Information Disclosure

2023-03-0811:33:04

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability buildkit access repositories

0.001 Low

EPSS

Percentile

50.4%

JSON

github.com/moby/buildkit is vulnerable to Information Disclosure. When a build request contains a Git URL with credentials, anyone with access to the build provenance attestation will be able to view the credentials issued. An attacker can use these Git credentials to access repositories.

CPENameOperatorVersion
github.com/moby/buildkitlev0.11.2
docker:edgeeq20.10.20-r0
docker:edgeeq20.10.12-r0
docker:edgeeq23.0.1-r1
docker:edgeeq19.03.8-r0
docker:edgeeq23.0.0-r1
docker:edgeeq20.10.15-r1
docker:edgeeq20.10.14-r0
docker:edgeeq23.0.0-r0
docker:edgeeq20.10.21-r0

Name	Operator	Version
github.com/moby/buildkit	le	v0.11.2
docker:edge	eq	20.10.20-r0
docker:edge	eq	20.10.12-r0
docker:edge	eq	23.0.1-r1
docker:edge	eq	19.03.8-r0
docker:edge	eq	23.0.0-r1
docker:edge	eq	20.10.15-r1
docker:edge	eq	20.10.14-r0
docker:edge	eq	23.0.0-r0
docker:edge	eq	20.10.21-r0