CVE-2024-24557

🗓️ 01 Feb 2024 16:26:29Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 408 Views

Moby open-source project by Docker is prone to cache poisoning in classic builder cache system. Attackers can poison cache by making users pull a specially crafted image. Impacting 23.0+ with Buildkit off or /build API usage and all versions before 23.0. Patched in 24.0.9 and 25.0.2 releases

Reporter	Title	Published	Views	Family All 210
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilies in Go affect IBM Robotic Process Automation for Cloud Pak.	2 Dec 202415:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in docker affect Cloud Pak System[CVE-2024-24557, CVE-2024-29018]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple packages which are vulnerable to multiple CVEs	8 Oct 202408:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	22 Aug 202417:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in moby: classic builder cache poisoning	26 Feb 202518:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Insufficient Verification of Data Authenticity in Moby via Grafana (CVE-2024-24557)	29 Jul 202520:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	20 Jun 202400:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	22 May 202509:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	23 Apr 202418:12	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Application Manager 4.5.6 addresses the security vulnerabilities listed in the CVEs below.	26 Jun 202414:33	–	ibm

NVD

Vulners

Node

mobyproject mobyRange<24.0.9

mobyproject mobyRange25.0.0–25.0.2

[
  {
    "vendor": "moby",
    "product": "moby",
    "versions": [
      {
        "version": ">= 25.0.0, < 25.0.2",
        "status": "affected"
      },
      {
        "version": " < 24.0.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc
github	www.github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae

17 Jun 2026 07:14Current

7.4High risk

Vulners AI Score7.4

CVSS 3.16.9 - 7.8

EPSS0.00258

SSVC