Docker buildx v0.37.2 Security Fix: Unauthorized Permission Handling and fs.read Requirements for Bake Command

Vulnerability Overview A security vulnerability exists in version v0.37.2. This vulnerability relates to the handling of unauthorized permissions, specifically manifested as follows: 1. Bake Command: Now denies unauthorized permissions rather than skipping consent checks. Requested permissions must be explicitly granted. 2. Bake Command: Now requires permissions to approve secret files selected via implicit fallback, as well as for local OCI layout named contexts. Impact Scope Bake Command: Affects all users of the command, particularly those relying on unauthorized permissions or implicit ID fallbacks. Secret File Handling: Affects all users utilizing secret files selected via implicit ID fallbacks. Local OCI Layout: Affects all users employing local OCI layout named contexts. Remediation 1. Explicit Permission Granting: Users must explicitly grant requested permissions instead of relying on unauthorized access. 2. Permission Requirements: Ensure that permissions are present for selecting secret files and using local OCI layout named contexts. Proof of Concept (PoC) Code or Exploit Code No specific PoC code or exploit code was provided in the page. Related Links GitHub Issues Previous Release Contributors CrazyMax Sebastiaan van Stijn Tõnis Tiagi Dependency Changes v2.3.4 -> v2.3.6 v0.33.0 -> v0.33.1 v0.55.0 -> v0.56.0 Assets The page lists multiple asset files, including binaries for different platforms and architectures, SBOM files, signature files, etc., but these are not directly related to the vulnerability itself. Summary This vulnerability primarily affects the behavior of the command in when handling unauthorized permissions and secret files. The remediation requires users to explicitly grant permissions and ensure necessary permissions are in place. It is recommended that users upgrade to version v0.37.2 to address this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Docker buildx v0.37.2 Security Fix: Unauthorized Permission Handling and fs.read Requirements for Bake Command

More from this source