47 matches found
[SECURITY] Fedora 45 Update: stargz-snapshotter-0.19.0-1.fc45
Fast container image distribution plugin with lazy pulling...
Fedora 45 : stargz-snapshotter (2026-7dfdd0e080)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7dfdd0e080 advisory. Release of stargz snapshotter v0.19.0, containing fixes for CVE-2026-71482 and CVE-2026-77395. Release note is available on...
[SECURITY] Fedora 43 Update: stargz-snapshotter-0.19.0-1.fc43
Fast container image distribution plugin with lazy pulling...
[SECURITY] Fedora 44 Update: stargz-snapshotter-0.19.0-1.fc44
Fast container image distribution plugin with lazy pulling...
Fedora 44 : stargz-snapshotter (2026-95476dd623)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-95476dd623 advisory. Release of stargz snapshotter v0.19.0, containing fixes for CVE-2026-71482 and CVE-2026-77395. Release note is available on...
Fedora 43 : stargz-snapshotter (2026-75361a79cf)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-75361a79cf advisory. Release of stargz snapshotter v0.19.0, containing fixes for CVE-2026-71482 and CVE-2026-77395. Release note is available on...
Linux Distros Unpatched Vulnerability : CVE-2026-71482
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - golang-github-containerd-stargz-snapshotter - None Ubuntu Linux - Unknown description CVE-2026-71482 Note that Nessus relies on the presence of t...
Linux Distros Unpatched Vulnerability : CVE-2026-77395
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - golang-github-containerd-stargz-snapshotter - None Ubuntu Linux - Unknown description CVE-2026-77395 Note that Nessus relies on the presence of t...
CVE-2026-77395
stargz-snapshotter before v0.19.0 commits remote snapshots under the layer chainID without checking that each layer's DiffID matches its TOCDigest, so a malicious image can advertise another image's DiffIDs and poison the snapshot cache; other containers on a containerd CRI node then run the...
SUSE CVE-2026-93318
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...
Linux Distros Unpatched Vulnerability : CVE-2026-93318
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised...
AZL-106818 CVE-2026-93318 affecting package moby-engine 25.0.18-1
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...
CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...
EUVD-2026-92532
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...
CVE-2026-93318
The BuildKit daemon is vulnerable to a cache poisoning issue where a malicious image can advertise DiffIDs from another image while containing different layer contents. Because BuildKit fails to validate that these DiffIDs match the actual layer contents, a daemon with a shared or persistent cach...
CVE-2026-93318
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...
CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...
CVE-2026-93318 Cache poisoning via unvalidated image layer DiffIDs
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...
PT-2026-106064
Name of the Vulnerable Software and Affected Versions BuildKit affected versions not specified Description BuildKit fails to validate that advertised DiffIDs match the actual layer contents of an image. A malicious image can advertise DiffIDs from another image while containing different content...
CVE-2026-93318: Improper Validation of Integrity Check Value
A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with...