Skip to content

Commit 5f2af4f

Browse files
timothy-kingtimothy-king
committed
data/reports: add GO-2024-2492.yaml
Aliases: CVE-2024-23650, GHSA-9p26-698r-w4hx Fixes #2492 Change-Id: I20b0e95fe5d7eaa21e4a7c62d684a596c6d180f7 Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/562376 LUCI-TryBot-Result: Go LUCI <[email protected]> Run-TryBot: Tim King <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]> TryBot-Result: Gopher Robot <[email protected]>
1 parent 64bc377 commit 5f2af4f

File tree

2 files changed

+197
-0
lines changed

2 files changed

+197
-0
lines changed

‎data/osv/GO-2024-2492.json

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2024-2492",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2024-23650",
8+
"GHSA-9p26-698r-w4hx"
9+
],
10+
"summary": "Panic in github.com/moby/buildkit",
11+
"details": "A malicious BuildKit client or frontend could craft a request that could lead to a BuildKit daemon crashing with a panic.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "github.com/moby/buildkit",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "0.12.5"
27+
}
28+
]
29+
}
30+
],
31+
"ecosystem_specific": {
32+
"imports": [
33+
{
34+
"path": "github.com/moby/buildkit/solver/llbsolver",
35+
"symbols": [
36+
"Solver.Solve",
37+
"llbBridge.loadResult",
38+
"loadSourcePolicy"
39+
]
40+
},
41+
{
42+
"path": "github.com/moby/buildkit/sourcepolicy",
43+
"symbols": [
44+
"match"
45+
]
46+
},
47+
{
48+
"path": "github.com/moby/buildkit/control",
49+
"symbols": [
50+
"Controller.Solve"
51+
]
52+
},
53+
{
54+
"path": "github.com/moby/buildkit/frontend/gateway/client",
55+
"symbols": [
56+
"AttestationFromPB"
57+
]
58+
},
59+
{
60+
"path": "github.com/moby/buildkit/frontend/gateway",
61+
"symbols": [
62+
"llbBridgeForwarder.Solve",
63+
"llbBridgeForwarder.Warn"
64+
]
65+
},
66+
{
67+
"path": "github.com/moby/buildkit/util/tracing/transform",
68+
"symbols": [
69+
"Attributes",
70+
"Spans",
71+
"arrayValues",
72+
"boolArray",
73+
"doubleArray",
74+
"intArray",
75+
"links",
76+
"spanEvents",
77+
"statusCode",
78+
"stringArray"
79+
]
80+
},
81+
{
82+
"path": "github.com/moby/buildkit/exporter/containerimage/exptypes",
83+
"symbols": [
84+
"ParsePlatforms"
85+
]
86+
},
87+
{
88+
"path": "github.com/moby/buildkit/exporter/containerimage",
89+
"symbols": [
90+
"patchImageConfig"
91+
]
92+
}
93+
]
94+
}
95+
}
96+
],
97+
"references": [
98+
{
99+
"type": "FIX",
100+
"url": "https://github.com/moby/buildkit/pull/4601"
101+
},
102+
{
103+
"type": "FIX",
104+
"url": "https://github.com/moby/buildkit/commit/e1924dc32da35bfb0bfdbb9d0fc7bca25e552330"
105+
},
106+
{
107+
"type": "FIX",
108+
"url": "https://github.com/moby/buildkit/commit/7718bd5c3dc8fc5cd246a30cc41766e7a53c043c"
109+
},
110+
{
111+
"type": "FIX",
112+
"url": "https://github.com/moby/buildkit/commit/96663dd35bf3787d7efb1ee7fd9ac7fe533582ae"
113+
},
114+
{
115+
"type": "FIX",
116+
"url": "https://github.com/moby/buildkit/commit/481d9c45f473c58537f39694a38d7995cc656987"
117+
},
118+
{
119+
"type": "FIX",
120+
"url": "https://github.com/moby/buildkit/commit/83edaef59d545b93e2750f1f85675a3764593fee"
121+
},
122+
{
123+
"type": "WEB",
124+
"url": "https://github.com/moby/buildkit/releases/tag/v0.12.5"
125+
}
126+
],
127+
"credits": [
128+
{
129+
"name": "@cpuguy83"
130+
}
131+
],
132+
"database_specific": {
133+
"url": "https://pkg.go.dev/vuln/GO-2024-2492"
134+
}
135+
}

‎data/reports/GO-2024-2492.yaml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
id: GO-2024-2492
2+
modules:
3+
- module: github.com/moby/buildkit
4+
versions:
5+
- fixed: 0.12.5
6+
vulnerable_at: 0.12.4
7+
packages:
8+
- package: github.com/moby/buildkit/solver/llbsolver
9+
symbols:
10+
- Solver.Solve
11+
- llbBridge.loadResult
12+
- loadSourcePolicy
13+
- package: github.com/moby/buildkit/sourcepolicy
14+
symbols:
15+
- match
16+
- package: github.com/moby/buildkit/control
17+
symbols:
18+
- Controller.Solve
19+
- package: github.com/moby/buildkit/frontend/gateway/client
20+
symbols:
21+
- AttestationFromPB
22+
- package: github.com/moby/buildkit/frontend/gateway
23+
symbols:
24+
- llbBridgeForwarder.Warn
25+
- llbBridgeForwarder.Solve
26+
- package: github.com/moby/buildkit/util/tracing/transform
27+
symbols:
28+
- spanEvents
29+
- doubleArray
30+
- arrayValues
31+
- stringArray
32+
- Attributes
33+
- intArray
34+
- links
35+
- statusCode
36+
- Spans
37+
- boolArray
38+
- package: github.com/moby/buildkit/exporter/containerimage/exptypes
39+
symbols:
40+
- ParsePlatforms
41+
- package: github.com/moby/buildkit/exporter/containerimage
42+
symbols:
43+
- patchImageConfig
44+
fix_link: https://github.com/moby/buildkit/commit/7718bd5c3dc8fc5cd246a30cc41766e7a53c043c
45+
summary: Panic in github.com/moby/buildkit
46+
description: |-
47+
A malicious BuildKit client or frontend could craft a request that
48+
could lead to a BuildKit daemon crashing with a panic.
49+
cves:
50+
- CVE-2024-23650
51+
ghsas:
52+
- GHSA-9p26-698r-w4hx
53+
credits:
54+
- '@cpuguy83'
55+
references:
56+
- fix: https://github.com/moby/buildkit/pull/4601
57+
- fix: https://github.com/moby/buildkit/commit/e1924dc32da35bfb0bfdbb9d0fc7bca25e552330
58+
- fix: https://github.com/moby/buildkit/commit/7718bd5c3dc8fc5cd246a30cc41766e7a53c043c
59+
- fix: https://github.com/moby/buildkit/commit/96663dd35bf3787d7efb1ee7fd9ac7fe533582ae
60+
- fix: https://github.com/moby/buildkit/commit/481d9c45f473c58537f39694a38d7995cc656987
61+
- fix: https://github.com/moby/buildkit/commit/83edaef59d545b93e2750f1f85675a3764593fee
62+
- web: https://github.com/moby/buildkit/releases/tag/v0.12.5

0 commit comments

Comments
 (0)