REDHAT-BUG-2519852: High severity acm-operator-bundle vulnerability
The acm-operator-bundle build fetches whatever is at stolostron/release@master HEAD at run time and execs tools/konflux/common/process-triggering-pr.sh from it. There is no commit-SHA pin, no checksum, and no signature verification. The exec'd script inherits the full environment of the triggering step, including a GitHub App token scoped to all repos under github.repositoryowner, registry passwords for registry.redhat.io/registry.stage.redhat.io/quay.io, and write access to the bundle PR that becomes the shipped ACM operator bundle. (Related weakness: CWE-494, Download of Code Without Integrity Check.)
Upstream Jira: ACM-38668
Affected Software
Event History
Frequently Asked Questions
Which build executions are exposed?
Builds of acm-operator-bundle that fetch stolostron/release at the master HEAD during runtime and execute tools/konflux/common/process-triggering-pr.sh are exposed. The data does not identify a fixed revision, checksum, or signature that would constrain the fetched code.
What access could unverified fetched code obtain?
The executed script inherits the triggering step environment, including a GitHub App token scoped to repositories under github.repository_owner, registry credentials for registry.redhat.io, registry.stage.redhat.io, and quay.io, and write access to the bundle pull request.
How can I check whether a build pipeline has this condition?
Review the acm-operator-bundle build definition and runtime logs for a fetch of stolostron/release@master followed by execution of tools/konflux/common/process-triggering-pr.sh. Confirm whether the fetched content is protected by a commit-SHA pin, checksum, or signature verification; the described build has none of these controls.