CVE-2022-31036

Description

Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server in github.com/argoproj/argo-cd

Affected packages (4)

• Go/github.com/argoproj/argo-cd>= 1.3.0, < 2.1.16
• Go/github.com/argoproj/argo-cd>= 1.3.0
• Go/github.com/argoproj/argo-cd/v2from 0, < 2.1.16
• Go/github.com/argoproj/argo-cd/v2from 0, < 2.1.16, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.5, >= 2.4.0, < 2.4.1

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-31036
• PATCHhttps://github.com/argoproj/argo-cd
• WEBhttps://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd
• WEBhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm