compose-lint YAML Parser Misconfiguration Leading to Security Setting Deletion

Executive Summary

This vulnerability affects compose-lint versions 0.9.0 to 0.17.0. It involves a mismatch in how line breaks are handled. The tool counts only newline characters as line breaks but the YAML parser also recognizes additional characters like carriage returns and Unicode separators. This causes the fix engine to edit incorrect lines, potentially deleting unintended security settings while reporting a successful fix.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if you are using compose-lint versions between 0.9.0 and 0.17.0. Run 'compose-lint --version' to verify the installed version. If the version is within the affected range, inspect Docker Compose files for ambiguous line breaks like carriage returns or Unicode separators that could cause misalignment.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to manipulate Docker Compose files by inserting invisible line break characters. When using the fix --apply command, this can cause the tool to delete unintended lines such as security settings like network configurations. The tool may still report success, and later checks might not detect the unauthorized changes.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade compose-lint to version 0.18.0 or later immediately. If upgrading is not possible, avoid using the 'fix --apply' command on untrusted files and always review dry-run diffs before applying changes. This prevents unintended deletions of security settings due to line break mismatches.

Useful 0 Not Useful 0