CVE-2024-23650: Improper Check for Unusual or Exceptional Conditions

January 31, 2024

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoid using BuildKit frontends from untrusted sources.

References

github.com/advisories/GHSA-9p26-698r-w4hx
github.com/moby/buildkit/pull/4601
github.com/moby/buildkit/security/advisories/GHSA-9p26-698r-w4hx

Code Behaviors & Features

Detect and mitigate CVE-2024-23650 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →