CVE-2023-26054

🗓️ 06 Mar 2023 19:10:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 89 Views🌐 WEB

BuildKit CVE-2023-26054: Git URL credentials visible in provenance attestatio

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 26
RedhatCVE	CVE-2023-26054	9 Mar 202300:15	–	redhatcve
OSV	CVE-2023-26054	6 Mar 202319:15	–	osv
OSV	Buildkit credentials inlined to Git URLs could end up in provenance attestation	7 Mar 202320:09	–	osv
Vulnrichment	CVE-2023-26054 Credentials inlined to Git URLs could end up in provenance attestation in BuildKit	6 Mar 202318:05	–	vulnrichment
AlpineLinux	CVE-2023-26054	6 Mar 202319:15	–	alpinelinux
NVD	CVE-2023-26054	6 Mar 202319:15	–	nvd
Veracode	Information Disclosure	8 Mar 202311:33	–	veracode
Github Security Blog	Buildkit credentials inlined to Git URLs could end up in provenance attestation	7 Mar 202320:09	–	github
Prion	Race condition	6 Mar 202319:15	–	prion
Cvelist	CVE-2023-26054 Credentials inlined to Git URLs could end up in provenance attestation in BuildKit	6 Mar 202318:05	–	cvelist

Nvd

Vulners

Node

mobyproject buildkitRange0.10.0–0.11.4

[
  {
    "vendor": "moby",
    "product": "buildkit",
    "versions": [
      {
        "version": ">= 0.10.0, < 0.11.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/
github	www.github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604
github	www.github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/

Parameter	Position	Path	Description	CWE
build	query param	/buildctl	Git URL containing credentials can be exposed in provenance attestation.	CWE-200
git_url	query param	/buildctl	Git URL containing credentials can be exposed in provenance attestation.	CWE-200

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

06 Mar 2023 19:15Current

6.6Medium risk

Vulners AI Score6.6

CVSS36.5

EPSS0.00785

SSVC

CWE-200