REDHAT-BUG-2450554: Path Traversal
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the pathInRepo parameter. A tenant with permission to create ResolutionRequests (e.g. by creating TaskRuns or PipelineRuns that use the git resolver) can read arbitrary files from the resolver pod's filesystem, including ServiceAccount tokens. The file contents are returned base64-encoded in resolutionrequest.status.data. Versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 contain a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tekton Pipelines git resolverto a version that resolves this vulnerability.Fixed in 1.0.1Patch patch - Upgrade
Upgrade
Tekton Pipelines git resolverto a version that resolves this vulnerability.Fixed in 1.3.3Patch patch - Upgrade
Upgrade
Tekton Pipelines git resolverto a version that resolves this vulnerability.Fixed in 1.6.1Patch patch - Upgrade
Upgrade
Tekton Pipelines git resolverto a version that resolves this vulnerability.Fixed in 1.9.2Patch patch - Upgrade
Upgrade
Tekton Pipelines git resolverto a version that resolves this vulnerability.Fixed in 1.10.2Patch patch - Compensating control
Prevent tenants from creating `ResolutionRequests` and from creating `TaskRuns` or `PipelineRuns` that use the git resolver (since the issue requires `pathInRepo` control via those resources).
- Operational
If exploit attempts may have occurred (e.g., arbitrary file reads from the resolver pod including ServiceAccount tokens), rotate any credentials that could have been exposed from the resolver pod filesystem.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2450554?
The severity of REDHAT-BUG-2450554 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2450554?
To fix REDHAT-BUG-2450554, upgrade to Tekton Pipelines versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, or 1.10.2.
What kind of vulnerability is REDHAT-BUG-2450554?
REDHAT-BUG-2450554 is a path traversal vulnerability affecting the Tekton Pipelines git resolver.
Which versions of Tekton Pipelines are affected by REDHAT-BUG-2450554?
Tekton Pipelines versions prior to 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2 are affected by REDHAT-BUG-2450554.
What is the potential impact of REDHAT-BUG-2450554?
The potential impact of REDHAT-BUG-2450554 is unauthorized access to files in a repository due to path traversal via the 'pathInRepo' parameter.