Open andersthorbeck opened 1 year ago
andersthorbeck
commented
1 year ago Somewhat related issues, also mentioning CVEs in the runner: https://github.com/actions/runner/issues/2145, https://github.com/actions/runner/issues/1869, https://github.com/actions/runner/issues/1886.
andersthorbeck
commented
1 year ago Almost all of these vulnerabilities (except CVE-2022-29244) are still present in new runner version 2.301.1.
matsest
commented
1 year ago Hi @TingluoHuang is this being addressed? Fixing the CVE's should be fixed regardless of the suggested solutions..
Is there an intent to implement something like the suggested solution here? Should not be very hard to add to the repository. Additionally - is this something you want contributions for, or work out internally?
andersthorbeck
commented
1 year ago In the most recent version, 2.302.1, the following vulnerabilities were introduced:
libssl3)http-cache-semantics via package.json)None of the previous CVEs were mitigated.
mario-campos
commented
1 year ago It looks like most, if not all, of the NPM vulnerabilities are not an issue. Either they were false-positives or they've been fixed, because I don't see any reference to http-cache-semantics, json-schema, npm, or qs in either package.json or package-lock.json file.
And, while minimatch is in the lock file, it's not subject to https://github.com/advisories/GHSA-f8q6-p94x-37v3 because it does not meet the version-range criteria (v3.1.2 > v3.0.5).
So, unless I missed something, I think it's safe to ignore those JS CVEs.
andersthorbeck
commented
1 year ago @mario-campos Even if they are false positives though, every GitHub consumer running their own self-hosted GitHub runners will run into these same issues. Even the most recent version 2.309.0 has 4 CVEs, all in .NET: the same 3 as originally reported here 9 months ago, and additionally CVE-2019-0820 (HIGH severity, from dotnet-core).
┌────────────────────────────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────────────────────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ System.Net.Http │ CVE-2018-8292 │ HIGH │ fixed │ 4.3.0 │ 4.3.4 │ .NET Core: information disclosure due to authentication │
│ │ │ │ │ │ │ information exposed in a redirect... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2018-8292 │
├────────────────────────────────┼───────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ System.Private.Uri │ CVE-2019-0980 │ │ │ │ 4.3.2 │ dotnet: infinite loop in Uri.TryCreate leading to ASP.Net │
│ │ │ │ │ │ │ Core Denial of Service... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-0980 │
│ ├───────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2019-0981 │ │ │ │ │ dotnet: crash in IPAddress.TryCreate leading to ASP.Net Core │
│ │ │ │ │ │ │ Denial of Service │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-0981 │
├────────────────────────────────┼───────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ System.Text.RegularExpressions │ CVE-2019-0820 │ │ │ │ 4.3.1 │ dotnet: timeouts for regular expressions are not enforced │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-0820 │
└────────────────────────────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘All of these CVEs seem mitigable simply by bumping version numbers. Doing so would absolve all GitHub consumers attempting to run self-hosted runners from investigating these same CVEs, which aggregated across all of us is currently a huge and unproductive time drain.
mmclane
commented
4 months ago I can't believe this is still an issue
casey-robertson-paypal
commented
4 weeks ago Still an issue - it gets tiresome seeing these pop up in vuln scanning
Describe the bug The GitHub Runner versions
2.299.1and2.300.0(most recent versions at the time of writing) have 1 critical severity and 6 high severity CVEs found by Trivy security vulnerability scan.To Reproduce Steps to reproduce the behavior:
In a GitHub repository, under a directory named
github-runner, have the followingDockerfile:The content of
entrypoint.shomitted for simplicity.In the same repository, define the following GitHub Actions workflow (to be run on a GitHub-hosted runner, but to generate and vulnerability scan the Docker image for a self-hosted runner):
Expected behavior
Expected zero HIGH or CRITICAL severity known, mitigatable vulnerabilities.
Runner Version and Platform
The GitHub-hosted runner generating the docker image and running the trivy scan:
The (to be self-hosted) runner Docker image being generated, which has vulnerabilities:
What's not working?
The Trivy vulnerability scan seems to indicate that the GitHub Runner code being pulled in via the Dockerfile is vulnerable to the following known CVEs:
json-schemaviapackage.json)minimatchviapackage.json)npmviapackage.json)qsviapackage.json)dotnet-core)dotnet-core)dotnet-core)Job Log Output
The full run log: trivy_run_redacted.log.
See in particular:
Suggested solution
Implement automated vulnerability scans of your own GitHub Runner code, and ensure any CRITICAL or HIGH severity CVEs which can be mitigated are mitigated before a new version is released.