GitHub Advisoryadvisory · Go
GHSA-h563-xh25-x54q Workflow re-write vulnerability using input parameter
MEDIUM
Official page ↗
- Aliases
- CVE-2021-37914
- Ecosystem
- Go
- Packages
- github.com/argoproj/argo-workflows/v3
- Severity
- Moderate
- Weaknesses
- CWE-20
- Reviewed
- 2021-08-04
Affected packages
• Go github.com/argoproj/argo-workflows/v3: >= 3.1.0, < 3.1.6 → fixed in 3.1.6
Description
Impact
• Allow end-users to set input parameters, but otherwise expect workflows to be secure.
Patches
Not yet.
Workarounds
• Set `EXPRESSION_TEMPLATES=false` for the workflow controller
References
• https://github.com/argoproj/argo-workflows/issues/6441
For more information
If you have any questions or comments about this advisory:
• Open an issue in example link to repo
• Email us at example email address
Related
Alias · CVE (1)
- CVE-2021-37914 In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://github.com/argoproj/argo-workflows/security/advisories/GHSA-h563-xh25-x54q web
- https://nvd.nist.gov/vuln/detail/CVE-2021-37914 advisory
- https://github.com/argoproj/argo-workflows/issues/6441 web
- https://github.com/argoproj/argo-workflows/pull/6285 web
- https://github.com/argoproj/argo-workflows/pull/6442 web
- https://github.com/argoproj/argo-workflows/commit/2a2ecc916925642fd8cb1efd026588e6828f82e1 web
- github.com/argoproj/argo-workflows/v3 package