CVE-2022-31054

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Uncontrolled Resource Consumption pada argo events project argo events. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.

Rincian

Terbit di NVD

13 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-787: Out-of-bounds Write

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35 patch · advisory pihak ketiga
• https://github.com/argoproj/argo-events/pull/1966 patch · advisory pihak ketiga
• https://github.com/argoproj/argo-events/issues/1946 issue tracking · advisory pihak ketiga
• https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57 advisory pihak ketiga