OpenShift GitOps CVE 2022-24348 Vulnerability

Last week, Argo CD was affected by CVE 2022-24348, which was identified by the research team at Apiiro. This flaw, which also affects Red Hat OpenShift GitOps, allows an attacker with permissions to create or update applications in Argo CD to pass an arbitrary Helm values file configuration parameter, leading to a path traversal issue. This issue enables the attacker to gain access to confidential information stored in other repositories within the same Argo CD installation.

OpenShift GitOps addresses this vulnerability with fixes released in version  1.2.2, 1.3.3 (RHSA-2022:0476), and 1.4.2 (RHSA-2022:0477). If the approval strategy in the OpenShift GitOps subscription in Operator Lifecycle Manager (OLM) is set to Automatic, no further actions are required, and the fixes are already applied automatically. Customers who have set the approval strategy to Manual must manually upgrade the operator as detailed in the OpenShift documentation. 

For more information about the vulnerability, please refer to the Apiiro team’s Vulnerability Details and Attack Breakdown. Any questions about the vulnerabilities or patches should be directed to Red Hat Support.