Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cert-manager: address CVE-2024-45337 #11817

Merged
merged 3 commits into from
Jan 9, 2025
+86 −2
Merged

cert-manager: address CVE-2024-45337 #11817

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f0b13f1
cert-manager: address CVE-2024-45337
mfrw Jan 8, 2025
55abc7e
cert-manager: update changelog date
mfrw Jan 8, 2025
5d0abf5
Merge branch 'fasttrack/3.0' into mfrw/cert-manager-CVE-2024-45337
jslobodzian Jan 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 80 additions & 0 deletions SPECS/cert-manager/CVE-2024-45337.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
From 784057d777784f1737dbf5d660f32bf2577add4c Mon Sep 17 00:00:00 2001
From: Roland Shoemaker <[email protected]>
Date: Tue, 3 Dec 2024 09:03:03 -0800
Subject: [PATCH] ssh: make the public key cache a 1-entry FIFO cache

Users of the the ssh package seem to extremely commonly misuse the
PublicKeyCallback API, assuming that the key passed in the last call
before a connection is established is the key used for authentication.
Some users then make authorization decisions based on this key. This
property is not documented, and may not be correct, due to the caching
behavior of the package, resulting in users making incorrect
authorization decisions about the connection.

This change makes the cache a one entry FIFO cache, making the assumed
property, that the last call to PublicKeyCallback represents the key
actually used for authentication, actually hold.

Thanks to Damien Tournoud, Patrick Dawkins, Vince Parker, and
Jules Duvivier from the Platform.sh / Upsun engineering team
for reporting this issue.

Fixes golang/go#70779
Fixes CVE-2024-45337

Change-Id: Ife7c7b4045d8b6bcd7e3a417bdfae370c709797f
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/635315
Reviewed-by: Roland Shoemaker <[email protected]>
Auto-Submit: Gopher Robot <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
Reviewed-by: Nicola Murino <[email protected]>
LUCI-TryBot-Result: Go LUCI <[email protected]>
Signed-off-by: Muhammad Falak R Wani <[email protected]>
---
.../vendor/golang.org/x/crypto/ssh/server.go | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/cmd/controller/vendor/golang.org/x/crypto/ssh/server.go b/cmd/controller/vendor/golang.org/x/crypto/ssh/server.go
index 3ca9e89..a8b673c 100644
--- a/cmd/controller/vendor/golang.org/x/crypto/ssh/server.go
+++ b/cmd/controller/vendor/golang.org/x/crypto/ssh/server.go
@@ -149,7 +149,7 @@ func (s *ServerConfig) AddHostKey(key Signer) {
}

// cachedPubKey contains the results of querying whether a public key is
-// acceptable for a user.
+// acceptable for a user. This is a FIFO cache.
type cachedPubKey struct {
user string
pubKeyData []byte
@@ -157,7 +157,13 @@ type cachedPubKey struct {
perms *Permissions
}

-const maxCachedPubKeys = 16
+// maxCachedPubKeys is the number of cache entries we store.
+//
+// Due to consistent misuse of the PublicKeyCallback API, we have reduced this
+// to 1, such that the only key in the cache is the most recently seen one. This
+// forces the behavior that the last call to PublicKeyCallback will always be
+// with the key that is used for authentication.
+const maxCachedPubKeys = 1

// pubKeyCache caches tests for public keys. Since SSH clients
// will query whether a public key is acceptable before attempting to
@@ -179,9 +185,10 @@ func (c *pubKeyCache) get(user string, pubKeyData []byte) (cachedPubKey, bool) {

// add adds the given tuple to the cache.
func (c *pubKeyCache) add(candidate cachedPubKey) {
- if len(c.keys) < maxCachedPubKeys {
- c.keys = append(c.keys, candidate)
+ if len(c.keys) >= maxCachedPubKeys {
+ c.keys = c.keys[1:]
}
+ c.keys = append(c.keys, candidate)
}

// ServerConn is an authenticated SSH connection, as seen from the
--
2.34.1

8 changes: 6 additions & 2 deletions SPECS/cert-manager/cert-manager.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Summary: Automatically provision and manage TLS certificates in Kubernetes
Name: cert-manager
Version: 1.12.13
Release: 1%{?dist}
Release: 2%{?dist}
License: ASL 2.0
Vendor: Microsoft Corporation
Distribution: Azure Linux
Expand All @@ -13,6 +13,7 @@ Source0: https://github.com/jetstack/%{name}/archive/refs/tags/v%{version
# 1. wget https://github.com/jetstack/%%{name}/archive/refs/tags/v%%{version}.tar.gz -O %%{name}-%%{version}.tar.gz
# 2. <repo-root>/SPECS/cert-manager/generate_source_tarball.sh --srcTarball %%{name}-%%{version}.tar.gz --pkgVersion %%{version}
Source1: %{name}-%{version}-vendor.tar.gz
Patch0: CVE-2024-45337.patch
BuildRequires: golang
Requires: %{name}-acmesolver
Requires: %{name}-cainjector
Expand Down Expand Up @@ -57,7 +58,7 @@ Summary: cert-manager's webhook binary
Webhook component providing API validation, mutation and conversion functionality for cert-manager.

%prep
%setup -q -a 1
%autosetup -a 1 -p1

%build

Expand Down Expand Up @@ -103,6 +104,9 @@ install -D -m0755 bin/webhook %{buildroot}%{_bindir}/
%{_bindir}/webhook

%changelog
* Wed Jan 08 2025 Muhammad Falak <[email protected]> - 1.12.13-2
- Patch CVE-2024-45337

* Mon Sep 16 2024 Jiri Appl <[email protected]> - 1.12.13-1
- Upgrade to 1.12.13 which carries helm 3.14.2 to fix CVE-2024-26147 and CVE-2024-25620

Expand Down
Loading