chore(deps): update module github.com/containerd/containerd to v1.7.11 [security] #2200
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
…1 [security] Signed-off-by: renovate[bot] <bot@renovateapp.com>
renovate
bot
added
kind/enhancement
maintainer-s-little-helper
bot
added
the
ready-to-merge
sayboras
deleted the
renovate/go-github.com/containerd/containerd-vulnerability
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.7.6->v1.7.11GitHub Vulnerability Alerts
GHSA-7ww5-4wqc-m92c
/sys/devices/virtual/powercap accessible by default to containers
Intel's RAPL (Running Average Power Limit) feature, introduced by the Sandy Bridge microarchitecture, provides software insights into hardware energy consumption. To facilitate this, Intel introduced the powercap framework in Linux kernel 3.13, which reads values via relevant MSRs (model specific registers) and provides unprivileged userspace access via
sysfs. As RAPL is an interface to access a hardware feature, it is only available when running on bare metal with the module compiled into the kernel.By 2019, it was realized that in some cases unprivileged access to RAPL readings could be exploited as a power-based side-channel against security features including AES-NI (potentially inside a SGX enclave) and KASLR (kernel address space layout randomization). Also known as the PLATYPUS attack, Intel assigned CVE-2020-8694 and CVE-2020-8695, and AMD assigned CVE-2020-12912.
Several mitigations were applied; Intel reduced the sampling resolution via a microcode update, and the Linux kernel prevents access by non-root users since 5.10. However, this kernel-based mitigation does not apply to many container-based scenarios:
sysfsis mounted inside containers read-only; however only read access is needed to carry out this attack on an unpatched CPUWhile this is not a direct vulnerability in container runtimes, defense in depth and safe defaults are valuable and preferred, especially as this poses a risk to multi-tenant container environments. This is provided by masking
/sys/devices/virtual/powercapin the default mount configuration, and adding an additional set of rules to deny it in the default AppArmor profile.While
sysfsis not the only way to read from the RAPL subsystem, other ways of accessing it require additional capabilities such asCAP_SYS_RAWIOwhich is not available to containers by default, orperfparanoia level less than 1, which is a non-default kernel tunable.References
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.7.11: containerd 1.7.11Compare Source
Welcome to the v1.7.11 release of containerd!
The eleventh patch release for containerd 1.7 contains various fixes and updates including
one security issue.
Notable Updates
/sys/devices/virtual/powercappath in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)Deprecation Warnings
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
39 commits
dfae68bc3Prepare release notes for v1.7.110d314401dupdate to go1.20.12, test go1.21.51ec1ae2c6update to go1.20.11, test go1.21.4cb804da21contrib/apparmor: deny /sys/devices/virtual/powercap40162a576oci/spec: deny /sys/devices/virtual/powercaped7c6895bDon't block snapshot garbage collection on Remove failures1fdefdd22Add warning for CRIU config usagef8f659e66Add HTTP client update function to tracing library807ddd658fix(tracing): use latest version of semconvdc45bc838Add cri-api v1alpha2 usage warning to all api calls9d1bad62edeprecation: fix missing spaces in warnings51a604c07cri: add deprecation warning for runtime_root8040e74bfcri: add deprecation warning for rutnime_engine99adc40ebcri: add deprecation warning for default_runtimeafef7ec64cri: add warning for untrusted_workload_runtime6220dc190cri: add warning for old form of systemd_cgroup80f96cd18runtime/v2: net.Dial gRPC shim sockets before trying grpcf471bb2b8tasks: emit warning for runc v1 runtime329e1d487tasks: emit warning for v1 runtime4464fde12push: always inherit distribution sources from parent7e069ee25Update tar tests to run on Darwin5fc0e4e61ctr: Add sandbox flag to ctr run31fe03764Fix windows default path overwrite issue625b35e4bsnapshots: emit deprecation warning for aufsDependency Changes
Previous release can be found at v1.7.10
v1.7.10: containerd 1.7.10Compare Source
Welcome to the v1.7.10 release of containerd!
The tenth patch release for containerd 1.7 contains various fixes and updates.
Notable Updates
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
11 commits
a995fe3a8Add release notes for v1.7.10206806128remotes/docker: close connection if no more data328493962integration: reproduce #9347d1aab27cbfix: deflake TestCRIImagePullTimeout/HoldingContentOpenWritera2b16d7f9cri: fix update of pinned label for images8dc861844cri: fix using the pinned label to pin image5930a3750Enhance container image unpack client logsDependency Changes
This release has no dependency changes
Previous release can be found at v1.7.9
v1.7.9: containerd 1.7.9Compare Source
Welcome to the v1.7.9 release of containerd!
The ninth patch release for containerd 1.7 contains various fixes and updates.
Notable Updates
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
28 commits
4b912af52Add release notes for v1.7.9eff291713update runc binary to v1.1.10bd9428ff7vendor: upgrade OpenTelemetry to v1.19.0 / v0.45.0d62cba40cExpose usage of cri-api v1alpha25dbc258a8integration: deflake TestIssue9103449912857fix: shimv1 leak issue152c57e91cri: add deprecation warning for configs689a1036dcri: add deprecation warning for auths8c38975bfcri: add deprecation warning for mirrors1fbce40c4cri: add ability to emit deprecation warnings73f15bdb6Update hcsshim tag to v0.11.460d48ffeactr: new deprecations command74a06671aplugin: record deprecation for dynamic pluginsfa5f3c91aserver: add ability to record config deprecationsf7880e7f0pull: record deprecation warning for schema 11dd2f2c02introspection: add support for deprecationsaaf000c18api/introspection: deprecation warnings in server9b7ceee54warning: new service for deprecationsb708f8bfadeprecation: new package for deprecationsDependency Changes
Previous release can be found at v1.7.8
v1.7.8: containerd 1.7.8Compare Source
Welcome to the v1.7.8 release of containerd!
The eighth patch release for containerd 1.7 contains various fixes and updates.
Notable Updates
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
27 commits
48dbdf871Prepare release notes for v1.7.868abc543bCheck scheme and host of request on push redirect35c7634e3Avoid TLS fallback when protocol is not ambiguousf36948cadvendor: gRPC v1.58.3c67a53190vendor: golang.org/x/net v0.17.071f4b36cavendor: golang.org/x/text v0.13.0a7b3b7090vendor: golang.org/x/sys v0.13.026736d6e1vendor: google.golang.org/grpc v1.56.354a69a6e4vendor: golang.org/x/oauth2 v0.7.0ac15a7f5bvendor: google.golang.org/protobuf v1.30.02479c3321[release/1.7] update to go1.20.10, test go1.21.311f40e9d8[release/1.7] update to go1.20.9, test go1.21.2cac1bab79Add a new image label if it is docker schema 16cd2cc4a8remotes: add handling for missing basic auth credentialsd0a1fedb5*: add runc-fp as runc wrapper to inject failpoint04491240acontainerd-shim-runc-v2: avoid potential deadlock in create handler6982a0df5containerd-shim-runc-v2: remove unnecessarys.getContainer()0e2320398Uncopypaste parsing of OCI Bundle spec fileDependency Changes
7f2fa6f->782d3b1782d3b1new782d3b1newPrevious release can be found at v1.7.7
v1.7.7: containerd 1.7.7Compare Source
Welcome to the v1.7.7 release of containerd!
The seventh patch release for containerd 1.7 contains various fixes and updates.
Notable Updates
See the changelog for complete list of changes
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
31 commits
a34fa5681Prepare release notes for v1.7.76ca0aebf0Allow for images with artifacts to pull7df492a95remotes/docker: Fix MountedFrom prefixed with target repositoryb3db314a5Bump x/net to 0.137779ce64eremotes: always try to establish tls connection when tls configured6013b5e03cri: stop recommending disable_cgroupa83c66813Require plugins to succeed after registering readiness171d76849cri: call RegisterReadiness after NewCRIService3d27bc738Handle unexpected shim kill events4ffa3ed29Build binaries with 1.21.15756f6064[release/1.7] vendor: github.com/Microsoft/hcsshim v0.11.109633b539deprecate logs package, but disable linter (for transitioning)cb201519falias log package to github.com/containerd/log v0.1.0a5024e6ddvendor: github.com/stretchr/testify v1.8.47bd976af3vendor: github.com/sirupsen/logrus v1.9.38cd2d33c2[release/1.7] remotes/docker: Add MountedFrom and Exists push status3ca015e55nri: update mock plugin handlers4cd208c1fvendor: update github.com/containerd/nri@v0.4.0Changes from containerd/log
9 commits
89c9a54Update golangci to 1.49cf26711Update description in READMEf9f250cAdd project detailsfb7fe3dAdd github CI flow7e13034Add go module16a3c76Rename log import from logtest698c398Add README87c83c4Add license fileChanges from containerd/nri
35 commits
5f13915releases: update note about 0.4.05ecea04ulimit-adjuster: add validation for hard limitsdb3de10test: exclude ulimit-adjuster from ginkgof0deb59ulimit-adjuster: new sample plugind2dd708Add support for rlimitsefaf36eapi: add POSIXRlimit type3f092c2.github: add test build to CI workflow.01d5f14Add a note about NRI API stability and release notes.ea9976dadaptation: add UpdateContainer tests.d042d24stub: fix plugin UpdateContainerInterface.f5d0f51plugins: update plugins for stub changes.b4bd301adaptation: update tests with stub changes.9d86150stub: pass context to plugin event handlers.5eee915removed linkc783fc7Resolves broken podman links and adds details to help better guide people in testing.da291a6Fix ParseEventMask to produce proper masksNRI_PLUGIN_NAMEenv value when launching a pre-installed plugin (#42)4a4cea6fix the NRI_PLUGIN_NAME env value when launching a pre-installed plugina67478estub: update setIdentify to ensureIdentify841f5edupdate module name of the logger plugin8d9c64dAdd gitignore for build artifactsc03d1beMakefile: fix 'install-*' targets.ab28e71docs: add a chapter about security considerations.2862d98api: initialize OCI LinuxMemory resources to empty.Dependency Changes
Previous release can be found at v1.7.6
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.cri-containerd-<VERSION>-<OS>-<ARCH>.tar.gz: (Deprecated)cri-containerd-cni-<VERSION>-<OS>-<ARCH>.tar.gz: (Deprecated)In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.