Critical · published November 10, 2022
🔥 Container breakouts are on the table with Vela's default configurations! Imagine a sneaky raccoon prying open a kitchen door left ajar — that’s how easy it could be for attackers to gain unauthorized access! In this scenario, think of the Vela Server and Worker as a shipping dock with containers. If the dock's access controls are weak, anyone could wander in and open any container, potentially stealing or tampering with valuable cargo! An attacker could exploit these default configurations to break out of the container environment, accessing sensitive data or even taking control of the entire system. This could lead to data breaches, service disruptions, and a complete loss of trust from your users – absolutely devastating!
In this scenario, think of the Vela Server and Worker as a shipping dock with containers. If the dock's access controls are weak, anyone could wander in and open any container, potentially stealing or tampering with valuable cargo! CVE-2022-39395 allows exploitation of container breakouts in Vela Server and Vela Worker versions prior to 0.16.0 and Vela UI prior to 0.17.0, due to insufficient default security configurations.
An attacker could exploit these default configurations to break out of the container environment, accessing sensitive data or even taking control of the entire system. This could lead to data breaches, service disruptions, and a complete loss of trust from your users – absolutely devastating! Upgrade your Vela installations to Server 0.16.0, Worker 0.16.0, and UI 0.17.0. After upgrading, make sure to explicitly configure the default settings to meet your security needs. Consider implementing workarounds like emptying the `VELA_RUNTIME_PRIVILEGED_IMAGES` setting and using `VELA_REPO_ALLOWLIST` to restrict repository access to enhance security. You've got this! With these steps, you’ll reinforce your defenses and take significant action against vulnerabilities. 🛡️