UpHeron
All vulnerabilities

Servers and applications

CVE-2024-24557

Classic builder cache poisoning

Severity
High 7.8
Published
1 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
23.0.10, 24.0.9, 25.0.2
Also known as
GHSA-xw73-rw38-6vjc
Sources
NVD, Project advisories (GitHub)

Description

Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with the knowledge of the Dockerfile someone is using could poison their cache by making…

Affected software

SoftwareAffected versions
Docker EngineServers and applications · cpe:a:mobyproject:moby
  • Every version before 24.0.9
  • From 25.0.0 before 25.0.2
Docker EngineServers and applications · github:moby/moby
  • From 23 before 23.0.10
  • From 24 before 24.0.9
  • From 25 before 25.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-24557
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-24557
  • GitHub Advisory Database https://github.com/advisories/GHSA-xw73-rw38-6vjc
  • github.com https://github.com/moby/moby/security/advisories/GHSA-xw73-rw38-6vjc