CVE-2024-23650 (https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx): BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources. CVE-2024-24557 (https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc): Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases. Please bump to 24.0.9 and/or 25.0.2.
I guess 24.x was never fixed and 25.0.4 is the first fixed version. Would be nice if the bug was updated for the bumps!
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=72515324253c8d95723f4e5308eb0fe41ebed5cd commit 72515324253c8d95723f4e5308eb0fe41ebed5cd Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2024-09-28 07:32:55 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2024-09-28 07:33:05 +0000 [ GLSA 202409-29 ] Docker: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/816273 Bug: https://bugs.gentoo.org/869407 Bug: https://bugs.gentoo.org/877653 Bug: https://bugs.gentoo.org/886509 Bug: https://bugs.gentoo.org/903804 Bug: https://bugs.gentoo.org/905336 Bug: https://bugs.gentoo.org/925022 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202409-29.xml | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+)
