oss-sec mailing list archives
[CVE] CVE-2018-11757 Docker Skeleton Runtime for Apache OpenWhisk
From: Rodric Rabbah <rabbah () apache org>
Date: Fri, 20 Jul 2018 18:07:08 +0000
Who is Affected: Apache OpenWhisk users with an explicitly created Docker action, and the Docker image used for the action inherits from the affected Docker tag: - openwhisk/dockerskeleton < 1.3.1 The Docker Skeleton Runtime does not currently have any Apache releases. Description: A Docker action running as a serverless function (e.g., wsk action create <name> —docker <image>), where the Dockerfile used to create the Docker image inherits one of the affected tags, may allow a carefully crafted parameter to overwrite the serverless function running inside the container. This requires the user included function to be vulnerable in some way, for example via parameter hijacking, remote code execution, or unsafe use of "eval()". Subsequent executions of the original function in the same container will use the replaced implementation if the function was successfully exploited. Mitigation: Users that create their own Docker runtimes to run as Apache OpenWhisk Docker actions, and who pin their Docker runtime image (e.g., Dockerfile starts with "FROM openwhisk/dockerskeleton:1.0.0") should upgrade their Docker tag to the latest available tag. Users who build from source, should use the latest commit Git tag [1]. Operators of an Apache OpenWhisk deployment should check their runtime manifest to determine if they are affected, and if so, upgrade the tags in their runtimes manifest to automatically patch all actions runtimes when updating their deployment. Credit: This issue was researched and reported by Yuri Shapira and Ory Segal of PureSec. [1] https://github.com/apache/incubator-openwhisk-runtime-docker/commit/891896f25c39bc336ef6dda53f80f466ac4ca3c8
Current thread:
- [CVE] CVE-2018-11757 Docker Skeleton Runtime for Apache OpenWhisk Rodric Rabbah (Jul 20)