Summary
Ein Angreifer kann mehrere Schwachstellen in BuildKit ausnutzen, um Privilegien zu erhöhen oder einen Denial of Service zu verursachen.
Product
BuildKit ist ein Open-Source-Toolkit zum effizienten und sicheren Erstellen von Container-Images, das erweiterte Funktionen wie parallele Build-Ausführung, Caching und Erweiterbarkeit bietet.
Vulnerabilities 2
-
Medium 6.7
Possible panic from Git source resolver
In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.…
-
Medium 4.5
Malicious client could set xattr value outside of BuildKit state directory
In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. name…
Revision history
-
#2
Neue Updates aufgenommen
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-2fqp-xg6f-v7gj vom 2026-11-03
https://github.com/moby/buildkit/security/advisories/GHSA-2fqp-xg6f-v7gj
-
GitHub Security Advisory GHSA-w26x-xg27-7qjc vom 2026-11-03
https://github.com/moby/buildkit/security/advisories/GHSA-w26x-xg27-7qjc
-
Microsoft Security Update Guide vom 2026-11-11
https://msrc.microsoft.com/update-guide/