Vulnerability Report: GO-2024-2497

  • CVE-2024-23653, GHSA-wr6v-9f75-vh2g
  • Affects: github.com/moby/buildkit
  • Published: Feb 07, 2024
  • Modified: May 20, 2024

BuildKit provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask BuildKit to run a container with elevated privileges. Normally, running such containers is only allowed if special security.insecure entitlement is enabled both by buildkitd configuration and allowed by the user initializing the build request.

Affected Packages

Aliases

References

Credits

  • @rmcnamara-snyk

Feedback

See anything missing or incorrect? Suggest an edit to this report.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.