The vulnerability of the ImageBuild() function in the software for creating containerized systems called Moby allows a attacker to execute a cache poisoning attack.

🗓️ 06 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Moby ImageBuild vulnerability enables cache poisoning from unverified data sources during endpoint processing.

Reporter	Title	Published	Views	Family All 210
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilies in Go affect IBM Robotic Process Automation for Cloud Pak.	2 Dec 202415:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in docker affect Cloud Pak System[CVE-2024-24557, CVE-2024-29018]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple packages which are vulnerable to multiple CVEs	8 Oct 202408:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	22 Aug 202417:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in moby: classic builder cache poisoning	26 Feb 202518:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Insufficient Verification of Data Authenticity in Moby via Grafana (CVE-2024-24557)	29 Jul 202520:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	20 Jun 202400:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	22 May 202509:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	23 Apr 202418:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Application Manager 4.5.6 addresses the security vulnerabilities listed in the CVEs below.	26 Jun 202414:33	–	ibm

Vulners

Node

moby mobyRange<24.0.9

OR

moby mobyRange25.0.0–25.0.2

Source	Link
github	www.github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae
github	www.github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc
access	www.access.redhat.com/security/cve/CVE-2024-24557
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1/
web	www.web.nvd.nist.gov/view/vuln/detail

04 Mar 2026 00:00Current

7High risk

Vulners AI Score7

CVSS 25.2

CVSS 36.9

EPSS0.00258

Moby ImageBuild cache poisoning data source verification endpoint processing