Package
podman-fips-5.8
Component
github.com/moby/buildkit
Latest update
8.4
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
False positive: the vulnerable code is not in this package.
podman v5.8.5 vendors only four buildkit packages (vendor/modules.txt): frontend/dockerfile/{command,parser,shell} and util/stack -- it uses buildkit solely as a Dockerfile parser. The v0.28.1 fix touches client/llb, executor/*, source/{containerblob,git,http}, source/util/pathutil and util/gitutil, none of which are vendored; the four vendored packages import nothing else from buildkit, so the whole vulnerable closure is absent from the artifact.
Status