Update dependency ops to v2.15.0 [SECURITY] #294
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
requested review from
a team,
paulomach,
taurus-forever,
shayancanonical and
carlcsaposs-canonical
and removed request for
a team
There was a problem hiding this comment.
@carlcsaposs-canonical can you please report this upstream. This PyYAML changes is popular and annoying...
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
2 times, most recently
from
6b792cb
to
582738e
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
2 times, most recently
from
56b16ad
to
ee34adb
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
2 times, most recently
from
188b4e0
to
9bd13eb
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
from
9bd13eb
to
1473451
Compare
|
@carlcsaposs-canonical how critical ops CVE here? |
we are somewhat blocked by canonical/operator#1279 technically we can merge 273 and ignore canonical/operator#1279 without issues—however it could paint us into a corner or cause problems in the future, as described in canonical/operator#1279 |
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
2 times, most recently
from
d90864a
to
c5c4622
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
from
c5c4622
to
5117c50
Compare
github-actions bot
added a commit
to carlcsaposs-canonical/mysql-router-k8s-operator
that referenced
this pull request
Oct 6, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.9.0->2.15.0^2.9.0, <2.10-><2.16GitHub Vulnerability Alerts
CVE-2024-41129
Summary
The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing
subprocess.CalledProcessError.There are two points that may log this command, in different files:
First, if there is an error during a secret handling, there will be a
subprocess.CalledProcessError, which will contain the CLI comand + all its args. This is going to be logged in any logging level. This exception, if not caught by the charm, will bubble up to the/var/log/juju/logs and syslog journal. Now, on Ubuntu 22.04, these logs are protected with:Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening.
Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only).
Passing secrets straight via CLI is not advised. Here are some ways out:
subprocess.CalledProcessError, redacting its content and reissuing the same type of exception; this will not cover the caseauditdis set to log CLI commands, if that is a riskSeverity Rationale
This is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to
admgroup users.Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an
admgroup user (e.g. ubuntu) or recovering logs stored on a 3rd party service.Details
From CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364
PoC
Impact
Juju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment.
Release Notes
canonical/operator (ops)
v2.15.0Compare Source
Features
Fixes
Documentation
CI
v2.14.1Compare Source
Fixes
Tests
Documentation
CI
v2.14.0Compare Source
Features
__str__to ActionFailed, for better unexpected failure output (#1209)Fixes
otherargument toRelatationDataContent.update(...)should be optional (#1226)Documentation
Refactoring
ruffformatter and reformat all code (#1224)v2.13.0Compare Source
Features
Fixes
Documentation
tox -e docs-depsto compile requirements.txt (#1172)Tests
pebble.CheckInfo.change_idfield (#1197)v2.12.0Compare Source
Features
Model.get_cloud_specwhich uses thecredential-gethook tool to get details of the cloud where the model is deployed (#1152)Fixes
get_noticesparameter name tousers=all(previouslyselect=all) (#1146)Model.relation.apptype fromApplication|NonetoApplication(#1151)begin(#1150)pebble.Client.execmight leak asocket.timeout(builtins.TimeoutError) exception (#1155)add_relation(#1138)get_relationbehaviour inleader-elected(#1156)type: secretfor config options (#1167)Refactoring
_Managerclass (#1085)Documentation
ops.testingfrom unittest to pytest style (#1157)Harness.add_relationdocstring (#1168)v2.11.0Compare Source
Features
StopEvent,RemoveEvent, and allLifeCycleEvents are no longer deferrable, and will raise aRuntimeErrorifdefer()is called on the event object (#1122)ActionEvent.id, exposing the JUJU_ACTION_UUID environment variable (#1124)pebble.Planobjects by passing in apebble.PlanDict, theability to compare two
Planobjects with==, and the ability to create an empty Plan withPlan()(#1134)Fixes
Documentation
can_connect()API documentation (#1123)Tooling
v2.10.0Compare Source
Features
PebbleCustomNoticeEvent,get_notices, and so on) (#1086, #1100)Relation.active, and excluded inactive relations fromModel.relations(#1091)ContainerMeta,and various info links in
CharmMeta) (#1106)ModelErrorin Harness if an invalid status is set (#1107)Fixes
Documentation
Tooling
Configuration
📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.