GHSA-c5pj-mqfh-rvc3 "Runc allows an arbitrary systemd property to be injected" is a misunderstood vulnerability. Users do NOT need to update runc.

[AkihiroSuda]

GHSA-c5pj-mqfh-rvc3
("GitHub Reviewed" 🤔) is mislabeled as a vuln of runc < v1.2.0-rc.1.

"This issue has its root in how runc handles Config Annotations lists" is disinformation; the issue has its actual root in how CRI-O handles user input. cri-o/cri-o@976ab1f

Users do NOT need to update runc.

[haircommander]

hm did I file the gh advisory wrong? happy to edit anything that I messed up

[AkihiroSuda]

hm did I file the gh advisory wrong? happy to edit anything that I messed up

GHSA-c5pj-mqfh-rvc3 seems published by NVD, not by you?

[AkihiroSuda]

The advisory GHSA-c5pj-mqfh-rvc3 is now withdrawn