GO-2024-2654

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2024-2654

Import Source

https://vuln.go.dev/ID/GO-2024-2654.json

JSON Data

https://api.test.osv.dev/v1/vulns/GO-2024-2654

Aliases

Published

2024-03-22T18:44:48Z

Modified

2024-05-20T16:03:47Z

Summary

Denial of service in github.com/argoproj/argo-cd/v2

Details

Application may crash due to concurrent writes, leading to a denial of service. An attacker can crash the application continuously, making it impossible for legitimate users to access the service. Authentication is not required in the attack.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2024-2654",
    "review_status": "REVIEWED"
}

References

Credits

- @nadava669
- @todaywasawesome
- @crenshaw-dev
- @jannfis
- @pasha-codefresh

Affected packages

Go / github.com/argoproj/argo-cd/v2

Package

Name: github.com/argoproj/argo-cd/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/argoproj/argo-cd/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.8.13

Introduced

2.9.0

Fixed

2.9.9

Introduced

2.10.0

Fixed

2.10.4

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/argoproj/argo-cd/v2/server/application",
            "symbols": [
                "NewHandler",
                "newTerminalSession"
            ]
        },
        {
            "path": "github.com/argoproj/argo-cd/v2/util/session",
            "symbols": [
                "SessionManager.VerifyUsernamePassword",
                "SessionManager.getFailureCount",
                "SessionManager.updateFailureCount",
                "expireOldFailedAttempts"
            ]
        }
    ]
}