CVE-2024-29893
CVSS 3.1 Score 6.5 of 10 (medium)
Details
Summary
CVE-2024-29893 is a Denial-of-Service vulnerability affecting Argo CD, a popular continuous delivery tool for Kubernetes. Versions of ArgoCD starting from v2.4 are susceptible to this issue. An attacker can exploit this bug by directing the ArgoCD repo-server component to a malicious Helm registry, causing an out-of-memory error. The affected component, loadRepoIndex(), retrieves and creates a byte slice from the entire data in one go without any limitations on size or time, making it susceptible to continuous data pushing from the registry. This ultimately causes the repo server to exhaust its memory, leading to a Denial-of-Service condition. Patches have been released for this vulnerability in versions v2.10.3, v2.9.8, and v2.8.12.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions