GMS-2022-2558: Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params

June 21, 2022 (updated June 23, 2022)

All versions of Argo CD starting with v0.11.0 is vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows.

References

github.com/advisories/GHSA-2m7h-86qq-fp4v
github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v

Code Behaviors & Features

Detect and mitigate GMS-2022-2558 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →