Laradock
Monthly
Laradock through 20.4 fetches code during its workspace Dockerfile build without verifying integrity, allowing a network-positioned attacker to substitute or intercept that download and influence the build with limited confidentiality, integrity, and availability impact. Exploitation requires a user to actively start the build (UI:P) and is rated high complexity, and while publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV). The issue is low priority given the network-positioning prerequisite, build-time-only window, and limited impact.
Laradock through 20.4 fetches code during its workspace Dockerfile build without verifying integrity, allowing a network-positioned attacker to substitute or intercept that download and influence the build with limited confidentiality, integrity, and availability impact. Exploitation requires a user to actively start the build (UI:P) and is rated high complexity, and while publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV). The issue is low priority given the network-positioning prerequisite, build-time-only window, and limited impact.