chore(deps): update module github.com/containerd/containerd/v2 to v2.0.4 [security] (main) #16798
+4
−4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v2.0.3->v2.0.4GitHub Vulnerability Alerts
CVE-2024-40635
Impact
A bug was found in containerd where containers launched with a User set as a
UID:GIDlarger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images.
Credits
The containerd project would like to thank Benjamin Koltermann and emxll for responsibly disclosing this issue in accordance with the containerd security policy.
References
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
containerd has an integer overflow in User ID handling in github.com/containerd/containerd
CVE-2024-40635 / GHSA-265r-hfxg-fhmg / GO-2025-3528
More information
Details
containerd has an integer overflow in User ID handling in github.com/containerd/containerd
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
containerd has an integer overflow in User ID handling
CVE-2024-40635 / GHSA-265r-hfxg-fhmg / GO-2025-3528
More information
Details
Impact
A bug was found in containerd where containers launched with a User set as a
UID:GIDlarger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.Patches
This bug has been fixed in the following containerd versions:
Users should update to these versions to resolve the issue.
Workarounds
Ensure that only trusted images are used and that only trusted users have permissions to import images.
Credits
The containerd project would like to thank Benjamin Koltermann and emxll for responsibly disclosing this issue in accordance with the containerd security policy.
References
For more information
If you have any questions or comments about this advisory:
To report a security issue in containerd:
Severity
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
containerd/containerd (github.com/containerd/containerd/v2)
v2.0.4: containerd 2.0.4Compare Source
Welcome to the v2.0.4 release of containerd!
The fourth patch release for containerd 2.0 includes various bug fixes and updates.
Highlights
client.WithTimeoutoption on connect (#11536)Node Resource Interface (NRI)
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
19 commits
1a43cb6a1Merge commit from fork07a0b5419(cherry picked from commitde1341c)06a886a8ePrepare release notes for v2.0.4client.WithTimeoutoption on connect (#11536)6b5efba83client: Respectclient.WithTimeoutoption916d48722core/remotes: Handle attestations in MakeRefKeydf4d905a6core/images: Ignore attestations when traversing children4f037050cadd name in package versione5ad0d0a0update build to go1.23.7, test go1.24.1a39f1146bdocs: include note about unprivileged sysctls81b3384a0e2e: use the shim bundled with containerd artifact7215a7d2cbuild(deps): bump containerd/project-checks from 1.1.0 to 1.2.1Dependency Changes
This release has no dependency changes
Previous release can be found at v2.0.3
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.