id: GO-2024-2654
modules:
    - module: github.com/argoproj/argo-cd/v2
      versions:
        - fixed: 2.8.13
        - introduced: 2.9.0
          fixed: 2.9.9
        - introduced: 2.10.0
          fixed: 2.10.4
      vulnerable_at: 2.10.3
      packages:
        - package: github.com/argoproj/argo-cd/v2/server/application
          symbols:
            - NewHandler
            - newTerminalSession
        - package: github.com/argoproj/argo-cd/v2/util/session
          symbols:
            - expireOldFailedAttempts
            - SessionManager.updateFailureCount
            - SessionManager.getFailureCount
          derived_symbols:
            - SessionManager.VerifyUsernamePassword
summary: Denial of service in github.com/argoproj/argo-cd/v2
description: |-
    Application may crash due to concurrent writes, leading to a denial of service.
    An attacker can crash the application continuously, making it impossible for
    legitimate users to access the service. Authentication is not required in the
    attack.
cves:
    - CVE-2024-21661
ghsas:
    - GHSA-6v85-wr92-q4p7
credits:
    - '@nadava669'
    - '@todaywasawesome'
    - '@crenshaw-dev'
    - '@jannfis'
    - '@pasha-codefresh'
references:
    - fix: https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345
    - fix: https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208
    - fix: https://github.com/argoproj/argo-cd/commit/ce04dc5c6f6e92033221ec6d96b74403b065ca8b
    - web: https://github.com/argoproj/argo-cd/blob/54601c8fd30b86a4c4b7eb449956264372c8bde0/util/session/sessionmanager.go#L302-L311