SB2025041829 - SUSE update for docker-stable

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025041829

SB2025041829 - SUSE update for docker-stable

Published: April 18, 2025

Security Bulletin ID SB2025041829
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2025-0495)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.


Remediation

Install update from vendor's website.

References