CVE-2021-25740

Advisory

Argo-workflows 6.3.10 and 6.4.4 (Python SDK) are compatible with Argo-workflows core v3.3.10 and v3.4.4, that update 'kubectl' to v1.24.8 to fix vulnerabilities.
https://github.com/argoproj/argo-workflows/commit/fd31eb811160c62f16b5aef002bf232235e0d2c6
https://github.com/argoproj/argo-workflows/issues/10006

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* [b19870d73](https://github.com/argoproj/argo-workflows/commit/b19870d737a14b21d86f6267642a63dd14e5acd5) fix(operator): Workflow stuck at running when init container failed. Fixes #10045 (10047)
* [fd31eb811](https://github.com/argoproj/argo-workflows/commit/fd31eb811160c62f16b5aef002bf232235e0d2c6) fix: Upgrade kubectl to v1.24.8 to fix vulnerabilities (#10008)
* [859bcb124](https://github.com/argoproj/argo-workflows/commit/859bcb1243728482d796a983776d84bd53b170ca) fix: assume plugins may produce outputs.result and outputs.exitCode (Fixes #9966) (9967)
* [33bba51a6](https://github.com/argoproj/argo-workflows/commit/33bba51a61fc2dfcf81efb09629dcbeb8dddb3a1) fix: cleaned key paths in gcs driver. Fixes #9958 (9959)

Contributors

* Isitha Subasinghe
* Michael Crenshaw
* Yuan Tang

Resources

• https://pypi.org/project/argo-workflows
• https://pyup.io/changelogs/argo-workflows/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-25740