fix(deps): update module github.com/containerd/containerd to v1.7.27 [security] #263
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
…[security] Signed-off-by: renovate[bot] <[email protected]>
renovate
bot
added
dependencies
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
renovate
bot
deleted the
renovate/go-github.com-containerd-containerd-vulnerability
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.7.25->v1.7.27GitHub Vulnerability Alerts
CVE-2024-40635
Impact
A bug was found in containerd where containers launched with a User set as a
UID:GIDlarger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images.
Credits
The containerd project would like to thank Benjamin Koltermann and emxll for responsibly disclosing this issue in accordance with the containerd security policy.
References
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.7.27Compare Source
v1.7.26: containerd 1.7.26Compare Source
Welcome to the v1.7.26 release of containerd!
The twenty-sixth patch release for containerd 1.7 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
Node Resource Interface (NRI)
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
24 commits
ceba197f5Prepare release notes for v1.7.263486bc8ddUpgrade x/net to 0.33.09025d3075update build to go1.23.6, test go1.24.083eaab482Update install-imgcrypt to allow change install repo8bc21cba7support to syncfs after pull by using diff plugin27c472acfUpdate runc binary to v1.2.5run.skip-dirstoissues.exclude-dirsin golangci-lint config (#11400)8d8034b66move skip-dirs to issues.exclude-dirs11af05177cri,nri: block NRI plugin sync. during event processing.d4036cd3dgo.{mod,sum}: bump NRI to v0.8.0, re-vendor.c3e24e024Add integ test to check tty leak4e45a463dfix master tty leak due to leaking init container object0fe9f0b52fix fatal error: concurrent map iteration and map write441b92636update build to go1.22.11, test go1.23.5Changes from containerd/nri
77 commits
eaf78a9api: support Pod IPs07bfc18wip: generate: add test for oom score adjb5fc359generate: do not set OOMScoreAdj if no adjustment235aa11chore: remove unreachable code and fmt files159f575template: dump pod/container count in sync message.bf267e3stub: collect/handle split sync messages.ed78ae9adaptation: use multiple sync messages if necessary.6fd59d6api: add support for multiple sync messages.a7fccccmux: split oversized messages.5fe9b06mux: fix maximum allowed message size.693d64ego.{mod,sum}, plugins: update ttrpc and NRI deps.320e4e7adaptation: tests for runtime version, timeouts.f86d982api,adaptation,stub: let plugin know configured timeouts.cfcd2afMakefile: fix ginkgo-tests target.8cd9504adaptation: block plugin sync/registration in test suite.966ac92adaptation: implement plugin synchronization blocks.f74ce31ci: verify code generation and generated files in repoe4d5c36ci: stop testing with golang 1.20.x.6578149go.{mod,sum}: bump golang requirement to 1.21.442e812go.{mod,sum}: update to ginkgo v2.19.1.eada085ignore pre-installed plugins that did not sync successfullyb881bc4sync sandboxes and containers after starting the pre-installed plugins3880f1dadaptation: add test case for mount removal.0d3b376adaptation: fix mount removal in adjustments.df84c47.github: add codespell workflow.a03dc93pkg,plugins,.codespellrc: add codespellrc, fix spelling.4aec208adaptation: log plugin as connected and synchronized.4e60cd0adaptation: close plugin if initial synchronization fails.1cc026fReset source path of api.pb.go to pkg/api/api.protoefcb2daNRI plugins support adjust oom_score_adj8783973device-injector: clarify precedence of annotations.4eb7075pkg/adaptation: fix grammatical mistakes in comments.4bd8da8device-injector: add support for CDI injection.44773bdruntime-tools/generate: add support CDI injection.65282feadaptation: add CDI device injection unit test.01f3b7aadaptation: add support for native CDI injection.f1aa58fapi: add support for native CDI device injection.8434439types: Fix a typo1719502support pids cgroup242661fstub: support re-start after stub stoppedba398fastop closed plugins that will be removedf96a550device-injector: small grammar fix in README.md.5680921plugins/template: fix typo in a comment.2c3608d.golangci.yml: silence dot-import errors for tests.8f56974pkg/{adaptation,api,net,stub}: fix linter errors.e863892.github: bump golangci-lint to v1.58.0.674cb41.github: bump setup-go to v5.9106283.github: test with golang 1.20.x, 1.21.x, 1.22.3 in CI.a9778adplugins: bump golang version to 1.20.8e86065go.{mod.sum}: bump golang version to 1.20.ff774e6network device injector plugin06841c2Modify hook-injector plugin to monitor directories to match cri-o2791e93docs: fix broken link to sample plugins in README.mdChanges from containerd/ttrpc
11 commits
430f734Add MD.Clonec4d96d5server: fix Serve() vs. immediate Shutdown() race.ed6c3baserver_test: add Serve()/Shutdown() race test.b5cd6e4channel: allow discovery of overflown message size.d8c00dfchannel_test: update oversize message test.de273bfchannel: reject oversized messages on the sender side.84e1784server_test: fix error message in TestOversizeCall.Dependency Changes
Previous release can be found at v1.7.25
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.