VDB
CISA-2024-23650
CISA-2024-23650
PUBLISHED
CVSS 5.3 MEDIUM
Reported by GitHub_M · Published January 31, 2024
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.
Risk Scores
CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| moby | buildkit | < 0.12.5 |
| moby | buildkit | *, < 0.12.5 |
| moby | buildkit | 0, 0 |
Timeline
- Jan 31, 2024 CVE Published
- Nov 12, 2024 CVE Updated
References
- https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx x_refsource_CONFIRM
- https://github.com/moby/buildkit/pull/4601 x_refsource_MISC
- https://github.com/moby/buildkit/releases/tag/v0.12.5 x_refsource_MISC