x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2024-24557

[GoVulnBot]

CVE-2024-24557 references github.com/moby/moby, which may be a Go module.

Description:
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-24557
• JSON: https://github.com/CVEProject/cvelist/tree/3a06462501266e2df9a0eaf97f0f14d66f1073c8/2024/24xxx/CVE-2024-24557.json
• advisory: GHSA-xw73-rw38-6vjc
• fix: moby/moby@3e230cf
• Imported by: https://pkg.go.dev/github.com/moby/moby?tab=importedby

Cross references:

• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-24769 #390 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-8fvr-5rqf-3wwh #638 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-v4h8-794j-g8mm #708 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vj3f-3286-r4pf #751 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2022-36109 #985 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: GHSA-vp35-85q5-9f25 #1107 NOT_IMPORTABLE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28840 #1699 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28841 #1700 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2023-28842 #1701 EFFECTIVELY_PRIVATE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2017-16539 #2199 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2018-10892 #2207 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2018-12608 #2209 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2018-15664 #2212 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2019-13139 #2236 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2021-21284 #2316 LEGACY_FALSE_POSITIVE
• Module github.com/moby/moby appears in issue x/vulndb: potential Go vuln in github.com/moby/moby: CVE-2021-21285 #2317 LEGACY_FALSE_POSITIVE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/moby/moby
      vulnerable_at: 25.0.2+incompatible
      packages:
        - package: moby
cves:
    - CVE-2024-24557
references:
    - advisory: https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc
    - fix: https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae

[gopherbot]

Change https://go.dev/cl/565379 mentions this issue: data/excluded: batch add 7 excluded reports

[gopherbot]

Change https://go.dev/cl/567817 mentions this issue: data/excluded: batch add 15 excluded reports

[gopherbot]

Change https://go.dev/cl/592778 mentions this issue: data/reports: unexclude 80 reports

[gopherbot]

Change https://go.dev/cl/595999 mentions this issue: data/reports: review 7 reports