We are encountering the vulnerability of CVE-2023-44487 for the image gardendev/buildkit:v0.12.2. Can you please provide me with the resolution for this issue?

[SiddharamAlagi]

We are encountering the vulnerability of CVE-2023-44487 for the image gardendev/buildkit:v0.12.2. Can you please provide me with the resolution for this issue?

[SiddharamAlagi]

we are waiting for your response

[10ko]

Hi @SiddharamAlagi,
we are working on updating the image since it's still present in the latest tag (v0.13.2). It will be released with the next release.
Also, just to make sure I understand the issue: are you experiencing the vulnerability or it's just being flagged by your security setup?

Thanks for reporting, we'll keep you posted.

[SiddharamAlagi]

Is there any way to override the buildkit image tag in the configuration to avoid this vulnerability

[twelvemo]

Hi @SiddharamAlagi , no that is currently not possible. I have updated the image to the latest buildkit image. Once it is merged you can use the garden edge version to already use the new image. We will also cut a new garden release today, which will make the fix generally available.

[vvagaytsev]

@SiddharamAlagi the fix was released in Garden 0.13.42 yesterday.

Now Garden uses moby/builtkit:0.16.0 as a base image and that one does not have the vulnerability mentioned above.
Please let us know if there are any other issues.

[SiddharamAlagi]

thank you so much