Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/moby/moby
  4. ›
  5. CVE-2024-24557

CVE-2024-24557: Origin Validation Error

February 1, 2024

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

References

  • github.com/advisories/GHSA-xw73-rw38-6vjc
  • github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae
  • github.com/moby/moby/commit/fca702de7f71362c8d103073c7e4a1d0a467fadd
  • github.com/moby/moby/commit/fce6e0ca9bc000888de3daa157af14fa41fcd0ff
  • github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc
  • nvd.nist.gov/vuln/detail/CVE-2024-24557

Code Behaviors & Features

Detect and mitigate CVE-2024-24557 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 24.0.9, all versions starting from 25.0.0 before 25.0.2

Fixed versions

  • 24.0.9
  • 25.0.2

Solution

Upgrade to versions 24.0.9, 25.0.2 or above.

Impact 7.8 HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-345: Insufficient Verification of Data Authenticity
  • CWE-346: Origin Validation Error

Source file

go/github.com/moby/moby/CVE-2024-24557.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:54 +0000.