CVE-2024-31989

CRITICAL Year: 2024
CVSS v3 Score
9.0
Critical
Weakness Type
CWE-327
View all →

Vulnerability Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS cluster, it requires manual enablement through configuration to enforce network policies. This raises concerns that many clients might unknowingly have open access to their Redis servers. This vulnerability could lead to Privilege Escalation to the level of cluster controller, or to information leakage, affecting anyone who does not have strict access controls on their Redis instance. This issue has been patched in version(s) 2.8.19, 2.9.15 and 2.10.10.

Related Vulnerabilities

CVE-2019-25052

CRITICAL
CVSS:9.1(Critical)

In Linaro OP-TEE before 3.7.0, by using inconsistent or malformed data, it is possible to call update and final cryptographic functions directly, causing a crash that could leak sensitive information.

CWE-3272019

CVE-2019-5502

CRITICAL
CVSS:9.1(Critical)

SMB in Data ONTAP operating in 7-Mode versions prior to 8.2.5P3 has weak cryptography which when exploited could lead to information disclosure or addition or modification of data.

CWE-3272019

CVE-2019-5919

CRITICAL
CVSS:9.1(Critical)

An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value...

CWE-3272019

CVE-2019-9483

CRITICAL
CVSS:9.1(Critical)

Amazon Ring Doorbell before 3.4.7 mishandles encryption, which allows attackers to obtain audio and video data, or insert spoofed video that does not correspond to the actual person at the door.

CWE-3272019

CVE-2020-6874

CRITICAL
CVSS:9.1(Critical)

A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so remote attackers could use this vulnerability for account credential enumeration ...

CWE-3272020

CVE-2021-31562

CRITICAL
CVSS:9.1(Critical)

The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to e...

CWE-3272021