CyberSecBulletin

Buildkite vulnerabilities

We track 2 vulnerabilities in Buildkite products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on December 22, 2023.

2vulnerabilities
0critical
2high
0exploited
7.4average CVSS score

Latest Buildkite vulnerabilities

  • 7.0 High severity

    Elastic Ci Stack: Time-of-check Time-of-use (TOCTOU) Race Condition

    CVE-2023-43741Buildkite

    A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permiss

  • 7.8 High severity

    Elastic Ci Stack: Improper Link Resolution Before File Access

    CVE-2023-43116Buildkite

    A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions