Impact
Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization.
Garden stores serialized objects using cryo in the Kubernetes ConfigMap resources prefixed with test-result and run-result to cache Garden test and run results. These ConfigMaps are stored either in the garden-system namespace or the configured user namespace.
When a user invokes the command garden test or garden run objects stored in the ConfigMap are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the ConfigMap, which can trigger a remote code execution on the users machine when cryo deserializes the object.
In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a garden test or garden run which has previously cached results.
Patches
The issue has been patched in Garden versions 0.13.17 (Bonsai) and 0.12.65 (Acorn). Only Garden versions prior to these are vulnerable.
Workarounds
No other workarounds available.
References
See also CVE-2018-3784
For more information
If you have any questions or comments about this advisory:
stefreak Finder
Impact
Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization.
Garden stores serialized objects using cryo in the Kubernetes
ConfigMapresources prefixed withtest-resultandrun-resultto cache Garden test and run results. TheseConfigMapsare stored either in thegarden-systemnamespace or the configured user namespace.When a user invokes the command
garden testorgarden runobjects stored in theConfigMapare retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in theConfigMap, which can trigger a remote code execution on the users machine when cryo deserializes the object.In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a
garden testorgarden runwhich has previously cached results.Patches
The issue has been patched in Garden versions
0.13.17(Bonsai) and0.12.65(Acorn). Only Garden versions prior to these are vulnerable.Workarounds
No other workarounds available.
References
See also CVE-2018-3784
For more information
If you have any questions or comments about this advisory: