Argo Events Project CVEs and Security Vulnerabilities

CVE-2022-31054

Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events

Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Argo Events Project

Products

Argo Events

CVE-2022-25856

Directory Traversal

The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ...

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed