Inclusion of Sensitive Information in Log Files in Buildx - CVE-2025-0495
Published: April 18, 2025
Vulnerability identifier: #VU107606
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-0495
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.
Affected software
Buildx
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
docker-stable-debuginfo
docker-stable
docker-stable-bash-completion
docker
docker-debuginfo
docker-bash-completion
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
docker-stable-debuginfo
docker-stable
docker-stable-bash-completion
docker
docker-debuginfo
docker-bash-completion
How to mitigate CVE-2025-0495
Install updates from vendor's website.
docker-stable-debuginfo - update to 24.0.9_ce-1.14.1
docker-stable - update to 24.0.9_ce-1.14.1
docker-stable-bash-completion - update to 24.0.9_ce-1.14.1
docker - update to 27.5.1_ce-98.129.1
docker-debuginfo - update to 27.5.1_ce-98.129.1
docker-bash-completion - update to 27.5.1_ce-98.129.1
docker-stable - update to 24.0.9_ce-1.14.1
docker-stable-bash-completion - update to 24.0.9_ce-1.14.1
docker - update to 27.5.1_ce-98.129.1
docker-debuginfo - update to 27.5.1_ce-98.129.1
docker-bash-completion - update to 27.5.1_ce-98.129.1