diff options
| author | Radosław Piliszek <radoslaw.piliszek@gmail.com> | 2022-08-29 09:55:59 +0000 |
|---|---|---|
| committer | Radosław Piliszek <radoslaw.piliszek@gmail.com> | 2022-08-29 10:05:05 +0000 |
| commit | 5b1da017988c987fc68b55d1f45b5d2676474ce1 (patch) | |
| tree | b8e18e89f4ea8ffc55f0c9e8979e71fee002575c /releasenotes | |
| parent | 91c2cc0d8d4caf8fa6567b95d8f7e7b4fc4dd443 (diff) | |
| download | kolla-5b1da017988c987fc68b55d1f45b5d2676474ce1.tar.gz kolla-5b1da017988c987fc68b55d1f45b5d2676474ce1.zip | |
Fix CVE-2022-38060
Closes-Bug: #1985784
Change-Id: I66476a2b396e2cbe41e68ac51f57aae1806b2ed8
Diffstat (limited to 'releasenotes')
| -rw-r--r-- | releasenotes/notes/bug-1985784-59df54a10a004551.yaml | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/releasenotes/notes/bug-1985784-59df54a10a004551.yaml b/releasenotes/notes/bug-1985784-59df54a10a004551.yaml new file mode 100644 index 000000000..5361cd528 --- /dev/null +++ b/releasenotes/notes/bug-1985784-59df54a10a004551.yaml @@ -0,0 +1,16 @@ +--- +security: + - | + Fixes CVE-2022-38060, a sudo privilege escalation vulnerability. + `LP#1985784 <https://launchpad.net/bugs/1889611>`__ +upgrade: + - | + To fix CVE-2022-38060, support for KOLLA_CONFIG and KOLLA_CONFIG_FILE + environment variables in kolla-built containers has been dropped. + Now, only the single trusted path of + ``/var/lib/kolla/config_files/config.json`` will be utilised for loading + container config. + We believe this is a reasonable tradeoff as these environment variables + were not used by any known downstream and potential users in the wild + can easily adapt as this does not limit the functionality per se, only + making it stricter as to where the config can come from. |