Dear zuul operators,

I discovered a security issue in zuul which allows untrusted speculative jobs to inspect the local file system of a zuul-executor. In the default configuration, access outside of the working directory is constrained by bubblewrap, so information disclosure should not be possible as long as bubblewrap is enabled. If bubblewrap was disabled (not the default, and not recommended), access to files outside of the working directory is possible.

This is due to a flaw in the safe path check which doesn't check for symlinks hidden in sub directories or chained symlinks.

This is fixed by https://review.openstack.org/553029 and it is advised to update to latest master and restart any running zuul-executor processes.

Sorry for any inconveniences

Kind regards Tobias

-- BMW Car IT GmbH Tobias Henkel Spezialist Entwicklung Moosacher Straße 86 80809 München

Tel.: ­+49 89 189311-48 Fax: +49 89 189311-20 Mail: tobias.henkel@bmw.demailto:tobias.henkel@bmw.de Web: http://www.bmw-carit.dehttp://www.bmw-carit.de/ ----------------------------------------------------------------------------- BMW Car IT GmbH Geschäftsführer: Kai-Uwe Balszuweit und Christian Salzmann Sitz und Registergericht: München HRB 134810 -----------------------------------------------------------------------------