Uploaded image for project: 'OpenShift GitOps'
  1. OpenShift GitOps
  2. GITOPS-7037

CVE-2024-13484 openshift-gitops-operator-container: Namespace Isolation Break [gitops-1.16]

XMLWordPrintable

    • False
    • Hide

      None

      Show
      None
    • False
    • Hide
      Before this update, user-workload monitoring support for workloads did not require any configuration by default. Argo CD monitoring worked automatically when deployed in any namespace. With this update, monitoring support for Argo CD deployed in non-{OCP} namespaces requires user-workload monitoring to be enabled in {OCP}. For more information, see link:https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/monitoring/configuring-user-workload-monitoring#configurable-monitoring-components_preparing-to-configure-the-monitoring-stack-uwm[Enabling monitoring for user-defined projects]. link:https://issues.redhat.com/browse/GITOPS-7037[GITOPS-7037]
      Show
      Before this update, user-workload monitoring support for workloads did not require any configuration by default. Argo CD monitoring worked automatically when deployed in any namespace. With this update, monitoring support for Argo CD deployed in non-{OCP} namespaces requires user-workload monitoring to be enabled in {OCP}. For more information, see link: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/monitoring/configuring-user-workload-monitoring#configurable-monitoring-components_preparing-to-configure-the-monitoring-stack-uwm [Enabling monitoring for user-defined projects]. link: https://issues.redhat.com/browse/GITOPS-7037 [ GITOPS-7037 ]
    • Red Hat
    • CVE-2024-13484
    • 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    • CWE-668
    • openshift-gitops-operator-container
    • openshift-gitops-operator-container
    • False
    • GitOps Crimson Sprint 16
    • Moderate

      Security Tracking Issue

      Do not make this issue public.

      Flaw:

      Namespace Isolation Break
      https://bugzilla.redhat.com/show_bug.cgi?id=2269376

      Currently argocd applies the label openshift.io/cluster-monitoring to all namespaces that deploy a ArgoCD CR instance. This then allows the namespace
      to create a rogue PrometheusRule that can then have adverse effects on the platform monitoring stack. As the label is applied the rule is rolled out
      cluster wide.

      This gives anyone who has argocd instances deployed a way to escalate out of their namespace isolation and affect the entire cluster.

      ~~~

      Tracker accuracy feedback form: https://docs.google.com/forms/d/e/1FAIpQLSfa6zTaEGohRdiIqGVAvWTSAL0kpO_DkkEICuIHzQHFwmKswg/viewform

              rh-ee-ansingh Anand Singh
              gsuckevi@redhat.com Guilherme Suckevicz
              Anand Francis Joseph, Jayachandra Prabhakar, William Tam
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: