GMS-2022-2554: Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params

June 21, 2022 (updated June 23, 2022)

Impact

All versions of Argo CD starting with v0.11.0 is vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a relatively-predictable (time-based) seed in a non-cryptographically-secure pseudo-random number generator made the parameter less random than required by the relevant spec or by general best practices.

References

github.com/advisories/GHSA-2m7h-86qq-fp4v
github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v

Code Behaviors & Features

Detect and mitigate GMS-2022-2554 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →