Описание
A flaw was found in olm-operator-konflux-sample. The bundle builder stage installs and upgrades Python packages using pip, a package installer, without verifying their versions or using hash verification. This allows a malicious or compromised package to be introduced into the build process undetected, potentially leading to a supply chain compromise where untrusted code is incorporated into software builds.
Отчет
This vulnerability has a Low impact on Konflux environments. The olm-operator-konflux-sample bundle builder stage is susceptible to pulling in malicious pip packages due to unpinned dependencies and lack of hash verification. Exploitation requires an attacker to compromise a package release or the build process itself, making it difficult to achieve.
Меры по смягчению последствий
To mitigate this issue, ensure that the bundle builder stage for olm-operator-konflux-sample uses pinned versions and hash verification for pip dependencies. This can be achieved by dropping the --upgrade pip command, vendoring a hash-pinned requirements.txt file, and installing dependencies using pip3 install --no-deps --require-hashes -r requirements.txt. Alternatively, prefetch pip inputs via Cachi2 to ensure a hermetic build process. Implementing these changes will require adjustments to the build pipeline configuration.
Дополнительная информация
Статус:
2.6 Low
CVSS3
2.6 Low
CVSS3