Update dependency ops to v2.15.0 [SECURITY] #163
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
requested review from
a team,
paulomach,
taurus-forever,
shayancanonical and
carlcsaposs-canonical
and removed request for
a team
|
Should we avoid update to ops 2.15 everywhere (where ops <=2.9 is still in use)? |
just on router |
taurus-forever
approved these changes
Jul 23, 2024
There was a problem hiding this comment.
LGTM for the version bump after canonical/mysql-router-k8s-operator#273 is merged.
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
2 times, most recently
from
a758fdb to
e81d4bc
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
2 times, most recently
from
d62bfa1 to
890f2f4
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
3 times, most recently
from
446b631 to
d045f05
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
from
d045f05 to
8bc7840
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
from
8bc7840 to
f669598
Compare
renovate
bot
force-pushed
the
renovate/pypi-ops-vulnerability
branch
from
f669598 to
457208b
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.9.0->2.15.0^2.9.0, <2.10-><2.16GitHub Vulnerability Alerts
CVE-2024-41129
Summary
The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju (>=3.0), Juju secrets and not correctly capturing and processing
subprocess.CalledProcessError.There are two points that may log this command, in different files:
First, if there is an error during a secret handling, there will be a
subprocess.CalledProcessError, which will contain the CLI comand + all its args. This is going to be logged in any logging level. This exception, if not caught by the charm, will bubble up to the/var/log/juju/logs and syslog journal. Now, on Ubuntu 22.04, these logs are protected with:Second, certain audit setups may log terminal commands, which would result in this command being logged with its secrets. It is unknown if this is done on ubuntu security benchmarks, such as CIS hardening.
Keep in mind these logs may be copied or even backed up. Which exposes it to more services in the user's environment (e.g. CI runs in GH - although these are dummy password generated per test only).
Passing secrets straight via CLI is not advised. Here are some ways out:
subprocess.CalledProcessError, redacting its content and reissuing the same type of exception; this will not cover the caseauditdis set to log CLI commands, if that is a riskSeverity Rationale
This is a CWE-532. Potentially, these secrets can lead to privilege escalation but Ubuntu default is to have logs only accessible to
admgroup users.Marking this issue as "Moderate", as this report is not presenting a clear way on how to get access to the logs themselves: either getting local access to an
admgroup user (e.g. ubuntu) or recovering logs stored on a 3rd party service.Details
From CI: https://github.com/canonical/opensearch-operator/actions/runs/9908987369/job/27376377521?pr=364
PoC
Impact
Juju secrets are generally composed of private keys, passwords, etc; generally valuable credentials that, if leaked, will likely allow an attacker to get privileged access to its target or other targets in the environment.
Release Notes
canonical/operator (ops)
v2.15.0Compare Source
Features
Fixes
Documentation
CI
v2.14.1Compare Source
Fixes
Tests
Documentation
CI
v2.14.0Compare Source
Features
__str__to ActionFailed, for better unexpected failure output (#1209)Fixes
otherargument toRelatationDataContent.update(...)should be optional (#1226)Documentation
Refactoring
ruffformatter and reformat all code (#1224)v2.13.0Compare Source
Features
Fixes
Documentation
tox -e docs-depsto compile requirements.txt (#1172)Tests
pebble.CheckInfo.change_idfield (#1197)v2.12.0Compare Source
Features
Model.get_cloud_specwhich uses thecredential-gethook tool to get details of the cloud where the model is deployed (#1152)Fixes
get_noticesparameter name tousers=all(previouslyselect=all) (#1146)Model.relation.apptype fromApplication|NonetoApplication(#1151)begin(#1150)pebble.Client.execmight leak asocket.timeout(builtins.TimeoutError) exception (#1155)add_relation(#1138)get_relationbehaviour inleader-elected(#1156)type: secretfor config options (#1167)Refactoring
_Managerclass (#1085)Documentation
ops.testingfrom unittest to pytest style (#1157)Harness.add_relationdocstring (#1168)v2.11.0Compare Source
Features
StopEvent,RemoveEvent, and allLifeCycleEvents are no longer deferrable, and will raise aRuntimeErrorifdefer()is called on the event object (#1122)ActionEvent.id, exposing the JUJU_ACTION_UUID environment variable (#1124)pebble.Planobjects by passing in apebble.PlanDict, theability to compare two
Planobjects with==, and the ability to create an empty Plan withPlan()(#1134)Fixes
Documentation
can_connect()API documentation (#1123)Tooling
v2.10.0Compare Source
Features
PebbleCustomNoticeEvent,get_notices, and so on) (#1086, #1100)Relation.active, and excluded inactive relations fromModel.relations(#1091)ContainerMeta,and various info links in
CharmMeta) (#1106)ModelErrorin Harness if an invalid status is set (#1107)Fixes
Documentation
Tooling
Configuration
📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.