Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBycWYteHIyai14ZjY1

Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client`

Impact

This is pro-active fix. No know exploits exist.

Impacted:

• You're running Kubernetes >= v1.19
• You're running Argo Server
• It is configured to with --auth-mode=client
• Is not configured with --auth-mode=server
• You are not running Argo Server in Kubernetes pod. E.g. on bare metal or other VM.
• You're using client key to authenticate on the server.
• The server has more permissions that the connecting client's account.

The client's authentication will be ignored and the server's authentication will be used. This will result in privilege escalation to that of the the server's account.

Patches

https://github.com/argoproj/argo-workflows/pull/6506

Workarounds

None.

Permalink: https://github.com/advisories/GHSA-prqf-xr2j-xf65
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBycWYteHIyai14ZjY1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-prqf-xr2j-xf65
References:

• https://github.com/argoproj/argo-workflows/security/advisories/GHSA-prqf-xr2j-xf65
• https://github.com/advisories/GHSA-prqf-xr2j-xf65

Repository: https://github.com/argoproj/argo-workflows
Blast Radius: 0.0

Affected Packages