Need docker buildx, but having CVE issues

[daipok]

Hi all, building a CI system for developers where we use docker image to run their builds. Part of their builds is to build a docker image, and they use such way:

COPY --chmod=755 foo bar

and this syntax requires docker buildx. I can ask them to change the syntax but probably quite hard to do (as it spreads out). I included docker buildx in my docker image, but then I get a CVE-2024-41110 for the buildx component.

I found that even up to docker 27.2.1 buildx component still has the issue. Anyone has idea on why is this?