Upstream has issued an advisory today (July 19): https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w The issue is fixed upstream in 1.4.8. Mageia 8 is also affected.
Whiteboard: (none) => MGA8TOOStatus comment: (none) => Fixed upstream in 1.4.8
Ubuntu has issued an advisory for this today (July 20): https://ubuntu.com/security/notices/USN-5012-1
openSUSE has issued an advisory for this today (July 21): https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KOVJMTDKAFMTONFNVO7Z327OFE52V7FK/
Another one for Bruno, the registered & active maintainer of this.
Assignee: bugsquad => bruno
updated in mga9
CC: (none) => mageiaWhiteboard: MGA8TOO => (none)Version: Cauldron => 8
Not yet.
Version: 8 => CauldronWhiteboard: (none) => MGA8TOO
version 1.5.5 pushed to cauldron
Status: NEW => ASSIGNED
Fedora has issued an advisory for this on August 25: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DDMNDPJJTP3J5GOEDB66F6MGXUTRG3Y3/
Whiteboard: MGA8TOO => (none)Version: Cauldron => 8
Upstream has issued an advisory today (October 4): https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq The issue is fixed upstream in 1.4.11 and 1.5.7.
Version: 8 => CauldronStatus comment: Fixed upstream in 1.4.8 => Fixed upstream in 1.4.11 and 1.5.7Whiteboard: (none) => MGA8TOOSummary: docker-containerd new security issue CVE-2021-32760 => docker-containerd new security issues CVE-2021-32760 and CVE-2021-41103
(In reply to David Walser from comment #8) > Upstream has issued an advisory today (October 4): > https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw- > 7mvq > > The issue is fixed upstream in 1.4.11 and 1.5.7. Ubuntu has issued an advisory for this today (October 4): https://ubuntu.com/security/notices/USN-5100-1
1.5.7 pushed to cauldron
Whiteboard: MGA8TOO => (none)Status comment: Fixed upstream in 1.4.11 and 1.5.7 => Fixed upstream in 1.4.11Version: Cauldron => 8
SUSE has issued an advisory for this today (October 12): https://lists.suse.com/pipermail/sle-security-updates/2021-October/009566.html
1.5.7 also pushed to mga8 updates_testing as 1.4.11 doesn't build easily out of the box for obscure reasons for me.
Assignee: bruno => qa-bugs
mga8, x64 User in docker group. $ urpmq --requires docker | uniq docker: docker-containerd[>= 1.1.0] $ rpm -q docker-containerd docker-containerd-1.4.4-1.mga8 Before update docker was working with docker-containerd. CVE-2021-32760: Fixed a bug which allows untrusted container images to change permissions in the host's filesystem. Did not pursue this. qarepo and mirrorservice Installed docker-containerd-1.5.7-1.mga8 Restarted the docker service. $ docker run hello-world Hello from Docker! This message shows that your installation appears to be working correctly. $ docker run -it ubuntu bash root@7a590701f872:/# help <This presented a list of the commands available and accepted arguments> root@7a590701f872:/# ls bin dev home lib32 libx32 mnt proc run srv tmp var boot etc lib lib64 media opt root sbin sys usr root@7a590701f872:/# exit $ docker ps -a CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 7a590701f872 ubuntu "bash" 4 minutes ago Exited (0) About a minute ago beautiful_jepsen 4a976d45fb97 hello-world "/hello" 5 minutes ago Exited (0) 5 minutes ago stupefied_blackburn .......... 7c0d05d8ec03 ubuntu "/bin/bash" 7 weeks ago Exited (0) 7 weeks ago stupefied_dhawan b9fbe95cd3a6 hello-world "/hello" 7 weeks ago Exited (0) 7 weeks ago strange_borg $ docker rm 7c0d05d8ec03 7c0d05d8ec03 $ docker ps -a ............. 967c69acb1d2 fedora:latest "/bin/bash" 7 weeks ago Exited (0) 7 weeks ago great_galois b9fbe95cd3a6 hello-world "/hello" 7 weeks ago Exited (0) 7 weeks ago strange_borg $ docker run -it fedora:latest bash [root@c91b7bc8d5b2 /]# exit Working OK for padawans.
Whiteboard: (none) => MGA8-64-OKCC: (none) => tarazed25
docker-containerd-1.5.7-1.mga8 from docker-containerd-1.5.7-1.mga8.src.rpm
Status comment: Fixed upstream in 1.4.11 => (none)CC: (none) => bruno
Fedora has issued an advisory for the newer issue today (October 19): https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/M7ZZTABKTSJ5DYVDIQ7CVZG5HABGM2EC/
Validating.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0484.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED