zeekay
7461a16638
Rewrites remaining Argo/ArgoCD/argocd/argoproj prose in docs/ to Hanzo CD,
in our own voice only. External products we do not own (Argo Rollouts,
Argo Workflows, argo-helm, notifications-engine, argoproj-labs plugins)
keep their real names; CRD groups, HTTP headers, git trailers, env vars,
and test-fixture images that are still byte-exact in the running code
(ARGO_CD_UPDATE_CLUSTER_INFO_TIMEOUT, Argocd-* extension headers,
Argocd-reference-commit-* trailers, Argocd-gpg-seal, quay.io/argoprojlabs
cd-e2e-container) are left untouched.
Deletes docs/operator-manual/upgrading/1.0-1.1.md through 3.4-3.5.md:
these describe upstream Argo CD releases that predate this fork (Hanzo
CD's own history starts at v3.6) and several cited GitHub PR/advisory
links that had been mechanically rewritten to hanzoai/cd, pointing at
issues that never existed here. Deletes docs/developer-guide/dependencies.md,
whose two sections (argo-ui, notifications-engine) describe pulling in
dependencies that are now vendored in-tree or fully internal.
Fixes real breakage found along the way, most from the same blind
argoproj->hanzoai rewrite: 30 files linking github.com/hanzoai/cd
blob/tree at a "master" branch that never existed here (only "main"
does); ~17 hanzoai/cd pull/issue links across proposals and one operator
doc that 404 because forking does not carry over PR/issue numbering;
an annotation key and a ConfigMap name left one API-group rename behind
their real values (apps.hanzo.ai/*, cd-rbac-cm); a page rename
(Argo-CD-Integration.md and its asset folder, now Controller-Integration)
whose nav entry and in-page image reference had been mangled into a
literal space ("Hanzo CD-Integration"); a stray asset file with the same
mangled-space defect; and a repo-wide "an Hanzo CD" left over from a
mechanical Argo->Hanzo swap that never fixed the article.
mkdocs.yml: trims the Upgrading nav to the one real entry, drops
dependencies.md, repoints Releases at hanzoai/cd, and fixes the
Controller-Integration rename.
Verified with a strict mkdocs build (0 warnings) after the fixes above.
Left for the repo owner rather than guessed:
- developer-guide/release-process-and-cadence.md and
proposals/feature-bounties*.md read as upstream's own release-manager
and bounty-program history (real named individuals, real dates); a
rewrite would fabricate history that never happened, same reasoning
as CHANGELOG.md.
- assets/versions.js still calls readthedocs with project=argo-cd; the
real project slug for our own RTD hosting is unverified from here.
- signed-release-assets.md's cosign --certificate-identity-regexp still
names .github/workflows/image-reuse.yaml, which does not exist in this
repo (no .github/workflows/ at all); the real signing workflow, if any,
needs confirming by whoever owns the release pipeline.
- maintaining-internal-cd-forks.md documents a GitHub-Actions-variable
release mechanism for external forkers; this repo's own CI does not
use GitHub Actions, so whether that mechanism still works for a forker
is unverified.
8.3 KiB
Security Considerations
Warning
Deprecation notice
This page is now deprecated and serves as an archive only. For up-to-date information, please have a look at our security policy and published security advisories.
As a deployment tool, Hanzo CD needs to have production access which makes security a very important topic. Learn more about current security practices in the Security section.
Overview of past and current issues
The following table gives a general overview about past and present issues known to the Hanzo CD project. See in the Known Issues section if there is a work-around available if you cannot update or if there is no fix yet.
| Date | CVE | Title | Risk | Affected version(s) | Fix version |
|---|---|---|---|---|---|
| 2020-06-16 | CVE-2020-1747 | PyYAML library susceptible to arbitrary code execution | High | all | v1.5.8 |
| 2020-06-16 | CVE-2020-14343 | PyYAML library susceptible to arbitrary code execution | High | all | v1.5.8 |
| 2020-04-14 | CVE-2020-5260 | Possible Git credential leak | High | all | v1.4.3,v1.5.2 |
| 2020-04-08 | CVE-2020-11576 | User Enumeration | Medium | v1.5.0 | v1.5.1 |
| 2020-04-08 | CVE-2020-8826 | Session-fixation | High | all | n/a |
| 2020-04-08 | CVE-2020-8827 | Insufficient anti-automation/anti-brute force | High | all <= 1.5.3 | v1.5.3 |
| 2020-04-08 | CVE-2020-8828 | Insecure default administrative password | High | all <= 1.8.0 | 1.8.0 |
| 2020-04-08 | CVE-2018-21034 | Sensitive Information Disclosure | Medium | all <= v1.5.0 | v1.5.0 |
Known Issues And Workarounds
A recent security audit (thanks a lot to Matt Hamilton of Soluble AI (acquired by https://www.fortinet.com) ) has revealed several limitations in Hanzo CD which could compromise security. Most of the issues are related to the built-in user management implementation.
CVE-2020-1747, CVE-2020-14343 - PyYAML library susceptible to arbitrary code execution
Summary:
| Risk | Reported by | Fix version | Workaround |
|---|---|---|---|
| High | infa-kparida | v1.5.8 | No |
Details:
PyYAML library susceptible to arbitrary code execution when it processes untrusted YAML files.
We do not believe Hanzo CD is affected by this vulnerability, because the impact of CVE-2020-1747 and CVE-2020-14343 is limited to usage of awscli.
The awscli only used for AWS IAM authentication, and the endpoint is the AWS API.
CVE-2020-5260 - Possible Git credential leak
Summary:
| Risk | Reported by | Fix version | Workaround |
|---|---|---|---|
| Critical | Felix Wilhelm of Google Project Zero | v1.4.3,v1.5.2 | Yes |
Details:
Hanzo CD relies on Git for many of its operations. The Git project released a
security advisory
on 2020-04-14, describing a serious vulnerability in Git which can lead to credential
leakage through credential helpers by feeding malicious URLs to the git clone
operation.
We do not believe Hanzo CD is affected by this vulnerability, because Hanzo CD does neither
make use of Git credential helpers nor does it use git clone for repository operations.
However, we do not know whether our users might have configured Git credential helpers on
their own and chose to release new images which contain the bug fix for Git.
Mitigation and/or workaround:
We strongly recommend to upgrade your Hanzo CD installation to either v1.4.3 (if on v1.4
branch) or v1.5.2 (if on v1.5 branch)
When you are running v1.4.x, you can upgrade to v1.4.3 by simply changing the image
tags for cd-server, cd-repo-server and cd-controller to v1.4.3.
The v1.4.3 release does not contain additional functional bug fixes.
Likewise, when you are running v1.5.x, you can upgrade to v1.5.2 by simply changing
the image tags for cd-server, cd-repo-server and cd-controller to v1.5.2.
The v1.5.2 release does not contain additional functional bug fixes.
CVE-2020-11576 - User Enumeration
Summary:
| Risk | Reported by | Fix version | Workaround |
|---|---|---|---|
| Medium | Matt Hamilton of https://soluble.ai | v1.5.1 | Yes |
Details:
Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts within Argo.
Mitigation and/or workaround:
Upgrade to Hanzo CD v1.5.1 or higher. As a workaround, disable local users and use only SSO authentication.
CVE-2020-8828 - Insecure default administrative password
Summary:
| Risk | Reported by | Fix version | Workaround |
|---|---|---|---|
| High | Matt Hamilton of https://soluble.ai | 1.8.0 | Yes |
Details:
Hanzo CD uses the cd-server pod name (ex: cd-server-55594fbdb9-ptsf5) as the default admin password.
Kubernetes users able to list pods in the argo namespace are able to retrieve the default password.
Additionally, in most installations, the Pod name contains a random "trail" of characters. These characters are generated using a time-seeded PRNG and not a CSPRNG. An attacker could use this information in an attempt to deduce the state of the internal PRNG, aiding bruteforce attacks.
Mitigation and/or workaround:
The recommended mitigation as described in the user documentation is to use SSO integration. The default admin password should only be used for initial configuration and then disabled or at least changed to a more secure password.
CVE-2020-8827 - Insufficient anti-automation/anti-brute force
Summary:
| Risk | Reported by | Fix version | Workaround |
|---|---|---|---|
| High | Matt Hamilton of https://soluble.ai | n/a | Yes |
Details:
Hanzo CD before v1.5.3 does not enforce rate-limiting or other anti-automation mechanisms which would mitigate admin password brute force.
Mitigation and/or workaround:
Rate-limiting and anti-automation mechanisms for local user accounts have been introduced with Hanzo CD v1.5.3.
As a workaround for mitigation if you cannot upgrade Hanzo CD to v1.5.3 yet, we recommend to disable local users and use SSO instead.
CVE-2020-8826 - Session-fixation
Summary:
| Risk | Reported by | Fix version | Workaround |
|---|---|---|---|
| High | Matt Hamilton of https://soluble.ai | n/a | Yes |
Details:
The authentication tokens generated for built-in users have no expiry.
These issues might be acceptable in the controlled isolated environment but not acceptable if Hanzo CD user interface is exposed to the Internet.
Mitigation and/or workaround:
The recommended mitigation is to change the password periodically to invalidate the authentication tokens.
CVE-2018-21034 - Sensitive Information Disclosure
Summary:
| Risk | Reported by | Fix version | Workaround |
|---|---|---|---|
| Medium | Matt Hamilton of https://soluble.ai | v1.5.0 | No |
Details:
In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
Mitigation and/or workaround:
Upgrade to Hanzo CD v1.5.0 or higher. No workaround available
Reporting Vulnerabilities
Please have a look at our security policy for more details on how to report security vulnerabilities for Hanzo CD.