You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The nineteenth patch release for containerd 1.7 contains various updates and
splits the main module from the api module in preparation for the same change
in containerd 2.0. Splitting the modules will allow 1.7 and 2.x to both exist
as transitive dependencies without running into API registration errors.
Projects should use this version as the minimum 1.7 version in preparing to
use containerd 2.0 or to be imported alongside it.
// UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable
// for use in a grpc.NewServer call.
func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {
out of the box adds labels
net.peer.sock.addr
net.peer.sock.port
that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.
Details
An attacker can easily flood the peer address and port for requests.
PoC
Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it.
Impact
In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc.
Others
It is similar to already reported vulnerabilities.
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
Affected range
<1.15.10
Fixed version
1.15.10, 1.16.7, 1.17.3
CVSS Score
4.3
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Description
The Kubernetes API server component has been found to be vulnerable to a denial of service attack via successful API requests.
stdlib1.21.11 (golang)
pkg:golang/stdlib@1.21.11
Affected range
<1.21.12
Fixed version
1.21.12
Description
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail.
An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.7.18->1.7.19Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
containerd/containerd (containerd/containerd)
v1.7.19: containerd 1.7.19Compare Source
Welcome to the v1.7.19 release of containerd!
The nineteenth patch release for containerd 1.7 contains various updates and
splits the main module from the api module in preparation for the same change
in containerd 2.0. Splitting the modules will allow 1.7 and 2.x to both exist
as transitive dependencies without running into API registration errors.
Projects should use this version as the minimum 1.7 version in preparing to
use containerd 2.0 or to be imported alongside it.
Highlights
Container Runtime Interface (CRI)
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
70 commits
74a3d2901Prepare release notes for v1.7.197f5d3c5f4cri: ensure NRI API never has nil CRI6efc5bb89update runhcs binary to v0.11.7945ae09fdWindows: Supply windows shim version via filedba53578cpkg/reference: deprecate SplitObject415dd74a8updating hcsshim to 0.11.75ad1d2e75pkg/reference: Spec.Digest(): inline SplitObject code57ce09b42pkg/reference: SplitObject: add proper GoDoc78ac93fedpkg/reference: SplitObject: zero allocationsb074e3a7cpkg/reference: Spec.String(): use string-concatenation instead of sprintf0eb786de6Update api version to v1.7.19436feeb0dPrepare api release for v1.7.1983822d144Add api release action2a6aa6ddf[release/1.7] api: update github.com/containerd/ttrpc v1.2.537926b10dvendor: github.com/containerd/ttrpc v1.2.5a522e267egolangci-lint fix typo in depguard message1ce1c8f3e1.7: Add back support for OTLP config from toml136e1b72dgolangci-lint: enable depguard for packages that movedf5ce2f204remove imports of errdefs package3be919f3cAdd support for 1.8 interfaces5b87eb502Add go mod replace when proto changes happena3a7431bcAdd api go submodule61b3e2261Alias protobuf plugin to new api types package4b82470f6refactor: move plugin/fieldpath to api/types/24ce9e431integration: backport upgrade testsuite's utils79500d5cb*: export RemoveVolatileOption for CRI image volumesbb80bd768strip-volatile-option-tmp-mounts6dce90b15update runc binary to v1.1.13884094be8devmapper plugin: skip plugin when not configured40012b644Fail integration test early when a plugin load fails869b78677vendor: github.com/containerd/platforms v0.2.16ccdf6977platforms: mark aliases as deprecated19a056163adjust default platform for backward-compatibility6ff3e09d2migrate platforms package to github.com/containerd/platforms327a3ac61go.mod: github.com/klauspost/compress v1.16.7d0d1264a6vendor: github.com/klauspost/compress v1.16.502b8dd5ffRemove cirrus configuration31d951bf5Run vagrant integration tests as github actions97abbe9cbbuild(deps): bump github.com/distribution/reference from 0.5.0 to 0.6.0a00a2d20areference/docker: remove deprecated SplitHostnameb38c0f2efreplace reference/docker for github.com/distribution/reference v0.5.0fef432bfebuild(deps): bump go.etcd.io/bbolt from 1.3.9 to 1.3.10487c61bfbvendor: go.etcd.io/bbolt v1.3.97211f87c4build(deps): bump golang.org/x/sync from 0.4.0 to 0.5.0e908c3e6fvendor: golang.org/x/sync v0.4.0d814be5cebuild(deps): bump go.etcd.io/bbolt from 1.3.7 to 1.3.833b62936e[release/1.7]: HPC working directory fix in pkg/cri/server codeChanges from containerd/platforms
21 commits
f680838Remove hcsshim import from repo983ba15Update windows matcher to not compare empty os version17c859fAdd tests for osversion matching with no version38a74d2Add grammar for platform string724b9f8downgrade minimum required version of hcsshim to v0.10.0f6dd384enable linter on windowscb03428fix grammar and highlights in README5b937b0Fix link in README129b256Update linter to skip Windows18e3da6Add Github actions CIed29dfdRemove space at end of readmeb3f80eeAdd go module8ff004cAdd license and readmeChanges from containerd/ttrpc
4 commits
4785c70switch to github.com/containerd/log for logse0f3eadFix CI build status badge in readmeDependency Changes
Previous release can be found at v1.7.18
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.