6.5

CVE-2023-40584: argoproj argo_cd Uncontrolled Resource Consumption

CVSS: 6.5v3.1MediumModified
AliasesGHSA-g687-f2gx-6wm8BIT-argo-cd-2023-40584GO-2023-2050
Published 07-09-2023Last modified 26-09-2024
Open JSON

Vulnerability summary

CVE-2023-40584 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in argoproj argo_cd. EPSS estimates a 1.42% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.42%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 07-09-2023
    PublishedVulnerability first disclosed.
  2. 26-09-2024
    Last modifiedVulnerability information updated.

Description

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed. A patch for this vulnerability has been released in versions 2.6.15, 2.7.14, and 2.8.3. Users are advised to upgrade. The only way to completely resolve the issue is to upgrade, however users unable to upgrade should configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

1.42%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

0.00 pp

From 1.42% on 21-09-2026

21-09-202621-10-2026
EPSS score
1.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Argoproj2 products
  • argo_cd≥ 2.4.0, < 2.6.15 | ≥ 2.7.0, < 2.7.14 | ≥ 2.8.0, < 2.8.3
  • argo-cd≥ 2.4.0, < 2.6.15 | ≥ 2.7.0, < 2.7.14 | ≥ 2.8.0, < 2.8.3
Github.com/argoproj1 product
  • argo-cdAll versions (No fix recorded)
Github.com/argoproj/argo-cd1 product
  • v2≥ 2.4.0, < 2.6.15 | ≥ 2.7.0, < 2.7.14 | ≥ 2.8.0, < 2.8.3

3 vendors · 4 products

References

8 links