Описание
A flaw was found in konflux-operator-tasks. GitHub Actions within this component are configured to use mutable tags or branches instead of specific, immutable commit SHAs. This vulnerability could allow a remote attacker to introduce malicious code into the build process if they compromise the referenced mutable tag or branch. Such a compromise could lead to unauthorized code execution or integrity issues within the affected system.
Отчет
Moderate impact. The Konflux operator tasks utilize GitHub Actions referenced by mutable tags or branches, which introduces a supply chain risk. This allows for potential integrity compromise if the referenced upstream content changes unexpectedly, leading to unauthorized code execution within Konflux CI/CD pipelines.
Меры по смягчению последствий
To mitigate this issue, Konflux users should ensure that all GitHub Actions referenced within konflux-operator-tasks are pinned to their full 40-character commit SHAs. This practice prevents unauthorized code execution by ensuring the exact version of the action is used. Additionally, consider enabling automated tools such as Renovate with helpers:pinGitHubActionDigests to maintain these commit SHA pins. Changes to CI/CD configurations will take effect upon the next pipeline run.
Дополнительная информация
Статус:
4.2 Medium
CVSS3
4.2 Medium
CVSS3