8.9Alta

CVE-2024-9348Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view

Docker Docker Desktop; docker desktop Publicada: 2024-10-16 17:50 (hace 2 años)

Descripción

Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view.

Debilidad (CWE): CWE-20 CWE-116

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
docker	desktop	< 4.34.3
Docker	Docker Desktop	< 4.34.3

Referencias y parches

https://docs.docker.com/desktop/release-notes/#4343 release-notes

Puntuación CVSS

8.9Alta

Fuente: Docker · CVSS 4.0

Vector de ataque: Red
Complejidad: Alta
Requisitos: Presentes
Privilegios: Ninguno
Interacción del usuario: Activa
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS (probabilidad de explotación en 30 días)

0.47%

superior al 41 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: none
Automatizable: no
Impacto técnico: total

Cronología

ID reservado2024-09-30
Publicada2024-10-16 17:50
Llegó a IP-DB2026-10-24 23:56
Última actualización2024-10-17 16:30

Asignada por (CNA): Docker

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Docker / Moby

4.5Media

CVE-2026-121520 hace 4 días

Malicious client could set xattr value outside of BuildKit state directory

Moby BuildKit

In BuildKit versions prior to v0.34.1, a malicious client with access to the BuildKit control APIs can submit a build request that sets an extended attribute on a file outside the BuildKit state directory. Extended attributes in the trusted. or security. name…

6.7Media

CVE-2026-121522 hace 4 días

Possible panic from Git source resolver

moby BuildKit

In BuildKit versions v0.26.0 through v0.34.1, a specific build definition that resolves metadata for the same Git source reference twice can cause the BuildKit daemon to panic and crash, interrupting builds handled by that daemon. The issue is fixed in v0.34.2.

5.6Media

CVE-2026-121541 hace 4 días

Bake filesystem path entitlements approval can be skipped in some multi-target builds

Docker Docker Buildx

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some …

1.8Baja

CVE-2026-121542 hace 4 días

Bake filesystem path entitlements approval can be skipped for path using basename prefix

Docker Docker Buildx

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working dire…

7.1Alta

CVE-2026-121614 hace 4 días

Docker Sandboxes host Git executes repository-controlled programs

Docker Docker Sandboxes

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox w…

7.3Alta

CVE-2026-93325 hace 4 días

Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx

Docker Docker Buildx

Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.