x/vulndb: potential Go vuln in github.com/argoproj/argo-cd: CVE-2022-24905

[GoVulnBot]

CVE-2022-24905 references github.com/argoproj/argo-cd, which may be a Go module.

Description:
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds.

Links:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-24905
• JSON: https://github.com/CVEProject/cvelist/tree/3e68474b925d83fb36d3a65a2bd8c532d8420967/2022/24xxx/CVE-2022-24905.json
• https://github.com/argoproj/argo-cd/releases/tag/v2.1.15
• https://github.com/argoproj/argo-cd/releases/tag/v2.2.9
• https://github.com/argoproj/argo-cd/releases/tag/v2.3.4
• GHSA-xmg8-99r8-jc2j

See doc/triage.md for instructions on how to triage this report.

module: github.com/argoproj/argo-cd
package: argo-cd
description: |
    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that allows an attacker to spoof error messages on the login screen when single sign on (SSO) is enabled. In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed. As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message. A patch for this vulnerability has been released in Argo CD versions 2.3.4, 2.2.9, and 2.1.15. There are currently no known workarounds.
cves:
  - CVE-2022-24905
links:
    context:
      - https://github.com/argoproj/argo-cd/releases/tag/v2.1.15
      - https://github.com/argoproj/argo-cd/releases/tag/v2.2.9
      - https://github.com/argoproj/argo-cd/releases/tag/v2.3.4
      - https://github.com/argoproj/argo-cd/security/advisories/GHSA-xmg8-99r8-jc2j

[neild]

Vulnerability in tool.

[gopherbot]

Change https://go.dev/cl/592768 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607218 mentions this issue: data/reports: unexclude 20 reports (16)