PT-2026-28525 · Buildkit+3 · Buildkit+3
CVSS v2.0
10
Crítica
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
BuildKit versions prior to 0.28.1
Description
BuildKit is a toolkit for converting source code to build artifacts. When using a custom BuildKit frontend, a malicious frontend can craft an API message that causes files to be written outside of the BuildKit state directory for the execution context. This issue requires using an untrusted BuildKit frontend set with
#syntax or --build-arg BUILDKIT SYNTAX. Using these options with a well-known frontend image like docker/dockerfile is not affected. The API message crafted by the frontend can lead to file escape outside of the storage root.Recommendations
Versions prior to 0.28.1 should be updated to version 0.28.1 or later.
Exploit
Correção
DoS
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Buildkit
Linuxmint
Red Os
Ubuntu