Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2024-01020

Опубликовано: 01 фев. 2024
Источник: fstec
CVSS3: 6.9
CVSS2: 5.2
EPSS Низкий

Описание

Уязвимость функции ImageBuild() программного средства для создания систем контейнерной изоляции Moby связана с недостатком в механизме подтверждения источника данных при обработке конечных точек. Эксплуатация уязвимости может позволить нарушителю реализовать атаку отравления кэша

Вендор

ООО «Ред Софт»
ООО «РусБИТех-Астра»
Moby Project

Наименование ПО

РЕД ОС
Astra Linux Special Edition
Moby

Версия ПО

7.3 (РЕД ОС)
1.7 (Astra Linux Special Edition)
4.7 (Astra Linux Special Edition)
до 24.0.9 (Moby)
от 25.0.0 до 25.0.2 (Moby)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

ООО «Ред Софт» РЕД ОС 7.3
ООО «РусБИТех-Астра» Astra Linux Special Edition 1.7
ООО «РусБИТех-Астра» Astra Linux Special Edition 4.7

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 5,2)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 6,9)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для Moby:
https://github.com/moby/moby/commit/3e230cfdcc989dc524882f6579f9e0dac77400ae
Для РедОС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/
Для ОС Astra Linux:
использование рекомендаций производителя: https://wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17
Для Astra Linux Special Edition 4.7 для архитектуры ARM:
использование рекомендаций производителя: https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 17%
0.00053
Низкий

6.9 Medium

CVSS3

5.2 Medium

CVSS2

Связанные уязвимости

redos
около 1 года назад

Уязвимость docker-ce

CVSS3: 6.9
ubuntu
больше 1 года назад

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

CVSS3: 6.9
redhat
больше 1 года назад

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

CVSS3: 6.9
nvd
больше 1 года назад

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases.

CVSS3: 7.8
msrc
больше 1 года назад

Описание отсутствует

EPSS

Процентиль: 17%
0.00053
Низкий

6.9 Medium

CVSS3

5.2 Medium

CVSS2