Inclusion of Functionality from Untrusted Control Sphere in Netatalk - #VU132264

Detailed vulnerability description

The vulnerability allows a remote user to execute arbitrary code during the image build process and inject code into published container images.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in distrib/docker/webmin_module.Dockerfile when downloading and executing a setup script from the mutable upstream master branch during the Docker image build. A remote privileged user can compromise the upstream repository or the script delivery path to inject code into published container images.

The downloaded script is executed as root during the build, and the resulting content is baked into published netatalk/webmin images.

Remediation

Sources

• https://github.com/Netatalk/netatalk/security/advisories/GHSA-7fch-hrhx-h3mq
• https://github.com/Netatalk/netatalk/commit/c5e2f021f4f41313794dd8a4371d404e4dd720d3