Cache Poisoning

🗓️ 02 Feb 2024 10:52:54Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 29 Views

Cache Poisoning vulnerability in Moby due to improper cache configuration when built FROM scratch

Reporter	Title	Published	Views	Family All 210
ibm	Security Bulletin: Multiple vulnerabilies in Go affect IBM Robotic Process Automation for Cloud Pak.	2 Dec 202415:46	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in docker affect Cloud Pak System[CVE-2024-24557, CVE-2024-29018]	28 Jan 202522:08	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses multiple packages which are vulnerable to multiple CVEs	8 Oct 202408:35	–	ibm
ibm	Security Bulletin: IBM Concert Software is vulnerable to multiple issues	22 Aug 202417:47	–	ibm
ibm	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in moby: classic builder cache poisoning	26 Feb 202518:52	–	ibm
ibm	Security Bulletin: IBM Storage Ceph is vulnerable to Insufficient Verification of Data Authenticity in Moby via Grafana (CVE-2024-24557)	29 Jul 202520:49	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data	20 Jun 202400:38	–	ibm
ibm	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	22 May 202509:27	–	ibm
ibm	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	23 Apr 202418:12	–	ibm
ibm	Security Bulletin: IBM Edge Application Manager 4.5.6 addresses the security vulnerabilities listed in the CVEs below.	26 Jun 202414:33	–	ibm

Vulners

Node

AND

docker dockerMatch24.0.7-r0go

alpinelinux alpine_linuxMatch3.19

AND

docker dockerMatch20.10.19-r0go

docker dockerMatch23.0.5-r0go

docker dockerMatch23.0.3-r1go

docker dockerMatch20.10.5-r1go

docker dockerMatch20.10.15-r1go

docker dockerMatch23.0.0-r1go

docker dockerMatch20.10.12-r1go

docker dockerMatch20.10.22-r0go

docker dockerMatch20.10.11-r0go

docker dockerMatch20.10.16-r0go

docker dockerMatch19.03.6-r2go

docker dockerMatch20.10.20-r0go

docker dockerMatch20.10.8-r0go

docker dockerMatch23.0.5-r2go

docker dockerMatch20.10.13-r0go

docker dockerMatch19.03.8-r1go

docker dockerMatch24.0.5-r0go

docker dockerMatch23.0.3-r2go

docker dockerMatch19.03.8-r0go

docker dockerMatch24.0.2-r0go

docker dockerMatch24.0.6-r3go

docker dockerMatch23.0.0-r0go

docker dockerMatch20.10.5-r0go

docker dockerMatch20.10.21-r0go

docker dockerMatch20.10.12-r0go

docker dockerMatch23.0.2-r0go

docker dockerMatch20.10.17-r0go

docker dockerMatch24.0.5-r1go

docker dockerMatch20.10.21-r2go

docker dockerMatch24.0.6-r4go

docker dockerMatch20.10.21-r1go

docker dockerMatch23.0.4-r1go

docker dockerMatch24.0.2-r2go

docker dockerMatch23.0.1-r1go

docker dockerMatch20.10.6-r1go

docker dockerMatch20.10.17-r2go

docker dockerMatch20.10.14-r1go

docker dockerMatch20.10.14-r0go

docker dockerMatch20.10.13-r1go

docker dockerMatch23.0.6-r1go

docker dockerMatch20.10.18-r0go

docker dockerMatch20.10.4-r0go

docker dockerMatch20.10.9-r0go

docker dockerMatch20.10.23-r0go

docker dockerMatch24.0.1-r0go

docker dockerMatch20.10.18-r1go

docker dockerMatch20.10.8-r1go

docker dockerMatch19.03.7-r0go

docker dockerMatch24.0.7-r0go

docker dockerMatch23.0.6-r3go

docker dockerMatch20.10.17-r3go

docker dockerMatch24.0.6-r1go

docker dockerMatch20.10.10-r0go

docker dockerMatch20.10.5-r2go

docker dockerMatch20.10.6-r0go

docker dockerMatch20.10.7-r1go

docker dockerMatch24.0.6-r2go

docker dockerMatch19.03.10-r0go

docker dockerMatch20.10.17-r1go

docker dockerMatch20.10.15-r0go

docker dockerMatch24.0.4-r2go

alpinelinux alpine_linuxMatchedge

AND

docker dockerMatch23.0.6-r3go

docker dockerMatch23.0.6-r5go

docker dockerMatch23.0.6-r2go

docker dockerMatch23.0.6-r7go

docker dockerMatch23.0.5-r2go

docker dockerMatch23.0.5-r0go

docker dockerMatch23.0.6-r6go

docker dockerMatch23.0.4-r1go

docker dockerMatch23.0.6-r4go

alpinelinux alpine_linuxMatch3.18

AND

docker.io docker.ioMatch19.03.13+dfsg3-1debian

docker.io docker.ioMatch20.10.4+dfsg1-1debian

debian debian_linuxMatch999

mobyproject github.com/moby/mobyRangev25.0.0-beta.1–v25.0.1go

mobyproject github.com/moby/mobyRangev23.0.0-beta.1–v24.0.8go

Source	Link
github	www.github.com/moby/moby/commit/fca702de7f71362c8d103073c7e4a1d0a467fadd
github	www.github.com/moby/moby/commit/fce6e0ca9bc000888de3daa157af14fa41fcd0ff
github	www.github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc
github	www.github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae

09 Feb 2024 21:31Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.16.9 - 7.8

EPSS0.00258