Headline
CVE-2023-44392: chore(deps): remove cryo (#5179) · garden-io/garden@3117964
Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes ConfigMap resources prefixed with test-result and run-result to cache Garden test and run results. These ConfigMaps are stored either in the garden-system namespace or the configured user namespace. When a user invokes the command garden test or garden run objects stored in the ConfigMap are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the ConfigMap, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a garden test or garden run which has previously cached results. The issue has been patched in Garden versions 0.13.17 (Bonsai) and 0.12.65 (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.
Expand Up
@@ -7,7 +7,6 @@
*/
import { mapValues } from “lodash”
import Cryo from “cryo”
import { writeFile } from “fs-extra”
import { DumpOptions, dump } from “js-yaml”
import highlight from “cli-highlight”
Expand Down Expand Up
@@ -50,11 +49,11 @@ export async function dumpYamlMulti(yamlPath: string, objects: object[]) {
}
export function serializeObject(o: any): string {
return Buffer.from(Cryo.stringify(o)).toString(“base64”)
return Buffer.from(JSON.stringify(o)).toString(“base64”)
}
export function deserializeObject(s: string) {
return Cryo.parse(Buffer.from(s, “base64”))
return JSON.parse(Buffer.from(s, “base64”).toString())
}
export function serializeValues(o: { [key: string]: any }): { [key: string]: string } {
Expand Down