DEBIAN-CVE-2024-24557
Record from OSV · Published February 1, 2024
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| docker.io | Debian:14 | 26.1.4+dfsg1-9 |
| docker.io | Debian:13 | 26.1.4+dfsg1-9 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | docker.io | 0 |
| Debian:13 | docker.io | 0 |
| Debian:12 | docker.io | 20.10.25+dfsg1-2, 20.10.25+dfsg1-3, 20.10.25+dfsg1-4 |
Timeline
- Feb 1, 2024 CVE Published
- Sep 15, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2024-24557
vulnetix vdb fixes DEBIAN-CVE-2024-24557Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2024-24557/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart