Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. Details: The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext , volumeMount can be specified, and applied to the EventSource or Sensor pod due to the code logic below. With these, A user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template. Here is an example that demonstrates the vulnerability. Impact: - Multi-tenant Clusters: - Tenant isolation broken - Non-admin users can gain host/cluster access - Access to other tenants' data - Security Model Bypass: - RBAC restrictions…
Recommended action: Upgrade to 1.9.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A path traversal issue was found in the (g GitArtifactReader).Read() API. Read() calls into (g GitArtifactReader).readFromRepository() that opens and reads the file that contains the trigger resource definition: No checks are made on this file at read time, which could lead an attacker to read files anywhere on the system. This could be achieved by either using symbolic links, or putting ../ in the path. Patches A patch for this vulnerability has been released in the following Argo Events version: v1.7.1 Credits Disclosed by Ada Logics in a security audit sponsored by CNCF and facilitated by OSTIF. For more information Open an issue in the Argo Events issue tracker or discussions Join us on Slack in channel #argo-events
Recommended action: Upgrade to 1.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memory denial-of-service attack: - AWS SNS - Bitbucket - Bitbucket - Gitlab - Slack - Storagegrid - Webhook Patches A patch for this vulnerability has been released in the following Argo Events version: v1.7.1 Credits Disclosed by Ada Logics in a security audit sponsored by CNCF and facilitated by OSTIF. For more information Open an issue in the Argo Events issue tracker or discussions Join us on Slack in channel #argo-events
Recommended action: Upgrade to 1.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.