{"schemaVersion":3,"id":"CVE-2025-0495","aliases":["SUSE-SU-2025:1341-1","SUSE-SU-2025:1344-1","UBUNTU-CVE-2025-0495","DEBIAN-CVE-2025-0495","CGA-59xj-fccc-m6h2","CGA-f6hj-jqqx-3pmf","CGA-hq5h-wxgj-j6hf","CGA-xwm6-pj49-wfjv","GHSA-m4gq-fm9h-8q75","GO-2025-3527","openSUSE-SU-2025:14980-1","CGA-mvvm-c47w-gf85","CGA-q897-w43m-mwj4"],"status":"published","duplicateOf":null,"title":null,"description":"Buildx is a Docker CLI plugin that extends build capabilities using BuildKit.\n\nCache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces as part of the arguments and flags for the traced CLI command. OpenTelemetry traces are also saved in BuildKit daemon's history records.\n\n\nThis vulnerability does not impact secrets passed to the Github cache backend via environment variables or registry authentication.","dates":{"published":"2025-03-17T19:21:11.295Z","modified":"2025-03-18T16:25:42.668Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.1,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":4.1,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":4.1,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":4.1,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":4.1,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":4.1,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":4.1,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":4.1,"severity":"medium","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00196,"percentile":0.08746,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.003999999999999989,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00192},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00196,"percentile":0.08746}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00192,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00196,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00196,"percentile":0.08746}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File","description":"The product writes sensitive information to a log file.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/532.html"}],"affected":[{"vendor":"chainguard","product":"docker-compose","name":"docker-compose","label":"docker-compose","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/docker-compose","purlType":"apk","versions":[{"text":"< 2.34.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.34.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"docker-compose-fips","name":"docker-compose-fips","label":"docker-compose-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/docker-compose-fips","purlType":"apk","versions":[{"text":"< 2.34.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.34.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubescape","purlType":"apk","versions":[{"text":"< 3.0.43-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.43-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"docker-compose","name":"docker-compose","label":"docker-compose","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/docker-compose","purlType":"apk","versions":[{"text":"< 2.34.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.34.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubescape","name":"kubescape","label":"kubescape","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubescape","purlType":"apk","versions":[{"text":"< 3.0.43-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.43-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"docker-buildx","name":"docker-buildx","label":"docker-buildx","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/docker-buildx","purlType":"deb","versions":[{"text":"< 0.13.1+ds1-3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.1+ds1-3","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"docker-buildx","name":"docker-buildx","label":"docker-buildx","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/docker-buildx","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"docker","product":"buildx","name":"buildx","label":"buildx","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 0.21.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 0.21.2","eol":null,"hubHref":"/vendor/docker/buildx"},{"vendor":"github.com/docker","product":"buildx","name":"github.com/docker/buildx","label":"buildx","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/docker/buildx","purlType":"golang","versions":[{"text":"< 0.21.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.21.3","eol":null,"hubHref":null},{"vendor":"opensuse","product":"docker-stable&distro=openSUSE Tumbleweed","name":"docker-stable","label":"docker-stable&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/docker-stable&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 24.0.9_ce-9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.9_ce-9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"docker-stable&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","name":"docker-stable","label":"docker-stable&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/docker-stable&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","purlType":"rpm","versions":[{"text":"< 24.0.9_ce-1.14.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.9_ce-1.14.1","eol":null,"hubHref":null},{"vendor":"suse","product":"docker&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","name":"docker","label":"docker&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/docker&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5","purlType":"rpm","versions":[{"text":"< 27.5.1_ce-98.129.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 27.5.1_ce-98.129.1","eol":null,"hubHref":null}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/docker/buildx","label":"github.com/docker/buildx","hostname":"github.com","tags":["REPORT","PACKAGE"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251341-1/","label":"www.suse.com/support/update/announcement/2025/suse-su-20251341-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1239765","label":"bugzilla.suse.com/1239765","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0495","label":"www.suse.com/security/cve/CVE-2025-0495","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20251344-1/","label":"www.suse.com/support/update/announcement/2025/suse-su-20251344-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-0495","label":"ubuntu.com/security/CVE-2025-0495","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-0495","label":"www.cve.org/CVERecord?id=CVE-2025-0495","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://github.com/docker/buildx/security/advisories/GHSA-m4gq-fm9h-8q75","label":"github.com/docker/buildx/security/advisories/GHSA-m4gq-fm9h-8q75","hostname":"github.com","tags":["REPORT","WEB","Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-0495","label":"security-tracker.debian.org/tracker/CVE-2025-0495","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0495.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0495.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0495","label":"nvd.nist.gov/vuln/detail/CVE-2025-0495","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://github.com/docker/buildx/commit/18ccba072076ddbfb0aeedd6746d7719b0729b58","label":"github.com/docker/buildx/commit/18ccba072076ddbfb0aeedd6746d7719b0729b58","hostname":"github.com","tags":["WEB","FIX"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2025:14910-1","OPENSUSE-SU-2025:14985-1","OPENSUSE-SU-2026:21247-1","SUSE-SU-2025:02289-1","SUSE-SU-2025:02289-2","SUSE-SU-2025:20205-1","SUSE-SU-2025:20360-1","SUSE-SU-2026:22546-1","SUSE-SU-2026:22567-1","SUSE-SU-2026:22703-1","SUSE-SU-2026:22887-1"],"duplicates":[],"related":["CGA-6V2X-X523-5635","CGA-GPHQ-4JVJ-3M35","CGA-JQQG-39Q6-6JP8","OPENSUSE-SU-2025:14910-1","OPENSUSE-SU-2025:14985-1","OPENSUSE-SU-2026:21247-1","SUSE-SU-2025:02289-1","SUSE-SU-2025:02289-2","SUSE-SU-2025:20205-1","SUSE-SU-2025:20360-1","SUSE-SU-2026:22546-1","SUSE-SU-2026:22567-1","SUSE-SU-2026:22703-1","SUSE-SU-2026:22887-1"]},"timeline":[{"kind":"published","date":"2025-03-17T19:21:11.295Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-03-18T16:25:42.668Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":16,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:10:57.254Z","stale":false,"partial":false}}