update: docker

[t-lo]

Name: app-containers/docker
CVEs: CVE-2024-24557, GHSA-xw73-rw38-6vjc
CVSSs: 6.9 (Medium)
Action Needed: Update to 24.0.9 or higher. 20.x will not be patched by upstream.

Summary: In Moby <= v25.0.1 and <= v24.0.8, the classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONBUILD) would not cause a cache miss. An attacker with knowledge of the Dockerfile someone is using could poison their cache by making them pull a specially crafted image that would be considered a valid cache candidate for some build steps.

refmap.gentoo: TBD

[t-lo]

The latest sysext bakery release ships a Docker sysext that includes a fix (docker 24.0.9): https://github.com/flatcar/sysext-bakery/releases/tag/latest. Using the sysext can mitigate the issue until we publish new OS releases later in February.
Check out the readme in the sysext bakery https://github.com/flatcar/sysext-bakery as well as our documentation on sysexts https://www.flatcar.org/docs/latest/provisioning/sysext/ for more information

[krnowak]

Next alpha, beta and stable will have docker 24.0.9.