CVE-2022-31034

Description

Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params in github.com/argoproj/argo-cd

Affected packages (4)

• Go/github.com/argoproj/argo-cd>= 0.11.0, < 2.1.16
• Go/github.com/argoproj/argo-cd>= 0.11.0
• Go/github.com/argoproj/argo-cd/v2from 0, < 2.1.16
• Go/github.com/argoproj/argo-cd/v2from 0, < 2.1.16, >= 2.2.0, < 2.2.10, >= 2.3.0, < 2.3.5, >= 2.4.0, < 2.4.1

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-31034
• PATCHhttps://github.com/argoproj/argo-cd
• WEBhttps://github.com/argoproj/argo-cd/commit/17f7f4f462bdb233e1b9b36f67099f41052d8cb0
• WEBhttps://github.com/argoproj/argo-cd/security/advisories/GHSA-2m7h-86qq-fp4v