Bug 1829674 (CVE-2020-10728)
| Summary: | CVE-2020-10728 automationbroker/apb: permissive sudoers file | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mark Cooper <mcooper> |
| Component: | vulnerability | Assignee: | Nobody <nobody> |
| Status: | ASSIGNED --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | bmontgom, eparis, jburrell, nstielau, sponnaga |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in automationbroker/apb container in versions up to and including 2.0.4-1. This container grants all users sudoer permissions allowing an unauthorized user with access to the running container the ability to escalate their own privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1829688, 1829689, 1829690 | ||
| Bug Blocks: | 1807720 | ||
|
Description
Mark Cooper
2020-04-30 03:59:50 UTC
The apb dockerfile runs sudo for adding users and groups to the image. https://github.com/automationbroker/apb/blob/master/apb-wrapper#L30-L39 We'll need to fix the above script so we don't have to do that. Then remove the sudoers line from the Dockerfile https://github.com/automationbroker/apb/blob/master/Dockerfile#L10 The affected repo is: https://github.com/automationbroker/apb/ 3.11 uses apb-1.9.8: https://github.com/automationbroker/apb/tree/release-1.9 4.x uses apb-2.0.x: https://github.com/automationbroker/apb Acknowledgments: Name: Mark Cooper (Red Hat) Statement: By default this vulnerability is not exploitable in un-privileged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy. In OpenShift 4.4 the container openshift-enterprise-abp-tools has been removed and hence is not affected by this flaw. |