PT-2023-20454 · Buildctl+2 · Buildctl+2
Oscar Alberto Tovar
·
Published
2023-03-06
·
Updated
2026-02-06
·
CVE-2023-26054
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BuildKit versions v0.11.0 through v0.11.3
Description
The issue arises when a build request contains a Git URL with credentials and creates a provenance attestation describing the build. These credentials could be visible from the provenance attestation. The Git URL can be passed in two ways: invoking build directly from a URL with credentials or sending additional version control system (VCS) info hint parameters on builds from a local source. When a build is performed under specific conditions where credentials were passed to BuildKit, they may be visible to everyone who has access to the provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0.
Recommendations
For versions v0.11.0 through v0.11.3, upgrade to version v0.11.4 to fix the issue.
For users unable to upgrade, disable VCS info hints by setting
BUILDX GIT INFO=0 as a temporary workaround.
In Docker Buildx, VCS info hint can be disabled by setting BUILDX GIT INFO=0.
buildctl does not set VCS hints based on .git directory, and values would need to be passed manually with --opt.
It is recommended to pass credentials with build secrets when building directly from Git URL as a more secure alternative than modifying the URL.Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Buildkit
Docker Buildx
Buildctl