Date: Fri, 20 Jul 2018 18:05:03 +0000 From: Rodric Rabbah <rabbah@...che.org> To: Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com, announce@...che.org, dev@...nwhisk.apache.org Cc: Ory Segal <ory@...esec.io> Subject: [CVE] CVE-2018-11756 PHP Runtime for Apache OpenWhisk Who is Affected: Apache OpenWhisk users with an explicitly created Docker action, and the Docker image used for the action inherits from the affected Docker tags: - openwhisk/action-php-v7.2 < 1.0.1 - openwhisk/action-php-v7.1 < 1.0.2 The PHP Runtime does not currently have any Apache releases. Description: A Docker action running as a serverless function (e.g., wsk action create <name> —docker <image>), where the Dockerfile used to create the Docker image inherits one of the affected tags, may allow a carefully crafted parameter to overwrite the serverless function running inside the container. This requires the user included function to be vulnerable in some way, for example via parameter hijacking, remote code execution, or unsafe use of “eval()”. Subsequent executions of the original function in the same container will use the replaced implementation if the function was successfully exploited. Mitigation: Users that create their own Docker runtimes to run as Apache OpenWhisk Docker actions, and who pin their Docker runtime image (e.g., Dockerfile starts with “FROM openwhisk/action-php-v7.2:1.0.0”) should upgrade their Docker tag to the latest available tag. Users who build from source, should use the latest commit Git tag . Operators of an Apache OpenWhisk deployment should check their runtime manifest to determine if they are affected, and if so, upgrade the tags in their runtimes manifest to automatically patch all actions runtimes when updating their deployment. Credit: This issue was discovered while investigating a related issue researched and reported by Yuri Shapira and Ory Segal of PureSec.  https://github.com/apache/incubator-openwhisk-runtime-php/commit/6caf902f527250ee4b7b695929b628d560e0dad1
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ