github.com/argoproj/argo-cd/v2@v2.10.5/docs/security_considerations.md (about)

     1  # Security Considerations
     2  
     3  !!!warning "Deprecation notice"
     4      This page is now deprecated and serves as an archive only. For up-to-date
     5      information, please have a look at our
     6      [security policy](https://github.com/argoproj/argo-cd/security/policy) and
     7      [published security advisories](https://github.com/argoproj/argo-cd/security/advisories).
     8  
     9  As a deployment tool, Argo CD needs to have production access which makes security a very important topic.
    10  The Argoproj team takes security very seriously and continuously working on improving it. Learn more about security
    11  related features in [Security](./operator-manual/security.md) section.
    12  
    13  ## Overview of past and current issues
    14  
    15  The following table gives a general overview about past and present issues known
    16  to the Argo CD project. See in the [Known Issues](#known-issues-and-workarounds)
    17  section if there is a work-around available if you cannot update or if there is
    18  no fix yet.
    19  
    20  |Date|CVE|Title|Risk|Affected version(s)|Fix version|
    21  |----|---|-----|----|-------------------|-----------|
    22  |2020-06-16|[CVE-2020-1747](https://nvd.nist.gov/vuln/detail/CVE-2020-1747)|PyYAML library susceptible to arbitrary code execution|High|all|v1.5.8|
    23  |2020-06-16|[CVE-2020-14343](https://nvd.nist.gov/vuln/detail/CVE-2020-14343)|PyYAML library susceptible to arbitrary code execution|High|all|v1.5.8|
    24  |2020-04-14|[CVE-2020-5260](https://nvd.nist.gov/vuln/detail/CVE-2020-5260)|Possible Git credential leak|High|all|v1.4.3,v1.5.2|
    25  |2020-04-08|[CVE-2020-11576](https://nvd.nist.gov/vuln/detail/CVE-2020-11576)|User Enumeration|Medium|v1.5.0|v1.5.1|
    26  |2020-04-08|[CVE-2020-8826](https://nvd.nist.gov/vuln/detail/CVE-2020-8826)|Session-fixation|High|all|n/a|
    27  |2020-04-08|[CVE-2020-8827](https://nvd.nist.gov/vuln/detail/CVE-2020-8827)|Insufficient anti-automation/anti-brute force|High|all <= 1.5.3|v1.5.3|
    28  |2020-04-08|[CVE-2020-8828](https://nvd.nist.gov/vuln/detail/CVE-2020-8828)|Insecure default administrative password|High|all <= 1.8.0|1.8.0|
    29  |2020-04-08|[CVE-2018-21034](https://nvd.nist.gov/vuln/detail/CVE-2018-21034)|Sensitive Information Disclosure|Medium|all <= v1.5.0|v1.5.0|
    30  
    31  ## Known Issues And Workarounds
    32  
    33  A recent security audit (thanks a lot to [Matt Hamilton](https://github.com/Eriner) of [https://soluble.ai](https://soluble.ai) )
    34  has revealed several limitations in Argo CD which could compromise security.
    35  Most of the issues are related to the built-in user management implementation.
    36  
    37  ### CVE-2020-1747, CVE-2020-14343 - PyYAML library susceptible to arbitrary code execution
    38  
    39  **Summary:**
    40  
    41  |Risk|Reported by|Fix version|Workaround|
    42  |----|-----------|-----------|----------|
    43  |High|[infa-kparida](https://github.com/infa-kparida)|v1.5.8|No|
    44  
    45  **Details:**
    46  
    47  PyYAML library susceptible to arbitrary code execution when it processes untrusted YAML files.
    48  We do not believe Argo CD is affected by this vulnerability, because the impact of CVE-2020-1747 and CVE-2020-14343 is limited to usage of awscli.
    49  The `awscli` only used for AWS IAM authentication, and the endpoint is the AWS API.
    50  
    51  ### CVE-2020-5260 - Possible Git credential leak
    52  
    53  **Summary:**
    54  
    55  |Risk|Reported by|Fix version|Workaround|
    56  |----|-----------|-----------|----------|
    57  |Critical|Felix Wilhelm of Google Project Zero|v1.4.3,v1.5.2|Yes|
    58  
    59  **Details:**
    60  
    61  Argo CD relies on Git for many of its operations. The Git project released a
    62  [security advisory](https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q)
    63  on 2020-04-14, describing a serious vulnerability in Git which can lead to credential
    64  leakage through credential helpers by feeding malicious URLs to the `git clone`
    65  operation.
    66  
    67  We do not believe Argo CD is affected by this vulnerability, because ArgoCD does neither
    68  make use of Git credential helpers nor does it use `git clone` for repository operations.
    69  However, we do not know whether our users might have configured Git credential helpers on
    70  their own and chose to release new images which contain the bug fix for Git.
    71  
    72  **Mitigation and/or workaround:**
    73  
    74  We strongly recommend to upgrade your ArgoCD installation to either `v1.4.3` (if on v1.4
    75  branch) or `v1.5.2` (if on v1.5 branch) 
    76  
    77  
    78  When you are running `v1.4.x`, you can upgrade to `v1.4.3` by simply changing the image
    79  tags for `argocd-server`, `argocd-repo-server` and `argocd-controller` to `v1.4.3`. 
    80  The `v1.4.3` release does not contain additional functional bug fixes.
    81  
    82  Likewise, hen you are running `v1.5.x`, you can upgrade to `v1.5.2` by simply changing
    83  the image tags for `argocd-server`, `argocd-repo-server` and `argocd-controller` to `v1.5.2`.
    84  The `v1.5.2` release does not contain additional functional bug fixes.
    85  
    86  ### CVE-2020-11576 - User Enumeration
    87  
    88  **Summary:**
    89  
    90  |Risk|Reported by|Fix version|Workaround|
    91  |----|-----------|-----------|----------|
    92  |Medium|[Matt Hamilton](https://github.com/Eriner) of [https://soluble.ai](https://soluble.ai)|v1.5.1|Yes|
    93  
    94  **Details:**
    95  
    96  Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts within Argo.
    97  
    98  **Mitigation and/or workaround:**
    99  
   100  Upgrade to ArgoCD v1.5.1 or higher. As a workaround, disable local users and use only SSO authentication.
   101  
   102  ### CVE-2020-8828 - Insecure default administrative password
   103  
   104  **Summary:**
   105  
   106  |Risk|Reported by|Fix version|Workaround|
   107  |----|-----------|-----------|----------|
   108  |High|[Matt Hamilton](https://github.com/Eriner) of [https://soluble.ai](https://soluble.ai)|1.8.0|Yes|
   109  
   110  **Details:**
   111  
   112  Argo CD uses the `argocd-server` pod name (ex: `argocd-server-55594fbdb9-ptsf5`) as the default admin password.
   113  
   114  Kubernetes users able to list pods in the argo namespace are able to retrieve the default password.
   115  
   116  Additionally, In most installations, [the Pod name contains a random "trail" of characters](https://github.com/kubernetes/kubernetes/blob/dda530cfb74b157f1d17b97818aa128a9db8e711/staging/src/k8s.io/apiserver/pkg/storage/names/generate.go#L37).
   117  These characters are generated using [a time-seeded PRNG](https://github.com/kubernetes/apimachinery/blob/master/pkg/util/rand/rand.go#L26) and not a CSPRNG.
   118  An attacker could use this information in an attempt to deduce the state of the internal PRNG, aiding bruteforce attacks.
   119  
   120  **Mitigation and/or workaround:**
   121  
   122  The recommended mitigation as described in the user documentation is to use SSO integration. The default admin password
   123  should only be used for initial configuration and then [disabled](../operator-manual/user-management/#disable-admin-user)
   124  or at least changed to a more secure password.
   125  
   126  ### CVE-2020-8827 - Insufficient anti-automation/anti-brute force
   127  
   128  **Summary:**
   129  
   130  |Risk|Reported by|Fix version|Workaround|
   131  |----|-----------|-----------|----------|
   132  |High|[Matt Hamilton](https://github.com/Eriner) of [https://soluble.ai](https://soluble.ai)|n/a|Yes|
   133  
   134  **Details:**
   135  
   136  ArgoCD before v1.5.3 does not enforce rate-limiting or other anti-automation mechanisms which would mitigate admin password brute force.
   137  
   138  **Mitigation and/or workaround:**
   139  
   140  Rate-limiting and anti-automation mechanisms for local user accounts have been introduced with ArgoCD v1.5.3.
   141  
   142  As a workaround for mitigation if you cannot upgrade ArgoCD to v1.5.3 yet, we recommend to disable local users and use SSO instead.
   143  
   144  ### CVE-2020-8826 - Session-fixation
   145  
   146  **Summary:**
   147  
   148  |Risk|Reported by|Fix version|Workaround|
   149  |----|-----------|-----------|----------|
   150  |High|[Matt Hamilton](https://github.com/Eriner) of [https://soluble.ai](https://soluble.ai)|n/a|Yes|
   151  
   152  **Details:**
   153  
   154  The authentication tokens generated for built-in users have no expiry.
   155  
   156  These issues might be acceptable in the controlled isolated environment but not acceptable if Argo CD user interface is
   157  exposed to the Internet.
   158  
   159  **Mitigation and/or workaround:**
   160  
   161  The recommended mitigation is to change the password periodically to invalidate the authentication tokens.
   162  
   163  ### CVE-2018-21034 - Sensitive Information Disclosure
   164  
   165  **Summary:**
   166  
   167  |Risk|Reported by|Fix version|Workaround|
   168  |----|-----------|-----------|----------|
   169  |Medium|[Matt Hamilton](https://github.com/Eriner) of [https://soluble.ai](https://soluble.ai)|v1.5.0|No|
   170  
   171  **Details:**
   172  
   173  In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
   174  
   175  **Mitigation and/or workaround:**
   176  
   177  Upgrade to ArgoCD v1.5.0 or higher. No workaround available
   178  
   179  ## Reporting Vulnerabilities
   180  
   181  Please have a look at our
   182  [security policy](https://github.com/argoproj/argo-cd/security/policy)
   183  for more details on how to report security vulnerabilities for Argo CD.