SUSE-SU-2023:4727-1

Sévérité par source

Aucune source ne donne de score CVSS.

Le label propre à Trivy est CRITICAL. Critique selon SUSE.

Description

This update of runc and containerd fixes the following issues: containerd: - Update to containerd v1.7.8. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.8 * CVE-2022-1996: Fixed CORS bypass in go-restful (bsc#1200528) catatonit: - Update to catatonit v0.2.0. * Change license to GPL-2.0-or-later. - Update to catatont v0.1.7 * This release adds the ability for catatonit to be used as the only process in a pause container, by passing the -P flag (in this mode no subprocess is spawned and thus no signal forwarding is done). - Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to socket activation or features somewhat adjacent to socket activation (such as passing file descriptors). runc: - Update to runc v1.1.10. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.10

Paquets affectés et versions corrigées

Références

• https://bugzilla.suse.com/1200528
• https://lists.suse.com/pipermail/sle-updates/2023-December/033070.html
• https://www.suse.com/security/cve/CVE-2022-1996/
• https://www.suse.com/support/security/rating/
• https://www.suse.com/support/update/announcement/2023/suse-su-20234727-1/