Detections
Analytics

Alpine: multiple docker packages: security update to 23.0.2-r0

medium Tenable Cloud Security Plugin ID 404111

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and
 repeatable manner. In affected versions when the user sends a build request that contains a Git URL that
 contains credentials and the build creates a provenance attestation describing that build, these
 credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1)
 Invoking build directly from a URL with credentials. 2) If the client sends additional version control
 system (VCS) info hint parameters on builds from a local source. Usually, that would mean reading the
 origin URL from `.git/config` file. When a build is performed under specific conditions where credentials
 were passed to BuildKit they may be visible to everyone who has access to provenance attestation.
 Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not
 vulnerable. In v0.10, when building directly from Git URL, the same URL could be visible in `BuildInfo`
 structure that is a predecessor of Provenance attestations. Previous versions are not vulnerable. This bug
 has been fixed in v0.11.4. Users are advised to upgrade. Users unable to upgrade may disable VCS info
 hints by setting `BUILDX_GIT_INFO=0`. `buildctl` does not set VCS hints based on `.git` directory, and
 values would need to be passed manually with `--opt`. (CVE-2023-26054)

See Also

https://security.alpinelinux.org/vuln/CVE-2023-26054

Plugin Details

Severity: Medium

ID: 404111

Version: Revision 1.29

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2023-26054

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 3/6/2023

Reference Information

CVE: CVE-2023-26054