CVE-2023-26054 — Sensitive Information Exposure in Moby Buildkit

CWE-200 — Sensitive Information Exposure5 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
1.0%
top 22.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Github.com Moby BuildkitMobyproject BuildkitMoby Buildkit
Timeline
PublishedMar 6
Latest updateMar 7

Description

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version con…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDmobyproject/buildkit0.10.0 — 0.11.4
▶Gogithub.com/moby_buildkit0.10.0 — 0.11.4
▶CVEListV5moby/buildkit>= 0.10.0, < 0.11.4

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
Buildkit credentials inlined to Git URLs could end up in provenance attestation↗2023-03-07
▶
OSV
Buildkit credentials inlined to Git URLs could end up in provenance attestation↗2023-03-07
▶
OSV
CVE-2023-26054: BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner↗2023-03-06
▶

📋Vendor Advisories

1
Red Hat
buildkit: Data disclosure in provenance attestation describing a build↗2023-03-06
▶