Vulnerability in Moby
CVE-2024-24557
Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being…
EPSS: 0.003 (16.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.9 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L.
Affected products
- Moby — versions >= 25.0.0, < 25.0.2, < 24.0.9
- Mobyproject Moby
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-24557?
- CVE-2024-24557 is a medium-severity vulnerability in Moby, classified under Insufficient Verification of Data Authenticity. CVSS score: 6.9/10. Published 2024-02-01.
- How severe is CVE-2024-24557?
- Medium severity. CVSS v3 base score is 6.9 out of 10.
- Is CVE-2024-24557 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.