[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 20 Jul 2018 18:05:03 +0000
From: Rodric Rabbah <rabbah@...che.org>
To: Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com,
announce@...che.org, dev@...nwhisk.apache.org
Cc: Ory Segal <ory@...esec.io>
Subject: [CVE] CVE-2018-11756 PHP Runtime for Apache OpenWhisk
Who is Affected: Apache OpenWhisk users with an explicitly created Docker
action, and the Docker image used for the action inherits from the affected
Docker tags:
- openwhisk/action-php-v7.2 < 1.0.1
- openwhisk/action-php-v7.1 < 1.0.2
The PHP Runtime does not currently have any Apache releases.
Description: A Docker action running as a serverless function (e.g., wsk
action create <name> —docker <image>), where the Dockerfile used to create
the Docker image inherits one of the affected tags, may allow a carefully
crafted parameter to overwrite the serverless function running inside the
container. This requires the user included function to be vulnerable in
some way, for example via parameter hijacking, remote code execution, or
unsafe use of “eval()”. Subsequent executions of the original function in
the same container will use the replaced implementation if the function was
successfully exploited.
Mitigation: Users that create their own Docker runtimes to run as Apache
OpenWhisk Docker actions, and who pin their Docker runtime image (e.g.,
Dockerfile starts with “FROM openwhisk/action-php-v7.2:1.0.0”) should
upgrade their Docker tag to the latest available tag. Users who build from
source, should use the latest commit Git tag [1]. Operators of an Apache
OpenWhisk deployment should check their runtime manifest to determine if
they are affected, and if so, upgrade the tags in their runtimes manifest
to automatically patch all actions runtimes when updating their deployment.
Credit: This issue was discovered while investigating a related issue
researched and reported by Yuri Shapira and Ory Segal of PureSec.
[1]
https://github.com/apache/incubator-openwhisk-runtime-php/commit/6caf902f527250ee4b7b695929b628d560e0dad1
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
