Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:1341-1

Опубликовано: 17 апр. 2025
Источник: suse-cvrf

Описание

Security update for docker

This update for docker fixes the following issues:

  • Update to docker-buildx v0.22.0
  • CVE-2025-0495: Fixed an integer overflow in User ID handling in containerd. (bsc#1239765)

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
docker-27.5.1_ce-98.129.1
docker-bash-completion-27.5.1_ce-98.129.1

Ссылки

Описание

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records. This vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:docker-27.5.1_ce-98.129.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:docker-bash-completion-27.5.1_ce-98.129.1
Ссылки