fix(deps): update module github.com/containerd/containerd/v2 to v2.3.0 [security] (alauda-v0.65.0)#148
Open
alaudaa-renovate[bot] wants to merge 1 commit into
Conversation
alaudaa-renovate
Bot
added
the
dependencies
Author
|
📊 API Changes DetectedSemver impact: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.2.1->v2.3.0containerd user ID handling bypass allows runAsNonRoot evasion
CVE-2026-46680 / GHSA-fqw6-gf59-qr4w
More information
Details
Impact
A bug was found in containerd where containers launched with a numeric
Userdirective that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image provides an/etc/passwdfile mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the KubernetesrunAsNonRootrestriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Note: The containerd 2.1 release has reached its end of life and a fixed version is not provided.
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images. Alternatively, enforcing a specific numeric
runAsUserin the Kubernetes PodsecurityContextoverrides theUSERdirective in the image and prevents the bypass. Newer versions of Kubernetes, starting with 1.34, also appear to enforcerunAsNonRootproperly regardless of this bug.Credits
The containerd project would like to thank Lei Wang (@ssst0n3) for responsibly disclosing this issue in accordance with the containerd security policy.
Resources
For more information
If there are any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd/v2)
v2.3.0: containerd 2.3.0Compare Source
Welcome to the v2.3.0 release of containerd!
The third minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the third time-based release for containerd.
Starting with containerd 2.3, the project has moved to release cadence aligned with
the Kubernetes release schedule, with new minor releases about every 4 months. The
containerd 2.3 release is also the first annual LTS (Long Term Stable) release under
this new schedule, with support planned for at least two years. Direct upgrades
between sequential LTS releases (e.g., 1.7 to 2.3) will be tested and supported.
Highlights
Container Runtime Interface (CRI)
Image Distribution
Image Storage
Node Resource Interface (NRI)
Runtime
Snapshotters
ctr development tool
Breaking
Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Dependency Changes
ad3df93d8f796a0ea5ed0->edf4cb35d4384ea7a43d2->9d38bb4a7a43d2->6f92a3bf2248ac5883c5enew4c0f3b2->28399d8cfa47c3->2d32026Previous release can be found at v2.2.0
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.2.3: containerd 2.2.3Compare Source
Welcome to the v2.2.3 release of containerd!
The third patch release for containerd 2.2 contains various fixes
and updates including a security patch.
Security Updates
Highlights
Container Runtime Interface (CRI)
Go client
Image Distribution
Runtime
Snapshotters
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
40 commits
8a0f4ed5dPrepare release notes for v2.2.331bd34a06update github.com/moby/spdystream v0.5.11336f6c45vendor: github.com/klauspost/compress v1.18.5409f75be8diff/walking: enable mount manager3f33146c1update runhcs to v0.14.18bd1b74e5vendor: github.com/Microsoft/hcsshim v0.14.1c6b0be8e1vendor: github.com/Microsoft/hcsshim v0.14.02ecde8cfeupdate to Go 1.25.9, 1.26.2be554f478Skip TestExportAndImportMultiLayer on s390x660de195bTweak mount info for overlayfs in case of parallel unpackbc9274a4bAdd integration test for issue 13030c387890b5Add integration test for privileged container cgroup mounts047a335a6Forward RUNC_FLAVOR env var down to integration tests9b2d72ee0Preserve host cgroup mount options for privileged containers5b66cd6a0Move cgroup namespace placement higher in spec builder584205c2f[release/2.2] update runc binary to v1.3.577c6886dfIgnore NOCHANGE errorfbed68b8fFix TOCTOU race bug in tar extractiona83510103cri: UpdatePodSandbox should return Unimplementedee4179e52fix(oci): apply absolute symlink resolution to /etc/groupfd061b848test(oci): use fstest and mock fs for better symlink coverage5d44d2c22fix(oci): handle absolute symlinks in rootfs user lookup00c776f07update to go1.25.8, test go1.26.1Dependency Changes
Previous release can be found at v2.2.2
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
v2.2.2: containerd 2.2.2Compare Source
Welcome to the v2.2.2 release of containerd!
The second patch release for containerd 2.2 contains various fixes and improvements.
Highlights
Container Runtime Interface (CRI)
Runtime
ctr development tool
ctr image mountfailing with "no such device" (#12831)Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
48 commits
7e6ecf434Prepare release notes for v2.2.2a20dead7cset default config_path in plugin inita5f83d8c2cri: unpack images with per-layer labels for runtime-specific snapshotters68855cb0bci: modprobe xt_comment on almalinuxef7a8beb3core/mount: add test for getUnprivilegedMountFlags07b2cc07ecore/mount: fix getUnprivilegedMountFlags iterating over indices instead of values54101116fadd integration test for cni result nild44c4384eaddress commentf1835270bfix issue where cni del is never executed6c05047b4apparmor: explicitly set abi/3.05dbf1b915update golangci-lint to v2.9.0 with go1.26 support8ec695eberemove windows/arm from cross buildb9c22a6e3ci: build/test go1.26.009b876a81integration: Fix TestImageLoad() failure on CI172ba65b6cri: Fix image volumes with user namespacesb4240ef87update to go1.24.13, go1.25.794dbfaea7ci: bump go 1.24.12, 1.25.6e46a7a286set fetch-depth for containerd to 0 for version parsingctr image mountfailing with "no such device" (#12831)1d7908273core/mount/manager: fix bind mount missing rbind option3d509bcd3core/mount/manager: add tests for WithTemporary optioncb3ae2119fix: sanitize error before gRPC return to prevent credential leak in pod events533a2552ebuild(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0b120237fbbuild(deps): bump google.golang.org/grpc from 1.76.0 to 1.77.04be4e5156Fix nil pointer dereference in container spec memory metricsa76eb698acri: emit warning for concurrent CreateContainer3d2e188b1cri: Use the runtimeHandler parameter in PullImage633057382cri: move noisy CDI logs to debug level8a7409e2eReinstate image decryptionDependency Changes
a7a43d2->ab9386aa7a43d2->ab9386aPrevious release can be found at v2.2.1
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.