[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAAC1_d7x6buq1aREekk_Eh9SjevQLPLkXc+aidiFBMcNz7GGwQ@mail.gmail.com>
Date: Fri, 20 Jul 2018 18:07:08 +0000
From: Rodric Rabbah <rabbah@...che.org>
To: Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com,
announce@...che.org, dev@...nwhisk.apache.org
Cc: Ory Segal <ory@...esec.io>
Subject: [CVE] CVE-2018-11757 Docker Skeleton Runtime for Apache OpenWhisk
Who is Affected: Apache OpenWhisk users with an explicitly created Docker
action, and the Docker image used for the action inherits from the affected
Docker tag:
- openwhisk/dockerskeleton < 1.3.1
The Docker Skeleton Runtime does not currently have any Apache releases.
Description: A Docker action running as a serverless function (e.g., wsk
action create <name> —docker <image>), where the Dockerfile used to create
the Docker image inherits one of the affected tags, may allow a carefully
crafted parameter to overwrite the serverless function running inside the
container. This requires the user included function to be vulnerable in
some way, for example via parameter hijacking, remote code execution, or
unsafe use of "eval()". Subsequent executions of the original function in
the same container will use the replaced implementation if the function was
successfully exploited.
Mitigation: Users that create their own Docker runtimes to run as Apache
OpenWhisk Docker actions, and who pin their Docker runtime image (e.g.,
Dockerfile starts with "FROM openwhisk/dockerskeleton:1.0.0") should
upgrade their Docker tag to the latest available tag. Users who build from
source, should use the latest commit Git tag [1]. Operators of an Apache
OpenWhisk deployment should check their runtime manifest to determine if
they are affected, and if so, upgrade the tags in their runtimes manifest
to automatically patch all actions runtimes when updating their deployment.
Credit: This issue was researched and reported by Yuri Shapira and Ory
Segal of PureSec.
[1]
https://github.com/apache/incubator-openwhisk-runtime-docker/commit/891896f25c39bc336ef6dda53f80f466ac4ca3c8
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
