From 37b5acf4c5132c8cbef8d7c05409812f5c0f9e0e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 31 May 2024 20:45:44 +0000 Subject: [PATCH] Publish Advisories GHSA-xw73-rw38-6vjc GHSA-8cm5-jfj2-26q7 --- .../GHSA-xw73-rw38-6vjc/GHSA-xw73-rw38-6vjc.json | 4 ++-- .../GHSA-8cm5-jfj2-26q7/GHSA-8cm5-jfj2-26q7.json | 16 ++++++++++++++-- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/advisories/github-reviewed/2024/02/GHSA-xw73-rw38-6vjc/GHSA-xw73-rw38-6vjc.json b/advisories/github-reviewed/2024/02/GHSA-xw73-rw38-6vjc/GHSA-xw73-rw38-6vjc.json index a3ec9ff0f09..df2765703c4 100644 --- a/advisories/github-reviewed/2024/02/GHSA-xw73-rw38-6vjc/GHSA-xw73-rw38-6vjc.json +++ b/advisories/github-reviewed/2024/02/GHSA-xw73-rw38-6vjc/GHSA-xw73-rw38-6vjc.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-xw73-rw38-6vjc", - "modified": "2024-03-20T17:07:42Z", + "modified": "2024-05-31T20:43:41Z", "published": "2024-02-01T20:51:19Z", "aliases": [ "CVE-2024-24557" ], "summary": "Classic builder cache poisoning", - "details": "The classic builder cache system is prone to cache poisoning if the image is built `FROM scratch`.\nAlso, changes to some instructions (most important being `HEALTHCHECK` and `ONBUILD`) would not cause a cache miss.\n\n\nAn attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.\n\nFor example, an attacker could create an image that is considered as a valid cache candidate for:\n```\nFROM scratch\nMAINTAINER Pawel\n```\n\nwhen in fact the malicious image used as a cache would be an image built from a different Dockerfile.\n\nIn the second case, the attacker could for example substitute a different `HEALTCHECK` command.\n\n\n### Impact\n\n23.0+ users are only affected if they explicitly opted out of Buildkit (`DOCKER_BUILDKIT=0` environment variable) or are using the `/build` API endpoint (which uses the classic builder by default).\n\nAll users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting.\n\nImage build API endpoint (`/build`) and `ImageBuild` function from `github.com/docker/docker/client` is also affected as it the uses classic builder by default. \n\n\n### Patches\n\nPatches are included in Moby releases:\n\n- v25.0.2\n- v24.0.9\n\n### Workarounds\n\n- Use `--no-cache` or use Buildkit if possible (`DOCKER_BUILDKIT=1`, it's default on 23.0+ assuming that the buildx plugin is installed).\n- Use `Version = types.BuilderBuildKit` or `NoCache = true` in `ImageBuildOptions` for `ImageBuild` call.\n\n", + "details": "The classic builder cache system is prone to cache poisoning if the image is built `FROM scratch`.\nAlso, changes to some instructions (most important being `HEALTHCHECK` and `ONBUILD`) would not cause a cache miss.\n\n\nAn attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps.\n\nFor example, an attacker could create an image that is considered as a valid cache candidate for:\n```\nFROM scratch\nMAINTAINER Pawel\n```\n\nwhen in fact the malicious image used as a cache would be an image built from a different Dockerfile.\n\nIn the second case, the attacker could for example substitute a different `HEALTCHECK` command.\n\n\n### Impact\n\n23.0+ users are only affected if they explicitly opted out of Buildkit (`DOCKER_BUILDKIT=0` environment variable) or are using the `/build` API endpoint (which uses the classic builder by default).\n\nAll users on versions older than 23.0 could be impacted. An example could be a CI with a shared cache, or just a regular Docker user pulling a malicious image due to misspelling/typosquatting.\n\nImage build API endpoint (`/build`) and `ImageBuild` function from `github.com/docker/docker/client` is also affected as it the uses classic builder by default. \n\n\n### Patches\n\nPatches are included in Moby releases:\n\n- v25.0.2\n- v24.0.9\n- v23.0.10\n\n### Workarounds\n\n- Use `--no-cache` or use Buildkit if possible (`DOCKER_BUILDKIT=1`, it's default on 23.0+ assuming that the buildx plugin is installed).\n- Use `Version = types.BuilderBuildKit` or `NoCache = true` in `ImageBuildOptions` for `ImageBuild` call.\n\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/05/GHSA-8cm5-jfj2-26q7/GHSA-8cm5-jfj2-26q7.json b/advisories/github-reviewed/2024/05/GHSA-8cm5-jfj2-26q7/GHSA-8cm5-jfj2-26q7.json index e481c829332..32c697c1896 100644 --- a/advisories/github-reviewed/2024/05/GHSA-8cm5-jfj2-26q7/GHSA-8cm5-jfj2-26q7.json +++ b/advisories/github-reviewed/2024/05/GHSA-8cm5-jfj2-26q7/GHSA-8cm5-jfj2-26q7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8cm5-jfj2-26q7", - "modified": "2024-05-29T15:25:52Z", + "modified": "2024-05-31T20:44:41Z", "published": "2024-05-29T15:25:51Z", "aliases": [ "CVE-2024-34715" @@ -40,13 +40,25 @@ "type": "WEB", "url": "https://github.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34715" + }, { "type": "WEB", "url": "https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c" }, + { + "type": "WEB", + "url": "https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords" + }, { "type": "PACKAGE", "url": "https://github.com/ethyca/fides" + }, + { + "type": "WEB", + "url": "https://github.com/sqlalchemy/sqlalchemy/discussions/6615" } ], "database_specific": { @@ -57,6 +69,6 @@ "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2024-05-29T15:25:51Z", - "nvd_published_at": null + "nvd_published_at": "2024-05-29T17:16:20Z" } } \ No newline at end of file