Most recent entries from all

bdu:2024-01029

BELL-CVE-2024-23652

Affected: Alpaquita:23: podman, Alpaquita:stream: docker, Alpaquita:stream: podman

certfr-2024-avi-0841 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0841

CLEANSTART-2025-VO24808 — BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner

Affected: CleanStart: buildkit, CleanStart: buildkitd

CVE-2024-23652 affects multiple packages. BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. See references for individual vulnerability details.

EUVD-2026-244986

fkie_cve-2024-23652

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.

GHSA-4v98-7qmw-rqr8 — BuildKit vulnerable to possible host system access from mount stub cleaner

Affected: Go: github.com/moby/buildkit

### Impact A malicious BuildKit frontend or Dockerfile using `RUN --mount` could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system.

### Patches The issue has been fixed in v0.12.5

### Workarounds Avoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing `RUN --mount` feature.

### References

gsd-2024-23652

msrc_CVE-2024-23652 — BuildKit possible host system access from mount stub cleaner

msrc_CVE-2024-23652

openSUSE-SU-2024:13651-1 — buildkit-0.12.5-1.1 on GA media

buildkit-0.12.5-1.1 on GA media

SUSE-SU-2024:0587-1 — Security update for docker

Security update for docker

UBUNTU-CVE-2024-23652

Affected: Ubuntu:Pro:16.04:LTS: docker.io, Ubuntu:Pro:18.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io, Ubuntu:Pro:20.04:LTS: docker.io-app, Ubuntu:22.04:LTS: docker.io-app, Ubuntu:Pro:22.04:LTS: docker.io, Ubuntu:24.04:LTS: docker.io-app, Ubuntu:Pro:24.04:LTS: docker.io

WID-SEC-W-2024-0272 — docker: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Docker ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder Dateien zu manipulieren.