CVE-2022-41939 Credential exposure when running third-party builders in knative/func
Developers using third-party buildpacks may expose registry credentials or Docker sockets to malicious lifecycle containers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-41939?
CVE-2022-41939 is a medium-severity vulnerability in knative func, published on 19 Nov 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious `lifecycle` container. This issues has been patched in PR #1442, and is part of release 1.8.1. This issue only affects users who are using function buildpacks from third-parties; pinning the builder image to a specific content-hash with a valid `lifecycle` image will also mitigate the attack.
Weakness: CWE-200
Which versions are affected by CVE-2022-41939?
It affects 1 product.
Products include Linuxfoundation Knative Func.
How do I fix CVE-2022-41939?
No fix has been published for CVE-2022-41939 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-41939 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-41939 exists.
Sources
Also known as GHSA-5336-2g3f-9g3m.