diff options
| author | Zuul <zuul@review.opendev.org> | 2022-09-06 11:59:30 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2022-09-06 11:59:30 +0000 |
| commit | 2a4a8fce31c12114e8f472c24dd96864b5bd2bd2 (patch) | |
| tree | 9288ed91a0e4efdab2ba9548d693c6eaf14a8539 /releasenotes | |
| parent | 2c2dc39b3bb39a27e6f94dbd797c9406bf512109 (diff) | |
| parent | 5b1da017988c987fc68b55d1f45b5d2676474ce1 (diff) | |
| download | kolla-2a4a8fce31c12114e8f472c24dd96864b5bd2bd2.tar.gz kolla-2a4a8fce31c12114e8f472c24dd96864b5bd2bd2.zip | |
Merge "Fix CVE-2022-38060"
Diffstat (limited to 'releasenotes')
| -rw-r--r-- | releasenotes/notes/bug-1985784-59df54a10a004551.yaml | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/releasenotes/notes/bug-1985784-59df54a10a004551.yaml b/releasenotes/notes/bug-1985784-59df54a10a004551.yaml new file mode 100644 index 000000000..5361cd528 --- /dev/null +++ b/releasenotes/notes/bug-1985784-59df54a10a004551.yaml @@ -0,0 +1,16 @@ +--- +security: + - | + Fixes CVE-2022-38060, a sudo privilege escalation vulnerability. + `LP#1985784 <https://launchpad.net/bugs/1889611>`__ +upgrade: + - | + To fix CVE-2022-38060, support for KOLLA_CONFIG and KOLLA_CONFIG_FILE + environment variables in kolla-built containers has been dropped. + Now, only the single trusted path of + ``/var/lib/kolla/config_files/config.json`` will be utilised for loading + container config. + We believe this is a reasonable tradeoff as these environment variables + were not used by any known downstream and potential users in the wild + can easily adapt as this does not limit the functionality per se, only + making it stricter as to where the config can come from. |