GHSA-prqf-xr2j-xf65: Github.com/argoproj/argo workflows/v3 Potential Privilege Escalation On Kubernetes Vulnerability
LOWGHSA-prqf-xr2j-xf65 is a LOW potential privilege escalation on kubernetes vulnerability (CWE-285: Improper Authorization) affecting Github.com/argoproj/argo workflows/v3 libraries in the Go ecosystem. The issue involves potential privilege escalation on kubernetes >= v1.19 when the argo sever is run with `--auth-mode=client`. Remediation is available by upgrading affected packages to version 3.0.9, 3.1.6.
GHSA-prqf-xr2j-xf65 at a Glance
How to Fix GHSA-prqf-xr2j-xf65
To remediate this vulnerability, upgrade all affected Github.com/argoproj/argo workflows/v3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/argoproj/argo-workflows/v3 to 3.0.9Upgrade github.com/argoproj/argo-workflows/v3 to 3.1.6Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/argoproj/argo-workflows/v3How to Check if You Are Affected
To determine whether your application is affected by GHSA-prqf-xr2j-xf65, inspect your project dependencies for Github.com/argoproj/argo workflows/v3:
inspect dependencies for github.com/argoproj/argo-workflows/v3Analyze the terminal output to locate any version of Github.com/argoproj/argo workflows/v3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.0.9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-285: Improper Authorization, where the product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In Github.com/argoproj/argo workflows/v3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-prqf-xr2j-xf65 Affected Github.com/argoproj/argo workflows/v3 Versions
2 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/argoproj/argo-workflows/v3
|
Go |
≥ 3.0.0
< 3.0.9
|
3.0.9
|
|
github.com/argoproj/argo-workflows/v3
|
Go |
≥ 3.1.0
< 3.1.6
|
3.1.6
|
References
Frequently Asked Questions
What is GHSA-prqf-xr2j-xf65?
Which Github.com/argoproj/argo workflows/v3 versions are affected?
What version fixes GHSA-prqf-xr2j-xf65?
Is github.com/argoproj/argo-workflows/v3 affected?
What CWE is associated with GHSA-prqf-xr2j-xf65?
How can I check Go dependencies for GHSA-prqf-xr2j-xf65?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-prqf-xr2j-xf65",
"modified" : "2021-08-23T17:05:11Z",
"published" : "2021-08-23T19:41:41Z",
"aliases" : [ ],
"summary" : "Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`",
"details" : "### Impact\n\nThis is pro-active fix. No know exploits exist. \n\nImpacted:\n\n* You're running Kubernetes >= v1.19\n* You're running Argo Server\n* It is configured to with `--auth-mode=client`\n* Is not configured with `--auth-mode=server`\n* You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.\n* You're using client key to authenticate on the server. \n* The server has more permissions that the connecting client's account.\n\nThe client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.\n\n### Patches\n\nhttps://github.com/argoproj/argo-workflows/pull/6506\n\n### Workarounds\n\nNone.",
"severity" : [ ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/argoproj/argo-workflows/v3"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "3.0.9"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/argoproj/argo-workflows/v3"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.1.0"
}, {
"fixed" : "3.1.6"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-prqf-xr2j-xf65"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-285" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2021-08-23T17:05:11Z",
"nvd_published_at" : null
}
}