Описание
A flaw was found in operator-sdk-builder. Due to an oversight in the Containerfile configuration, the final built container image runs with root privileges by default. This increases the attack surface of the container, as any process executed within it will have elevated permissions. If a malicious actor compromises the container, they could leverage these root privileges to perform unauthorized actions, potentially leading to a broader system compromise.
Отчет
Moderate: The operator-sdk-builder component in Konflux generates container images that execute as the root user by default. This elevates the potential impact of a container compromise, as processes within the container will operate with full system privileges, even though exploitation requires the image to be built and run by a user.
Меры по смягчению последствий
To mitigate, modify the Containerfile used by operator-sdk-builder to explicitly set a non-root user after the dnf install layer. Insert USER 1001 or USER default into the Containerfile before the ENTRYPOINT instruction. This ensures the resulting image runs with reduced privileges. If specific tasks genuinely require root, configure the consuming Tekton Task securityContext instead of baking root into the image. Rebuilding and redeploying affected images are necessary for these changes to take effect.
Дополнительная информация
Статус:
4.2 Medium
CVSS3
4.2 Medium
CVSS3