argo-cd prior 2.8.19/2.9.15/2.10.10 Redis Server risky encryption

Summaryinfo

A vulnerability has been found in argo-cd and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Redis Server. The manipulation leads to risky encryption. This vulnerability is listed as CVE-2024-31989. The attack must be carried out from within the local network. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in argo-cd and classified as problematic. This issue affects an unknown part of the component Redis Server. The manipulation with an unknown input leads to a risky encryption vulnerability. Using CWE to declare the problem leads to CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2024-31989 since 04/08/2024. The exploitation is known to be easy. The attack needs to be done within the local network. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1600 for this issue.

Upgrading to version 2.8.19, 2.9.15 or 2.10.10 eliminates this vulnerability. Applying the patch 2de0ceade243039c120c28374016c04ff9590d1d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• argo-cd

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion