{"id":"CVE-2024-13484","aliases":["EUVD-2025-0134","GHSA-58fx-7v9q-3g56","GO-2025-3427","SUSE-SU-2025:0429-1","openSUSE-SU-2025:14728-1"],"status":"published","title":"Openshift-gitops-operator-container: namespace isolation break","description":"A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00225,"percentile":0.13204,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668"],"published":"2025-01-28T17:54:28Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Go","package":"github.com/redhat-developer/gitops-operator","fixed_in":["1.16.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/redhat-developer/gitops-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/redhat-developer/gitops-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/redhat-developer/gitops-operator","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250207T224745-150000.1.32.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250130T185858-1.1"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat openshift gitops 1.14"},{"vendor":"red hat","product":"red hat openshift gitops 1.15"},{"vendor":"red hat","product":"red hat openshift gitops 1.16"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:7753","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8274","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9506","tags":["vendor-advisory","x_refsource_REDHAT","advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-13484","tags":["vdb-entry","x_refsource_REDHAT","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269376","tags":["issue-tracking","x_refsource_REDHAT","report","web"]},{"url":"https://github.com/redhat-developer/gitops-operator/pull/853","tags":["fix","web"]},{"url":"https://github.com/redhat-developer/gitops-operator/pull/867","tags":["fix","web"]},{"url":"https://github.com/redhat-developer/gitops-operator/pull/868","tags":["fix","web"]},{"url":"https://github.com/redhat-developer/gitops-operator/pull/869","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13484","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3427","tags":["web"]},{"url":"https://github.com/redhat-developer/gitops-operator/pull/897","tags":["web"]},{"url":"https://github.com/redhat-developer/gitops-operator/commit/bc6ac3e03d7c8b3db5d8f1770c868396a4c2dcef","tags":["web"]},{"url":"https://issues.redhat.com/browse/GITOPS-7037","tags":["web"]},{"url":"https://github.com/advisories/GHSA-58fx-7v9q-3g56","tags":["advisory"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13484.json","tags":["advisory"]},{"url":"https://github.com/redhat-developer/gitops-operator","tags":["package"]},{"url":"https://github.com/argoproj/argo-cd","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250429-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-47930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-10846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-13484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-3727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24884","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13484","title":"Openshift-gitops-operator-container: namespace isolation break","description":"A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.","status":"published","published":"2025-01-28T17:54:28.701Z","modified":"2026-06-26T04:27:26.108Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2025-0134","description":"A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.","status":"published","published":"2025-01-28T17:54:28Z","modified":"2026-06-26T04:27:26Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:24.957062Z"}],"ghsa":[{"id":"GHSA-58fx-7v9q-3g56","title":"OpenShift GitOps Operator Namespace Isolation Break","description":"A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.","status":"published","published":"2025-01-28T18:31:28Z","modified":"2026-07-21T15:01:45Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:40:49.410128Z"}],"nvd":[{"id":"CVE-2024-13484","description":"A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.","status":"published","published":"2025-01-28T18:15:32.537Z","modified":"2026-06-26T05:16:25.783Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:10:43.581383Z"}],"osv":[{"id":"CVE-2024-13484","title":"Openshift-gitops-operator-container: namespace isolation break","description":"A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.","status":"published","published":"2025-01-28T17:54:28.701Z","modified":"2026-10-28T02:31:05.600201727Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"GHSA-58fx-7v9q-3g56","title":"OpenShift GitOps Operator Namespace Isolation Break","description":"A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.","status":"published","published":"2025-01-28T18:31:28Z","modified":"2026-07-21T15:15:51.495458485Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GO-2025-3427","title":"Malicious PrometheusRule creation to all namespaces that deploy a ArgoCD CR instance in github.com/redhat-developer/gitops-operator","description":"Malicious PrometheusRule creation to all namespaces that deploy a ArgoCD CR instance in github.com/redhat-developer/gitops-operator","status":"published","published":"2025-01-29T00:01:32Z","modified":"2026-03-03T04:57:09.995383Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:14728-1","title":"govulncheck-vulndb-0.0.20250130T185858-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250130T185858-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-04T00:00:00Z","modified":"2026-02-04T03:12:18.270116Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:0429-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76\n  * GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c\n  * GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx\n\n- Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74\n  * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n\n- Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3428 CVE-2025-22867\n  * GO-2025-3447 CVE-2025-22866\n\n- Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3408\n  * GO-2025-3448 GHSA-23qp-3c2m-xx6w\n  * GO-2025-3449 GHSA-mx2j-7cmv-353c\n  * GO-2025-3450 GHSA-w7wm-2425-7p2h\n  * GO-2025-3454 GHSA-mj4v-hp69-27x5\n  * GO-2025-3455 GHSA-vqv5-385r-2hf8\n\n- Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3451\n\n- Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2\n  * GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v\n  * GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg\n  * GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c\n  * GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2\n  * GO-2025-3437 GHSA-274v-mgcv-cm8j\n  * GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58\n  * GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4\n  * GO-2025-3443 GHSA-r3r4-g7hq-pq4f\n  * GO-2025-3444 CVE-2024-35177\n  * GO-2025-3445 CVE-2024-47770\n\n- Use standard RPM macros to unpack the source and populate a\n  working directory. Fixes build with RPM 4.20.\n\n- Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425\n  * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n  * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n  * GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3408\n  * GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n  * GO-2025-3424 CVE-2025-24369\n  * GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g\n  * GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56\n","status":"published","published":"2025-02-11T14:12:30Z","modified":"2026-02-05T00:10:56.097493Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}