Bug 2270173 (CVE-2024-21661)

Summary:	CVE-2024-21661 argo-cd: Denial of Service Due to Unsafe Array Modification in Multi-threaded Environment
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, aveerama, rgarg, shbose, sreber, ubhargav
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	argo-cd 2.10.4, argo-cd 2.9.9, argo-cd 2.8.13	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Argo CD that may result in a remote denial of service. The expireOldFailedAttempts function modifies an array while it is being iterated over. This issue may cause an application crash when executed in a multi-threaded environment if two threads interact with the same array simultaneously.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2270175
Bug Blocks:	2270183

Description Pedro Sampaio 2024-03-18 19:38:44 UTC

An attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment.

References:

https://github.com/argoproj/argo-cd/security/advisories/GHSA-6v85-wr92-q4p7

Comment 3 errata-xmlrpc 2024-04-08 13:36:20 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.11

Via RHSA-2024:1697 https://access.redhat.com/errata/RHSA-2024:1697

Comment 4 errata-xmlrpc 2024-04-08 16:37:17 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.10

Via RHSA-2024:1700 https://access.redhat.com/errata/RHSA-2024:1700

Comment 5 errata-xmlrpc 2024-04-10 12:17:56 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.12
  Red Hat OpenShift GitOps 1.12 - RHEL 9

Via RHSA-2024:1752 https://access.redhat.com/errata/RHSA-2024:1752

Comment 6 errata-xmlrpc 2024-04-10 12:42:04 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift GitOps 1.12
  Red Hat OpenShift GitOps 1.12 - RHEL 9

Via RHSA-2024:1753 https://access.redhat.com/errata/RHSA-2024:1753