Headline
CVE-2023-32696: Merge pull request from GHSA-c74x-xfvr-x5wg · ckan/ckan-docker-base@5483c46
CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the ckan user (equivalent to www-data) owned code and configuration files in the docker container and the ckan user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.
@@ -1,4 +1,5 @@
FROM alpine:3.16
FROM alpine:3.17
ARG CKAN_VERSION=ckan-2.10.0
Internals, you probably don’t need to change these
ENV APP_DIR=/srv/app
Expand All
@@ -8,8 +9,7 @@ ENV PIP_SRC=${SRC_DIR}
ENV CKAN_STORAGE_PATH=/var/lib/ckan
ENV GIT_URL=https://github.com/ckan/ckan.git
CKAN version to build
#ENV GIT_BRANCH=dev-v2.10
ENV GIT_BRANCH=ckan-2.10.0
ENV GIT_BRANCH=${CKAN_VERSION}
Customize these on the .env file if needed
ENV CKAN_SITE_URL=http://localhost:5000
ENV CKAN__PLUGINS image_view text_view recline_view datastore datapusher envvars
Expand Down Expand Up
@@ -37,7 +37,7 @@ RUN apk add --no-cache tzdata \
libmagic \
curl \
patch \
sudo && \
bash && \
Packages to build CKAN requirements and plugins
apk add --no-cache --virtual .build-deps \
postgresql-dev \
Expand All
@@ -61,7 +61,6 @@ RUN apk add --no-cache tzdata \
python3 ${SRC_DIR}/get-pip.py && \
pip3 install supervisor && \
mkdir /etc/supervisord.d && \
#pip wheel --wheel-dir=/wheels uwsgi gevent && \
rm -rf ${SRC_DIR}/get-pip.py
COPY setup/supervisord.conf /etc
Expand All
@@ -80,7 +79,7 @@ RUN pip3 install -e git+${GIT_URL}@${GIT_BRANCH}#egg=ckan && \
Create a local user and group to run the app
RUN addgroup -g 92 -S ckan && \
adduser -u 92 -h /srv/app -s /bin/bash -D -G ckan ckan
adduser -u 92 -h /home/ckan -s /bin/bash -D -G ckan ckan
Create local storage folder
RUN mkdir -p ${CKAN_STORAGE_PATH} && \
Expand All
@@ -89,15 +88,11 @@ RUN mkdir -p ${CKAN_STORAGE_PATH} && \
COPY setup/prerun.py ${APP_DIR}
COPY setup/start_ckan.sh ${APP_DIR}
ADD https://raw.githubusercontent.com/ckan/ckan/${GIT_BRANCH}/wsgi.py ${APP_DIR}
RUN chmod 644 ${APP_DIR}/wsgi.py
Create entrypoint directory for children image scripts
ONBUILD RUN mkdir /docker-entrypoint.d
RUN chown ckan -R /srv/app
RUN addgroup sudo && \
adduser ckan sudo
EXPOSE 5000
HEALTHCHECK --interval=60s --timeout=5s --retries=5 CMD curl --fail http://localhost:5000/api/3/action/status_show || exit CMD [“/srv/app/start_ckan.sh”]
Expand Down