GO-2022-0518 CVE-2022-31105 GHSA-7943-82jg-wmw5
Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd
- Severity
- 9.6 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.81%
- Chance of exploitation in the next 30 days. Higher than 56.87% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
- Available
- 2 packages have a fixed version
Description
Argo CD certificate verification is skipped for connections to OIDC providers in github.com/argoproj/argo-cd
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/argoproj/argo-cd | >= 0.4.0, < 2.2.11 |
2.2.11 |
| github.com/argoproj/argo-cd | >= 2.3.0, < 2.3.6 |
2.3.6 |
| github.com/argoproj/argo-cd | >= 2.4.0, < 2.4.5 |
2.4.5 |
| github.com/argoproj/argo-cd | >= 0.4.0 |
No fix yet |
| github.com/argoproj/argo-cd/v2 | < 2.2.11>= 2.3.0, < 2.3.6>= 2.4.0, < 2.4.5 |
2.2.112.3.62.4.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/argoproj/argo-cd Go → 2.2.11
- go
go get github.com/argoproj/argo-cd@v2.2.11 && go mod tidy
github.com/argoproj/argo-cd/v2 Go → 2.4.5
- go
go get github.com/argoproj/argo-cd/v2@v2.4.5 && go mod tidy
Severity breakdown
CVSS 3.1 9.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it
- Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CWE-599: Missing Validation of OpenSSL Certificate
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
How to prevent it
- Architecture and Design: Ensure that proper authentication is included in the system design.
- Implementation: Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks | Critical | Also affects github.com/argoproj/argo-cd |
| GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL | High | Also affects github.com/argoproj/argo-cd |
| GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation | High | Also affects github.com/argoproj/argo-cd |
| GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations | Medium | Also affects github.com/argoproj/argo-cd |
| GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction | Critical | Also affects github.com/argoproj/argo-cd |
| GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook | High | Also affects github.com/argoproj/argo-cd |
| GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload | High | Also affects github.com/argoproj/argo-cd |
| GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload | High | Also affects github.com/argoproj/argo-cd |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor