Details
-
Work Item
-
Resolution: Done
-
Critical
-
None
-
GreenHopper Ranking:0|i2jsjf:
-
9223372036854775807
Description
Remote Code Execution in Talend/component-runtime (master)
Issue Details
- Vulnerability: Remote Code Execution
- Severity: High
- Project: Talend/component-runtime
- Branch: master
- Scan Date: Unknown
Issue Description
com.google.cloud.tools:jib-core is vulnerable to remote code execution. The executables are run without verifying whether the provided docker path is accurate, which allows a remote attacker to upload and execute malicious code via the vulnerable `isDockerInstalled` function.
We need to keep remote-engine-customizer using jib for the docker layers handling.
component-starter-server will move to TSBI (see linked issues).
Attachments
Issue Links
- is related to
-
TCOMP-2274 Move component-starter-server to TSBI
-
- Done
-