LOW

GHSA-72x6-4j93-7w86

BuildKit has a possible runtime DoS via unbounded group parsing

Quick fix

GHSA-72x6-4j93-7w86 — github.com/moby/buildkit: upgrade to the fixed version with the command below.

go get github.com/moby/buildkit@v0.31.1

Details

### Impact Maliciously crafted base image or build can cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the buildkitd process.

### Patches Issue is fixed in BuildKit v0.31.1+

### Workarounds Use trusted build sources.

### References This is BuildKit variant of containerd advisory https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/moby/buildkit

Introduced in: 0 Fixed in: 0.31.1

Fix go get github.com/moby/buildkit@v0.31.1

References

https://github.com/moby/buildkit/security/advisories/GHSA-72x6-4j93-7w86 [WEB]
https://github.com/moby/buildkit/commit/408266e4ba254cecabedaacdad6905de4d2a75a1 [WEB]
https://github.com/moby/buildkit/commit/69a3924648e485acb3faad3081e03a8554431255 [WEB]
https://github.com/moby/buildkit [PACKAGE]
https://github.com/moby/buildkit/releases/tag/v0.31.1 [WEB]