fix(deps): update module github.com/containerd/containerd/v2 to v2.1.5 [security] #58
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #58 +/- ##
==========================================
- Coverage 20.40% 20.31% -0.10%
==========================================
Files 8 8
Lines 1083 886 -197
==========================================
- Hits 221 180 -41
+ Misses 840 684 -156
Partials 22 22
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.1.4->v2.1.5GitHub Vulnerability Alerts
CVE-2024-25621
Impact
An overly broad default permission vulnerability was found in containerd.
/var/lib/containerdwas created with the permission bits 0o711, while it should be created with 0o700/run/containerd/io.containerd.grpc.v1.criwas created with 0o755, while it should be created with 0o700/run/containerd/io.containerd.sandbox.controller.v1.shimwas created with 0o711, while it should be created with 0o700The directory paths may differ depending on the daemon configuration.
When the
tempdirectory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing directories.
Note
/run/containerdand/run/containerd/io.containerd.runtime.v2.taskare still created with 0o711.This is an expected behavior for supporting userns-remapped containers.
Workarounds
The system administrator on the host can manually chmod the directories to not
have group or world accessible permisisons:
An alternative mitigation would be to run containerd in rootless mode.
Credits
The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
CVE-2025-64329
Impact
A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks.
Repetitive calls of CRI Attach (e.g.,
kubectl attach) could increase the memory usage of containerd.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Workarounds
Set up an admission controller to control accesses to
pods/attachresources.e.g., Validating Admission Policy.
Credits
The containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the containerd security policy.
References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Release Notes
containerd/containerd (github.com/containerd/containerd/v2)
v2.1.5: containerd 2.1.5Compare Source
Welcome to the v2.1.5 release of containerd!
The fifth patch release for containerd 2.1 contains various fixes and updates.
Security Updates
containerd
runc
Highlights
Container Runtime Interface (CRI)
Image Distribution
Runtime
Deprecations
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
58 commits
fc5bdfeacPrepare release notes for v2.1.5c578c26bfUpdate mailmap46a4a03fbMerge commit from fork232786c90Fix directory permissions239ab877dMerge commit from fork0766796e8fix goroutine leak of container Attach3d713d3d0runc: Update runc binary to v1.3.3de4221cb7Update GHA runners to use latest images for basic binaries build2045b1920ci: bump Go 1.24.9, 1.25.321ec7cc7dUpdate GHA runners to use latest image for most jobs893b5f92eCI: update Fedora to 436374a8f9dPostpone v2.2 deprecation items to v2.398e0e73deCI: skip ubuntu-24.04-arm on private reposa3770cf83cri/server/podsandbox: disable event subscriber7d9f09ba0bugfix:fix container logs lost because io close too quicklyd1cab3cc5ci: bump Go 1.24.89b57a4d35Prevent goroutine hangs during ProgressTracker shutdownca3de4fe7Ensure errContentRangeIgnored error when range-get request is ignored by registrydfffe3d9cRemove additional fuzzers from CIc54585ba7update release builds to 1.24.7 and add 1.25.1 to CIf0a48ce38runc:Update runc binary to v1.3.1f13f8c431add SystemdCgroup to default runtime options42bb71e1einstall-runhcs-shim: fetch target commit instead of tags10944e19fintegration: Add test for directives with userns41d74aee2cri: Fix userns with Dockerfile VOLUME mounts that need copyf40bfc46bcore/mount: Retry unmounting idmapped directories1f51d2deacore/mount: Test cleanup of DoPrepareIDMappedOverlay()8fbf8c503core/mount: Properly cleanup on doPrepareIDMappedOverlay errorsb9d678e15core/mount: Don't call nil function on errors583fe2d24core/mount: Only idmap once per overlayfs, not per layer4832b4d15Add documentation for cgroup_writable field3c174cf64fix: create bootstrap.json with 0644 permission74b0505ebci: bump Go 1.23.12, 1.24.65ef6ea747sys: fix pidfd leak in UnshareAfterEnterUsernsDependency Changes
This release has no dependency changes
Previous release can be found at v2.1.4
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.