Bug 2292311 (CVE-2024-36106)

Summary:	CVE-2024-36106 argo-cd: Error messages contain sensitive information
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, anjoseph, jprabhak, rgarg
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	argo-cd 2.11.3, argo-cd 2.10.12, argo-cd 2.9.17	Doc Type:	---
Doc Text:	A flaw was found in Argo-CD. Error messages in Argo-CD may contain sensitive information, such as clusters and project names, which allows authenticated malicious users to enumerate possible targets.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2292312
Bug Blocks:	2292314

Description Pedro Sampaio 2024-06-14 02:55:01 UTC

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. This vulnerability is fixed in 2.11.3, 2.10.12, and 2.9.17.

References:

https://github.com/argoproj/argo-cd/commit/c2647055c261a550e5da075793260f6524e65ad9
https://github.com/argoproj/argo-cd/security/advisories/GHSA-3cqf-953p-h5cp