Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2023-26054

Published: 6 March 2023

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In affected versions when the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1) Invoking build directly from a URL with credentials. 2) If the client sends additional version control system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the origin URL from `.git/config` file. When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation. Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo` structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and values would need to be passed manually with `--opt`.

Notes

AuthorNote
alexmurray 
Traditionally the docker.io source package contained both the
library and docker application. However, in releases that
contain the
docker.io-app source package, the docker.io source package
contains only
the library whilst the docker application itself is contained
in the
docker.io-app package.
sbeattie 
docker packages contain an embedded copy of github:moby/buildkit
0xnishit 
docker packages contains old version (v0.8.0) of moby/buildkit

Priority

Medium

Cvss 3 Severity Score

6.5

Score breakdown

Status

Package Release Status
docker.io
Launchpad, Ubuntu, Debian 		bionic Not vulnerable
(code not present)
focal Not vulnerable
(code not present)
jammy Not vulnerable
(code not present)
mantic Not vulnerable
(code not present)
noble Not vulnerable
(code not present)
trusty Ignored
(end of standard support)
upstream Needs triage

xenial Not vulnerable
(code not present)
Patches:
upstream: https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604
docker.io-app
Launchpad, Ubuntu, Debian 		bionic Does not exist

focal Not vulnerable
(24.0.5-0ubuntu1~20.04.1)
jammy Not vulnerable
(24.0.5-0ubuntu1~22.04.1)
mantic Not vulnerable
(24.0.5-0ubuntu1)
noble Not vulnerable
(24.0.7-0ubuntu)
trusty Ignored
(end of standard support)
upstream Needs triage

xenial Does not exist

Severity score breakdown

Parameter Value
Base score 6.5
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Further reading