x/vulndb: potential Go vuln in github.com/argoproj/argo: GHSA-h8jc-jmrf-9h8f

[GoVulnBot]

In GitHub Security Advisory GHSA-h8jc-jmrf-9h8f, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/argoproj/argo		<= 1.5.0

Cross references:

• CVE-2020-8828 appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo: GHSA-h8jc-jmrf-9h8f #843 NOT_IMPORTABLE
• GHSA-h8jc-jmrf-9h8f appears in issue x/vulndb: potential Go vuln in github.com/argoproj/argo: GHSA-h8jc-jmrf-9h8f #843 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: TODO
    versions:
      - {}
    packages:
      - package: github.com/argoproj/argo
description: As of v1.5.0, the default admin password is set to the argocd-server
    pod name. For insiders with access to the cluster or logs, this issue could be
    abused for privilege escalation, as Argo has privileged roles. A malicious insider
    is the most realistic threat, but pod names are not meant to be kept secret and
    could wind up just about anywhere.
cves:
  - CVE-2020-8828
ghsas:
  - GHSA-h8jc-jmrf-9h8f

[tatianab]

Duplicate of #843