Threat Investigation
Request a demo

CVE-2024-23650

Medium

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

SeverityMedium
CVSS5.3
Exploit probability—
ProductMobyproject Buildkit
PublishedJan 31, 2024
First seenJan 31, 2024
Weakness typeCWE-754CWE-754

How to fix

Update
  • mobyproject buildkit0.12.5 or later
  • github.com/moby/buildkit0.12.5 or later

Affected products

ProductAffected versionsFixed in
mobyproject buildkitv < 0.12.50.12.5
github.com/moby/buildkitGov < 0.12.50.12.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.