271 matches found
CBL Mariner 2.0 Security Update: containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc (CVE-2023-47108)
The version of containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-47108 advisory. - OpenTelemetry-Go Contrib is a collecti...
CVE-2024-24786 affecting package docker-buildx for versions less than 0.14.0-1
CVE-2024-24786 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-45288 affecting package docker-buildx for versions less than 0.14.0-1
CVE-2023-45288 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-47108 affecting package docker-buildx for versions less than 0.14.0-1
CVE-2023-47108 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-45142 affecting package docker-buildx for versions less than 0.14.0-1
CVE-2023-45142 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1
CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2023-44487 affecting package docker-buildx for versions less than 0.14.0-1
CVE-2023-44487 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...
CVE-2024-23653 affecting package docker-buildx for versions less than 0.14.0-1
CVE-2024-23653 affecting package docker-buildx for versions less than 0.14.0-1. An upgraded version of the package is available that resolves this issue...
AZL-38260 CVE-2023-45288 affecting package docker-buildx for versions less than 0.14.0-1
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...
AZL-35582 CVE-2024-24786 affecting package moby-buildx for versions less than 0.7.1-24
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
AZL-35641 CVE-2024-24786 affecting package docker-buildx for versions less than 0.14.0-1
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
CVE-2024-23653 affecting package moby-buildx for versions less than 0.7.1-18
CVE-2024-23653 affecting package moby-buildx for versions less than 0.7.1-18. A patched version of the package is available...
CVE-2021-44716 affecting package moby-buildx for versions less than 0.7.1-18
CVE-2021-44716 affecting package moby-buildx for versions less than 0.7.1-18. A patched version of the package is available...
CVE-2022-21698 affecting package moby-buildx for versions less than 0.7.1-16
CVE-2022-21698 affecting package moby-buildx for versions less than 0.7.1-16. A patched version of the package is available...
AZL-34078 CVE-2024-23653 affecting package moby-buildx for versions less than 0.7.1-18
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...
AZL-35433 CVE-2024-23653 affecting package docker-buildx for versions less than 0.14.0-1
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...
AZL-35432 CVE-2024-23650 affecting package docker-buildx for versions less than 0.14.0-1
BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...
AZL-35435 CVE-2023-48795 affecting package docker-buildx for versions less than 0.14.0-1
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...
AZL-35434 CVE-2023-47108 affecting package docker-buildx for versions less than 0.14.0-1
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the...