github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity
f4095a6876
containerd/contrib
History
Sebastiaan van Stijn 8f2bbd5e8f
Update to go 1.19.1, 1.18.6 to address CVE-2022-27664, CVE-2022-32190 
From the mailing list:

We have just released Go versions 1.19.1 and 1.18.6, minor point releases.
These minor releases include 2 security fixes following the security policy:

- net/http: handle server errors after sending GOAWAY
  A closing HTTP/2 server connection could hang forever waiting for a clean
  shutdown that was preempted by a subsequent fatal error. This failure mode
  could be exploited to cause a denial of service.

  Thanks to Bahruz Jabiyev, Tommaso Innocenti, Anthony Gavazzi, Steven Sprecher,
  and Kaan Onarlioglu for reporting this.

  This is CVE-2022-27664 and Go issue https://go.dev/issue/54658.

- net/url: JoinPath does not strip relative path components in all circumstances
  JoinPath and URL.JoinPath would not remove `../` path components appended to a
  relative path. For example, `JoinPath("https://go.dev", "../go")` returned the
  URL `https://go.dev/../go`, despite the JoinPath documentation stating that
  `../` path elements are cleaned from the result.

  Thanks to q0jt for reporting this issue.

  This is CVE-2022-32190 and Go issue https://go.dev/issue/54385.

Release notes:

go1.19.1 (released 2022-09-06) includes security fixes to the net/http and
net/url packages, as well as bug fixes to the compiler, the go command, the pprof
command, the linker, the runtime, and the crypto/tls and crypto/x509 packages.
See the Go 1.19.1 milestone on the issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.19.1+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-09-06 22:41:55 +02:00
..
ansible migrate from k8s.gcr.io to registry.k8s.io 2022-08-24 13:46:46 +08:00
apparmor Copy fuzzers from github.com/cncf/cncf-fuzzing 2022-07-06 15:21:48 +00:00
autocomplete Fix zsh autocomplete script 2020-02-11 19:56:27 +08:00
aws Move snapshotters benchmark to a separate package 2019-04-02 14:42:21 -07:00
Dockerfile.test.d/cri-in-userns Dockerfile.test: add "cri-in-userns" (aka rootless) test stage 2021-07-09 14:50:04 +09:00
fuzz Update to go 1.19.1, 1.18.6 to address CVE-2022-27664, CVE-2022-32190 2022-09-06 22:41:55 +02:00
gce adds support for using env file for systemd boot 2022-07-20 12:52:10 -05:00
nvidia replace uses of os/exec with golang.org/x/sys/execabs 2021-08-25 18:11:09 +02:00
seccomp adding support of CAP_BPF and CAP_PERFMON 2022-08-17 19:59:09 +00:00
snapshotservice Rename Size_ to Size 2022-04-22 15:31:53 +00:00
Dockerfile.test Update to go 1.19.1, 1.18.6 to address CVE-2022-27664, CVE-2022-32190 2022-09-06 22:41:55 +02:00
README.md Add readme to contib 2017-09-18 11:47:27 -04:00

README.md

contrib

The contrib directory contains packages that do not belong in the core containerd packages but still contribute to overall containerd usability.

Package such as Apparmor or Selinux are placed in contrib because they are platform dependent and often require higher level tools and profiles to work.

Packaging and other built tools can be added to contrib to aid in packaging containerd for various distributions.

Testing

Code in the contrib directory may or may not have been tested in the normal test pipeline for core components.