{"action":"Upgrade github.com/moby/buildkit to 0.11.4 or later.","affected":[{"fixed":"0.11.4","introduced":"0.10.0"}],"component":"github.com/moby/buildkit","cve_ids":["CVE-2023-26054"],"ecosystem":"Go","epss":0.01026,"exploited":false,"fixed_versions":["0.11.4"],"ghsa_id":"GHSA-gc89-7gcr-jxqc","id":"tcs_01M5KFATAW5QMAY712Z0G8DTAZ","modified_at":"2023-11-08T04:11:57.408330Z","published_at":"2023-03-07T20:09:44Z","references":["https://osv.dev/vulnerability/GHSA-gc89-7gcr-jxqc","https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc","https://nvd.nist.gov/vuln/detail/CVE-2023-26054","https://github.com/moby/buildkit/commit/75123c696506bdbca1ed69906479e200f1b62604","https://github.com/moby/buildkit","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI","https://www.rfc-editor.org/rfc/rfc3986#section-3.2.1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-gc89-7gcr-jxqc","url":"https://osv.dev/vulnerability/GHSA-gc89-7gcr-jxqc"}],"summary":"Buildkit credentials inlined to Git URLs could end up in provenance attestation"}