jenkins-slave not affected by polkit (CVE-2021-4034)
Description
CSP Request Details
None
CSP Rejection Details
None
Potential Workaround
None
Checklist
hideTestRail: Results
Activity
Show:
Cannot Reproduce
Details
Details
Assignee
David Crossley
David CrossleyReporter
Julian Ladisch
Julian LadischLabels
Priority
Sprint
None
Development Team
FOLIO DevOps
RCA Group
TBD
TestRail: Cases
Open TestRail: Cases
TestRail: Runs
Open TestRail: Runs
Created January 26, 2022 at 3:27 PM
Updated January 27, 2022 at 4:31 PM
Resolved January 26, 2022 at 4:00 PM
TestRail: Cases
TestRail: Runs
jenkins-slave = https://github.com/folio-org/folio-tools/blob/master/jenkins-slave-docker/Dockerfile.focal-java-11
This is based on Ubuntu Focal that is vulnerable to Local Privilege Escalation in polkit's pkexec. Focal with a fix has been released: https://ubuntu.com/security/CVE-2021-4034
However, the container that FOLIO uses doesn't install the polkit package (policykit-1). a
cd /; find -name '*pkexec*'
doesn't find the vulnerable binary.Therefore jenkins-slave is not affected.