'CloudImposer' Flaw in Google Cloud Affected Millions of Servers

Tenable researchers disclosed a critical dependency-confusion vulnerability called "CloudImposer" in Google Cloud Platform's Cloud Composer (also affecting App Engine and Cloud Functions) where use of the --extra-index-url option allowed public packages to override private internal packages. An attacker publishing a malicious package with the same name as an internal dependency could have achieved remote code execution and impacted large numbers of cloud deployments. Google patched the vulnerable installation script, updated documentation to recommend --index-url and Artifact Registry virtual repositories, inspected checksums, and reported no known exploitation.