Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-47827

Good to know:

icon

Date: October 28, 2024

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.

Language: Go

Severity Score

Related Resources (7)

https://nvd.nist.gov/vuln/detail/CVE-2024-47827
https://github.com/argoproj/argo-workflows
https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a
https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr
https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75
https://github.com/argoproj/argo-workflows/pull/13641
https://www.mend.io/vulnerability-database/CVE-2024-47827

Severity Score

Weakness Type (CWE)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-362

Excessive Reliance on Global Variables

CWE-1108

Top Fix

icon

Upgrade Version

Upgrade to version github.com/argoproj/argo-workflows/v3 - v3.6.0-rc2

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): ADJACENT_NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us