chore(deps): bump docker/login-action from 4 to 4.5.1 - #87
chore(deps): bump docker/login-action from 4 to 4.5.1#87dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [docker/login-action](https://github.com/docker/login-action) from 4 to 4.5.1. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@v4...v4.5.1) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![semgrep-code-wireapp[bot]](https://avatars.githubusercontent.com/u/16047324?s=60&v=4){kind=small}
|
|
||
| - name: Login to Quay.io | ||
| uses: docker/login-action@v4 | ||
| uses: docker/login-action@v4.5.1 |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
GitHub Actions step uses mutable version tag v4.5.1 instead of a commit SHA, allowing the action owner to silently inject malicious code that could steal your repository secrets.
More details about this
The docker/login-action step is pinned to a mutable version tag (v4.5.1) instead of a specific commit SHA. This means the action maintainers can silently update the code at this tag without your knowledge.
Here's how an attacker could exploit this:
- Compromise the action repository: An attacker gains write access to the
docker/login-actionrepository (e.g., through credential theft or social engineering). - Modify the action code: They update the code at the
v4.5.1tag to include malicious logic—for example, exfiltrating the${{ secrets.QUAY_ROBOT_TOKEN }}secret to an attacker-controlled server. - Your workflow runs silently compromised: The next time your workflow runs after the tag is updated, it automatically pulls the poisoned action code. The step logs in to Quay.io as normal, but the secret is also sent to the attacker.
- Account takeover: With the leaked
QUAY_ROBOT_TOKEN, the attacker can push malicious container images to yourquay.io/wire/poll-appregistry, compromising all deployments.
This attack pattern was used in real supply-chain compromises like trivy-action and kics-github-action. Version tags and branch names are mutable and can be repointed at any time by the action owner or a compromised maintainer.
To resolve this comment:
✨ Commit fix suggestion
| uses: docker/login-action@v4.5.1 | |
| # Replace the SHA below with the full 40-character commit SHA for the trusted | |
| # docker/login-action release you intend to use (ideally the commit for v4.5.1). | |
| # This pins the action to an immutable revision to satisfy Semgrep. | |
| uses: docker/login-action@0123456789abcdef0123456789abcdef01234567 |
View step-by-step instructions
-
Replace the mutable action reference with a full 40-character commit SHA in the
usesline for the login step.
Changeuses: docker/login-action@v4.5.1touses: docker/login-action@<full-40-character-commit-sha>. -
Keep the same action and version when choosing the SHA by using the commit that corresponds to the
v4.5.1release from thedocker/login-actionrepository.
This makes the workflow use an immutable revision instead of a tag that can be moved later. -
Update the step so it still looks like
uses: docker/login-action@0123456789abcdef0123456789abcdef01234567, replacing the example SHA with the real 40-character commit for that release. -
Manually verify that the workflow can still authenticate to Quay.io and that the login step still receives
registry,username, andpasswordexactly as before.
Alternatively, if you need an immediate temporary fix and already trust a newer release, pin directly to that release’s full commit SHA instead of v4.5.1, but still avoid any tag such as @v4 or @v4.5.1.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.
You can view more details about this finding in the Semgrep AppSec Platform.
Bumps docker/login-action from 4 to 4.5.1.
Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
a5e9150Merge pull request #1048 from docker/dockerhub-oidc-supporta482ba4build(deps): bump the codeql-actions group with 2 updates9e3d36echore: update generated content14d6a79docker hub oidc support03c8510Merge pull request #1044 from docker/dependabot/npm_and_yarn/docker/actions-t...ad8a81fMerge pull request #1046 from docker/dependabot/npm_and_yarn/brace-expansion-...6d219a4[dependabot skip] chore: update generated contentb320069build(deps): bump@docker/actions-toolkitfrom 0.92.0 to 0.93.008d3680[dependabot skip] chore: update generated content381f5a4Merge pull request #1042 from docker/dependabot/github_actions/codeql-actions...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)