Moby and Open Container Initiative Release Critical Updates for Multiple Vulnerabilities Affecting Docker-related Components

Moby and Open Container Initiative Release Critical Updates for Multiple Vulnerabilities Affecting Docker-related Components ↗ source

February 1, 2024 CISA Alert

Source: https://www.cisa.gov/news-events/alerts/2024/02/01/moby-and-open-container-initiative-release-critical-updates-multiple-vulnerabilities-affecting

Summary

A cyber threat actor could exploit these vulnerabilities to take control of an affected system. This product is provided subject to this Notification and this Privacy & Use policy.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-23652	10.0 Critical	moby buildkit BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend …
CVE-2024-23653	9.8 Critical	moby buildkit BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running contain…
CVE-2024-23651	8.7 High	moby buildkit BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps runn…
CVE-2024-21626	8.6 High	opencontainers runc runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal fi…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Docker 1 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.