fix(deps): update module github.com/containerd/containerd to v1.7.27 [security] (v1.1) - abandoned #3521
+3,643
−5,328
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![cilium-renovate[bot]](https://avatars.githubusercontent.com/in/339224?s=60&v=4){kind=small}
…[security] Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com>
cilium-renovate
bot
requested review from
kkourt
and removed request for
a team
cilium-renovate
bot
added
release-blocker
ℹ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
cilium-renovate
bot
changed the title
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.7.16->v1.7.27containerd has an integer overflow in User ID handling
CVE-2024-40635 / GHSA-265r-hfxg-fhmg / GO-2025-3528
More information
Details
Impact
A bug was found in containerd where containers launched with a User set as a
UID:GIDlarger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images.
Credits
The containerd project would like to thank Benjamin Koltermann and emxll for responsibly disclosing this issue in accordance with the containerd security policy.
References
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
containerd has an integer overflow in User ID handling in github.com/containerd/containerd
CVE-2024-40635 / GHSA-265r-hfxg-fhmg / GO-2025-3528
More information
Details
containerd has an integer overflow in User ID handling in github.com/containerd/containerd
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.7.27: containerd 1.7.27Compare Source
Welcome to the v1.7.27 release of containerd!
The twenty-seventh patch release for containerd 1.7 contains various fixes
and updates.
Highlights
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
20 commits
05044ec0aMerge commit from fork11504c3fcvalidate uid/gid1be04be6cPrepare release notes for v1.7.2782b5c43fecore/remotes: Handle attestations in MakeRefKey2c670e79bcore/images: Ignore attestations when traversing childrena39863c9fupdate build to go1.23.7, test go1.24.149537b3a7e2e: use the shim bundled with containerd artifactfe490b76fBump up github.com/intel/goresctrl to 0.5.013fc9d313update containerd/project-checks to 1.2.1585699c94Remove unnecessary joinError unwrap4b9df59beRemove hashicorp/go-multierror5ba28f8dcgo.{mod,sum}: bump CDI deps to v0.8.1, re-vendor.85f10bd92CI: arm64-8core-32gb -> ubuntu-24.04-arm561ed520eincrease xfs base image size to 300MbDependency Changes
f223a00->bc3834cPrevious release can be found at v1.7.26
v1.7.26: containerd 1.7.26Compare Source
Welcome to the v1.7.26 release of containerd!
The twenty-sixth patch release for containerd 1.7 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
Node Resource Interface (NRI)
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
24 commits
ceba197f5Prepare release notes for v1.7.263486bc8ddUpgrade x/net to 0.33.09025d3075update build to go1.23.6, test go1.24.083eaab482Update install-imgcrypt to allow change install repo8bc21cba7support to syncfs after pull by using diff plugin27c472acfUpdate runc binary to v1.2.5run.skip-dirstoissues.exclude-dirsin golangci-lint config (#11400)8d8034b66move skip-dirs to issues.exclude-dirs11af05177cri,nri: block NRI plugin sync. during event processing.d4036cd3dgo.{mod,sum}: bump NRI to v0.8.0, re-vendor.c3e24e024Add integ test to check tty leak4e45a463dfix master tty leak due to leaking init container object0fe9f0b52fix fatal error: concurrent map iteration and map write441b92636update build to go1.22.11, test go1.23.5Changes from containerd/nri
77 commits
eaf78a9api: support Pod IPs07bfc18wip: generate: add test for oom score adjb5fc359generate: do not set OOMScoreAdj if no adjustment235aa11chore: remove unreachable code and fmt files159f575template: dump pod/container count in sync message.bf267e3stub: collect/handle split sync messages.ed78ae9adaptation: use multiple sync messages if necessary.6fd59d6api: add support for multiple sync messages.a7fccccmux: split oversized messages.5fe9b06mux: fix maximum allowed message size.693d64ego.{mod,sum}, plugins: update ttrpc and NRI deps.320e4e7adaptation: tests for runtime version, timeouts.f86d982api,adaptation,stub: let plugin know configured timeouts.cfcd2afMakefile: fix ginkgo-tests target.8cd9504adaptation: block plugin sync/registration in test suite.966ac92adaptation: implement plugin synchronization blocks.f74ce31ci: verify code generation and generated files in repoe4d5c36ci: stop testing with golang 1.20.x.6578149go.{mod,sum}: bump golang requirement to 1.21.442e812go.{mod,sum}: update to ginkgo v2.19.1.eada085ignore pre-installed plugins that did not sync successfullyb881bc4sync sandboxes and containers after starting the pre-installed plugins3880f1dadaptation: add test case for mount removal.0d3b376adaptation: fix mount removal in adjustments.df84c47.github: add codespell workflow.a03dc93pkg,plugins,.codespellrc: add codespellrc, fix spelling.4aec208adaptation: log plugin as connected and synchronized.4e60cd0adaptation: close plugin if initial synchronization fails.1cc026fReset source path of api.pb.go to pkg/api/api.protoefcb2daNRI plugins support adjust oom_score_adj8783973device-injector: clarify precedence of annotations.4eb7075pkg/adaptation: fix grammatical mistakes in comments.4bd8da8device-injector: add support for CDI injection.44773bdruntime-tools/generate: add support CDI injection.65282feadaptation: add CDI device injection unit test.01f3b7aadaptation: add support for native CDI injection.f1aa58fapi: add support for native CDI device injection.8434439types: Fix a typo1719502support pids cgroup242661fstub: support re-start after stub stoppedba398fastop closed plugins that will be removedf96a550device-injector: small grammar fix in README.md.5680921plugins/template: fix typo in a comment.2c3608d.golangci.yml: silence dot-import errors for tests.8f56974pkg/{adaptation,api,net,stub}: fix linter errors.e863892.github: bump golangci-lint to v1.58.0.674cb41.github: bump setup-go to v5.9106283.github: test with golang 1.20.x, 1.21.x, 1.22.3 in CI.a9778adplugins: bump golang version to 1.20.8e86065go.{mod.sum}: bump golang version to 1.20.ff774e6network device injector plugin06841c2Modify hook-injector plugin to monitor directories to match cri-o2791e93docs: fix broken link to sample plugins in README.mdChanges from containerd/ttrpc
11 commits
430f734Add MD.Clonec4d96d5server: fix Serve() vs. immediate Shutdown() race.ed6c3baserver_test: add Serve()/Shutdown() race test.b5cd6e4channel: allow discovery of overflown message size.d8c00dfchannel_test: update oversize message test.de273bfchannel: reject oversized messages on the sender side.84e1784server_test: fix error message in TestOversizeCall.Dependency Changes
Previous release can be found at v1.7.25
v1.7.25: containerd 1.7.25Compare Source
Welcome to the v1.7.25 release of containerd!
The twenty-fifth patch release for containerd 1.7 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
ip_prefconfiguration option (#11223)Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
32 commits
bda53fc60Prepare release notes for v1.7.25d4a649130update runc binary to v1.2.499c973791runtime/v2: reduce shim plugin logip_prefconfiguration option (#11223)0cfc1edf3Fix "even if IPv4 comes first" test to have IPv4 first53d1fd0d9Don't useTo16() != nilto detect IPv6 addressespluginimport (#11202) (#11203)2b12ef2f4chore: add a build tag to disable containerd plugin importb99091838build(deps): bump github.com/containerd/continuity from 0.4.3 to 0.4.49f48f7af0build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.35.279172ba16go.mod: github.com/containerd/continuity v0.4.32dfbe2c7cvendor: update golang.org/x/crypto dependencies3d7a50749Replace use of deprecated api Envelope929e7bde6Use api types over deprecated alias5a42503d1Remove end of life api directoryc4069878eUpdate runtime/v2/runc/options to alias api type4d955223aUpdate to containerd api 1.8efacd2ac7Fix lint failures957c31895update runc binary to v1.2.34c0db6ad6update build to go1.22.10, test go1.23.4a40aa60a5fix panic due to nil dereference cgroups v2b1ef1dda7move rocky 9.4 to almalinux/9 in CIChanges from containerd/continuity
40 commits
8ae2b5eDisable FUSE for FreeBSDef3b6f4go.mod: bump up327ebddcmd/continuity/commands: MountCmd: remove macOS remnants7d074e7kind.String(): fix missing case statements for iota consts in switch433b975go-fix: remove pre-go1.17 build-tagsc494f3dfs: properly handle ENOTSUP in copyXAttrs3ca0c62gha: update CodeQL action to v3, as v2 is deprecated1d06b76gha: update CodeQL action to run on go1.223eb1ef4cmd/continuity: tidy go.mod, go.sumf0775b0go.mod: prune indirect gopkg.in/yaml.v3f0f6869gha: run CI on go1.227d07d28switch to github.com/containerd/log module97eff17Fix TestDiffDirChangeWithOverlayfsd934057CI: use ubuntu-24.043cbda8cfs: implement Atime for Windows31a50debuild(deps): bump google.golang.org/protobuf from 1.26.0 to 1.33.0b3e10e6build(deps): bump google.golang.org/protobuf in /cmd/continuity8df9930support filesystem magic for linux8b312bdfs: add DiffDirChanges function to get changeset faste08b7e4update golangci-lint to vl.55.0 , matching the version used by containerd5c2d1b4Add type to itterate directory242e29eSubstitute deprecated rand.Seed() in Go 1.20Dependency Changes
995d672->c3f9821Previous release can be found at v1.7.24
v1.7.24: containerd 1.7.24Compare Source
Welcome to the v1.7.24 release of containerd!
The twenty-fourth patch release for containerd 1.7 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
Image Distribution
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
36 commits
936f8e2dePrepare release notes for v1.7.2447ff8e2b6add info of exited event10af0d60fAdds a mutex to protect fallback hoste426ec51bUse unix and windows specific connection error checks49c9f303bAllow fallback across default portsddf2b03edlocal: avoid writing to content root on readonly store06e72da76update runc binary to 1.2.223a31ce63Revert "Disable vagrant strict dependency checking"4bd411f8ctestutil: avoid conflict with continuity/testutil216dc892eupdate cri-tools to v1.29.056a7d31cbupdate build to go1.22.9, test go1.23.3205940716ci: disable marking 1.7 releases as latestb7bb8d515Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz860a51384Disable vagrant strict dependency checking710cd3716update runc binary to 1.2.15bd0834ceservices/snapshots: include name of snapshotter in debug logs455787bf8Make TestContainerPids more resilientcb82e52a4Add After=dbus.service to containerd.serviced6f577843metrics: Use UnmarshalTo instead of UnmarshalAnyDependency Changes
This release has no dependency changes
Previous release can be found at v1.7.23
v1.7.23: containerd 1.7.23Compare Source
Welcome to the v1.7.23 release of containerd!
The twenty-third patch release for containerd 1.7 contains various fixes
and updates.
Highlights
Container Runtime Interface (CRI)
Image Distribution
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
37 commits
921f554afPrepare release notes for v1.7.238f16d6588Revert "update runc binary to 1.1.15"41e8f24cdSwitch from actuated.dev to GH Action runners for arm64dd811f224Update github actions ci to run on forks284484af4bump golangci/golangci-lint-action from 4 to 6814c59ba5update to go1.23.2,go1.22.8ae11176faprow: allow ENABLE_CRI_SANDBOXES to be configured7fd794a7cTestNewBinaryIOCleanup: fix a comment, minor rewrite0714a2952Add errdefs aliases113a9f1fcupdate runc binary to 1.1.155305b03f2Update runner images to macOS13950740390Allow proxy plugins to have capabilitiese8aae7824Bump crun to 1.16ee1c39b79CI: bump up crun to 1.15cb5e6a01aFix the race condition during GC of snapshots when client retries278bd0f72[release/1.7] Add check for CNI plugins before tearing down pod network18403239eSynchronize 1.7 error package with errdefsd8d27205bRevert "migrate errdefs package to github.com/containerd/errdefs module"e82d201b3Revert "replace uses of github.com/containerd/containerd/errdefs"51939238fRevert "errdefs: denote deprecation as a godoc comment"ae80077e8Revert "golangci-lint: enable depguard for packages that moved"32675f983Revert "remove imports of errdefs package"Changes from containerd/errdefs
29 commits
46a6522Add errdefs/pkg package303a6eaUpdate to Go 1.22.8 in CIe70104eUpgrade to golangci-lint@v1.61.0ffe5586Upgrade to golangci/golangci-lint-action@v6908b04bUpgrade to actions/checkout@v4608b83cUpgrade to actions/setup-go@v58e82ae4Upgrade macOS runner image to macOS 13Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.