# Snyk test report

December 18th 2022, 12:14:47 am

Scanned the following path:

- quay.io/argoproj/argocd:latest/argoproj/argocd (deb)

15 known vulnerabilities
91 vulnerable dependency paths
162 dependencies

Project | docker-image|quay.io/argoproj/argocd
Path | quay.io/argoproj/argocd:latest/argoproj/argocd
Package Manager | deb
Manifest | Dockerfile

## Off-by-one Error

medium severity

- Package Manager: ubuntu:22.04
- Vulnerable module: systemd/libsystemd0
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and systemd/libsystemd0@249.11-0ubuntu3.6

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › systemd/libsystemd0@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › apt@2.4.8 › systemd/libsystemd0@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › procps/libprocps8@2:3.3.17-6ubuntu2 › systemd/libsystemd0@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › util-linux@2.37.2-4ubuntu3 › systemd/libsystemd0@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › util-linux/bsdutils@1:2.37.2-4ubuntu3 › systemd/libsystemd0@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › apt@2.4.8 › apt/libapt-pkg6.0@2.4.8 › systemd/libsystemd0@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › systemd/libudev1@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › libfido2/libfido2-1@1.10.0-1 › systemd/libudev1@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › util-linux@2.37.2-4ubuntu3 › systemd/libudev1@249.11-0ubuntu3.6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › apt@2.4.8 › apt/libapt-pkg6.0@2.4.8 › systemd/libudev1@249.11-0ubuntu3.6

## NVD Description

Note: Versions mentioned in the description apply to the upstream `systemd` package.

An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.

## Remediation

There is no fixed version for `Ubuntu:22.04` `systemd`.

## References

- ADVISORY
- MISC
- MISC
- MISC
- MISC
- FEDORA

More about this vulnerability

## CVE-2022-46908

medium severity

- Package Manager: ubuntu:22.04
- Vulnerable module: sqlite3/libsqlite3-0
- Introduced through: docker-image|quay.io/argoproj/argocd@latest, gnupg2/gpg@2.2.27-3ubuntu2.1 and others

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpg@2.2.27-3ubuntu2.1 › sqlite3/libsqlite3-0@3.37.2-2ubuntu0.1

## NVD Description

Note: Versions mentioned in the description apply to the upstream `sqlite3` package.

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

## Remediation

There is no fixed version for `Ubuntu:22.04` `sqlite3`.

## References

- ADVISORY
- MISC
- MISC
- MISC

More about this vulnerability

## Uncontrolled Recursion

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: pcre3/libpcre3
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › grep@3.7-1build1 › pcre3/libpcre3@2:8.39-13ubuntu0.22.04.1

## NVD Description

Note: Versions mentioned in the description apply to the upstream `pcre3` package.

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

## Remediation

There is no fixed version for `Ubuntu:22.04` `pcre3`.

## References

- ADVISORY
- CVE Details
- Debian Security Tracker
- MLIST
- OSS security Advisory
- Security Focus

More about this vulnerability

## Release of Invalid Pointer or Reference

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: patch
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and patch@2.7.6-7build2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › patch@2.7.6-7build2

## NVD Description

Note: Versions mentioned in the description apply to the upstream `patch` package.

An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.

## Remediation

There is no fixed version for `Ubuntu:22.04` `patch`.

## References

- ADVISORY
- MISC

More about this vulnerability

## Double Free

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: patch
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and patch@2.7.6-7build2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › patch@2.7.6-7build2

## NVD Description

Note: Versions mentioned in the description apply to the upstream `patch` package.

A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6.

## Remediation

There is no fixed version for `Ubuntu:22.04` `patch`.

## References

- ADVISORY
- CVE Details
- Debian Security Tracker
- Gentoo Security Advisory
- MISC
- REDHAT
- Security Focus

More about this vulnerability

## Improper Locking

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: openssl/libssl3
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and openssl/libssl3@3.0.2-0ubuntu1.7

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › openssl/libssl3@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › cyrus-sasl2/libsasl2-modules@2.1.27+dfsg2-3ubuntu1 › openssl/libssl3@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › libfido2/libfido2-1@1.10.0-1 › openssl/libssl3@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › openssh/openssh-client@1:8.9p1-3 › openssl/libssl3@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ca-certificates@20211016ubuntu0.22.04.1 › openssl@3.0.2-0ubuntu1.7 › openssl/libssl3@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › git@1:2.34.1-1ubuntu1.5 › curl/libcurl3-gnutls@7.81.0-1ubuntu1.6 › libssh/libssh-4@0.9.6-2build1 › openssl/libssl3@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › adduser@3.118ubuntu5 › shadow/passwd@1:4.8.1-2ubuntu2.1 › pam/libpam-modules@1.4.0-11ubuntu2 › libnsl/libnsl2@1.3.0-2build2 › libtirpc/libtirpc3@1.3.2-2ubuntu0.1 › krb5/libgssapi-krb5-2@1.19.2-2 › krb5/libkrb5-3@1.19.2-2 › openssl/libssl3@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › openssl@3.0.2-0ubuntu1.7
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ca-certificates@20211016ubuntu0.22.04.1 › openssl@3.0.2-0ubuntu1.7

## NVD Description

Note: Versions mentioned in the description apply to the upstream `openssl` package.

If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process hangs. Policy processing being enabled on a publicly facing server is not considered to be a common setup. Policy processing is enabled by passing the `-policy&#39; argument to the command line utilities or by calling either` X509_VERIFY_PARAM_add0_policy()' or `X509_VERIFY_PARAM_set1_policies()' functions.

## Remediation

There is no fixed version for `Ubuntu:22.04` `openssl`.

## References

- ADVISORY
- MISC
- MISC

More about this vulnerability

## CVE-2021-41617

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: openssh/openssh-client
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and openssh/openssh-client@1:8.9p1-3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › openssh/openssh-client@1:8.9p1-3

## NVD Description

Note: Versions mentioned in the description apply to the upstream `openssh` package.

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

## Remediation

There is no fixed version for `Ubuntu:22.04` `openssh`.

## References

- ADVISORY
- CONFIRM
- CONFIRM
- FEDORA
- FEDORA
- FEDORA
- MISC
- MISC
- MISC
- MISC
- N/A
- MISC

More about this vulnerability

## Information Exposure

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: openssh/openssh-client
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and openssh/openssh-client@1:8.9p1-3

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › openssh/openssh-client@1:8.9p1-3

## NVD Description

Note: Versions mentioned in the description apply to the upstream `openssh` package.

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

## Remediation

There is no fixed version for `Ubuntu:22.04` `openssh`.

## References

- ADVISORY
- CONFIRM
- GENTOO
- MISC
- MISC
- MISC
- MISC
- MISC
- MLIST

More about this vulnerability

## Out-of-bounds Read

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: ncurses/libtinfo6
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and ncurses/libtinfo6@6.3-2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › bash@5.1-6ubuntu1 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/libncursesw6@6.3-2 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › less@590-1build1 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › libedit/libedit2@3.1-20210910-1build1 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/libncurses6@6.3-2 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/ncurses-bin@6.3-2 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › procps@2:3.3.17-6ubuntu2 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › util-linux@2.37.2-4ubuntu3 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpg@2.2.27-3ubuntu2.1 › gnupg2/gpgconf@2.2.27-3ubuntu2.1 › readline/libreadline8@8.1.2-1 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 › pinentry/pinentry-curses@1.1.1-1build2 › ncurses/libtinfo6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/libncursesw6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › procps@2:3.3.17-6ubuntu2 › ncurses/libncursesw6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 › pinentry/pinentry-curses@1.1.1-1build2 › ncurses/libncursesw6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/libncurses6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › procps@2:3.3.17-6ubuntu2 › ncurses/libncurses6@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/ncurses-base@6.3-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › ncurses/ncurses-bin@6.3-2

## NVD Description

Note: Versions mentioned in the description apply to the upstream `ncurses` package.

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.

## Remediation

There is no fixed version for `Ubuntu:22.04` `ncurses`.

## References

- ADVISORY
- MISC
- MISC
- CONFIRM
- MLIST
- FULLDISC

More about this vulnerability

## Integer Overflow or Wraparound

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: krb5/libk5crypto3
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and krb5/libk5crypto3@1.19.2-2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › krb5/libk5crypto3@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › adduser@3.118ubuntu5 › shadow/passwd@1:4.8.1-2ubuntu2.1 › pam/libpam-modules@1.4.0-11ubuntu2 › libnsl/libnsl2@1.3.0-2build2 › libtirpc/libtirpc3@1.3.2-2ubuntu0.1 › krb5/libgssapi-krb5-2@1.19.2-2 › krb5/libk5crypto3@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › adduser@3.118ubuntu5 › shadow/passwd@1:4.8.1-2ubuntu2.1 › pam/libpam-modules@1.4.0-11ubuntu2 › libnsl/libnsl2@1.3.0-2build2 › libtirpc/libtirpc3@1.3.2-2ubuntu0.1 › krb5/libgssapi-krb5-2@1.19.2-2 › krb5/libkrb5-3@1.19.2-2 › krb5/libk5crypto3@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › krb5/libkrb5-3@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › adduser@3.118ubuntu5 › shadow/passwd@1:4.8.1-2ubuntu2.1 › pam/libpam-modules@1.4.0-11ubuntu2 › libnsl/libnsl2@1.3.0-2build2 › libtirpc/libtirpc3@1.3.2-2ubuntu0.1 › krb5/libgssapi-krb5-2@1.19.2-2 › krb5/libkrb5-3@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › krb5/libgssapi-krb5-2@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › openssh/openssh-client@1:8.9p1-3 › krb5/libgssapi-krb5-2@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › git@1:2.34.1-1ubuntu1.5 › curl/libcurl3-gnutls@7.81.0-1ubuntu1.6 › krb5/libgssapi-krb5-2@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › git@1:2.34.1-1ubuntu1.5 › curl/libcurl3-gnutls@7.81.0-1ubuntu1.6 › libssh/libssh-4@0.9.6-2build1 › krb5/libgssapi-krb5-2@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › adduser@3.118ubuntu5 › shadow/passwd@1:4.8.1-2ubuntu2.1 › pam/libpam-modules@1.4.0-11ubuntu2 › libnsl/libnsl2@1.3.0-2build2 › libtirpc/libtirpc3@1.3.2-2ubuntu0.1 › krb5/libgssapi-krb5-2@1.19.2-2
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › meta-common-packages@meta › krb5/libkrb5support0@1.19.2-2

## NVD Description

Note: Versions mentioned in the description apply to the upstream `krb5` package.

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

## Remediation

There is no fixed version for `Ubuntu:22.04` `krb5`.

## References

- CVE Details
- Debian Security Tracker
- GitHub Additional Information
- MLIST
- Ubuntu CVE Tracker

More about this vulnerability

## CVE-2022-3219

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: gnupg2/gpgv
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and gnupg2/gpgv@2.2.27-3ubuntu2.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpgv@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › apt@2.4.8 › gnupg2/gpgv@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpgv@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/dirmngr@2.2.27-3ubuntu2.1 › gnupg2/gpgconf@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpg@2.2.27-3ubuntu2.1 › gnupg2/gpgconf@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1 › gnupg2/gpgconf@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpgsm@2.2.27-3ubuntu2.1 › gnupg2/gpgconf@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/dirmngr@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/dirmngr@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 › gnupg2/dirmngr@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gnupg-l10n@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gnupg-utils@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpg@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 › gnupg2/gpg@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 › gnupg2/gpg@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpg-agent@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1 › gnupg2/gpg-agent@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-wks-client@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpg-wks-server@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gpgsm@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1 › gnupg2/gpgsm@2.2.27-3ubuntu2.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › gnupg2/gnupg@2.2.27-3ubuntu2.1

## NVD Description

This vulnerability has not been analyzed by NVD yet.

## Remediation

There is no fixed version for `Ubuntu:22.04` `gnupg2`.

## References

- ADVISORY

More about this vulnerability

## Allocation of Resources Without Limits or Throttling

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: glibc/libc-bin
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and glibc/libc-bin@2.35-0ubuntu3.1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › glibc/libc-bin@2.35-0ubuntu3.1
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › meta-common-packages@meta › glibc/libc6@2.35-0ubuntu3.1

## NVD Description

Note: Versions mentioned in the description apply to the upstream `glibc` package.

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

## Remediation

There is no fixed version for `Ubuntu:22.04` `glibc`.

## References

- ADVISORY
- MISC
- MISC
- MISC

More about this vulnerability

## Improper Input Validation

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: git/git-man
- Introduced through: docker-image|quay.io/argoproj/argocd@latest, git@1:2.34.1-1ubuntu1.5 and others

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › git@1:2.34.1-1ubuntu1.5 › git/git-man@1:2.34.1-1ubuntu1.5
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › git@1:2.34.1-1ubuntu1.5
- Introduced through: docker-image|quay.io/argoproj/argocd@latest › git-lfs@3.0.2-1 › git@1:2.34.1-1ubuntu1.5

## NVD Description

Note: Versions mentioned in the description apply to the upstream `git` package.

GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).

## Remediation

There is no fixed version for `Ubuntu:22.04` `git`.

## References

- ADVISORY
- Debian Security Tracker
- http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html

More about this vulnerability

## Improper Input Validation

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: coreutils
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and coreutils@8.32-4.1ubuntu1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › coreutils@8.32-4.1ubuntu1

## NVD Description

Note: Versions mentioned in the description apply to the upstream `coreutils` package.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

## Remediation

There is no fixed version for `Ubuntu:22.04` `coreutils`.

## References

- ADVISORY
- Debian Security Tracker
- MLIST
- OSS security Advisory
- OSS security Advisory

More about this vulnerability

## CVE-2022-3715

low severity

- Package Manager: ubuntu:22.04
- Vulnerable module: bash
- Introduced through: docker-image|quay.io/argoproj/argocd@latest and bash@5.1-6ubuntu1

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@latest › bash@5.1-6ubuntu1

## NVD Description

This vulnerability has not been analyzed by NVD yet.

## Remediation

There is no fixed version for `Ubuntu:22.04` `bash`.

## References

- ADVISORY

More about this vulnerability