CVE-2024-24557 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-24557 Interim 1 6 2025-04-30T23:57:51Z current 2024-08-25T23:21:02Z 2025-04-30T23:57:51Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-24557 Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES-LTSS-TERADATA 15 SP2 SUSE CaaS Platform 4.0 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Module for Containers 12 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Manager Proxy 4.3 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Manager Retail Branch Server 4.3 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Manager Server 4.3 openSUSE Leap 15.6 openSUSE Tumbleweed docker docker-bash-completion docker-buildx docker-fish-completion docker-rootless-extras forgejo-runner-3.5.1-1.1 forgejo-runner-bash-completion-3.5.1-1.1 forgejo-runner-fish-completion-3.5.1-1.1 forgejo-runner-zsh-completion-3.5.1-1.1 skopeo skopeo-bash-completion skopeo-fish-completion skopeo-zsh-completion forgejo-runner-3.5.1-1.1 as a component of openSUSE Tumbleweed forgejo-runner-bash-completion-3.5.1-1.1 as a component of openSUSE Tumbleweed forgejo-runner-fish-completion-3.5.1-1.1 as a component of openSUSE Tumbleweed forgejo-runner-zsh-completion-3.5.1-1.1 as a component of openSUSE Tumbleweed skopeo as a component of SLES-LTSS-TERADATA 15 SP2 docker as a component of SUSE CaaS Platform 4.0 docker-bash-completion as a component of SUSE CaaS Platform 4.0 docker as a component of SUSE Enterprise Storage 7.1 docker-bash-completion as a component of SUSE Enterprise Storage 7.1 docker-buildx as a component of SUSE Enterprise Storage 7.1 docker-fish-completion as a component of SUSE Enterprise Storage 7.1 docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker-fish-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS skopeo as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS docker-rootless-extras as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS docker as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS docker-bash-completion as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS docker-buildx as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS docker-rootless-extras as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS skopeo as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS skopeo as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS skopeo as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS docker as a component of SUSE Linux Enterprise Micro 5.1 docker-buildx as a component of SUSE Linux Enterprise Micro 5.1 docker as a component of SUSE Linux Enterprise Micro 5.2 docker-buildx as a component of SUSE Linux Enterprise Micro 5.2 docker as a component of SUSE Linux Enterprise Micro 5.3 docker-buildx as a component of SUSE Linux Enterprise Micro 5.3 docker as a component of SUSE Linux Enterprise Micro 5.4 docker-buildx as a component of SUSE Linux Enterprise Micro 5.4 docker as a component of SUSE Linux Enterprise Micro 5.5 docker-buildx as a component of SUSE Linux Enterprise Micro 5.5 skopeo as a component of SUSE Linux Enterprise Micro 5.5 skopeo as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 skopeo-bash-completion as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 skopeo-zsh-completion as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 docker as a component of SUSE Linux Enterprise Module for Containers 12 docker as a component of SUSE Linux Enterprise Module for Containers 15 SP4 docker-bash-completion as a component of SUSE Linux Enterprise Module for Containers 15 SP4 docker-rootless-extras as a component of SUSE Linux Enterprise Module for Containers 15 SP4 docker as a component of SUSE Linux Enterprise Module for Containers 15 SP5 docker-bash-completion as a component of SUSE Linux Enterprise Module for Containers 15 SP5 docker-buildx as a component of SUSE Linux Enterprise Module for Containers 15 SP5 docker-rootless-extras as a component of SUSE Linux Enterprise Module for Containers 15 SP5 docker as a component of SUSE Linux Enterprise Server 15 SP1-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP1-LTSS skopeo as a component of SUSE Linux Enterprise Server 15 SP1-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP2-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP2-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP2-LTSS skopeo as a component of SUSE Linux Enterprise Server 15 SP2-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker-fish-completion as a component of SUSE Linux Enterprise Server 15 SP3-LTSS skopeo as a component of SUSE Linux Enterprise Server 15 SP3-LTSS docker as a component of SUSE Linux Enterprise Server 15 SP4-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15 SP4-LTSS docker-buildx as a component of SUSE Linux Enterprise Server 15 SP4-LTSS docker-rootless-extras as a component of SUSE Linux Enterprise Server 15 SP4-LTSS skopeo as a component of SUSE Linux Enterprise Server 15 SP4-LTSS skopeo as a component of SUSE Linux Enterprise Server 15 SP5-LTSS docker as a component of SUSE Linux Enterprise Server 15-LTSS docker-bash-completion as a component of SUSE Linux Enterprise Server 15-LTSS skopeo as a component of SUSE Linux Enterprise Server 15-LTSS skopeo as a component of SUSE Linux Enterprise Server Teradata 15 SP4 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 docker-buildx as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker-buildx as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker-fish-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 skopeo as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 docker as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 docker-bash-completion as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 docker-buildx as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 docker-rootless-extras as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 skopeo as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 skopeo as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 skopeo as a component of SUSE Linux Micro 6.0 skopeo as a component of SUSE Linux Micro 6.1 skopeo as a component of SUSE Manager Proxy 4.3 skopeo as a component of SUSE Manager Retail Branch Server 4.3 skopeo as a component of SUSE Manager Server 4.3 skopeo as a component of openSUSE Leap 15.6 skopeo-bash-completion as a component of openSUSE Leap 15.6 skopeo-fish-completion as a component of openSUSE Leap 15.6 skopeo-zsh-completion as a component of openSUSE Leap 15.6 Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered as a valid cache candidate for some build steps. 23.0+ users are only affected if they explicitly opted out of Buildkit (DOCKER_BUILDKIT=0 environment variable) or are using the /build API endpoint. All users on versions older than 23.0 could be impacted. Image build API endpoint (/build) and ImageBuild function from github.com/docker/docker/client is also affected as it the uses classic builder by default. Patches are included in 24.0.9 and 25.0.2 releases. CVE-2024-24557 openSUSE Tumbleweed:forgejo-runner-3.5.1-1.1 openSUSE Tumbleweed:forgejo-runner-bash-completion-3.5.1-1.1 openSUSE Tumbleweed:forgejo-runner-fish-completion-3.5.1-1.1 openSUSE Tumbleweed:forgejo-runner-zsh-completion-3.5.1-1.1 SLES-LTSS-TERADATA 15 SP2:skopeo SUSE CaaS Platform 4.0:docker SUSE CaaS Platform 4.0:docker-bash-completion SUSE Enterprise Storage 7.1:docker SUSE Enterprise Storage 7.1:docker-bash-completion SUSE Enterprise Storage 7.1:docker-buildx SUSE Enterprise Storage 7.1:docker-fish-completion SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:docker SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:docker SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:docker-fish-completion SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:skopeo SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:docker SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:docker-rootless-extras SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker-bash-completion SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker-buildx SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:docker-rootless-extras SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:skopeo SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:skopeo SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:skopeo SUSE Linux Enterprise Micro 5.1:docker SUSE Linux Enterprise Micro 5.1:docker-buildx SUSE Linux Enterprise Micro 5.2:docker SUSE Linux Enterprise Micro 5.2:docker-buildx SUSE Linux Enterprise Micro 5.3:docker SUSE Linux Enterprise Micro 5.3:docker-buildx SUSE Linux Enterprise Micro 5.4:docker SUSE Linux Enterprise Micro 5.4:docker-buildx SUSE Linux Enterprise Micro 5.5:docker SUSE Linux Enterprise Micro 5.5:docker-buildx SUSE Linux Enterprise Micro 5.5:skopeo SUSE Linux Enterprise Module for Basesystem 15 SP6:skopeo SUSE Linux Enterprise Module for Basesystem 15 SP6:skopeo-bash-completion SUSE Linux Enterprise Module for Basesystem 15 SP6:skopeo-zsh-completion SUSE Linux Enterprise Module for Containers 12:docker SUSE Linux Enterprise Module for Containers 15 SP4:docker SUSE Linux Enterprise Module for Containers 15 SP4:docker-bash-completion SUSE Linux Enterprise Module for Containers 15 SP4:docker-rootless-extras SUSE Linux Enterprise Module for Containers 15 SP5:docker SUSE Linux Enterprise Module for Containers 15 SP5:docker-bash-completion SUSE Linux Enterprise Module for Containers 15 SP5:docker-buildx SUSE Linux Enterprise Module for Containers 15 SP5:docker-rootless-extras SUSE Linux Enterprise Server 15 SP1-LTSS:docker SUSE Linux Enterprise Server 15 SP1-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP1-LTSS:skopeo SUSE Linux Enterprise Server 15 SP2-LTSS:docker SUSE Linux Enterprise Server 15 SP2-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP2-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP2-LTSS:skopeo SUSE Linux Enterprise Server 15 SP3-LTSS:docker SUSE Linux Enterprise Server 15 SP3-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP3-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP3-LTSS:docker-fish-completion SUSE Linux Enterprise Server 15 SP3-LTSS:skopeo SUSE Linux Enterprise Server 15 SP4-LTSS:docker SUSE Linux Enterprise Server 15 SP4-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15 SP4-LTSS:docker-buildx SUSE Linux Enterprise Server 15 SP4-LTSS:docker-rootless-extras SUSE Linux Enterprise Server 15 SP4-LTSS:skopeo SUSE Linux Enterprise Server 15 SP5-LTSS:skopeo SUSE Linux Enterprise Server 15-LTSS:docker SUSE Linux Enterprise Server 15-LTSS:docker-bash-completion SUSE Linux Enterprise Server 15-LTSS:skopeo SUSE Linux Enterprise Server Teradata 15 SP4:skopeo SUSE Linux Enterprise Server for SAP Applications 15 SP1:docker SUSE Linux Enterprise Server for SAP Applications 15 SP1:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP2:docker SUSE Linux Enterprise Server for SAP Applications 15 SP2:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP2:docker-buildx SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker-buildx SUSE Linux Enterprise Server for SAP Applications 15 SP3:docker-fish-completion SUSE Linux Enterprise Server for SAP Applications 15 SP3:skopeo SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker-bash-completion SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker-buildx SUSE Linux Enterprise Server for SAP Applications 15 SP4:docker-rootless-extras SUSE Linux Enterprise Server for SAP Applications 15 SP4:skopeo SUSE Linux Enterprise Server for SAP Applications 15 SP5:skopeo SUSE Linux Micro 6.0:skopeo SUSE Linux Micro 6.1:skopeo SUSE Manager Proxy 4.3:skopeo SUSE Manager Retail Branch Server 4.3:skopeo SUSE Manager Server 4.3:skopeo openSUSE Leap 15.6:skopeo openSUSE Leap 15.6:skopeo-bash-completion openSUSE Leap 15.6:skopeo-fish-completion openSUSE Leap 15.6:skopeo-zsh-completion moderate 6.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L