Bug 1951025 - codecov: Unauthorized access to Bash Uploader script
Summary: codecov: Unauthorized access to Bash Uploader script
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1951389 1951390 1951394 1951993 1951994
Blocks: 1951026
TreeView+ depends on / blocked
 
Reported: 2021-04-19 12:38 UTC by Pedro Sampaio
Modified: 2023-07-07 08:31 UTC (History)
15 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Pedro Sampaio 2021-04-19 12:38:26 UTC
Flaw was found in codecov. An error in Codecov’s Docker image creation process that allowed the actor to extract the credential required to modify the Bash Uploader script.

References:

https://about.codecov.io/security-update/

Comment 18 Jason Shepherd 2021-04-28 04:17:56 UTC
Statement:

Codecov is not usually a component shipped by products, but is sometimes used during product builds. The flaw is the outcome of an investigation into how the use of Covscan in our builds might have affects Red Hat products or services.

Red Hat's internal build system (Koji) does not have egress to the internet so the malicious script could not have been used on those systems to ex-filtrate secret environment information directly. We are still investigating if upstream builds might have been impacted.

OpenShift Container Platform's cri-o component is not affected because the GitHub actions job which executes codecov does not add any secrets: https://github.com/cri-o/cri-o/blob/8ab831e686740a25509514010fba4bb2abca0f28/.github/workflows/test.yml#L273-L282

OpenShift Container Platform's coredns component does not use codecov at all.

OpenShift Container Platform's etcd component is not affected because it doesn't ship any binary upstream or downstream built with this testing Dockerfile which has a reference to the codecov bash uploader script.

OpenShift Container Platform's ose-cluster-ingress-operator component is not affected because it does not use codecov during a Red Hat downstream build.


Note You need to log in before you can comment on or make changes to this bug.