From 5b1da017988c987fc68b55d1f45b5d2676474ce1 Mon Sep 17 00:00:00 2001 From: Radosław Piliszek Date: Mon, 29 Aug 2022 09:55:59 +0000 Subject: Fix CVE-2022-38060 Closes-Bug: #1985784 Change-Id: I66476a2b396e2cbe41e68ac51f57aae1806b2ed8 --- releasenotes/notes/bug-1985784-59df54a10a004551.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 releasenotes/notes/bug-1985784-59df54a10a004551.yaml (limited to 'releasenotes') diff --git a/releasenotes/notes/bug-1985784-59df54a10a004551.yaml b/releasenotes/notes/bug-1985784-59df54a10a004551.yaml new file mode 100644 index 000000000..5361cd528 --- /dev/null +++ b/releasenotes/notes/bug-1985784-59df54a10a004551.yaml @@ -0,0 +1,16 @@ +--- +security: + - | + Fixes CVE-2022-38060, a sudo privilege escalation vulnerability. + `LP#1985784 `__ +upgrade: + - | + To fix CVE-2022-38060, support for KOLLA_CONFIG and KOLLA_CONFIG_FILE + environment variables in kolla-built containers has been dropped. + Now, only the single trusted path of + ``/var/lib/kolla/config_files/config.json`` will be utilised for loading + container config. + We believe this is a reasonable tradeoff as these environment variables + were not used by any known downstream and potential users in the wild + can easily adapt as this does not limit the functionality per se, only + making it stricter as to where the config can come from. -- cgit v1.2.3