Accepting request 1216680 from devel:microos
Update to version 1.37.5 (forwarded request 1216563 from danishprakash) OBS-URL: https://build.opensuse.org/request/show/1216680 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/buildah?expand=0&rev=94
This commit is contained in:
Ana Guerrero
Git OBS Bridge
commit
b8b6cf1657
@ -1,111 +0,0 @@
|
||||
From 37d71af79a9c2dbebe56073fa6f4bd7271b1419e Mon Sep 17 00:00:00 2001
|
||||
From: Matt Heon <mheon@redhat.com>
|
||||
Date: Wed, 9 Oct 2024 15:23:03 -0400
|
||||
Subject: [PATCH] Properly validate cache IDs and sources
|
||||
|
||||
The `--mount type=cache` argument to the `RUN` instruction in
|
||||
Dockerfiles was using `filepath.Join` on user input, allowing
|
||||
crafted paths to be used to gain access to paths on the host,
|
||||
when the command should normally be limited only to Buildah;s own
|
||||
cache and context directories. Switch to `filepath.SecureJoin` to
|
||||
resolve the issue.
|
||||
|
||||
Fixes CVE-2024-9675
|
||||
|
||||
Signed-off-by: Matt Heon <mheon@redhat.com>
|
||||
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
|
||||
---
|
||||
internal/volumes/volumes.go | 19 ++++++++++++++-----
|
||||
tests/bud.bats | 34 ++++++++++++++++++++++++++++++++++
|
||||
2 files changed, 48 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/internal/volumes/volumes.go b/internal/volumes/volumes.go
|
||||
index da6b768fdc21..610e9fcf11b2 100644
|
||||
--- a/internal/volumes/volumes.go
|
||||
+++ b/internal/volumes/volumes.go
|
||||
@@ -23,6 +23,7 @@ import (
|
||||
"github.com/containers/storage/pkg/idtools"
|
||||
"github.com/containers/storage/pkg/lockfile"
|
||||
"github.com/containers/storage/pkg/unshare"
|
||||
+ digest "github.com/opencontainers/go-digest"
|
||||
specs "github.com/opencontainers/runtime-spec/specs-go"
|
||||
selinux "github.com/opencontainers/selinux/go-selinux"
|
||||
)
|
||||
@@ -374,7 +375,11 @@ func GetCacheMount(args []string, store storage.Store, imageMountLabel string, a
|
||||
return newMount, nil, fmt.Errorf("no stage found with name %s", fromStage)
|
||||
}
|
||||
// path should be /contextDir/specified path
|
||||
- newMount.Source = filepath.Join(mountPoint, filepath.Clean(string(filepath.Separator)+newMount.Source))
|
||||
+ evaluated, err := copier.Eval(mountPoint, string(filepath.Separator)+newMount.Source, copier.EvalOptions{})
|
||||
+ if err != nil {
|
||||
+ return newMount, nil, err
|
||||
+ }
|
||||
+ newMount.Source = evaluated
|
||||
} else {
|
||||
// we need to create cache on host if no image is being used
|
||||
|
||||
@@ -391,11 +396,15 @@ func GetCacheMount(args []string, store storage.Store, imageMountLabel string, a
|
||||
}
|
||||
|
||||
if id != "" {
|
||||
- newMount.Source = filepath.Join(cacheParent, filepath.Clean(id))
|
||||
- buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, filepath.Clean(id))
|
||||
+ // Don't let the user control where we place the directory.
|
||||
+ dirID := digest.FromString(id).Encoded()[:16]
|
||||
+ newMount.Source = filepath.Join(cacheParent, dirID)
|
||||
+ buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, dirID)
|
||||
} else {
|
||||
- newMount.Source = filepath.Join(cacheParent, filepath.Clean(newMount.Destination))
|
||||
- buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, filepath.Clean(newMount.Destination))
|
||||
+ // Don't let the user control where we place the directory.
|
||||
+ dirID := digest.FromString(newMount.Destination).Encoded()[:16]
|
||||
+ newMount.Source = filepath.Join(cacheParent, dirID)
|
||||
+ buildahLockFilesDir = filepath.Join(BuildahCacheLockfileDir, dirID)
|
||||
}
|
||||
idPair := idtools.IDPair{
|
||||
UID: uid,
|
||||
diff --git a/tests/bud.bats b/tests/bud.bats
|
||||
index b1ed89072ce6..79ca91b2b5e6 100644
|
||||
--- a/tests/bud.bats
|
||||
+++ b/tests/bud.bats
|
||||
@@ -6917,3 +6917,37 @@ _EOF
|
||||
run_buildah 125 build $WITH_POLICY_JSON ${TEST_SCRATCH_DIR}
|
||||
expect_output --substring "invalid mount option"
|
||||
}
|
||||
+
|
||||
+@test "build-check-cve-2024-9675" {
|
||||
+ _prefetch alpine
|
||||
+
|
||||
+ touch ${TEST_SCRATCH_DIR}/file.txt
|
||||
+
|
||||
+ cat > ${TEST_SCRATCH_DIR}/Containerfile <<EOF
|
||||
+FROM alpine
|
||||
+RUN --mount=type=cache,id=../../../../../../../../../../../$TEST_SCRATCH_DIR,target=/var/tmp \
|
||||
+ls -l /var/tmp && cat /var/tmp/file.txt
|
||||
+EOF
|
||||
+
|
||||
+ run_buildah 1 build --no-cache ${TEST_SCRATCH_DIR}
|
||||
+ expect_output --substring "cat: can't open '/var/tmp/file.txt': No such file or directory"
|
||||
+
|
||||
+ cat > ${TEST_SCRATCH_DIR}/Containerfile <<EOF
|
||||
+FROM alpine
|
||||
+RUN --mount=type=cache,source=../../../../../../../../../../../$TEST_SCRATCH_DIR,target=/var/tmp \
|
||||
+ls -l /var/tmp && cat /var/tmp/file.txt
|
||||
+EOF
|
||||
+
|
||||
+ run_buildah 1 build --no-cache ${TEST_SCRATCH_DIR}
|
||||
+ expect_output --substring "cat: can't open '/var/tmp/file.txt': No such file or directory"
|
||||
+
|
||||
+ mkdir ${TEST_SCRATCH_DIR}/cve20249675
|
||||
+ cat > ${TEST_SCRATCH_DIR}/cve20249675/Containerfile <<EOF
|
||||
+FROM alpine
|
||||
+RUN --mount=type=cache,from=testbuild,source=../,target=/var/tmp \
|
||||
+ls -l /var/tmp && cat /var/tmp/file.txt
|
||||
+EOF
|
||||
+
|
||||
+ run_buildah 1 build --security-opt label=disable --build-context testbuild=${TEST_SCRATCH_DIR}/cve20249675/ --no-cache ${TEST_SCRATCH_DIR}/cve20249675/
|
||||
+ expect_output --substring "cat: can't open '/var/tmp/file.txt': No such file or directory"
|
||||
+}
|
||||
--
|
||||
2.46.0
|
||||
|
||||
2
_service
2
_service
@ -5,7 +5,7 @@
|
||||
<param name="filename">buildah</param>
|
||||
<param name="versionformat">@PARENT_TAG@</param>
|
||||
<param name="versionrewrite-pattern">v(.*)</param>
|
||||
<param name="revision">v1.37.4</param>
|
||||
<param name="revision">v1.37.5</param>
|
||||
<param name="changesgenerate">enable</param>
|
||||
</service>
|
||||
<service name="recompress" mode="manual">
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
<servicedata>
|
||||
<service name="tar_scm">
|
||||
<param name="url">https://github.com/containers/buildah.git</param>
|
||||
<param name="changesrevision">df9247c59b2d44cb7b698fab124f2efe6a17032d</param></service></servicedata>
|
||||
<param name="changesrevision">5fd40b989860984a00f6fc1539ff53caceca1325</param></service></servicedata>
|
||||
@ -1,3 +0,0 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:5189a2b518d7249f9f322b9506278c2245e184d50dddb4ae7dac589d4e8ce090
|
||||
size 11768780
|
||||
3
buildah-1.37.5.tar.xz
Normal file
3
buildah-1.37.5.tar.xz
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:5fbb41b906a26deb5db84eb7850fa61436d77b427d805471f19908e8d048a684
|
||||
size 11777240
|
||||
@ -1,3 +1,14 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Oct 21 06:45:12 UTC 2024 - danish.prakash@suse.com
|
||||
|
||||
- Update to version 1.37.5:
|
||||
* [release-1.37] Bump Buildah to v1.37.5
|
||||
* Bump the containers/storage library to v1.55.1 (CVE-2024-9676, bsc#1231698)
|
||||
* Properly validate cache IDs and sources
|
||||
* Packit: constrain koji job to fedora package to avoid dupes
|
||||
- Removed patch:
|
||||
* 0001-Properly-validate-cache-IDs-and-sources.patch (merged upstream)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 15 06:48:18 UTC 2024 - Danish Prakash <danish.prakash@suse.com>
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@
|
||||
|
||||
%define project github.com/containers/buildah
|
||||
Name: buildah
|
||||
Version: 1.37.4
|
||||
Version: 1.37.5
|
||||
Release: 0
|
||||
Summary: Tool for building OCI containers
|
||||
License: Apache-2.0
|
||||
@ -27,7 +27,6 @@ Group: System/Management
|
||||
URL: https://%{project}
|
||||
Source0: %{name}-%{version}.tar.xz
|
||||
Source1: %{name}-rpmlintrc
|
||||
Patch0: 0001-Properly-validate-cache-IDs-and-sources.patch
|
||||
BuildRequires: bash-completion
|
||||
BuildRequires: device-mapper-devel
|
||||
BuildRequires: fdupes
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user