What's going on with the latest release? (SupplyChainAttackPoC for Meta BB)

[theolivenbaum]

The latest release (9.5.2) is marked as "SupplyChainAttackPoC for Meta BB" - could anyone from Meta please elaborate on what's going on?

All I could find is this post on oss-security: https://www.openwall.com/lists/oss-security/2024/08/22/2, but some official note would be great to explain if this is just a mistake or an actual security issue.

[hx235]

Edit: Hi - I'm the release manager and we are investigating why the titled got changed. The title has been reverted and changed to RocksDB 9.5.2

[theolivenbaum]

@hx235 anything we should be worried about? Do I need to retract the latest release of our rocksdb wrapper?

[anand1976]

We've determined that the release title change was part of an effort sponsored by Meta to identify security vulnerabilities. This was not due to a malicious user. We have mitigated the vulnerability and there is no risk due to it going forward.

[ericpruitt]

Are any details going to be made available to the public?

[andreasstieger]

Not only the title got changed - the content did.

[adamretter]

@andreasstieger can you describe where the content was changed please?

[andreasstieger]

From the archive pages I see the short commit for this tag changed from d1826fb to a7e70f9.

https://web.archive.org/web/20240821151922/https://github.com/facebook/rocksdb/releases/tag/v9.5.2

https://web.archive.org/web/20240822053615/https://github.com/facebook/rocksdb/releases/tag/v9.5.2

[jaykorean]

The commit change in the release tag was something that the release manager did internally, not from an external user.

Regarding the title change done due to a security vulnerability, we completed an internal verification and confirmed that there have been no bad or unintended changes injected into 9.5.2. We mitigated the issue by disabling the self-hosted run and down-scoping the GITHUB_TOKEN accesses used for the workflows.

We will put together all of the details and communicate this out to the public via our communication channels.

[andreasstieger]

How many ways are there to not say that this project force-pushed a publicly visible tag?

[hx235]

How many ways are there to not say that this project force-pushed a publicly visible tag?

Edit: Though not relevant to the title change/security vulnerability here, in general, force-pushing to a publicly visible tag is not a good way to correct the mistake originally made in the tag (e.g, pointing to the wrong commit). We will avoid doing that in the future. Thanks!

[equinox]

We will put together all of the details and communicate this out to the public via our communication channels.

Hi there, could you please link said public communications here? I seemed to have missed it. Thanks!