Google fixes GCP flaw that could expose sensitive container images

Personal pictures are restricted and require authentication to entry. They’re used to retailer proprietary functions, configurations, or delicate code.

The employee, aka service agent, “is a particular sort of service account created and managed by Google Cloud,” mentioned Liv Matan, senior safety researcher at Tenable. “If an attacker positive aspects sure permissions inside a sufferer’s challenge – particularly run.providers.replace and iam.serviceAccounts.actAspermissions – they might modify a Cloud Run service and deploy a brand new revision.“

In doing so, they might specify (by means of malicious code injection) any non-public container picture saved in a sufferer’s registries, Matan added.