Detections
Analytics
SCA: security update for github.com/docker/docker, github.com/moby/moby (GHSA-xw73-rw38-6vjc)
high Tenable Cloud Security Plugin ID 420706
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Moby is an open-source project created by Docker to enable software containerization. The classic builder
cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some
instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with
the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially
crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are
only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are
using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API
endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the
uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases. (CVE-2024-24557)
See Also
Plugin Details
Severity: High
ID: 420706
Version: Revision 1.13
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.82
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.3
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-24557
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 2/1/2024
Vulnerability Publication Date: 2/1/2024
Reference Information
CVE: CVE-2024-24557