Advisories · Technology
Moby BuildKit.
Every CVE that names Moby BuildKit among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.5 Medium
Malicious client could set xattr value outside of BuildKit state directory
- Moby BuildKit
- CWE-61
- CVSS 6.7 Medium
Possible panic from Git source resolver
- moby BuildKit
- Memory corruption
- CVSS 6.9 Medium
Malformed LLB file operation can crash buildkitd
- moby BuildKit
- CWE-129
- CVSS 5.8 Medium
BuildKit proxy CA cleanup can be disrupted by build steps
- moby BuildKit
- Race condition
- CVSS 6.0 Medium
Crafted Git build source can bypass certain policy validation
- moby BuildKit
- CWE-180
- CVSS 6.8 Medium
Oversized Dockerfile or .dockerignore can exhaust buildkitd memory
- moby BuildKit
- Denial of service
- CVSS 6.9 Medium
Malformed MergeOp can crash the BuildKit daemon
- moby BuildKit
- CWE-129
- CVSS 6.0 Medium
BuildKit improperly handles special files in build snapshots
- moby BuildKit
- CWE-441
- CVSS 5.7 Medium
A malicious frontend can cause a daemon panic
- moby BuildKit
- CWE-567
- CVSS 7.5 High
Cache poisoning via unvalidated image layer DiffIDs
- moby BuildKit
- CWE-354
- CVSS 5.9 Medium
Container blob cache can accept unverified content
- moby BuildKit
- CWE-354
- CVSS 7.1 High
Starting daemon with --cdi-disabled flag can lead to panic on specific builds
- moby BuildKit
- Memory corruption
- CVSS 7.2 High
BuildKit: Malicious client can bypass destination directory validation on local sources upload
- moby buildkit
- Path traversal
- CVSS 6.5 Medium
Git source checkout from a bundle file could lead to command injection
- moby BuildKit
- Command injection
- CVSS 6.3 Medium
Possible panic when incorrect parameters sent from frontend
- moby BuildKit
- CWE-20
- CVSS 3.3 Low
LLB file operation can be tricked to remove /tmp directory contents
- moby BuildKit
- Path traversal
- CVSS 6.9 Medium
Malicious client can bypass destination directory validation on local sources upload
- moby BuildKit
- Path traversal
- CVSS 5.6 Medium
WCOW cache mount source selector resolves NTFS junctions outside of cache root
- moby BuildKit
- Path traversal