GitHub Advisoryadvisory · Go

GHSA-9p26-698r-w4hx BuildKit vulnerable to possible panic when incorrect parameters sent from frontend

MEDIUM Published 2024-01-31 Modified 2024-03-04 Official page ↗
Aliases
CVE-2024-23650
Ecosystem
Go
Packages
github.com/moby/buildkit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-754
Reviewed
2024-01-31

Affected packages

• Go github.com/moby/buildkit: < 0.12.5 → fixed in 0.12.5

Description

Impact A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. Patches The issue has been fixed in v0.12.5 Workarounds Avoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the `#syntax` line on your Dockerfile, or with `--frontend` flag when using `buildctl build` command. References

Related

Alias · CVE (1)

  • CVE-2024-23650 BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. vulnerability

Weakness · CWE (1)

  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness

References