The vulnerability identified as CVE-2024-29180 affects the webpack-dev-middleware component used in Argo CD within Red Hat OpenShift GitOps versions 1.10 and 1.11. The issue stems from insufficient URL validation, which may allow an attacker to cause a file leak. Red Hat has issued security advisories RHSA-2024:2817 and RHSA-2024:2815 providing updated versions 1.10.5 and 1.11.4 respectively, which include fixes for this vulnerability. The advisories also include several bug fixes unrelated to the security issue. The vulnerability is classified under CWE-22 (Path Traversal). No known exploits in the wild have been reported. The updates apply to multiple hardware architectures supported by Red Hat OpenShift GitOps.

The vulnerability could allow unauthorized file disclosure due to lack of proper URL validation in the webpack-dev-middleware component of Argo CD. This may lead to sensitive information leakage from the affected system. The security impact is rated as Important by Red Hat. There are no reports of active exploitation in the wild at this time.

Red Hat has released official security updates for Red Hat OpenShift GitOps versions 1.10.5 and 1.11.4 that address CVE-2024-29180. Users should apply these updates promptly. Before applying these updates, ensure all previously released errata relevant to your system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated by the vendor advisory.