Bake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx

Summary

Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.

Remediation

1. Inventory every Docker Docker Buildx deployment, including staging.
2. Upgrade Docker Docker Buildx to 0.37.2.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/docker/buildx/releases/tag/v0.37.2
• Advisoryhttps://github.com/docker/buildx/security/advisories/GHSA-gwr2-q96m-6682
• Advisoryhttps://www.zerodayinitiative.com/advisories/ZDI-CAN-31688/