Coder Social home page Coder Social logo

devtron-labs / devtron Goto Github PK

View Code? Open in Web Editor NEW
4.1K 46.0 465.0 283.41 MB

Tool integration platform for Kubernetes

Home Page: https://devtron.ai

License: Apache License 2.0

Dockerfile 0.11% Shell 0.13% Go 97.48% Makefile 0.04% Mustache 1.82% Python 0.11% TSQL 0.21% Smarty 0.03% PLpgSQL 0.08%
kubernetes kubernetes-deployment kubectl deployment deployment-automation deployment-strategy deployment-pipeline argocd gitops appops

devtron's Introduction

Cloud Native tool integration platform for Kubernetes


Explore documentation »
Try Devtron Demo »
Website · Blogs · Join Discord channel · Twitter . YouTube

Join Discord Go Report Card License CII Best Practices made-with-Go Website devtron.ai Tweet

🔥 Want to accelerate K8s adoption? Introducing DevOps in a Box; Leave DevOps on Devtron 🔥

Devtron deeply integrates with products across the lifecycle of microservices,i.e., CI, CD, security, cost, debugging, and observability via an intuitive web interface.

Devtron helps you deploy, observe, manage & debug existing Helm apps in all your clusters.

Devtron Demo Environment

Please log in the Demo environment using github credentials. Please note the user is granted view access.

Devtron Features

Application-level Resource grouping for easier Debugging
  • Devtron groups your Kubernetes objects deployed via Helm charts and display them in a slick UI for easier monitoring or debugging. Access pod logs and resource manifests right from the Devtron UI and even edit them!
Centralized Access Management
  • Control and give customizable view-only, edit access to users on Project, Environment and Application levels
Deploy, Manage and Observe on multiple clusters
  • Deploy and manage Helm charts, applications across multiple Kubernetes clusters (hosted on multiple clouds/on-prem) right from a single Devtron setup

Integrations

Devtron is designed to be modular, and its functionality can be easily extended with the help of integrations.

CI/CD Integration

Devtron CI/CD with GitOps integration is used to automate the builds and deployments and enables the software development teams to focus on meeting the business requirements, code quality, and security.

  • Devtron leverages Kubernetes auto-scaling and centralized caching to give you unlimited cost-efficient CI workers.
  • Supports pre-CI and post-CI integrations for code quality monitoring.
  • Seamlessly integrates with Clair for image vulnerability scanning.
  • Supports different deployment strategies: Blue/Green, Rolling, Canary, and Recreate.
  • Implements GitOps to manage the state of Kubernetes applications.
  • Integrates with ArgoCD for continuous deployment.
  • Checks logs, events, and manifests or exec inside containers for debugging.
  • Provides deployment metrics like; deployment frequency, lead time, change failure rate, and mean-time recovery.
  • Seamlessly integrates with Grafana for continuous application metrics like CPU and memory usage, status code, throughput, and latency on the dashboard.

Architecture

Installation

Before you begin, you must create a Kubernetes cluster (preferably K8s 1.16 or higher) and install Helm.

1. Install Devtron with CI/CD Integration

Run the following command to install the latest version of Devtron along with the CI/CD module:

helm repo add devtron https://helm.devtron.ai

helm install devtron devtron/devtron-operator \
--create-namespace --namespace devtroncd \
--set installer.modules={cicd}

Access Devtron

URL: Use the following command to get the dashboard URL:

kubectl get svc -n devtroncd devtron-service -o jsonpath='{.status.loadBalancer.ingress}'

Credentials:

UserName: admin
Password: Run the following command to get the admin password for Devtron version v0.6.0 and higher

kubectl -n devtroncd get secret devtron-secret -o jsonpath='{.data.ADMIN_PASSWORD}' | base64 -d

For Devtron version less than v0.6.0, run the following command to get the admin password:

kubectl -n devtroncd get secret devtron-secret -o jsonpath='{.data.ACD_PASSWORD}' | base64 -d

Please refer to the document for more information on how to access the Devtron Dashboard.

Installation Status

The above install command for CI/CD integration starts Devtron-operator, which takes about 20 minutes to spin up all of the Devtron microservices one by one. You can check the status of the installation with the following command:

kubectl -n devtroncd get installers installer-devtron \
-o jsonpath='{.status.sync.status}'

The command executes with one of the following output messages, indicating the status of the installation:

  • Downloaded: The installer has downloaded all the manifests, and installation is in progress.
  • Applied: The installer has successfully applied all the manifests, and the installation is complete.

2. Install Devtron with Helm Bundle

helm repo add devtron https://helm.devtron.ai

helm install devtron devtron/devtron-operator --create-namespace --namespace devtroncd

Install Multi-Architecture Nodes (ARM and AMD)

To install Devtron on clusters with the multi-architecture nodes (ARM and AMD), append the Devtron installation command with --set installer.arch=multi-arch

💙 Technology

Devtron is built on some of the most trusted and loved technologies:

📹 Videos

📝 Blogs from Community

💪 Trusted By

Devtron is trusted by communities all across the globe. The list of organizations using Devtron can be found here.

❓ FAQs & Troubleshooting

📄 Compatibility

Current build

  • Devtron uses modified version of Argo Rollout
  • Application metrics only work for K8s version 1.16+

Support, Contribution, and Community

👥 Community

Get updates on Devtron's development and chat with project maintainers, contributors, and community members

Join us at Discord channel

Join Devtron : Heroku for Kubernetes

🤝 Contribute

Check out our contributing guidelines. Included, are directions for opening issues, coding standards, and notes on our development processes. We deeply appreciate your contribution.

Please look at our community contributions and feel free to create a video or blog around Devtron and add your valuable contribution to the list.

Contributors:

We are deeply grateful to all our amazing contributors!

🐛 Vulnerability Reporting

We at Devtron, take security and our users' trust very seriously. If you believe you have found a security issue, please report it to [email protected].

🔖 License

Devtron is licensed under Apache License, Version 2.0

devtron's People

Contributors

abhinav-26 avatar adi6859 avatar arushi09-hub avatar ash-exp avatar ashish-devtron avatar ashishdevtron avatar ashokdevtron avatar badal773 avatar dheeth avatar divyabhushan avatar gireesh-naidu avatar iamayushm avatar kartik-579 avatar kripanshdevtron avatar manish-agrawal-ai avatar nishant-d avatar pawan-59 avatar pawan-mehta-dt avatar pghildiyal avatar prakarsh-dt avatar prakash100198 avatar shashwatdadhich avatar shivam-nagar23 avatar shivani170 avatar shubham9t9 avatar sne789 avatar snehith57624 avatar subhashish-devtron avatar uxarya-d avatar vikramdevtron avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

devtron's Issues

CVE-2018-19838 (Medium) detected in opennmsopennms-source-26.0.0-1, node-sass-4.14.1.tgz

CVE-2018-19838 - Medium Severity Vulnerability

Vulnerable Libraries - opennmsopennms-source-26.0.0-1, node-sass-4.14.1.tgz

node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().

Publish Date: 2018-12-04

URL: CVE-2018-19838

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/sass/libsass/blob/3.6.0/src/ast.cpp

Release Date: 2019-07-01

Fix Resolution: LibSass - 3.6.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-11358 (Medium) detected in jquery-3.2.1.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/superagent/docs/tail.html

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/superagent/docs/tail.html

Dependency Hierarchy:

  • jquery-3.2.1.min.js (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-3.10.1.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/jsdoctypeparser/node_modules/lodash/package.json,devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/jscs/node_modules/lodash/package.json,devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/xmlbuilder/node_modules/lodash/package.json

Dependency Hierarchy:

  • jscs-3.0.7.tgz (Root Library)
    • lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-23

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

:sparkles: **Welcome to GitHub Projects** :sparkles:

We're so excited that you've decided to create a new project! Now that you're here, let's make sure you know how to get the most out of GitHub Projects.

  • Create a new project
  • Give your project a name
  • Press the ? key to see available keyboard shortcuts
  • Add a new column
  • Drag and drop this card to the new column
  • Search for and add issues or PRs to your project
  • Manage automation on columns
  • Archive a card or archive all cards in a column

CVE-2020-7751 (High) detected in pathval-0.1.1.tgz

CVE-2020-7751 - High Severity Vulnerability

Vulnerable Library - pathval-0.1.1.tgz

Object value retrieval given a string path

Library home page: https://registry.npmjs.org/pathval/-/pathval-0.1.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/pathval/package.json

Dependency Hierarchy:

  • jscs-3.0.7.tgz (Root Library)
    • pathval-0.1.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

This affects all versions of package pathval.

Publish Date: 2020-10-26

URL: CVE-2020-7751

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2019-11253 (High) detected in multiple libraries

CVE-2019-11253 - High Severity Vulnerability

Vulnerable Libraries - k8s.io/apimachinery/pkg/runtime/serializer/json-kubernetes-1.14.6, k8s.io/apimachinery/pkg/runtime-kubernetes-1.14.6, k8s.io/apimachinery/pkg/runtime/serializer-kubernetes-1.14.6, k8s.io/apimachinery/pkg/util/json-kubernetes-1.14.6

k8s.io/apimachinery/pkg/runtime/serializer/json-kubernetes-1.14.6

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • k8s.io/api/core/v1-kubernetes-1.14.10-beta.0
      • k8s.io/apimachinery/pkg/apis/meta/v1-kubernetes-1.14.6
        • k8s.io/apimachinery/pkg/watch-kubernetes-1.14.6
          • k8s.io/apimachinery/pkg/runtime-kubernetes-1.14.6
            • k8s.io/apimachinery/pkg/runtime/serializer/json-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/apimachinery/pkg/runtime-kubernetes-1.14.6

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • k8s.io/api/core/v1-kubernetes-1.14.10-beta.0
      • k8s.io/apimachinery/pkg/apis/meta/v1-kubernetes-1.14.6
        • k8s.io/apimachinery/pkg/watch-kubernetes-1.14.6
          • k8s.io/apimachinery/pkg/runtime-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/apimachinery/pkg/runtime/serializer-kubernetes-1.14.6

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/tools/cache-kubernetes-1.14.6
          • k8s.io/client-go/tools/pager-kubernetes-1.14.6
            • k8s.io/apimachinery/pkg/apis/meta/internalversion-kubernetes-1.14.6
              • k8s.io/apimachinery/pkg/runtime/serializer-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/apimachinery/pkg/util/json-kubernetes-1.14.6

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • k8s.io/api/core/v1-kubernetes-1.14.10-beta.0
      • k8s.io/apimachinery/pkg/apis/meta/v1-kubernetes-1.14.6
        • k8s.io/apimachinery/pkg/watch-kubernetes-1.14.6
          • k8s.io/apimachinery/pkg/runtime-kubernetes-1.14.6
            • k8s.io/apimachinery/pkg/apis/meta/v1/unstructured-kubernetes-1.14.6
              • k8s.io/apimachinery/pkg/util/json-kubernetes-1.14.6 (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

Publish Date: 2019-10-17

URL: CVE-2019-11253

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: kubernetes/kubernetes#83253

Release Date: 2019-10-17

Fix Resolution: v1.13.12;v1.14.8;v1.15.5;v1.16.2


Step up your Open Source Security Game with WhiteSource here

CVE-2019-16769 (Medium) detected in serialize-javascript-1.9.1.tgz

CVE-2019-16769 - Medium Severity Vulnerability

Vulnerable Library - serialize-javascript-1.9.1.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

  • copy-webpack-plugin-4.6.0.tgz (Root Library)
    • serialize-javascript-1.9.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Publish Date: 2019-12-05

URL: CVE-2019-16769

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769

Release Date: 2019-12-05

Fix Resolution: v2.1.1


Step up your Open Source Security Game with WhiteSource here

[RELEASED] Quick Jump

Problem Statement
Currently, users need to click around the dashboard interface to navigate around and perform actions.

Why
Inherently, we as individuals try to do things in the easiest way possible if they need to be done again and again. Specifically, developers use the keyboard as their preferred mode of interaction; partly due to the nature of their work (writing code), moreover, it prevents constant switching between keyboard and mouse as input modes, thus saving time.

CVE-2020-7774 (High) detected in y18n-4.0.0.tgz - autoclosed

CVE-2020-7774 - High Severity Vulnerability

Vulnerable Library - y18n-4.0.0.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/y18n/package.json

Dependency Hierarchy:

  • copy-webpack-plugin-4.6.0.tgz (Root Library)
    • cacache-10.0.4.tgz
      • y18n-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

This affects the package y18n before 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7774

Release Date: 2020-11-17

Fix Resolution: 5.0.5


Step up your Open Source Security Game with WhiteSource here

CVE-2018-11499 (High) detected in opennmsopennms-source-26.0.0-1

CVE-2018-11499 - High Severity Vulnerability

Vulnerable Library - opennmsopennms-source-26.0.0-1

A Java based fault and performance management system

Library home page: https://sourceforge.net/projects/opennms/

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerable Source Files (1)

devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/node-sass/src/libsass/src/parser.cpp

Vulnerability Details

A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.

Publish Date: 2018-05-26

URL: CVE-2018-11499

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11499

Release Date: 2018-05-26

Fix Resolution: LibSass - 3.6.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8828 (High) detected in multiple libraries

CVE-2020-8828 - High Severity Vulnerability

Vulnerable Libraries - github.com/argoproj/argo-cd/util/session-v1.2.3, github.com/argoproj/argo-cd/util-v1.2.3, github.com/argoproj/argo-cd/common-v1.2.3

github.com/argoproj/argo-cd/util/session-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/util/session-v1.2.3 (Vulnerable Library)
github.com/argoproj/argo-cd/util-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/git-v1.2.3
        • github.com/argoproj/argo-cd/util-v1.2.3 (Vulnerable Library)
github.com/argoproj/argo-cd/common-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/common-v1.2.3 (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.

Publish Date: 2020-04-08

URL: CVE-2020-8828

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8828

Release Date: 2020-04-08

Fix Resolution: v1.5.0-rc3


Step up your Open Source Security Game with WhiteSource here

CVE-2018-19839 (Medium) detected in node-sass-4.14.1.tgz, CSS::Sassv3.4.11

CVE-2018-19839 - Medium Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.1.tgz, CSS::Sassv3.4.11

node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.

Publish Date: 2018-12-04

URL: CVE-2018-19839

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19839

Release Date: 2018-12-04

Fix Resolution: Libsass:3.6.0


Step up your Open Source Security Game with WhiteSource here

test report UI

support for visualisation and analysis of helm chart

AB#274

feature flag for UI

ability to toggle feature based on env variable.

components

  1. application metrics
  2. support chat

Command Bar prototype

What all will be covered ?

  • App Details -> app / {appName} / {envName}
    logs/events/manifest -> app / {appName} / {envName} / {objectKind} / {objectName} / {tab}, where tab = logs/events/manifest
  • Configure -> app / {appName} / config / {secondaryNavigation}, where secondaryNavigation = git/docker-config/deployment-template/workflow-editor
  • Discover Chart -> chart / discover
    Discover Chart Detail -> chart / discover / {chartName}
  • Documentation -> doc
    Deployment Template -> doc / create-app / deployment-template
    Contextual documentation link
  • Global configuration -> global-config
    Secondary Navigation -> global-config / {nav}, where nav = git/docker/cluster/project/notification/user-access

Milestones

widget

  • Component signature
  • Component implementation: state, function, props, API Calls, UI interactions
  • Create Suggestions: Implement API calls/ create suggestions. Keyboard Navigation: all key handling
  • Integration on component: add component on pages


CVE-2018-11698 (High) detected in opennmsopennms-source-26.0.0-1, node-sass-4.14.1.tgz

CVE-2018-11698 - High Severity Vulnerability

Vulnerable Libraries - opennmsopennms-source-26.0.0-1, node-sass-4.14.1.tgz

node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11698

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-11698

Release Date: 2018-06-04

Fix Resolution: Libsass-3.6.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-3.10.1.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/jsdoctypeparser/node_modules/lodash/package.json,devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/jscs/node_modules/lodash/package.json,devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/xmlbuilder/node_modules/lodash/package.json

Dependency Hierarchy:

  • jscs-3.0.7.tgz (Root Library)
    • lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-11576 (Medium) detected in github.com/argoproj/argo-cd/util/session-v1.2.3, github.com/argoproj/argo-cd/util-v1.2.3

CVE-2020-11576 - Medium Severity Vulnerability

Vulnerable Libraries - github.com/argoproj/argo-cd/util/session-v1.2.3, github.com/argoproj/argo-cd/util-v1.2.3

github.com/argoproj/argo-cd/util/session-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/util/session-v1.2.3 (Vulnerable Library)
github.com/argoproj/argo-cd/util-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/git-v1.2.3
        • github.com/argoproj/argo-cd/util-v1.2.3 (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.

Publish Date: 2020-04-08

URL: CVE-2020-11576

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11576

Release Date: 2020-04-08

Fix Resolution: v1.5.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8826 (High) detected in multiple libraries

CVE-2020-8826 - High Severity Vulnerability

Vulnerable Libraries - github.com/argoproj/argo-cd/util/session-v1.2.3, github.com/argoproj/argo-cd/util-v1.2.3, github.com/argoproj/argo-cd/common-v1.2.3, github.com/argoproj/argo-cd/util/settings-v1.2.3

github.com/argoproj/argo-cd/util/session-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/util/session-v1.2.3 (Vulnerable Library)
github.com/argoproj/argo-cd/util-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/git-v1.2.3
        • github.com/argoproj/argo-cd/util-v1.2.3 (Vulnerable Library)
github.com/argoproj/argo-cd/common-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/common-v1.2.3 (Vulnerable Library)
github.com/argoproj/argo-cd/util/settings-v1.2.3

Declarative continuous deployment for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/git-v1.2.3
        • github.com/argoproj/argo-cd/util-v1.2.3
          • github.com/argoproj/argo-cd/util/db-d7f099992d8cf93c280df2ed38a0b9a1b2614e56
            • github.com/argoproj/argo-cd/util/settings-v1.2.3 (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.

Publish Date: 2020-04-08

URL: CVE-2020-8826

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8826

Release Date: 2020-04-08

Fix Resolution: v1.5.0-rc1


Step up your Open Source Security Game with WhiteSource here

WS-2018-0148 (Low) detected in utile-0.2.1.tgz

WS-2018-0148 - Low Severity Vulnerability

Vulnerable Library - utile-0.2.1.tgz

A drop-in replacement for `util` with some additional advantageous functions

Library home page: https://registry.npmjs.org/utile/-/utile-0.2.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/utile/package.json

Dependency Hierarchy:

  • jscs-3.0.7.tgz (Root Library)
    • prompt-0.2.14.tgz
      • utile-0.2.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

utile allocates uninitialized Buffers when number is passed in input.
Before version 0.3.0

Publish Date: 2018-07-16

URL: WS-2018-0148

CVSS 2 Score Details (1.8)

Base Score Metrics not available


Step up your Open Source Security Game with WhiteSource here

docker hub registry type support

in global config -> Docker registries we have only two supported registry type ecr and other. add support for docker hub

display value : docker hub
form value: docker-hub

  • change from UI
  • test

CVE-2018-11697 (High) detected in opennmsopennms-source-26.0.0-1, CSS::Sassv3.4.11

CVE-2018-11697 - High Severity Vulnerability

Vulnerable Libraries - opennmsopennms-source-26.0.0-1, CSS::Sassv3.4.11

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11697

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11697

Release Date: 2019-09-01

Fix Resolution: LibSass - 3.6.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-11250 (Medium) detected in multiple libraries

CVE-2019-11250 - Medium Severity Vulnerability

Vulnerable Libraries - k8s.io/client-go/kubernetes/typed/authorization/v1beta1-kubernetes-1.14.6, k8s.io/client-go/tools/remotecommand-kubernetes-1.14.6, k8s.io/client-go/util/keyutil-kubernetes-1.14.6, k8s.io/client-go/kubernetes/typed/node/v1beta1-kubernetes-1.14.6, k8s.io/client-go/util/connrotation-kubernetes-1.14.6, k8s.io/client-go/pkg/version-kubernetes-1.14.6, k8s.io/client-go/kubernetes/typed/networking/v1beta1-kubernetes-1.14.6, k8s.io/client-go/transport-kubernetes-1.14.6, k8s.io/client-go/tools/pager-kubernetes-1.14.6, k8s.io/client-go/discovery-kubernetes-1.14.6, k8s.io/client-go/kubernetes/typed/networking/v1-kubernetes-1.14.6, k8s.io/client-go/dynamic-kubernetes-1.14.6, k8s.io/client-go/kubernetes/typed/node/v1alpha1-kubernetes-1.14.6, k8s.io/client-go/kubernetes/typed/authorization/v1-kubernetes-1.14.6

k8s.io/client-go/kubernetes/typed/authorization/v1beta1-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/kubernetes-kubernetes-1.14.6
          • k8s.io/client-go/kubernetes/typed/authorization/v1beta1-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/tools/remotecommand-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/git-v1.2.3
        • github.com/argoproj/argo-cd/util-v1.2.3
          • github.com/argoproj/argo/util-v2.4.1
            • github.com/argoproj/argo-v2.4.1
              • github.com/argoproj/argo/workflow/common-v2.4.1
                • k8s.io/client-go/tools/remotecommand-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/util/keyutil-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/tools/cache-kubernetes-1.14.6
          • k8s.io/client-go/rest-kubernetes-1.14.6
            • k8s.io/client-go/util/cert-kubernetes-1.14.6
              • k8s.io/client-go/util/keyutil-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/kubernetes/typed/node/v1beta1-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/kubernetes-kubernetes-1.14.6
          • k8s.io/client-go/kubernetes/typed/node/v1beta1-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/util/connrotation-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/tools/cache-kubernetes-1.14.6
          • k8s.io/client-go/rest-kubernetes-1.14.6
            • k8s.io/client-go/plugin/pkg/client/auth/exec-kubernetes-1.14.6
              • k8s.io/client-go/util/connrotation-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/pkg/version-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/tools/cache-kubernetes-1.14.6
          • k8s.io/client-go/rest-kubernetes-1.14.6
            • k8s.io/client-go/pkg/version-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/kubernetes/typed/networking/v1beta1-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/kubernetes-kubernetes-1.14.6
          • k8s.io/client-go/kubernetes/typed/networking/v1beta1-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/transport-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/tools/cache-kubernetes-1.14.6
          • k8s.io/client-go/rest-kubernetes-1.14.6
            • k8s.io/client-go/plugin/pkg/client/auth/exec-kubernetes-1.14.6
              • k8s.io/client-go/transport-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/tools/pager-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/tools/cache-kubernetes-1.14.6
          • k8s.io/client-go/tools/pager-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/discovery-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/kubernetes-kubernetes-1.14.6
          • k8s.io/client-go/discovery-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/kubernetes/typed/networking/v1-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/kubernetes-kubernetes-1.14.6
          • k8s.io/client-go/kubernetes/typed/networking/v1-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/dynamic-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/git-v1.2.3
        • github.com/argoproj/argo-cd/util-v1.2.3
          • github.com/argoproj/argo-cd/util/kube-d7f099992d8cf93c280df2ed38a0b9a1b2614e56
            • k8s.io/client-go/dynamic-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/kubernetes/typed/node/v1alpha1-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/kubernetes-kubernetes-1.14.6
          • k8s.io/client-go/kubernetes/typed/node/v1alpha1-kubernetes-1.14.6 (Vulnerable Library)
k8s.io/client-go/kubernetes/typed/authorization/v1-kubernetes-1.14.6

Go client for Kubernetes.

Dependency Hierarchy:

  • github.com/argoproj/argo-cd/pkg/apiclient/session-v1.2.3 (Root Library)
    • github.com/argoproj/argo-cd/pkg/apis/application/v1alpha1-v1.2.3
      • github.com/argoproj/argo-cd/util/rbac-v1.2.3
        • k8s.io/client-go/kubernetes-kubernetes-1.14.6
          • k8s.io/client-go/kubernetes/typed/authorization/v1-kubernetes-1.14.6 (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Publish Date: 2019-08-29

URL: CVE-2019-11250

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11250

Release Date: 2019-08-29

Fix Resolution: 1.16.0


Step up your Open Source Security Game with WhiteSource here

Chart Upgrade

  • Fetch Installed App (charts) By Id (Modification)
  • Search AppStore (charts) By name (New API)
  • Update[upgrade chart] Installed App (Modification)

app name reuse

app name reuse currently deleted app names can't be reused

CVE-2019-11254 (Medium) detected in gopkg.in/yaml.v2-v2.2.4

CVE-2019-11254 - Medium Severity Vulnerability

Vulnerable Library - gopkg.in/yaml.v2-v2.2.4

YAML support for the Go language.

Dependency Hierarchy:

  • github.com/ghodss/yaml-v1.0.0 (Root Library)
    • gopkg.in/yaml.v2-v2.2.4 (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Publish Date: 2020-04-01

URL: CVE-2019-11254

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/go-yaml/yaml/tree/v2.2.8

Release Date: 2020-04-01

Fix Resolution: v2.2.8


Step up your Open Source Security Game with WhiteSource here

CVE-2018-11694 (High) detected in opennmsopennms-source-26.0.0-1, node-sass-4.14.1.tgz

CVE-2018-11694 - High Severity Vulnerability

Vulnerable Libraries - opennmsopennms-source-26.0.0-1, node-sass-4.14.1.tgz

node-sass-4.14.1.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.1.tgz

Path to dependency file: devtron/vendor/github.com/argoproj/argo-cd/ui/package.json

Path to vulnerable library: devtron/vendor/github.com/argoproj/argo-cd/ui/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.1.tgz (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-06-04

URL: CVE-2018-11694

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11694

Release Date: 2018-06-04

Fix Resolution: LibSass - 3.6.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-26160 (High) detected in github.com/dgrijalva/jwt-go-v3.2.0

CVE-2020-26160 - High Severity Vulnerability

Vulnerable Library - github.com/dgrijalva/jwt-go-v3.2.0

Golang implementation of JSON Web Tokens (JWT)

Dependency Hierarchy:

  • github.com/dgrijalva/jwt-go-v3.2.0 (Vulnerable Library)

Found in HEAD commit: f7db3d4b83b1d3b0008f56e9a649b36ed2ae830d

Found in base branch: main

Vulnerability Details

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Publish Date: 2020-09-30

URL: CVE-2020-26160

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.