diff --git a/advisories/github-reviewed/2024/01/GHSA-4v98-7qmw-rqr8/GHSA-4v98-7qmw-rqr8.json b/advisories/github-reviewed/2024/01/GHSA-4v98-7qmw-rqr8/GHSA-4v98-7qmw-rqr8.json index d73731b3930..53c15155248 100644 --- a/advisories/github-reviewed/2024/01/GHSA-4v98-7qmw-rqr8/GHSA-4v98-7qmw-rqr8.json +++ b/advisories/github-reviewed/2024/01/GHSA-4v98-7qmw-rqr8/GHSA-4v98-7qmw-rqr8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4v98-7qmw-rqr8", - "modified": "2024-01-31T22:43:26Z", + "modified": "2024-02-01T17:48:26Z", "published": "2024-01-31T22:43:26Z", "aliases": [ "CVE-2024-23652" @@ -9,7 +9,10 @@ "summary": "BuildKit vulnerable to possible host system access from mount stub cleaner", "details": "### Impact\nA malicious BuildKit frontend or Dockerfile using `RUN --mount` could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system.\n\n### Patches\nThe issue has been fixed in v0.12.5\n\n### Workarounds\nAvoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing `RUN --mount` feature.\n\n### References\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H" + } ], "affected": [ { @@ -37,6 +40,10 @@ "type": "WEB", "url": "https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23652" + }, { "type": "WEB", "url": "https://github.com/moby/buildkit/pull/4603" @@ -44,15 +51,19 @@ { "type": "PACKAGE", "url": "https://github.com/moby/buildkit" + }, + { + "type": "WEB", + "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5" } ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], - "severity": "HIGH", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-01-31T22:43:26Z", - "nvd_published_at": null + "nvd_published_at": "2024-01-31T22:15:54Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-9p26-698r-w4hx/GHSA-9p26-698r-w4hx.json b/advisories/github-reviewed/2024/01/GHSA-9p26-698r-w4hx/GHSA-9p26-698r-w4hx.json index 706147d3d10..e5940363132 100644 --- a/advisories/github-reviewed/2024/01/GHSA-9p26-698r-w4hx/GHSA-9p26-698r-w4hx.json +++ b/advisories/github-reviewed/2024/01/GHSA-9p26-698r-w4hx/GHSA-9p26-698r-w4hx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9p26-698r-w4hx", - "modified": "2024-01-31T22:43:54Z", + "modified": "2024-02-01T17:48:10Z", "published": "2024-01-31T22:43:54Z", "aliases": [ "CVE-2024-23650" @@ -9,7 +9,10 @@ "summary": "BuildKit vulnerable to possible panic when incorrect parameters sent from frontend", "details": "### Impact\nA malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.\n\n### Patches\nThe issue has been fixed in v0.12.5\n\n### Workarounds\nAvoid using BuildKit frontends from untrusted sources. A frontend image is usually specified as the `#syntax` line on your Dockerfile, or with `--frontend` flag when using `buildctl build` command. \n\n### References\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } ], "affected": [ { @@ -37,6 +40,10 @@ "type": "WEB", "url": "https://github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23650" + }, { "type": "WEB", "url": "https://github.com/moby/buildkit/pull/4601" @@ -44,15 +51,19 @@ { "type": "PACKAGE", "url": "https://github.com/moby/buildkit" + }, + { + "type": "WEB", + "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5" } ], "database_specific": { "cwe_ids": [ - + "CWE-754" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-01-31T22:43:54Z", - "nvd_published_at": null + "nvd_published_at": "2024-01-31T22:15:53Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-m3r6-h7wv-7xxv/GHSA-m3r6-h7wv-7xxv.json b/advisories/github-reviewed/2024/01/GHSA-m3r6-h7wv-7xxv/GHSA-m3r6-h7wv-7xxv.json index d61f43fe0e7..a9c514e2f1e 100644 --- a/advisories/github-reviewed/2024/01/GHSA-m3r6-h7wv-7xxv/GHSA-m3r6-h7wv-7xxv.json +++ b/advisories/github-reviewed/2024/01/GHSA-m3r6-h7wv-7xxv/GHSA-m3r6-h7wv-7xxv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m3r6-h7wv-7xxv", - "modified": "2024-01-31T22:43:32Z", + "modified": "2024-02-01T17:48:14Z", "published": "2024-01-31T22:43:32Z", "aliases": [ "CVE-2024-23651" @@ -9,7 +9,10 @@ "summary": "BuildKit vulnerable to possible race condition with accessing subpaths from cache mounts", "details": "### Impact\nTwo malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.\n\n### Patches\nThe issue has been fixed in v0.12.5\n\n### Workarounds\nAvoid using BuildKit frontend from an untrusted source or building an untrusted Dockerfile containing cache mounts with `--mount=type=cache,source=...` options.\n\n### References\nhttps://www.openwall.com/lists/oss-security/2019/05/28/1\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N" + } ], "affected": [ { @@ -37,6 +40,10 @@ "type": "WEB", "url": "https://github.com/moby/buildkit/security/advisories/GHSA-m3r6-h7wv-7xxv" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23651" + }, { "type": "WEB", "url": "https://github.com/moby/buildkit/pull/4604" @@ -44,15 +51,19 @@ { "type": "PACKAGE", "url": "https://github.com/moby/buildkit" + }, + { + "type": "WEB", + "url": "https://github.com/moby/buildkit/releases/tag/v0.12.5" } ], "database_specific": { "cwe_ids": [ - + "CWE-362" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-31T22:43:32Z", - "nvd_published_at": null + "nvd_published_at": "2024-01-31T22:15:54Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-xr7r-f8xq-vfvv/GHSA-xr7r-f8xq-vfvv.json b/advisories/github-reviewed/2024/01/GHSA-xr7r-f8xq-vfvv/GHSA-xr7r-f8xq-vfvv.json index 2a90e030e32..a83123de706 100644 --- a/advisories/github-reviewed/2024/01/GHSA-xr7r-f8xq-vfvv/GHSA-xr7r-f8xq-vfvv.json +++ b/advisories/github-reviewed/2024/01/GHSA-xr7r-f8xq-vfvv/GHSA-xr7r-f8xq-vfvv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xr7r-f8xq-vfvv", - "modified": "2024-01-31T22:44:08Z", + "modified": "2024-02-01T17:48:04Z", "published": "2024-01-31T22:44:08Z", "aliases": [ "CVE-2024-21626" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21626" + }, { "type": "WEB", "url": "https://github.com/opencontainers/runc/commit/02120488a4c0fc487d1ed2867e901eeed7ce8ecf" @@ -54,6 +58,10 @@ { "type": "WEB", "url": "https://github.com/opencontainers/runc/releases/tag/v1.1.12" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/01/1" } ], "database_specific": { @@ -63,6 +71,6 @@ "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-01-31T22:44:08Z", - "nvd_published_at": null + "nvd_published_at": "2024-01-31T22:15:53Z" } } \ No newline at end of file