Go/github.com/argoproj/argo-cd/v2 CVE-2023-40025: high 7.1, EPSS 0.57%
Argo CD web terminal session doesn't expire
Action: Upgrade github.com/argoproj/argo-cd/v2 to 2.0.0-20230821201509-e047efa8f951 or later.
go get github.com/argoproj/argo-cd/v2@v2.6.14go get github.com/argoproj/argo-cd/v2@v2.7.12go get github.com/argoproj/argo-cd/v2@v2.8.1go get github.com/argoproj/argo-cd/v2@v2.0.0-20230821201509-e047efa8f951Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.6.0 | 2.6.14 | - |
| 2.7.0 | 2.7.12 | - |
| 2.8.0 | 2.8.1 | - |
| 2.0.0-20230718200744-12a5a7a70d6e | 2.0.0-20230821201509-e047efa8f951 | - |
Fixed versions
| 2.6.14 | 2.7.12 | 2.8.1 | 2.0.0-20230821201509-e047efa8f951 |
Sources
- osv: GHSA-c8xw-vjgf-94hr
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-c8xw-vjgf-94hr
- https://nvd.nist.gov/vuln/detail/CVE-2023-40025
- https://github.com/argoproj/argo-cd/commit/e047efa8f9518c54d00d2e4493b64bc4dba98478
- https://github.com/argoproj/argo-cd
CVE-2023-40025 · published · modified · JSON