package/{containerd,docker-compose,runc}: security bumps - #35
Open
rschueler wants to merge 3 commits into
Open
Conversation
Fixes three advisories published on 2026-07-01 and addressed by containerd on 2026-07-09 across all maintained branches: CVE-2026-53488 critical image-config LABEL flows to a host-root command (>= 2.0.0, < 2.0.10) CVE-2026-47262 medium image-triggered runtime DoS via unbounded group parsing (>= 2.0.0, < 2.0.10) CVE-2026-46680 medium user ID handling bypass allows runAsNonRoot evasion (>= 2.0.4, fixed in 2.0.9) 2.0.11 is the current release of the 2.0.x branch, so this stays within the series already packaged rather than moving to 2.3.x. Signed-off-by: Rainer Schueler <rainer.schueler@tobrain.org>
rschueler
changed the title
added 2 commits
August 4, 2026 08:12
CVE-2025-62725 (CVSS 8.9, CWE-22, EPSS 0.137 / 96th percentile) — path traversal through remote OCI compose artifacts. When a layer carries the annotations com.docker.compose.extends or com.docker.compose.envfile, Compose joins the attacker-supplied value from com.docker.compose.file / com.docker.compose.envfile with its local cache directory and writes there. The path is never constrained to that directory, so a crafted artifact can overwrite arbitrary files as the user running compose. Two things make this worse than a typical container-image issue: no container is ever started — resolving the artifact is enough, so read-only commands such as `docker compose config` or `docker compose ps` trigger it — and it applies to every workflow that resolves remote OCI compose artifacts, including CI runners. Fixed upstream in v2.40.2 (commit 69bcb96), GHSA-gv8h-7v7w-r22q. Hash regenerated from the go-vendored tarball produced by the download post-process; the LICENSE hash is unchanged. Signed-off-by: Rainer Schueler <rainer.schueler@tobrain.org>
CVE-2026-41579 (CVSS 3.3) — affects versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1 and 1.5.0-rc.1, in the container setup path. Low severity, but the bump is a patch release inside the 1.3.x series and carries no interface change, so there is little reason to carry the finding instead. Drops 0001-Replace-os.Is-error-checking-functions-with-their-er.patch. That patch backported upstream runc 536e183451b7 ("Replace os.Is error checking functions with their errors.Is counterpart"), which is contained in 1.3.6 — validator.go, criu_linux.go, device_unix.go and the rest of the files it touched already use errors.Is. Keeping it makes the build fail at the patch step, which is how this was found. The only remaining os.Is* callers in 1.3.6 are integration tests and vendored third-party code, neither of which the patch addressed. Hash regenerated from the go-vendored tarball; the LICENSE hash is unchanged. Signed-off-by: Rainer Schueler <rainer.schueler@tobrain.org>
rschueler
force-pushed
the
containerd-2.0.11
branch
from
August 4, 2026 06:13
a8cfe93 to
2ca4a24
Compare
rschueler
pushed a commit
to rschueler/SkiffOS
that referenced
this pull request
Aug 4, 2026
docker-compose 2.38.2 → 2.40.2 closes CVE-2025-62725 (CVSS 8.9), a path traversal through remote OCI compose artifacts: a crafted layer's com.docker.compose.extends or .envfile annotation is joined with the local cache directory without being constrained to it, and resolving the artifact is enough — no container has to start, so `docker compose config` triggers it. runc 1.3.5 → 1.3.6 closes CVE-2026-41579 (3.3) in the container setup path. Low severity, but a patch release with no interface change. Both went into skiffos/buildroot#35 alongside the containerd bump. Not bumped: docker-engine and docker-cli. CVE-2026-42306 (7.2) and CVE-2026-41568 (6.1) match the packaged 28.3.3, but the records list github.com/docker/docker/daemon <= 28.5.2 as affected — there is no 28.x fix, only Engine 29.5.1. A major version jump needs its own change and its own testing. These three were invisible to the previous scanner. They only surfaced after the matching engine moved to grype, which normalises version strings before matching where NVD's cpeName lookup returned nothing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three security bumps against the
skiffbranch. Each is the smallest release that carries the fix, and none crosses a major version.containerd 2.0.7 → 2.0.11
Three advisories published 2026-07-01, fixed by containerd 2026-07-09 across all maintained branches.
CVE-2026-53488 is the one that matters: the CRI plugin propagates labels from an image config (the
LABELinstruction in a Dockerfile) into a context where they reach a command run as root on the host. Pulling an untrusted image is enough.2.0.11 is the current release of the 2.0.x branch, so this stays within the series already packaged. Moving to 2.3.x would pull in a Go toolchain bump and API changes that are a separate discussion.
docker-compose 2.38.2 → 2.40.2
CVE-2025-62725, CVSS 8.9, CWE-22, EPSS 0.137 (96th percentile).
Compose trusts the path information embedded in remote OCI compose artifacts. When a layer carries the annotations
com.docker.compose.extendsorcom.docker.compose.envfile, Compose joins the attacker-supplied value with its local cache directory and writes there, without constraining the result to that directory.Two things make this worse than a typical image issue: no container is ever started, so read-only commands such as
docker compose configordocker compose psare enough to trigger it; and it applies to every workflow that resolves remote OCI compose artifacts, CI runners included.Fixed upstream in v2.40.2 (commit 69bcb96), GHSA-gv8h-7v7w-r22q.
runc 1.3.5 → 1.3.6
CVE-2026-41579, CVSS 3.3, in the container setup path. Low severity, but a patch release inside the 1.3.x series with no interface change — little reason to carry the finding instead.
Verification
Built for
pi/4x64(arm64) against this branch; containerd, containerd-shim-runc-v2 and ctr install into the target as before.All three are
golang-packages whose hashes cover the go-vendored tarball produced by the download post-process, so they cannot be taken from an upstream release page. Each was regenerated by running the package's-sourcetarget and reading back the computed hash:The
LICENSEhashes are unchanged in all three; verified against the top-levelLICENSEin each tarball, not the vendored ones.Not included: docker-engine / docker-cli
CVE-2026-42306 (7.2) and CVE-2026-41568 (6.1) match the packaged 28.3.3, and it would be natural to bump to the latest 28.x. That does not help. The CVE records list
github.com/docker/docker/daemon <= 28.5.2as affected — there is no fix in the 28 series, only Docker Engine 29.5.1. That is a major version jump and belongs in its own change, not bundled here.Upstream
Checked buildroot upstream first:
mastercarries containerd 2.1.x, docker-compose 2.38.2 and runc 1.3.5, so there is nothing to cherry-pick for any of the three. These are fork-local bumps.