最新のセキュリティ情報
10月16日(金)
containerd: Unpack DoS via repeated opaque whiteouts
影響: go:github.com/containerd/containerd/v2 < 2.0.12 → 2.0.12, go:github.com/containerd/containerd < 1.7.35 → 1.7.35, go:github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.8 → 2.2.8, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.5 → 2.3.5 A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or importing a maliciously crafted image can result in increased unpack times and a moderate increase in CPU usage. This delays container startup, even if the compressed image layers are small. Additionally, in…
containerd CRI plugin: Checkpoint restore bypasses destination security context
影響: go:github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.7 → 2.2.7, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.4 → 2.3.4 A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs, and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig. An attacker who can ru…
10月14日(水)
containerd 2.3.7
Welcome to the v2.3.7 release of containerd! The seventh patch release for containerd 2.3 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14301 ) Image Distribution Apply hardening to reject image references with ".." path components ( #14281 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14248 ) Snapshotters Apply hardening to…
containerd 2.2.10
Welcome to the v2.2.10 release of containerd! The tenth patch release for containerd 2.2 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-5p7c-hggf-c748 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14300 ) Image Distribution Avoid hang and data corruption during multipart image fetch ( #14316 ) Apply hardening to reject image references with ".." path components ( #14280 ) Runtime Apply hardening to allowlist socket domains in…
containerd 2.4.2
Welcome to the v2.4.2 release of containerd! The second patch release for containerd 2.4 contains various fixes and updates including security patches. Security Updates containerd CVE-2026-95839 GHSA-8647-2jxj-p2rc GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14302 ) Image Distribution Fix excessive memory usage during image pulls when registry downloads outpace content writes ( #14342 ) Apply hardening to reject image references with ".." path components ( #14282 ) Runtime Apply hardening to allowlist socke…
containerd 2.0.14
Welcome to the v2.0.14 release of containerd! The fourteenth patch release for containerd 2.0 contains various fixes and updates including a security patch. Security Updates containerd GHSA-hc94-p972-ch66 Highlights Container Runtime Interface (CRI) Apply hardening to not follow symlinks for container log files ( #14299 ) Runtime Apply hardening to allowlist socket domains in the default seccomp profile ( #14251 ) Snapshotters Apply hardening to filter ID-mapping labels from image annotations during unpack ( #14270 ) Please try out the release binaries and report any issues at https://github.…
9月25日(金)
containerd 1.7.36
Welcome to the v1.7.36 release of containerd! The thirty-sixth patch release for containerd 1.7 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14142 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ( #14184 ) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues . Contributors Samuel Karp Chris Henzie Derek McGow…
containerd 2.4.1
Welcome to the v2.4.1 release of containerd! The first patch release for containerd 2.4 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where failed container start cleanup leaked tasks and prevented container removal ( #14223 ) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14212 ) Image Distribution Fix content upload failures when retrying fetch content after reaching EOF ( #14197 ) Snapshotters Apply hardening to filter ID-map…
containerd 2.2.9
Welcome to the v2.2.9 release of containerd! The ninth patch release for containerd 2.2 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14210 ) Enable mount manager for image mounts in CRI ( #14148 ) Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14140 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux co…
containerd 2.3.6
Welcome to the v2.3.6 release of containerd! The sixth patch release for containerd 2.3 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Container Runtime Interface (CRI) Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ( #14211 ) Enable mount manager for image mounts in CRI ( #14147 ) Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14139 ) Runtime Avoid unexpected mutation of mount options in mount helpers ( #14192 )…
containerd 2.0.13
Welcome to the v2.0.13 release of containerd! The thirteenth patch release for containerd 2.0 contains various fixes and updates including a security patch. Security Updates containerd CVE-2026-53493 Highlights Image Storage Ensure all layers are fetched when multiple manifests in an index share a config descriptor ( #14141 ) Runtime Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ( #14183 ) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues . Contributors Samuel Karp Chris Henzie Maksym Pavlen…
9月17日(木)
containerd 2.4.0
Welcome to the v2.4.0 release of containerd! containerd 2.4 is a regular (non-LTS) release with a shorter support window, intended for users who want to adopt new features sooner. As the release following the 2.3 LTS, it is the point in the release cycle where previously deprecated features may be removed, so this release may include breaking changes; check the notes below and clear any deprecation warnings from your current version before upgrading. Users prioritizing stability and a longer support lifecycle should stay on the 2.3 LTS release. Highlights Container Runtime Interface (CRI) Ena…