CVE-2024-23650

MEDIUM5.3

BuildKit possible panic when incorrect parameters sent from frontend

Published Jan 31, 2024

Modified 1 years ago

Details

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

References

WEB

https://github.com/moby/buildkit/pull/4601

WEB

https://github.com/moby/buildkit/releases/tag/v0.12.5

WEB

https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-23650

CVSS Analysis

CVSS v3.1

5.3