p PatchFirst

CVE-2024-24557

CVE-2024-24557 · Moby classic builder cache poisoning

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · containers

Affected products and versions

  • docker engine

    Versions
    • >= 25.0.0, < 25.0.2: Affected
    • < 24.0.9: Affected

    No fix published

  • docker.io Debian:12

    Versions
    • 20.10.24+dfsg1-1
    • 20.10.24+dfsg1-1+deb12u1
    • 20.10.25+dfsg1-1
    • 20.10.25+dfsg1-2
    • 20.10.25+dfsg1-3
    • 20.10.25+dfsg1-4
    • 26.1.4+dfsg1-1
    • 26.1.4+dfsg1-2
    • 26.1.4+dfsg1-3
    • 26.1.4+dfsg1-4
    • 26.1.4+dfsg1-5
    • 26.1.4+dfsg1-6
    • 26.1.4+dfsg1-7
    • 26.1.4+dfsg1-8
    • 26.1.4+dfsg1-9
    • 26.1.4+dfsg2-1
    • 26.1.4+dfsg3-1
    • 26.1.5+dfsg1-1
    • 26.1.5+dfsg1-10
    • 26.1.5+dfsg1-2
    • 26.1.5+dfsg1-3
    • 26.1.5+dfsg1-4
    • 26.1.5+dfsg1-5
    • 26.1.5+dfsg1-6
    • 26.1.5+dfsg1-7
    • 26.1.5+dfsg1-8
    • 26.1.5+dfsg1-9
    • 27.5.1+dfsg1-1
    • 27.5.1+dfsg1-2
    • 27.5.1+dfsg2-1
    • 27.5.1+dfsg3-1
    • 27.5.1+dfsg3-2
    • 27.5.1+dfsg3-3
    • 27.5.1+dfsg3-4
    • 27.5.1+dfsg3-5
    • 27.5.1+dfsg3-6
    • 27.5.1+dfsg4-1
    • 27.5.1+dfsg4-2
    • 28.5.2+dfsg1-1
    • 28.5.2+dfsg2-1
    • 28.5.2+dfsg3-1
    • 28.5.2+dfsg3-2
    • 28.5.2+dfsg4-1
    • 28.5.2+dfsg4-2
    • 28.5.2+dfsg4-3
    • 28.5.2+dfsg4-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io Debian:13

    Affected ranges
    • ECOSYSTEM: < 26.1.4+dfsg1-9

    Update to 26.1.4+dfsg1-9

  • docker.io Debian:14

    Affected ranges
    • ECOSYSTEM: < 26.1.4+dfsg1-9

    Update to 26.1.4+dfsg1-9

  • docker.io Ubuntu:Pro:18.04:LTS

    Versions
    • 1.13.1-0ubuntu6
    • 17.03.2-0ubuntu1
    • 17.03.2-0ubuntu3
    • 17.03.2-0ubuntu5
    • 17.12.1-0ubuntu1
    • 18.06.1-0ubuntu1~18.04.1
    • 18.06.1-0ubuntu1.2~18.04.1
    • 18.09.2-0ubuntu1~18.04.1
    • 18.09.5-0ubuntu1~18.04.2
    • 18.09.7-0ubuntu1~18.04.1
    • 18.09.7-0ubuntu1~18.04.3
    • 18.09.7-0ubuntu1~18.04.4
    • 19.03.6-0ubuntu1~18.04.1
    • 19.03.6-0ubuntu1~18.04.2
    • 19.03.6-0ubuntu1~18.04.3
    • 20.10.2-0ubuntu1~18.04.2
    • 20.10.2-0ubuntu1~18.04.3
    • 20.10.7-0ubuntu1~18.04.1
    • 20.10.7-0ubuntu1~18.04.2
    • 20.10.7-0ubuntu5~18.04.2
    • 20.10.7-0ubuntu5~18.04.3
    • 20.10.12-0ubuntu2~18.04.1
    • 20.10.21-0ubuntu1~18.04.2
    • 20.10.21-0ubuntu1~18.04.3
    • 20.10.21-0ubuntu1~18.04.3+esm1
    • 20.10.21-0ubuntu1~18.04.3+esm2
    • 20.10.21-0ubuntu1~18.04.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io Ubuntu:Pro:20.04:LTS

    Versions
    • 19.03.2-0ubuntu1
    • 19.03.6-0ubuntu1
    • 19.03.8-0ubuntu1
    • 19.03.8-0ubuntu1.20.04
    • 19.03.8-0ubuntu1.20.04.1
    • 19.03.8-0ubuntu1.20.04.2
    • 20.10.2-0ubuntu1~20.04.2
    • 20.10.2-0ubuntu1~20.04.3
    • 20.10.7-0ubuntu1~20.04.1
    • 20.10.7-0ubuntu1~20.04.2
    • 20.10.7-0ubuntu5~20.04.1
    • 20.10.7-0ubuntu5~20.04.2
    • 20.10.12-0ubuntu2~20.04.1
    • 20.10.21-0ubuntu1~20.04.1
    • 20.10.21-0ubuntu1~20.04.2
    • 20.10.21-0ubuntu1~20.04.4
    • 20.10.21-0ubuntu1~20.04.5
    • 20.10.21-0ubuntu1~20.04.6
    • 20.10.21-0ubuntu1~20.04.6+esm1
    • 20.10.21-0ubuntu1~20.04.6+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io-app Ubuntu:Pro:20.04:LTS

    Versions
    • 20.10.25-0ubuntu1~20.04.1
    • 20.10.25-0ubuntu1~20.04.2
    • 24.0.5-0ubuntu1~20.04.1
    • 24.0.7-0ubuntu2~20.04.1
    • 26.1.3-0ubuntu1~20.04.1
    Affected ranges
    • ECOSYSTEM: < 26.1.3-0ubuntu1~20.04.1+esm1

    Update to 26.1.3-0ubuntu1~20.04.1+esm1

  • docker.io-app Ubuntu:22.04:LTS

    Versions
    • 20.10.25-0ubuntu1~22.04.1
    • 20.10.25-0ubuntu1~22.04.2
    • 24.0.5-0ubuntu1~22.04.1
    • 24.0.7-0ubuntu2~22.04.1
    • 26.1.3-0ubuntu1~22.04.1
    • 27.5.1-0ubuntu3~22.04.1
    Affected ranges
    • ECOSYSTEM: < 27.5.1-0ubuntu3~22.04.2

    Update to 27.5.1-0ubuntu3~22.04.2

  • docker.io Ubuntu:Pro:22.04:LTS

    Versions
    • 20.10.7-0ubuntu5
    • 20.10.7-0ubuntu7
    • 20.10.12-0ubuntu1
    • 20.10.12-0ubuntu2
    • 20.10.12-0ubuntu3
    • 20.10.12-0ubuntu3+gke1.24.1
    • 20.10.12-0ubuntu4
    • 20.10.21-0ubuntu1~22.04.2
    • 20.10.21-0ubuntu1~22.04.3
    • 20.10.21-0ubuntu1~22.04.5
    • 20.10.21-0ubuntu1~22.04.6
    • 20.10.21-0ubuntu1~22.04.7
    • 20.10.21-0ubuntu1~22.04.7+esm1
    • 20.10.21-0ubuntu1~22.04.7+esm2
    • 20.10.21-0ubuntu1~22.04.8
    • 20.10.21-0ubuntu1~22.04.8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io-app Ubuntu:24.04:LTS

    Versions
    • 24.0.5-0ubuntu1
    • 24.0.7-0ubuntu1
    • 24.0.7-0ubuntu2
    • 24.0.7-0ubuntu3
    • 24.0.7-0ubuntu4
    • 24.0.7-0ubuntu4.1
    • 26.1.3-0ubuntu1~24.04.1
    • 27.5.1-0ubuntu3~24.04.1
    Affected ranges
    • ECOSYSTEM: < 27.5.1-0ubuntu3~24.04.2

    Update to 27.5.1-0ubuntu3~24.04.2

  • docker.io Ubuntu:Pro:24.04:LTS

    Versions
    • 20.10.24+dfsg1-1ubuntu2
    • 20.10.25+dfsg1-2ubuntu1
    • 20.10.25+dfsg1-2ubuntu1+esm1
    • 20.10.25+dfsg1-2ubuntu1+esm2
    • 20.10.25+dfsg1-2ubuntu1.24.04.1
    • 20.10.25+dfsg1-2ubuntu1.24.04.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io Ubuntu:25.10

    Versions
    • 26.1.5+dfsg1-9ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io Ubuntu:26.10

    Versions
    • 27.5.1+dfsg4-2ubuntu1
    • 28.5.2+dfsg4-5ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • docker.io Ubuntu:26.04:LTS

    Versions
    • 26.1.5+dfsg1-9ubuntu1
    • 27.5.1+dfsg4-1ubuntu1
    • 27.5.1+dfsg4-2ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →