{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-21662", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-29T16:10:20.367Z", "datePublished": "2024-03-18T18:42:04.701Z", "dateUpdated": "2024-08-01T22:27:36.084Z"}, "containers": {"cna": {"title": "Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "lang": "en", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454"}, {"name": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d", "tags": ["x_refsource_MISC"], "url": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d"}, {"name": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b", "tags": ["x_refsource_MISC"], "url": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b"}, {"name": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456", "tags": ["x_refsource_MISC"], "url": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456"}, {"name": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force", "tags": ["x_refsource_MISC"], "url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force"}], "affected": [{"vendor": "argoproj", "product": "argo-cd", "versions": [{"version": "< 2.8.13", "status": "affected"}, {"version": ">= 2.9.0, < 2.9.9", "status": "affected"}, {"version": ">= 2.10.0, < 2.10.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-18T18:42:04.701Z"}, "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch."}], "source": {"advisory": "GHSA-2vgg-9h6w-m454", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "linuxfoundation", "product": "argo-cd", "cpes": ["cpe:2.3:a:linuxfoundation:argo-cd:2.9.0:-:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.9.0", "status": "affected", "lessThan": "2.9.9", "versionType": "custom"}]}, {"vendor": "linuxfoundation", "product": "argo-cd", "cpes": ["cpe:2.3:a:linuxfoundation:argo-cd:2.10.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "2.10.0", "status": "affected"}]}, {"vendor": "linuxfoundation", "product": "argo-cd", "cpes": ["cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.8.13", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-16T00:19:37.829646Z", "id": "CVE-2024-21662", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T00:24:27.974Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.084Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454"}, {"name": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d"}, {"name": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b"}, {"name": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456"}, {"name": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454", "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d", "name": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b", "name": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456", "name": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force", "name": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:27:36.084Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-21662", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-16T00:19:37.829646Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:linuxfoundation:argo-cd:2.9.0:-:*:*:*:*:*:*"], "vendor": "linuxfoundation", "product": "argo-cd", "versions": [{"status": "affected", "version": "2.9.0", "lessThan": "2.9.9", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:linuxfoundation:argo-cd:2.10.0:*:*:*:*:*:*:*"], "vendor": "linuxfoundation", "product": "argo-cd", "versions": [{"status": "affected", "version": "2.10.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:linuxfoundation:argo-cd:*:*:*:*:*:*:*:*"], "vendor": "linuxfoundation", "product": "argo-cd", "versions": [{"status": "affected", "version": "0", "lessThan": "2.8.13", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-16T00:24:19.309Z"}}], "cna": {"title": "Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow", "source": {"advisory": "GHSA-2vgg-9h6w-m454", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "argoproj", "product": "argo-cd", "versions": [{"status": "affected", "version": "< 2.8.13"}, {"status": "affected", "version": ">= 2.9.0, < 2.9.9"}, {"status": "affected", "version": ">= 2.10.0, < 2.10.4"}]}], "references": [{"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454", "name": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d", "name": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b", "name": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456", "name": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456", "tags": ["x_refsource_MISC"]}, {"url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force", "name": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-18T18:42:04.701Z"}}}, "cveMetadata": {"cveId": "CVE-2024-21662", "state": "PUBLISHED", "dateUpdated": "2024-08-01T22:27:36.084Z", "dateReserved": "2023-12-29T16:10:20.367Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-03-18T18:42:04.701Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "matchCriteriaId": "6312AE1F-68E1-4B95-952B-BCFA03CCC7AD", "versionEndExcluding": "2.8.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "matchCriteriaId": "89CCBDB3-E3A5-4529-9483-556AE5F93775", "versionEndExcluding": "2.9.9", "versionStartIncluding": "2.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*", "matchCriteriaId": "5FD6C646-5A70-42B0-A92A-DEB525C09A64", "versionEndExcluding": "2.10.4", "versionStartIncluding": "2.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch."}, {"lang": "es", "value": "Argo CD es una herramienta declarativa de entrega continua de GitOps para Kubernetes. Antes de las versiones 2.8.13, 2.9.9 y 2.10.4, un atacante pod\u00eda eludir eficazmente el l\u00edmite de velocidad y las protecciones de fuerza bruta explotando el d\u00e9bil mecanismo basado en cach\u00e9 de la aplicaci\u00f3n. Esta laguna de seguridad se puede combinar con otras vulnerabilidades para atacar la cuenta de administrador predeterminada. Esta falla socava un parche para CVE-2020-8827 destinado a proteger contra ataques de fuerza bruta. La protecci\u00f3n de fuerza bruta de la aplicaci\u00f3n se basa en un mecanismo de cach\u00e9 que rastrea los intentos de inicio de sesi\u00f3n de cada usuario. Este cach\u00e9 est\u00e1 limitado a un `defaultMaxCacheSize` de 1000 entradas. Un atacante puede desbordar este cach\u00e9 bombarde\u00e1ndolo con intentos de inicio de sesi\u00f3n para diferentes usuarios, eliminando as\u00ed los intentos fallidos de la cuenta de administrador y restableciendo efectivamente el l\u00edmite de velocidad para esa cuenta. Se trata de una vulnerabilidad grave que permite a los atacantes realizar ataques de fuerza bruta a un ritmo acelerado, especialmente dirigidos a la cuenta de administrador predeterminada. Los usuarios deben actualizar a la versi\u00f3n 2.8.13, 2.9.9 o 2.10.4 para recibir un parche."}], "id": "CVE-2024-21662", "lastModified": "2025-01-09T17:13:17.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-18T19:15:06.870", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://argo-cd.readthedocs.io/en/stable/security_considerations/#cve-2020-8827-insufficient-anti-automationanti-brute-force"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/argocd-rhel8:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/argo-rollouts-rhel8:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/console-plugin-rhel8:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/dex-rhel8:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/gitops-operator-bundle:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/gitops-rhel8:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/gitops-rhel8-operator:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/kam-delivery-rhel8:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1700", "cpe": "cpe:/a:redhat:openshift_gitops:1.10::el8", "package": "openshift-gitops-1/must-gather-rhel8:v1.10.4-1", "product_name": "Red Hat OpenShift GitOps 1.10", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/argocd-rhel8:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/argo-rollouts-rhel8:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/console-plugin-rhel8:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/dex-rhel8:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/gitops-operator-bundle:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/gitops-rhel8:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/gitops-rhel8-operator:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/kam-delivery-rhel8:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1697", "cpe": "cpe:/a:redhat:openshift_gitops:1.11::el8", "package": "openshift-gitops-1/must-gather-rhel8:v1.11.3-2", "product_name": "Red Hat OpenShift GitOps 1.11", "release_date": "2024-04-08T00:00:00Z"}, {"advisory": "RHSA-2024:1752", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-argocd-cli-0:1.12.1-5.el8", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/argocd-rhel8:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/argo-rollouts-rhel8:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/console-plugin-rhel8:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/dex-rhel8:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/gitops-operator-bundle:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/gitops-rhel8:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/gitops-rhel8-operator:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/kam-delivery-rhel8:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el8", "package": "openshift-gitops-1/must-gather-rhel8:v1.12.1-1", "product_name": "Red Hat OpenShift GitOps 1.12", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1752", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el9", "package": "microshift-gitops-0:1.12.1-4.el9", "product_name": "Red Hat OpenShift GitOps 1.12 - RHEL 9", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1752", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el9", "package": "openshift-gitops-argocd-cli-0:1.12.1-4.el9", "product_name": "Red Hat OpenShift GitOps 1.12 - RHEL 9", "release_date": "2024-04-10T00:00:00Z"}, {"advisory": "RHSA-2024:1753", "cpe": "cpe:/a:redhat:openshift_gitops:1.12::el9", "package": "openshift-gitops-argocd-rhel9-container-v1.12.1-2", "product_name": "Red Hat OpenShift GitOps 1.12 - RHEL 9", "release_date": "2024-04-10T00:00:00Z"}], "bugzilla": {"description": "argo-cd: Bypassing Rate Limit and Brute Force Protection Using Cache Overflow", "id": "2270182", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270182"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-307", "details": ["Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effectively bypass the rate limit and brute force protections by exploiting the application's weak cache-based mechanism. This loophole in security can be combined with other vulnerabilities to attack the default admin account. This flaw undermines a patch for CVE-2020-8827 intended to protect against brute-force attacks. The application's brute force protection relies on a cache mechanism that tracks login attempts for each user. This cache is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by bombarding it with login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This is a severe vulnerability that enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account. Users should upgrade to version 2.8.13, 2.9.9, or 2.10.4 to receive a patch.", "A flaw was found in Argo CD, where the rate limit for login attempts may be bypassed due to an incomplete fix for CVE-2020-8827. The cache-based mechanism is limited to a `defaultMaxCacheSize` of 1000 entries. An attacker can overflow this cache by sending excessive login attempts for different users, thereby pushing out the admin account's failed attempts and effectively resetting the rate limit for that account. This enables attackers to perform brute force attacks at an accelerated rate, especially targeting the default admin account."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-21662", "package_state": [{"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "package_name": "odf4/odr-rhel8-operator", "product_name": "Red Hat Openshift Data Foundation 4"}], "public_date": "2024-03-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-21662\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-21662\nhttps://github.com/argoproj/argo-cd/commit/17b0df1168a4c535f6f37e95f25ed7cd81e1fa4d\nhttps://github.com/argoproj/argo-cd/commit/6e181d72b31522f886a2afa029d5b26d7912ec7b\nhttps://github.com/argoproj/argo-cd/commit/cebb6538f7944c87ca2fecb5d17f8baacc431456\nhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-2vgg-9h6w-m454"], "threat_severity": "Moderate", "upstream_fix": "argo-cd 2.10.4, argo-cd 2.9.9, argo-cd 2.8.13"}