GO-2024-2492

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2024-2492
Import Source
https://vuln.go.dev/ID/GO-2024-2492.json
JSON Data
https://api.osv.dev/v1/vulns/GO-2024-2492
Aliases
Published
2024-02-12T18:45:38Z
Modified
2024-05-20T16:03:47Z
Summary
Panic in github.com/moby/buildkit
Details

A malicious BuildKit client or frontend could craft a request that could lead to a BuildKit daemon crashing with a panic.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2024-2492"
}
References
Credits
    • @cpuguy83

Affected packages

Go / github.com/moby/buildkit

Package

Name
github.com/moby/buildkit
View open source insights on deps.dev
Purl
pkg:golang/github.com/moby/buildkit

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.12.5

Ecosystem specific 

{
    "imports": [
        {
            "path": "github.com/moby/buildkit/solver/llbsolver",
            "symbols": [
                "Solver.Solve",
                "llbBridge.loadResult",
                "loadSourcePolicy"
            ]
        },
        {
            "path": "github.com/moby/buildkit/sourcepolicy",
            "symbols": [
                "match"
            ]
        },
        {
            "path": "github.com/moby/buildkit/control",
            "symbols": [
                "Controller.Solve"
            ]
        },
        {
            "path": "github.com/moby/buildkit/frontend/gateway/client",
            "symbols": [
                "AttestationFromPB"
            ]
        },
        {
            "path": "github.com/moby/buildkit/frontend/gateway",
            "symbols": [
                "llbBridgeForwarder.Solve",
                "llbBridgeForwarder.Warn"
            ]
        },
        {
            "path": "github.com/moby/buildkit/util/tracing/transform",
            "symbols": [
                "Attributes",
                "Spans",
                "arrayValues",
                "boolArray",
                "doubleArray",
                "intArray",
                "links",
                "spanEvents",
                "statusCode",
                "stringArray"
            ]
        },
        {
            "path": "github.com/moby/buildkit/exporter/containerimage/exptypes",
            "symbols": [
                "ParsePlatforms"
            ]
        },
        {
            "path": "github.com/moby/buildkit/exporter/containerimage",
            "symbols": [
                "patchImageConfig"
            ]
        }
    ]
}