Vulnerability Details CVE-2022-31054
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 66.4%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35
- https://github.com/argoproj/argo-events/issues/1946
- https://github.com/argoproj/argo-events/pull/1966
- https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57
- https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35
- https://github.com/argoproj/argo-events/issues/1946
- https://github.com/argoproj/argo-events/pull/1966
- https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57
Products affected by CVE-2022-31054
-
cpe:2.3:a:argo_events_project:argo_events:-
-
cpe:2.3:a:argo_events_project:argo_events:.0.9
-
cpe:2.3:a:argo_events_project:argo_events:0.10
-
cpe:2.3:a:argo_events_project:argo_events:0.11
-
cpe:2.3:a:argo_events_project:argo_events:0.12
-
cpe:2.3:a:argo_events_project:argo_events:0.13.0
-
cpe:2.3:a:argo_events_project:argo_events:0.14.0
-
cpe:2.3:a:argo_events_project:argo_events:0.15.0
-
cpe:2.3:a:argo_events_project:argo_events:0.16.0
-
cpe:2.3:a:argo_events_project:argo_events:0.17.0
-
cpe:2.3:a:argo_events_project:argo_events:0.5
-
cpe:2.3:a:argo_events_project:argo_events:0.6
-
cpe:2.3:a:argo_events_project:argo_events:0.7
-
cpe:2.3:a:argo_events_project:argo_events:0.8
-
cpe:2.3:a:argo_events_project:argo_events:0.8.1
-
cpe:2.3:a:argo_events_project:argo_events:0.8.2
-
cpe:2.3:a:argo_events_project:argo_events:0.8.3
-
cpe:2.3:a:argo_events_project:argo_events:0.9.1
-
cpe:2.3:a:argo_events_project:argo_events:0.9.2
-
cpe:2.3:a:argo_events_project:argo_events:0.9.3
-
cpe:2.3:a:argo_events_project:argo_events:1.0.0
-
cpe:2.3:a:argo_events_project:argo_events:1.1.0
-
cpe:2.3:a:argo_events_project:argo_events:1.2.0
-
cpe:2.3:a:argo_events_project:argo_events:1.2.1
-
cpe:2.3:a:argo_events_project:argo_events:1.2.2
-
cpe:2.3:a:argo_events_project:argo_events:1.2.3
-
cpe:2.3:a:argo_events_project:argo_events:1.3.0
-
cpe:2.3:a:argo_events_project:argo_events:1.3.1
-
cpe:2.3:a:argo_events_project:argo_events:1.4.0
-
cpe:2.3:a:argo_events_project:argo_events:1.4.1
-
cpe:2.3:a:argo_events_project:argo_events:1.4.2
-
cpe:2.3:a:argo_events_project:argo_events:1.4.3
-
cpe:2.3:a:argo_events_project:argo_events:1.5.0
-
cpe:2.3:a:argo_events_project:argo_events:1.5.1
-
cpe:2.3:a:argo_events_project:argo_events:1.5.2
-
cpe:2.3:a:argo_events_project:argo_events:1.5.3
-
cpe:2.3:a:argo_events_project:argo_events:1.5.4
-
cpe:2.3:a:argo_events_project:argo_events:1.5.5
-
cpe:2.3:a:argo_events_project:argo_events:1.5.6
-
cpe:2.3:a:argo_events_project:argo_events:1.6.0
-
cpe:2.3:a:argo_events_project:argo_events:1.6.1
-
cpe:2.3:a:argo_events_project:argo_events:1.6.2
-
cpe:2.3:a:argo_events_project:argo_events:1.6.3
-
cpe:2.3:a:argo_events_project:argo_events:1.7.0