Vulnerabilities > CVE-2022-31054 - Out-of-bounds Write vulnerability in Argo Events Project Argo Events

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

argo-events-project

CWE-787

NVD

Published: 2022-06-13

Updated: 2023-01-10

Summary

Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.

Vulnerable Configurations

Part	Description	Count
Application	Argo_Events_Project Argo Events Project Argo Events - Argo Events Project Argo Events .0.9 Argo Events Project Argo Events 0.5 Argo Events Project Argo Events 0.6 Argo Events Project Argo Events 0.7 Argo Events Project Argo Events 0.8 Argo Events Project Argo Events 0.8.1 Argo Events Project Argo Events 0.8.2 Argo Events Project Argo Events 0.8.3 Argo Events Project Argo Events 0.9.1 Argo Events Project Argo Events 0.9.2 Argo Events Project Argo Events 0.9.3 Argo Events Project Argo Events 0.10 Argo Events Project Argo Events 0.11 Argo Events Project Argo Events 0.12 Argo Events Project Argo Events 0.13.0 Argo Events Project Argo Events 0.14.0 Argo Events Project Argo Events 0.15.0 Argo Events Project Argo Events 0.16.0 Argo Events Project Argo Events 0.17.0 Argo Events Project Argo Events 1.0.0 Argo Events Project Argo Events 1.1.0 Argo Events Project Argo Events 1.2.0 Argo Events Project Argo Events 1.2.1 Argo Events Project Argo Events 1.2.2 Argo Events Project Argo Events 1.2.3 Argo Events Project Argo Events 1.3.0 Argo Events Project Argo Events 1.3.1 Argo Events Project Argo Events 1.4.0 Argo Events Project Argo Events 1.4.1 Argo Events Project Argo Events 1.4.2 Argo Events Project Argo Events 1.4.3 Argo Events Project Argo Events 1.5.0 Argo Events Project Argo Events 1.5.1 Argo Events Project Argo Events 1.5.2 Argo Events Project Argo Events 1.5.3 Argo Events Project Argo Events 1.5.4 Argo Events Project Argo Events 1.5.5 Argo Events Project Argo Events 1.5.6 Argo Events Project Argo Events 1.6.0 Argo Events Project Argo Events 1.6.1 Argo Events Project Argo Events 1.6.2 Argo Events Project Argo Events 1.6.3 Argo Events Project Argo Events 1.7.0	57

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References