[CVE] CVE-2018-11757 Docker Skeleton Runtime for Apache OpenWhisk

[Rodric Rabbah <ra...@apache.org>]

Who is Affected: Apache OpenWhisk users with an explicitly created Docker
action, and the Docker image used for the action inherits from the affected
Docker tag:
- openwhisk/dockerskeleton < 1.3.1

The Docker Skeleton Runtime does not currently have any Apache releases.

Description: A Docker action running as a serverless function (e.g., wsk
action create <name> —docker <image>), where the Dockerfile used to create
the Docker image inherits one of the affected tags, may allow a carefully
crafted parameter to overwrite the serverless function running inside the
container. This requires the user included function to be vulnerable in
some way, for example via parameter hijacking, remote code execution, or
unsafe use of "eval()". Subsequent executions of the original function in
the same container will use the replaced implementation if the function was
successfully exploited.

Mitigation: Users that create their own Docker runtimes to run as Apache
OpenWhisk Docker actions, and who pin their Docker runtime image (e.g.,
Dockerfile starts with "FROM openwhisk/dockerskeleton:1.0.0") should
upgrade their Docker tag to the latest available tag. Users who build from
source, should use the latest commit Git tag [1]. Operators of an Apache
OpenWhisk deployment should check their runtime manifest to determine if
they are affected, and if so, upgrade the tags in their runtimes manifest
to automatically patch all actions runtimes when updating their deployment.

Credit: This issue was researched and reported by Yuri Shapira and Ory
Segal of PureSec.

[1]
https://github.com/apache/incubator-openwhisk-runtime-docker/commit/891896f25c39bc336ef6dda53f80f466ac4ca3c8