Cache Poisoning

2024-02-0210:52:54

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

moby

cache poisoning

vulnerability

improper configuration

buildkit

docker

build api

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.2%

JSON

Moby is vulnerable to Cache Poisoning. The vulnerability is due to improper cache configuration when the image is built FROM scratch. This issue can be exploited by an attacker to poison the cache and force a user to pull a specially crafted image. Note that 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint.

CPENameOperatorVersion
github.com/moby/mobylev25.0.1
github.com/moby/mobylev24.0.8
docker:3.19eq24.0.7-r0
docker:edgeeq24.0.2-r0
docker:edgeeq20.10.17-r3
docker:edgeeq20.10.14-r1
docker:edgeeq19.03.6-r2
docker:edgeeq20.10.5-r0
docker:edgeeq20.10.15-r1
docker:edgeeq20.10.8-r0

Name	Operator	Version
github.com/moby/moby	le	v25.0.1
github.com/moby/moby	le	v24.0.8
docker:3.19	eq	24.0.7-r0
docker:edge	eq	24.0.2-r0
docker:edge	eq	20.10.17-r3
docker:edge	eq	20.10.14-r1
docker:edge	eq	19.03.6-r2
docker:edge	eq	20.10.5-r0
docker:edge	eq	20.10.15-r1
docker:edge	eq	20.10.8-r0