CVE-2025-11065 affecting package moby-buildx for versions less than 0.7.1-28

CVE-2025-11065 affecting package moby-buildx for versions less than 0.7.1-28. A patched version of the package is available...

AZL-75524 CVE-2025-11065 affecting package moby-buildx for versions less than 0.7.1-28

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

CVE-2025-65637 affecting package moby-buildx for versions less than 0.7.1-27

CVE-2025-65637 affecting package moby-buildx for versions less than 0.7.1-27. A patched version of the package is available...

AZL-71629 CVE-2025-65637 affecting package moby-buildx for versions less than 0.7.1-27

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...

CVE-2025-0495 affecting package moby-buildx for versions less than 0.7.1-25

CVE-2025-0495 affecting package moby-buildx for versions less than 0.7.1-25. A patched version of the package is available...

AZL-58854 CVE-2025-0495 affecting package moby-buildx for versions less than 0.7.1-25

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...

CVE-2024-24786 affecting package moby-buildx for versions less than 0.7.1-24

CVE-2024-24786 affecting package moby-buildx for versions less than 0.7.1-24. A patched version of the package is available...

CBL Mariner 2.0 Security Update: cf-cli / cri-o / gh / libcontainers-common (CVE-2021-43565)

The version of cf-cli / cri-o / gh / libcontainers-common installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-43565 advisory. - The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of...

CVE-2021-43565 affecting package moby-buildx for versions less than 0.7.1-20

CVE-2021-43565 affecting package moby-buildx for versions less than 0.7.1-20. A patched version of the package is available...

AZL-35582 CVE-2024-24786 affecting package moby-buildx for versions less than 0.7.1-24

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2021-44716 affecting package moby-buildx for versions less than 0.7.1-18

CVE-2021-44716 affecting package moby-buildx for versions less than 0.7.1-18. A patched version of the package is available...

CVE-2024-23653 affecting package moby-buildx for versions less than 0.7.1-18

CVE-2024-23653 affecting package moby-buildx for versions less than 0.7.1-18. A patched version of the package is available...

CVE-2022-21698 affecting package moby-buildx for versions less than 0.7.1-16

CVE-2022-21698 affecting package moby-buildx for versions less than 0.7.1-16. A patched version of the package is available...

AZL-34078 CVE-2024-23653 affecting package moby-buildx for versions less than 0.7.1-18

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...

CVE-2023-44487 affecting package moby-buildx for versions less than 0.7.1-14

CVE-2023-44487 affecting package moby-buildx for versions less than 0.7.1-14. A patched version of the package is available...

AZL-31325 CVE-2023-44487 affecting package moby-buildx for versions less than 0.7.1-14

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-43344 CVE-2021-43565 affecting package moby-buildx for versions less than 0.7.1-20

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...

AZL-33614 CVE-2022-21698 affecting package moby-buildx for versions less than 0.7.1-16

clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and...

AZL-33613 CVE-2021-44716 affecting package moby-buildx for versions less than 0.7.1-18

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

CVE-2021-21284 affecting package moby-buildx 0.4.1-3

CVE-2021-21284 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...