GO-2024-2493

Host system file access in github.com/moby/buildkit

En bref

Publiée: 2024-02-13 18:23 UTC
Mise à jour: 2026-02-04 03:54 UTC
CVE: CVE-2024-23651
Alias: GHSA-m3r6-h7wv-7xxv

Description

Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to files from the host system being accessible to the build container.

Paquets affectés

Paquet	Versions
Go · github.com/moby/buildkit	introduced 0, fixed 0.12.5

Références

https://github.com/moby/buildkit/pull/4604 FIX

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database