buildkitd.advisories.yaml

schema-version: 2.0.2

package:
  name: buildkitd

advisories:
  - id: CGA-26hw-5rgh-wxj7
    aliases:
      - CVE-2023-3978
      - GHSA-2wrh-6pvc-2jm9
    events:
      - timestamp: 2024-01-30T15:54:11Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 24fb3ebbebde4ba4
            componentName: golang.org/x/net
            componentVersion: v0.8.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:37Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4

  - id: CGA-28rj-6mp6-vf8g
    aliases:
      - CVE-2024-45337
      - GHSA-v778-237x-gjrc
    events:
      - timestamp: 2024-12-12T08:04:01Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 232f6a7b2b291a81
            componentName: golang.org/x/crypto
            componentVersion: v0.27.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-12-12T16:31:06Z
        type: fixed
        data:
          fixed-version: 0.18.1-r2

  - id: CGA-3pwm-f94p-fppg
    aliases:
      - CVE-2025-30204
      - GHSA-mh63-6h87-95cp
    events:
      - timestamp: 2025-03-22T08:14:34Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 105f85fb59ff2581
            componentName: github.com/golang-jwt/jwt/v5
            componentVersion: v5.2.1
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2025-03-22T12:19:36Z
        type: fixed
        data:
          fixed-version: 0.20.1-r4

  - id: CGA-4823-c588-79x4
    aliases:
      - CVE-2024-34156
      - GHSA-crqm-pwhx-j97f
    events:
      - timestamp: 2024-09-10T07:07:55Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildctl
            componentID: 1c4f204595d89359
            componentName: stdlib
            componentVersion: go1.23.0
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2025-03-20T19:33:19Z
        type: fixed
        data:
          fixed-version: 0.20.1-r3

  - id: CGA-4jgr-8hg2-hpf8
    aliases:
      - CVE-2024-45338
      - GHSA-w32m-9786-jp63
    events:
      - timestamp: 2024-12-19T08:27:55Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 38b0d432f912b65b
            componentName: golang.org/x/net
            componentVersion: v0.29.0
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2024-12-19T13:39:07Z
        type: fixed
        data:
          fixed-version: 0.18.2-r1

  - id: CGA-4wmp-6w9c-3v8q
    aliases:
      - CVE-2024-21626
      - GHSA-xr7r-f8xq-vfvv
    events:
      - timestamp: 2024-02-05T07:04:30Z
        type: fixed
        data:
          fixed-version: 0.12.5-r1

  - id: CGA-5r59-v4x3-mcq8
    aliases:
      - CVE-2024-23651
      - GHSA-m3r6-h7wv-7xxv
    events:
      - timestamp: 2024-02-01T07:06:14Z
        type: fixed
        data:
          fixed-version: 0.12.5-r0

  - id: CGA-5w2m-6qcc-8vj2
    aliases:
      - CVE-2025-22870
      - GHSA-qxp5-gwg8-xv66
    events:
      - timestamp: 2025-03-14T08:17:31Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: e128f32a0c8b5104
            componentName: golang.org/x/net
            componentVersion: v0.33.0
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2025-03-16T05:31:15Z
        type: fixed
        data:
          fixed-version: 0.20.1-r2

  - id: CGA-68p7-3997-8577
    aliases:
      - CVE-2024-24785
      - GHSA-j6m3-gc37-6r6q
    events:
      - timestamp: 2024-04-11T19:01:05Z
        type: fixed
        data:
          fixed-version: 0.13.1-r2

  - id: CGA-6jm9-j3j6-7fxh
    aliases:
      - CVE-2023-48795
      - GHSA-45x7-px36-x8w8
    events:
      - timestamp: 2024-01-30T15:54:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 2bce5397fdf60b52
            componentName: golang.org/x/crypto
            componentVersion: v0.2.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:37Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4

  - id: CGA-6mh4-qmrc-qf44
    aliases:
      - CVE-2024-6104
      - GHSA-v6v8-xj6m-xwqh
    events:
      - timestamp: 2024-06-25T08:14:07Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 94270d3f917f828a
            componentName: github.com/hashicorp/go-retryablehttp
            componentVersion: v0.7.5
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-06-25T10:23:06Z
        type: fixed
        data:
          fixed-version: 0.14.1-r1

  - id: CGA-7x48-64j5-42pf
    aliases:
      - CVE-2024-34155
      - GHSA-8xfx-rj4p-23jm
    events:
      - timestamp: 2024-09-10T07:07:46Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildctl
            componentID: 1c4f204595d89359
            componentName: stdlib
            componentVersion: go1.23.0
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2025-03-20T19:33:20Z
        type: fixed
        data:
          fixed-version: 0.20.1-r3

  - id: CGA-8j5r-c2w7-m2x2
    aliases:
      - CVE-2023-45284
      - GHSA-rq3x-83w4-p28c
    events:
      - timestamp: 2023-11-07T19:23:47Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-8q3r-4wx8-6f9q
    aliases:
      - GHSA-7ww5-4wqc-m92c
    events:
      - timestamp: 2024-01-30T15:54:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 75c561d61f53d326
            componentName: github.com/containerd/containerd
            componentVersion: v1.7.2
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:36Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4
      - timestamp: 2024-02-07T20:36:36Z
        type: pending-upstream-fix
        data:
          note: containerd v1.7.11 appears to contain API-incompatible changes with this version of buildkitd. Bumping this dependency downstream causes issues where buildkitd is unable to start due to a conflicting URL schema.

  - id: CGA-94qp-jq9h-fvq6
    aliases:
      - CVE-2024-51744
      - GHSA-29wx-vh33-7x7r
    events:
      - timestamp: 2024-11-05T09:12:30Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildctl
            componentID: 31f7cac9cfe08ed2
            componentName: github.com/golang-jwt/jwt/v4
            componentVersion: v4.5.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-11-07T07:37:42Z
        type: fixed
        data:
          fixed-version: 0.17.0-r1

  - id: CGA-9gf3-9vpr-xg6r
    aliases:
      - CVE-2023-45289
      - GHSA-32ch-6x54-q4h9
    events:
      - timestamp: 2024-04-11T19:00:33Z
        type: fixed
        data:
          fixed-version: 0.13.1-r2

  - id: CGA-9rgp-8f3j-ghcg
    aliases:
      - CVE-2024-24787
      - GHSA-5fq7-4mxc-535h
    events:
      - timestamp: 2024-05-14T07:40:24Z
        type: fixed
        data:
          fixed-version: 0.13.2-r1

  - id: CGA-cffc-qx4h-898j
    aliases:
      - CVE-2024-24789
      - GHSA-236w-p7wf-5ph8
    events:
      - timestamp: 2024-06-07T09:21:43Z
        type: fixed
        data:
          fixed-version: 0.13.2-r2

  - id: CGA-cpw2-h53q-c5w6
    aliases:
      - CVE-2023-39325
      - GHSA-4374-p667-p6c8
    events:
      - timestamp: 2024-01-30T15:54:12Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 24fb3ebbebde4ba4
            componentName: golang.org/x/net
            componentVersion: v0.8.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:37Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4

  - id: CGA-fvh9-6v4w-vfc5
    aliases:
      - CVE-2024-29018
      - GHSA-mq39-4gv4-mvpx
    events:
      - timestamp: 2024-03-21T07:34:43Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 19cd3c2af876f2e9
            componentName: github.com/docker/docker
            componentVersion: v25.0.3+incompatible
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-03-21T11:43:47Z
        type: fixed
        data:
          fixed-version: 0.13.1-r1

  - id: CGA-g8fr-g5rp-4g53
    aliases:
      - CVE-2023-44487
      - GHSA-qppj-fm5r-hxr3
    events:
      - timestamp: 2024-01-30T15:54:15Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 24fb3ebbebde4ba4
            componentName: golang.org/x/net
            componentVersion: v0.8.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:37Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4

  - id: CGA-g9xv-mrf3-2jx9
    aliases:
      - CVE-2024-35255
      - GHSA-m5vv-6r4h-3vj9
    events:
      - timestamp: 2024-06-12T07:03:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 479db76f53cf07a3
            componentName: github.com/Azure/azure-sdk-for-go/sdk/azidentity
            componentVersion: v1.1.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-06-15T18:35:01Z
        type: fixed
        data:
          fixed-version: 0.14.0-r1

  - id: CGA-gh3x-4cv3-3r74
    aliases:
      - GHSA-m425-mq94-257g
    events:
      - timestamp: 2024-01-30T15:54:14Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 5479b9a00cbef3b2
            componentName: google.golang.org/grpc
            componentVersion: v1.53.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:37Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4

  - id: CGA-ghhc-x2xj-72p7
    aliases:
      - CVE-2024-41110
      - GHSA-v23v-6jw2-98fq
    events:
      - timestamp: 2024-07-31T09:10:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildctl
            componentID: c4f4fcb51c64e471
            componentName: github.com/docker/docker
            componentVersion: v27.0.3+incompatible
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2025-03-20T19:33:21Z
        type: fixed
        data:
          fixed-version: 0.20.1-r3

  - id: CGA-gw7m-mhvq-98vj
    aliases:
      - CVE-2023-47108
      - GHSA-8pgv-569h-w5rw
    events:
      - timestamp: 2024-01-30T15:54:13Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 5b504ca37fc67e7e
            componentName: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
            componentVersion: v0.40.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:37Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4
      - timestamp: 2024-02-07T20:37:09Z
        type: pending-upstream-fix
        data:
          note: otelgrpc v0.46.0 appears to contain API-incompatible changes with this version of buildkitd. Bumping this dependency causes build-time issues with missing required packages.

  - id: CGA-h2vq-f2rf-jwrq
    aliases:
      - CVE-2023-45142
      - GHSA-rcjv-mgp8-qvmr
    events:
      - timestamp: 2024-01-30T15:54:16Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: d187dc2cd891df14
            componentName: go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
            componentVersion: v0.40.0
            componentType: go-module
            componentLocation: /usr/bin/buildkitd
            scanner: grype
      - timestamp: 2024-01-31T17:46:37Z
        type: fixed
        data:
          fixed-version: 0.12.4-r4
      - timestamp: 2024-02-07T20:38:51Z
        type: pending-upstream-fix
        data:
          note: otelhttptrace and otelhttp have been both bumped to v0.45.0 in the upstream via https://github.com/moby/buildkit/commit/5ecfec1039959e8b742494eec8f7b5fd8202df5a, but this change is yet to be released. Bumping this dependency downstream causes build-time issues with missing required packages.

  - id: CGA-h6wq-3vfj-vrgv
    aliases:
      - CVE-2023-45288
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-12T08:47:08Z
        type: fixed
        data:
          fixed-version: 0.13.1-r2

  - id: CGA-hp32-mw2w-f3m9
    aliases:
      - CVE-2025-22866
      - GHSA-3whm-j4xm-rv8x
    events:
      - timestamp: 2025-02-08T18:21:05Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: a6ebe915603ae56a
            componentName: stdlib
            componentVersion: go1.23.5
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2025-02-09T10:24:07Z
        type: fixed
        data:
          fixed-version: 0.19.0-r1

  - id: CGA-hx6m-5pw9-29pm
    aliases:
      - CVE-2024-24788
      - GHSA-2jwv-jmq4-4j3r
    events:
      - timestamp: 2024-05-14T07:40:20Z
        type: fixed
        data:
          fixed-version: 0.13.2-r1

  - id: CGA-j4wr-rjxh-qjfj
    aliases:
      - CVE-2025-22869
    events:
      - timestamp: 2025-03-11T15:23:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 420c66253ee02eec
            componentName: golang.org/x/crypto
            componentVersion: v0.31.0
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2025-03-12T11:15:57Z
        type: fixed
        data:
          fixed-version: 0.20.1-r1

  - id: CGA-j6c2-xp4q-vhg8
    aliases:
      - CVE-2023-45290
      - GHSA-rr6r-cfgf-gc6h
    events:
      - timestamp: 2024-04-11T19:01:17Z
        type: fixed
        data:
          fixed-version: 0.13.1-r2

  - id: CGA-jh96-52rx-r7gm
    aliases:
      - CVE-2024-23653
      - GHSA-wr6v-9f75-vh2g
    events:
      - timestamp: 2024-02-01T07:06:18Z
        type: fixed
        data:
          fixed-version: 0.12.5-r0

  - id: CGA-m25j-vf39-rw94
    aliases:
      - CVE-2024-40635
      - GHSA-265r-hfxg-fhmg
    events:
      - timestamp: 2025-03-18T11:45:08Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildkitd
            componentID: 3327dddada12a638
            componentName: github.com/containerd/containerd/v2
            componentVersion: v2.0.3
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2025-03-22T05:19:35Z
        type: fixed
        data:
          fixed-version: 0.20.1-r3

  - id: CGA-pvj9-jfx8-wmx9
    aliases:
      - CVE-2024-24557
      - GHSA-xw73-rw38-6vjc
    events:
      - timestamp: 2024-04-11T19:02:14Z
        type: fixed
        data:
          fixed-version: 0.13.1-r2

  - id: CGA-pwq3-833q-q6jr
    aliases:
      - CVE-2024-23650
      - GHSA-9p26-698r-w4hx
    events:
      - timestamp: 2024-02-01T07:06:16Z
        type: fixed
        data:
          fixed-version: 0.12.5-r0

  - id: CGA-qjhp-rhq4-4qxr
    aliases:
      - CVE-2023-45283
      - GHSA-vvjp-q62m-2vph
    events:
      - timestamp: 2023-11-07T19:23:46Z
        type: false-positive-determination
        data:
          type: vulnerable-code-not-included-in-package
          note: Only affects Windows

  - id: CGA-qvgx-w72v-859j
    aliases:
      - CVE-2024-24784
      - GHSA-fgq5-q76c-gx78
    events:
      - timestamp: 2024-04-11T19:01:57Z
        type: fixed
        data:
          fixed-version: 0.13.1-r2

  - id: CGA-wgv3-9hrx-gj3g
    aliases:
      - CVE-2024-23652
      - GHSA-4v98-7qmw-rqr8
    events:
      - timestamp: 2024-02-01T07:06:15Z
        type: fixed
        data:
          fixed-version: 0.12.5-r0

  - id: CGA-wh8j-mhfv-89f7
    aliases:
      - CVE-2024-24786
      - GHSA-8r3f-844c-mc37
    events:
      - timestamp: 2024-03-14T07:06:22Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildctl
            componentID: aa14e3342f8f268a
            componentName: google.golang.org/protobuf
            componentVersion: v1.31.0
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2024-03-14T15:17:54Z
        type: fixed
        data:
          fixed-version: 0.13.0-r1

  - id: CGA-wr87-ff6v-q75v
    aliases:
      - CVE-2024-24790
      - GHSA-49gw-vxvf-fc2g
    events:
      - timestamp: 2024-06-07T09:21:50Z
        type: fixed
        data:
          fixed-version: 0.13.2-r2

  - id: CGA-x352-mjxq-8r69
    aliases:
      - CVE-2024-34158
      - GHSA-j7vj-rw65-4v26
    events:
      - timestamp: 2024-09-10T07:08:04Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: buildctl
            componentID: 1c4f204595d89359
            componentName: stdlib
            componentVersion: go1.23.0
            componentType: go-module
            componentLocation: /usr/bin/buildctl
            scanner: grype
      - timestamp: 2025-03-20T19:33:21Z
        type: fixed
        data:
          fixed-version: 0.20.1-r3

  - id: CGA-xq26-g4pf-7x8c
    aliases:
      - CVE-2024-24783
      - GHSA-3q2c-pvp5-3cqp
    events:
      - timestamp: 2024-04-11T19:00:52Z
        type: fixed
        data:
          fixed-version: 0.13.1-r2