-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/argoproj/argo-cd/v2 | go | >= 2.9.0-rc1, <= 2.14.19 | 2.14.20 |
| github.com/argoproj/argo-cd/v3 | go | = 3.2.0-rc1 | 3.2.0-rc2 |
| github.com/argoproj/argo-cd/v3 | go | >= 3.1.0-rc1, <= 3.1.7 | 3.1.8 |
| github.com/argoproj/argo-cd/v3 | go | >= 3.0.0-rc1, <= 3.0.18 | 3.0.19 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the affectedRevisionInfo function within util/webhook/webhook.go. The provided vulnerability description explicitly points out the code snippet where an index-out-of-range panic occurs when processing an Azure DevOps git.push webhook. The panic happens because the code accesses payload.Resource.RefUpdates[0] without verifying that the RefUpdates slice is not empty. The provided commit 1a023f1ca7fe4ec942b4b6696804988d5a632baf confirms this by adding a length check (if len(payload.Resource.RefUpdates) > 0) before the vulnerable code block. The crash log also confirms the vulnerable function is github.com/argoproj/argo-cd/v3/util/webhook.affectedRevisionInfo. Since affectedRevisionInfo is a method of the ArgoCDWebhookHandler struct, the function name that would appear in a Go profiler is ArgoCDWebhookHandler.affectedRevisionInfo.
Ongoing coverage of React2Shell