chore(deps): update dawidd6/action-download-artifact action to v6 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
dawidd6/action-download-artifact	action	major	v2 → v6

---

Artifact poisoning vulnerability in action-download-artifact v5 and earlier

GHSA-5xr6-xhww-33m4

More information

Details

Summary

In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts (such as malicious executables) into a privileged workflow context, as creating a fork requires no privileges.

Users should immediately upgrade to v6 or newer, which changes the default behavior to avoid searching forks for matching artifacts. Users who cannot upgrade should explicitly set allow_forks: false to disable searching forks for artifacts.

Details

GitHub's artifact storage for workflows does not natively distinguish between artifacts created by a repository and artifacts created by forks of that repository. As a result, attempting to retrieve the "latest" artifact for a workflow run can return artifacts produced by a fork, rather than its upstream.

Because any GitHub user can create a fork of a public repository, this allows for artifact poisoning in the following scenarios (as well as potentially others):

1. Repository alice/foo runs build.yml, producing build.exe
2. Repository alice/foo runs publish.yml, which uses action-download-artifact@v5 to retrieve the latest build.exe from build.yml

To compromise publish.yml in this scenario, Mallory forks alice/foo to mallory/foo, and then modifies build.yml to produce a compromised build.exe. Mallory can then repeatedly trigger their copy of build.yml to ensure that their compromised build.exe is always the latest artifact, meaning that Alice's publish.yml will retrieve it.

Additional details on this vulnerability can be found in this blog post from 2022:

• https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust

Impact

This vulnerability impacts all repositories on GitHub that use action-download-artifacts@v5 or older and do not disable allow_forks: true, which is the default.

If a repository is affected, the severity ranges from downstream contamination (such as publishing attacker-controlled artifacts) to direct workflow compromise (if the retrieved artifact is then executed in a privileged workflow context, such as push or pull_request_target).

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/dawidd6/action-download-artifact/security/advisories/GHSA-5xr6-xhww-33m4
• https://github.com/dawidd6/action-download-artifact/commit/bf251b5aa9c2f7eeb574a96ee720e24f801b7c11
• https://www.legitsecurity.com/blog/artifact-poisoning-vulnerability-discovered-in-rust
• https://github.com/advisories/GHSA-5xr6-xhww-33m4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

dawidd6/action-download-artifact (dawidd6/action-download-artifact)

v6

Compare Source

Full Changelog: dawidd6/action-download-artifact@v5...v6

v5

Compare Source

Full Changelog: dawidd6/action-download-artifact@v4...v5

v4

Compare Source

What's Changed

• VERSIONING CHANGE: now there will only be major releases of this action, e.g. v5, v6 and so on
• build(deps): bump undici from 5.28.3 to 5.28.4 by @​dependabot in #​284
• build(deps): bump @​actions/artifact from 2.1.4 to 2.1.5 by @​dependabot in #​285
• build(deps): bump @​actions/artifact from 2.1.5 to 2.1.7 by @​dependabot in #​287
• build(deps): bump adm-zip from 0.5.12 to 0.5.13 by @​dependabot in #​289
• Set allow_forks to false by default by @​timweri in #​290

New Contributors

• @​timweri made their first contribution in #​290

Full Changelog: dawidd6/action-download-artifact@v3...v4

v3.1.4

Compare Source

What's Changed

• build(deps): bump adm-zip from 0.5.10 to 0.5.12 by @​dependabot in #​282
• build(deps): bump @​actions/artifact from 2.1.2 to 2.1.4 by @​dependabot in #​280
• fix: accept expired artifacts with documentation url by @​wdconinc in #​283

New Contributors

• @​wdconinc made their first contribution in #​283

Full Changelog: dawidd6/action-download-artifact@v3...v3.1.4

v3.1.3

Compare Source

What's Changed

• node_modules: upgrade by @​dawidd6 in #​276
• build(deps): bump @​actions/artifact from 2.1.1 to 2.1.2 by @​dependabot in #​277

Full Changelog: dawidd6/action-download-artifact@v3.1.2...v3.1.3

v3.1.2

Compare Source

What's Changed

• Read workflow_search input as a boolean by @​klutchell in #​273

New Contributors

• @​klutchell made their first contribution in #​273

Full Changelog: dawidd6/action-download-artifact@v3.1.1...v3.1.2

v3.1.1

Compare Source

What's Changed

• Head sha revert by @​romangg in #​271
• build(deps): bump undici from 5.28.2 to 5.28.3 by @​dependabot in #​272

Full Changelog: dawidd6/action-download-artifact@v3...v3.1.1

v3.1.0

Compare Source

What's Changed

• build(deps): bump @​actions/artifact from 2.0.0 to 2.0.1 by @​dependabot in #​267
• build(deps): bump actions/upload-artifact from 3 to 4 by @​dependabot in #​264
• build(deps): bump @​actions/artifact from 2.0.1 to 2.1.1 by @​dependabot in #​269
• Optionally search for workflows by @​romangg in #​270

New Contributors

• @​romangg made their first contribution in #​270

Full Changelog: dawidd6/action-download-artifact@v3...v3.1.0

v3.0.0

Compare Source

Node was updated from 16 to 20.
Node 20 requires glibc>=2.28.

v3

Compare Source

v2.28.0

Compare Source

v2.27.0

Compare Source

v2.26.1

Compare Source

v2.26.0

Compare Source

v2.25.0

Compare Source

v2.24.4

Compare Source

v2.24.3

Compare Source

v2.24.2

Compare Source

v2.24.1

Compare Source

v2.24.0

Compare Source

v2.23.0

Compare Source

v2.22.0

Compare Source

v2.21.1

Compare Source

v2.21.0

Compare Source

v2.20.0

Compare Source

v2.19.0

Compare Source

v2.18.0

Compare Source

v2.17.0

Compare Source

v2.16.0

Compare Source

v2.15.0

Compare Source

v2.14.1

Compare Source

v2.14.0

Compare Source

v2.13.0

Compare Source

v2.12.0

Compare Source

v2.11.1

Compare Source

v2.11.0

Compare Source

v2.10.0

Compare Source

v2.9.0

Compare Source

v2.8.1

Compare Source

v2.8.0

Compare Source

v2.7.0

Compare Source

v2.6.3

Compare Source

v2.6.2

Compare Source

v2.6.1

Compare Source

v2.6.0

Compare Source

• added an ability to download artifacts from most recent workflow run, when neither of pr or commit inputs are specified
• fixed deprecation warning
• updated NPM dependecies

v2.5.0

Compare Source

v2.4.0

Compare Source

v2.3.1

Compare Source

v2.3.0

Compare Source

v2.2.0

Compare Source

v2.1.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.