CVE-2022-31105

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-31105
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31105.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-31105
Aliases
Published
2022-07-12T22:05:11Z
Modified
2025-12-04T09:43:25.156839Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Argo CD's certificate verification is skipped for connections to OIDC providers
Details

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the oidc.config.rootCA field in the argocd-cm ConfigMap. This mitigation only forces certificate validation when the API server handles login flows. It does not force certificate verification when verifying tokens on API calls.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31105.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-295",
        "CWE-599"
    ]
}
References

Affected packages

Git / github.com/argoproj/argo-cd

Affected ranges

Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
9c0daebfe088a1ac5145417df14d11769f266e82
Fixed
aa3f3749f8d5f174d2e4cdd2cf14cf6f9ef55143
Database specific 
{
    "versions": [
        {
            "introduced": "0.4.0"
        },
        {
            "fixed": "2.2.11"
        }
    ]
}
Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
fe427802293b090f43f91f5839393174df6c3b3a
Fixed
0badce7840e3fdb9f6d94e13488bec358fd0472d
Database specific 
{
    "versions": [
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "2.3.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/argoproj/argo-cd
Events
Introduced
91aefabc5b213a258ddcfe04b8e69bb4a2dd2566
Fixed
0232073ccffa0348f633a8a1fce0b55c3a56a688
Database specific 
{
    "versions": [
        {
            "introduced": "2.4.0"
        },
        {
            "fixed": "2.4.5"
        }
    ]
}

Affected versions

v0.*
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.0
v2.*
v2.2.0
v2.2.0-rc1
v2.2.1
v2.2.10
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31105.json"