Описание
A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags (e.g., @v0, @v4) instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration (CI) pipeline through an upstream compromise or by re-pointing a tag, leading to unauthorized code execution or manipulation.
Отчет
Moderate impact. The operator-foundry component within Konflux utilizes GitHub Actions and reusable workflows that reference mutable tags. This practice introduces a supply chain risk, as an upstream compromise or tag re-point could silently alter the code executed in the CI pipeline, potentially leading to unauthorized code execution or data manipulation during the build process.
Меры по смягчению последствий
To mitigate this issue, Konflux users should ensure that all uses: references within their GitHub Actions workflows for operator-foundry are explicitly pinned to a full 40-character commit SHA. This prevents silent code changes through mutable tags. For example, instead of @v4, use actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1. This is a configuration change within the GitHub Actions workflow files and does not require service restarts.
Дополнительная информация
Статус:
4.2 Medium
CVSS3
4.2 Medium
CVSS3