MEDIUM

GHSA-7236-3392-c5c6

BuildKit: Custom frontend could bypass Seccomp/AppArmor

Quick fix

GHSA-7236-3392-c5c6 — github.com/moby/buildkit: upgrade to the fixed version with the command below.

go get github.com/moby/buildkit@v0.31.1

Details

### Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the `security.insecure` entitlement. Other security measures, like Linux capabilities were still applied to these containers.

### Patches Problem has been fixed in versions v0.31.1+

### Workarounds Only use BuildKit frontends from trusted providers.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/moby/buildkit

Introduced in: 0 Fixed in: 0.31.1

Fix go get github.com/moby/buildkit@v0.31.1

References

https://github.com/moby/buildkit/security/advisories/GHSA-7236-3392-c5c6 [WEB]
https://github.com/moby/buildkit [PACKAGE]