Описание
A flaw was found in konflux-operator-tasks. The Continuous Integration (CI) process installs the tkn command-line interface (CLI) from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to substitute a malicious binary, potentially leading to the execution of unauthorized code within the CI environment.
Отчет
This flaw has a Low impact as it requires a compromised distribution channel to substitute a malicious binary during the installation of the tkn CLI. In Red Hat Konflux CI environments, the tkn CLI is installed from a network download without checksum or signature verification, increasing the risk of supply chain attacks if the distribution channel is compromised.
Меры по смягчению последствий
To mitigate this issue, ensure that the tkn CLI is installed with proper checksum and signature verification within your CI pipelines. This can be achieved by downloading the published checksums.txt for the tkn CLI release and verifying it with sha256sum -c. Additionally, verify the sigstore signature using cosign verify-blob. Alternatively, configure your CI setup to use a SHA-pinned action for tkn CLI installations. This requires modifying existing CI pipeline configurations.
Дополнительная информация
Статус:
2.6 Low
CVSS3
2.6 Low
CVSS3