fix(deps): update module github.com/containerd/containerd to v1.7.29 [security] (v1.4) #4303
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
cilium-renovate
bot
added
release-blocker
cilium-renovate
bot
requested review from
tixxdz
and removed request for
a team
cilium-renovate
bot
added
the
release-blocker
Contributor
Author
|
cilium-renovate
bot
added
the
release-note/dependency
…[security] Signed-off-by: cilium-renovate[bot] <134692979+cilium-renovate[bot]@users.noreply.github.com> Signed-off-by: Tam Mach <[email protected]>
sayboras
force-pushed
the
renovate/v1.4-go-github.com-containerd-containerd-vulnerability
branch
from
34d7ca7 to
afbad01
Compare
sayboras
added a commit
that referenced
this pull request
Nov 22, 2025
This is mainly for renovate post upgrade task. Renovate config is only available in main branch, and it's hard to pass respective branch for BUF_BREAKING_AGAINST_BRANCH, unlike in github action with (ref_name and base_ref). #4303 (comment)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.7.27->v1.7.29containerd CRI server: Host memory exhaustion through Attach goroutine leak
CVE-2025-64329 / GHSA-m6hq-p25p-ffr2 / GO-2025-4108
More information
Details
Impact
A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks.
Repetitive calls of CRI Attach (e.g.,
kubectl attach) could increase the memory usage of containerd.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Workarounds
Set up an admission controller to control accesses to
pods/attachresources.e.g., Validating Admission Policy.
Credits
The containerd project would like to thank @Wheat2018 for responsibly disclosing this issue in accordance with the containerd security policy.
References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd
CVE-2024-25621 / GHSA-pwhc-rpq9-4c8w / GO-2025-4100
More information
Details
containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
containerd affected by a local privilege escalation via wide permissions on CRI directory
CVE-2024-25621 / GHSA-pwhc-rpq9-4c8w / GO-2025-4100
More information
Details
Impact
An overly broad default permission vulnerability was found in containerd.
/var/lib/containerdwas created with the permission bits 0o711, while it should be created with 0o700/run/containerd/io.containerd.grpc.v1.criwas created with 0o755, while it should be created with 0o700/run/containerd/io.containerd.sandbox.controller.v1.shimwas created with 0o711, while it should be created with 0o700The directory paths may differ depending on the daemon configuration.
When the
tempdirectory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing directories.
Workarounds
The system administrator on the host can manually chmod the directories to not
have group or world accessible permisisons:
An alternative mitigation would be to run containerd in rootless mode.
Credits
The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the containerd security policy.
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd
CVE-2025-64329 / GHSA-m6hq-p25p-ffr2 / GO-2025-4108
More information
Details
containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd)
v1.7.29: containerd 1.7.29Compare Source
Welcome to the v1.7.29 release of containerd!
The twenty-ninth patch release for containerd 1.7 contains various fixes
and updates including security patches.
Security Updates
containerd
runc
Highlights
Image Distribution
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
38 commits
442cb34bdMerge commit from fork0450f046eFix directory permissionse5cb6ddb7Merge commit from forkc575d1b5ffix goroutine leak of container Attach1fc2daaf3Prepare release notes for v1.7.293f5f9f872runc: Update runc binary to v1.3.3667409fb6ci: bump Go 1.24.9, 1.25.3294f8c027Update GHA runners to use latest images for basic binaries buildcf66b4141Update GHA runners to use latest image for most jobsfa3e6fa18pkg/epoch: extract parsing SOURCE_DATE_EPOCH to a functionac334bffcpkg/epoch: fix tests on macOSd04b8721fpkg/epoch: replace some fmt.Sprintfs with strconv5cfedbf52CI: update Fedora to 43cf99a012dCI: skip ubuntu-24.04-arm on private repos4c77b8d07runc:Update runc binary to v1.3.1d30024db2bugfix:fix container logs lost because io close too quicklyf4b3d96f3ci: bump Go 1.24.8334fd8e4bupdate golangci-lint to v1.64.28a67abc4cDrop inactivated linter exportlooprefe4dbf08f0build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0d7db2ba06build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2d7182888fbuild(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.04be6c7e3bbuild(deps): bump actions/cache from 4.1.2 to 4.2.0a2e097e86build(deps): bump actions/checkout from 4.2.1 to 4.2.26de404d11build(deps): bump actions/cache from 4.1.1 to 4.1.2038a25584[StepSecurity] ci: Harden GitHub Actionseaeb4b6acUpdate differ to handle zstd media types83c535339ci: bump Go 1.23.12, 1.24.6Dependency Changes
This release has no dependency changes
Previous release can be found at v1.7.28
v1.7.28: containerd 1.7.28Compare Source
Welcome to the v1.7.28 release of containerd!
The twenty-eighth patch release for containerd 1.7 contains various fixes
and updates.
Highlights
Image Distribution
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
57 commits
b01b809f8Prepare release notes for v1.7.28ce2373176ci: bump Go 1.23.11, 1.24.53c06bcc4dFix intermittent test failures on Windows CIsc6c0c6854Remove WS2025 from CIs due to regression6d7e021cfci: use fedora/39-cloud-base image from archivec362e18ccCI: install OVMF for Vagrant1d99bec21CI: fix "Unable to find a source package for vagrant" errordafa3c48dadd debian sources for ubuntu-24b03301d85partial: enable ubuntu 24 runners13fbc5f97update release runners to ubuntu 24.04da5d1a371go.mod: golang.org/x/* latest5fef123baRemove additional fuzzers from CIa35978f5aci: bump golang [1.23.10, 1.24.4] in build and releasedf035aa3eci: bump golang [1.23.9, 1.24.3] in build and release2a6d9fc71use go1.23.8 as the default go version15d4d6ebaupdate to go 1.24.2, 1.23.81613a3b1aEnable CIs to run on WS2022 and WS202560e73122ctest: added runc v1 tests using vagrant10e1b515eRevert "Disable port mapping tests in CRI-in-UserNS"7a680e884fix unbound SKIP_TEST variable errore5f8cc995Revert "disable portmap test in ubuntu-22 to make CI happy"b001469c7Update runc binary to v1.3.0a6421da84remotes/docker/authorizer.go: invalidate auth tokens when they expire.effc49e8bFix vagrant setupd3e7dd716Skip criu on Arms7cf9ebe94Disable port mapping tests in CRI-in-UserNS42657a4eddisable portmap test in ubuntu-22 to make CI happyb300fd37badd option to skip tests in critest6f4ffad27Address cgroup mountpoint does not existcef298331Update Ubuntu to 242dd9be16eci: update GitHub Actions release runner to ubuntu-24.04e40e59e4eSet default differ for the default unpack config of transfer serviceff097d5a4silence govulncheck false positives52dd4dc51vendor: github.com/go-jose/go-jose/v3 v3.0.424f41d2d5use shimCtx for fifo copy1e1e78ad7Update runc binary to v1.2.69a8d1d44aUse RWMutex in NSMap and reduce lock areaDependency Changes
90d013b-> v0.12.0Previous release can be found at v1.7.27
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.