From dd44066211afa60f834a5c670364167e73de83ba Mon Sep 17 00:00:00 2001 From: blam Date: Wed, 28 Feb 2024 15:48:12 +0100 Subject: [PATCH 1/2] blog: add security notice blog Signed-off-by: blam --- microsite/blog/2024-02-28-security-notice.mdx | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 microsite/blog/2024-02-28-security-notice.mdx diff --git a/microsite/blog/2024-02-28-security-notice.mdx b/microsite/blog/2024-02-28-security-notice.mdx new file mode 100644 index 0000000000..4605aa04b2 --- /dev/null +++ b/microsite/blog/2024-02-28-security-notice.mdx @@ -0,0 +1,24 @@ +--- +title: "CVE-2024-26150: Keeping Backstage safe and secure" +author: Ben Lambert, Spotify & Sam Nixon, Roadie +--- + +**TL;DR**: For the Backstage maintainers, ensuring that the project is secure for every adopter and end user is one of our top priorities. +With the recent discovery of [CVE-2024-26150](https://www.cve.org/CVERecord?id=CVE-2024-26150), we've shipped fixes for versions > v1.15.0. +Please update your Backstage instance. + +![Backstage Security Audit & Updates](assets/22-08-23/backstage-security-audit.png) + +{/* truncate */} + +Last week we were notified by [Roadie](https://roadie.io/) of a potential security vulnerability in the scaffolder that they had discovered during a third-party security audit. +Roadie are running their scaffolder tasks in an isolated, ephemeral container to mitigate these kinds of issues, but as good citizens of the Backstage community, they alerted the Backstage maintainer team to make sure a fix was applied to the upstream project. +Upon further investigation, it turned out that this was a more widespread issue with the `resolveSafeChildPath` utility from the `@backstage/backend-common` package, which is used to prevent path traversal exploits. +This issue has now been fixed, and also backported to cover releases almost a year ago. + +Please make sure that you have updated your Backstage instance to the latest v.1.23.2, or that you are using `@backstage/backend-common` `v0.21.1`, `v0.19.10`, or `v0.20.2`. +If you are building backend plugins for Backstage and do any local file operations, make sure you use the `resolveSafeChildPath` utility, as this check is quite tricky to implement correctly 😊 + +Thanks to Roadie and the team for reporting this issue, and making the Backstage community safe! + +For more information you can check out the [security advisory](https://github.com/backstage/backstage/security/advisories/GHSA-2fc9-xpp8-2g9h). From c75996741b5d6b99d1b484277af3277b05e431f8 Mon Sep 17 00:00:00 2001 From: Ben Lambert Date: Wed, 28 Feb 2024 19:07:36 +0100 Subject: [PATCH 2/2] Update microsite/blog/2024-02-28-security-notice.mdx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Fredrik Adelöw Signed-off-by: Ben Lambert Signed-off-by: blam --- microsite/blog/2024-02-28-security-notice.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/microsite/blog/2024-02-28-security-notice.mdx b/microsite/blog/2024-02-28-security-notice.mdx index 4605aa04b2..4f987b90a4 100644 --- a/microsite/blog/2024-02-28-security-notice.mdx +++ b/microsite/blog/2024-02-28-security-notice.mdx @@ -14,7 +14,7 @@ Please update your Backstage instance. Last week we were notified by [Roadie](https://roadie.io/) of a potential security vulnerability in the scaffolder that they had discovered during a third-party security audit. Roadie are running their scaffolder tasks in an isolated, ephemeral container to mitigate these kinds of issues, but as good citizens of the Backstage community, they alerted the Backstage maintainer team to make sure a fix was applied to the upstream project. Upon further investigation, it turned out that this was a more widespread issue with the `resolveSafeChildPath` utility from the `@backstage/backend-common` package, which is used to prevent path traversal exploits. -This issue has now been fixed, and also backported to cover releases almost a year ago. +This issue has now been fixed, and also backported to cover releases up to almost a year old. Please make sure that you have updated your Backstage instance to the latest v.1.23.2, or that you are using `@backstage/backend-common` `v0.21.1`, `v0.19.10`, or `v0.20.2`. If you are building backend plugins for Backstage and do any local file operations, make sure you use the `resolveSafeChildPath` utility, as this check is quite tricky to implement correctly 😊