GHSA-h563-xh25-x54qMedium
Workflow re-write vulnerability using input parameter
🔗 CVE IDs covered (1)
📋 Description
Impact
- Allow end-users to set input parameters, but otherwise expect workflows to be secure.
Patches
Not yet.
Workarounds
- Set
EXPRESSION_TEMPLATES=falsefor the workflow controller
References
- https://github.com/argoproj/argo-workflows/issues/6441
For more information
If you have any questions or comments about this advisory:
- Open an issue in example link to repo
- Email us at example email address
🎯 Affected products1
- go/github.com/argoproj/argo-workflows/v3:>= 3.1.0, < 3.1.6
🔗 References (7)
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-h563-xh25-x54q
- https://github.com/argoproj/argo-workflows/issues/6441
- https://github.com/argoproj/argo-workflows/pull/6442
- https://github.com/argoproj/argo-workflows/pull/6285
- https://github.com/argoproj/argo-workflows/commit/2a2ecc916925642fd8cb1efd026588e6828f82e1
- https://nvd.nist.gov/vuln/detail/CVE-2021-37914
- https://github.com/advisories/GHSA-h563-xh25-x54q