kots/1.112.1 package update

[octo-sts]

[github-actions]

Package kots: Click to expand/collapse

Package kots:
Modified: /usr/bin/kots
Modified: /usr/bin/kotsadm

Package kots-symlink-compat: Click to expand/collapse

Package kots-symlink-compat:
Unchanged

bincapz found differences: Click to expand/collapse

Moved: kots/var/lib/db/sbom/kots-1.112.0-r0.spdx.json -> /tmp/wolfictl-apk-3678799839/kots/var/lib/db/sbom/kots-1.112.1-r0.spdx.json (similarity: 0.99)

Changed: /tmp/wolfictl-apk-3678799839/kots-symlink-compat/var/lib/db/sbom/kots-symlink-compat-1.112.1-r0.spdx.json

Changed: /tmp/wolfictl-apk-3678799839/kots/usr/bin/kots

Changed: /tmp/wolfictl-apk-3678799839/kots/usr/bin/kotsadm

1 removed behaviors

RISK	KEY	DESCRIPTION	EVIDENCE
-MEDIUM	security_controls/linux/ufw	interacts with the ufw firewall	allow deny disable enable ufw

[octo-sts]

bincapz detected files with a risk score equal or higher than 'CRITICAL': Click to expand/collapse

/tmp/bincapz2915025190/packages/x86_64/kots-1.112.1-r0.apk/usr/bin/kots [🚨 CRITICAL]

RISK	KEY	DESCRIPTION	EVIDENCE
HIGH	combo/dropper/shell	fetches content and pipes it to a shell	[curl https://kots.io/install
HIGH	combo/stealer/creds	suspected data stealer	Atomic Bitcoin Bookmarks Chrome Chromium Firefox History Snowflake
CRITICAL	evasion/base64/php_functions	References multiple PHP functions in base64 form	<?php::$php BcnJhe::$f_Array FycmF5::$f_Array NvdW50::$f_count QXJyYX::$f_Array Y291bn::$f_count ZXhlY::$f_exec base64_decode c3lzdGVt::$f_system leGVj::$f_exec zeXN0ZW::$f_system
HIGH	evasion/rename_system_binary	Renames system binary	cp /usr/bin/mc
HIGH	ref/path/dev/shm	reference file within /dev/shm (world writeable)	/dev/shm/aufs.xinovfs

/tmp/bincapz2915025190/packages/x86_64/kots-1.112.1-r0.apk/usr/bin/kotsadm [🚨 CRITICAL]

RISK	KEY	DESCRIPTION	EVIDENCE
HIGH	combo/dropper/shell	fetches content and pipes it to a shell	[curl https://krew.sh/preflight
HIGH	combo/recon/upload_netinfo	Has a user agent and collects network info	/proc/net/route User-Agent
HIGH	combo/stealer/creds	suspected data stealer	Atomic Bitcoin Bookmarks Chrome Chromium Firefox History Snowflake
CRITICAL	evasion/base64/php_functions	References multiple PHP functions in base64 form	<?php::$php BcnJhe::$f_Array FycmF5::$f_Array NvdW50::$f_count QXJyYX::$f_Array Y291bn::$f_count ZXhlY::$f_exec base64_decode c3lzdGVt::$f_system leGVj::$f_exec zeXN0ZW::$f_system
HIGH	evasion/rename_system_binary	Renames system binary	cp /usr/bin/mc
HIGH	ref/path/dev/shm	reference file within /dev/shm (world writeable)	/dev/shm/aufs.xinovfs