Skip to content

Commit ab65a78

Browse files
committed
Skip GDAL VRT driver to mitigate security issue
Skip VRT driver to prevent arbitrary file reading vulnerability reported in GDAL issue OSGeo/gdal#12645 and developmentseed/titiler#1180. This configuration prevents exploitation of GDAL's VRT driver which can be used to read arbitrary files from the filesystem.
1 parent b98818c commit ab65a78

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

helm-chart/eoapi/values.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,7 @@ raster:
247247
GDAL_HTTP_MERGE_CONSECUTIVE_RANGES: "YES"
248248
GDAL_HTTP_MULTIPLEX: "YES"
249249
GDAL_HTTP_VERSION: "2"
250+
GDAL_SKIP: "VRT" # skip VRT driver to avoid https://github.com/OSGeo/gdal/issues/12645
250251
PYTHONWARNINGS: "ignore"
251252
VSI_CACHE: "TRUE"
252253
VSI_CACHE_SIZE: "5000000" # 5 MB (per file-handle)

0 commit comments

Comments
 (0)