mirror of
https://github.com/containerd/containerd.git
synced 2026-08-09 09:33:06 +00:00
3b199c22b1
This release include 11 security fixes:
- cmd/go: malicious module proxy can bypass checksum database
A malicious module proxy could exploit a flaw in the go command's
validation of module checksums to bypass checksum database validation.
This vulnerability affects any user using an untrusted module proxy
(GOMODPROXY) or checksum database (GOSUMDB).
A malicious module proxy can serve altered versions of the Go toolchain.
When selecting a different version of the Go toolchain than the
currently installed toolchain (due to the GOTOOLCHAIN environment variable,
or a go.work or go.mod with a toolchain line), the go command will download
and execute a toolchain provided by the module proxy. A malicious module
proxy can bypass checksum database validation for this downloaded
toolchain.
Since this vulnerability affects the security of toolchain downloads,
setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade
your base Go toolchain.
The go tool always validates the hash of a toolchain before executing it,
so fixed versions will refuse to execute any cached, altered versions of the
toolchain.
The go tool trusts go.sum files to contain accurate hashes of the current
module's dependencies. A malicious proxy exploiting this vulnerability to
serve an altered module will have caused an incorrect hash to be recorded
in the go.sum. Users who have configured a non-trusted GOPROXY can determine
if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify",
which will revalidate all dependencies of the current module.
The specific flaw in more detail:
The go command consults the checksum database to validate downloaded modules,
when a module is not listed in the go.sum file. It verifies that the module hash
reported by the checksum database matches the hash of the downloaded module.
If, however, the checksum database returns a successful response that contains
no entry for the module, the go command incorrectly permitted validation to succeed.
A module proxy may mirror or proxy the checksum database, in which case the go
command will not connect to the checksum database directly. Checksums reported
by the checksum database are cryptographically signed, so a malicious proxy
cannot alter the reported checksum for a module. However, a proxy which returns
an empty checksum response, or a checksum response for an unrelated module,
could cause the go command to proceed as if a downloaded module has been validated.
The go command now properly checks checksum database responses to ensure
that the expected module signature is present, not just that if a signature is
present it matches the expectation.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-42501 and Go issue https://go.dev/issue/79070.
- net/http/httputil: ReverseProxy forwards queries with more than urlmaxqueryparams parameters
When used with a Rewrite function, or a Director function which parses query parameters,
ReverseProxy sanitizes the forwarded request to remove query parameters which are not
parsed by url.ParseQuery. ReverseProxy did not take ParseQuery's limit on the total number
of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account.
This could permit ReverseProxy to forward a request containing a query parameter
that was not visible to the Rewrite function.
For example, the query "a1=x&a2=x&...&a10000=x&hidden=y" could forward the parameter
"hidden=y" while hiding it from the proxy's Rewrite function.
ReverseProxy now avoids forwarding parameters that exceed the ParseQuery limit.
This is CVE-2026-39825 and Go issue https://go.dev/issue/78948.
- net: panic in Dial and LookupPort when handling NUL byte on Windows
The Dial and LookupPort functions would panic on Windows when provided
with an input containing a NUL (0). These functions now return an error
rather than panicking.
This is CVE-2026-39836 and Go issue https://go.dev/issue/79006.
- net/mail: quadratic string concatenation in consumePhrase
Pathological inputs could cause DoS through consumePhrase
when parsing an email address according to RFC 5322.
This is CVE-2026-42499 and Go issue https://go.dev/issue/78987.
- net/mail: quadratic string concatentation in consumeComment
Well-crafted inputs reaching ParseAddress, ParseAddressList,
and ParseDate were able to trigger excessive CPU exhaustion
and memory allocations.
This is CVE-2026-39820 and Go issue https://go.dev/issue/78566.
- cmd/go: "go bug" follows symlinks in predictable temporary filenames
The "go bug" command wrote to two files with predictable names in
the system temporary directory (for example, "/tmp").
An attacker with access to the temporary directory could create a
symlink in one of these names, causing "go bug" to overwrite the
target of the symlink.
The "go bug" command now uses os.MkdirTemp to create a safe
working directory.
Thanks to Harshit Gupta (Mr HAX) for reporting this issue.
This is CVE-2026-39819 and Go issue https://go.dev/issue/78584.
- cmd/go: "go tool pack" does not sanitize output paths
The "go tool pack" subcommand is a minimal version of the Unix ar utility.
It is used by the compiler as an internal tool with known-good inputs.
The "pack" subcommand did not sanitize output filenames.
When invoked to extract a malicious archive file, it could write
files to arbitrary locations on the filesystem.
The "pack" subcommand now refuses to extract files with names
containing any directory components.
Thanks to Harshit Gupta (Mr HAX) for reporting this issue.
This is CVE-2026-39817 and Go issue https://go.dev/issue/78778.
- net/http: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of
writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a
value of 0.
This allows potential DoS against a client by a malicious server. HTTP/2
transport now properly checks that the received SETTINGS_MAX_FRAME_SIZE is
valid.
Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.
This is CVE-2026-33814 and Go issue https://go.dev/issue/78476.
- html/template: escaper bypass leads to XSS
If a trusted template author were to write a
tag containing an empty type attribute or a type
attribute with an ASCII whitespace, the execution of
the template would incorrectly escape any data passed
into the block.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-39826 and Go issue https://go.dev/issue/78981.
- net: crash when handling long CNAME response
When using LookupCNAME with the cgo DNS resolver,
a very long CNAME response could trigger a double-free of C memory
and a crash. The double-free has been fixed.
Thanks to hamayanhamayan for reporting this issue.
This is CVE-2026-33811 and Go issue https://go.dev/issue/78803.
- html/template: bypass of meta content URL escaping causes XSS
CVE-2026-27142 fixed a vulnerability in which URLs were not
correctly escaped inside of a tag's attribute.
If the URL content were to insert ASCII whitespaces around the
= rune inside of the attribute, the escaper would
fail to similarly escape it, leading to XSS.
Dynamic inputs to a tag's attribute are now
whitespace sanitized prior to escaping.
Thanks to Samy Ghannad for reporting this issue.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
168 lines
7.3 KiB
Modula-2
168 lines
7.3 KiB
Modula-2
module github.com/containerd/containerd/v2
|
|
|
|
go 1.26.3
|
|
|
|
require (
|
|
dario.cat/mergo v1.0.2
|
|
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6
|
|
github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29
|
|
github.com/Microsoft/hcsshim v0.15.0-rc.1
|
|
github.com/checkpoint-restore/checkpointctl v1.5.0
|
|
github.com/checkpoint-restore/go-criu/v7 v7.2.0
|
|
github.com/containerd/btrfs/v2 v2.0.0
|
|
github.com/containerd/cgroups/v3 v3.1.3
|
|
github.com/containerd/console v1.0.5
|
|
github.com/containerd/containerd/api v1.11.0
|
|
github.com/containerd/continuity v0.5.0
|
|
github.com/containerd/errdefs v1.0.0
|
|
github.com/containerd/errdefs/pkg v0.3.0
|
|
github.com/containerd/fifo v1.1.0
|
|
github.com/containerd/go-cni v1.1.13
|
|
github.com/containerd/go-dmverity v0.1.0
|
|
github.com/containerd/go-runc v1.1.0
|
|
github.com/containerd/imgcrypt/v2 v2.0.2
|
|
github.com/containerd/log v0.1.0
|
|
github.com/containerd/nri v0.12.0
|
|
github.com/containerd/otelttrpc v0.1.0
|
|
github.com/containerd/platforms v1.0.0-rc.4
|
|
github.com/containerd/plugin v1.1.0
|
|
github.com/containerd/ttrpc v1.2.8
|
|
github.com/containerd/typeurl/v2 v2.2.3
|
|
github.com/containerd/zfs/v2 v2.0.0
|
|
github.com/containernetworking/cni v1.3.0
|
|
github.com/containernetworking/plugins v1.9.1
|
|
github.com/coreos/go-systemd/v22 v22.7.0
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
|
|
github.com/distribution/reference v0.6.0
|
|
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c
|
|
github.com/docker/go-metrics v0.0.1
|
|
github.com/docker/go-units v0.5.0
|
|
github.com/erofs/go-erofs v0.3.0
|
|
github.com/fsnotify/fsnotify v1.9.0
|
|
github.com/google/certtostore v1.0.6
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.1.0
|
|
github.com/intel/goresctrl v0.12.0
|
|
github.com/klauspost/compress v1.18.5
|
|
github.com/mdlayher/vsock v1.2.1
|
|
github.com/moby/locker v1.0.1
|
|
github.com/moby/sys/mountinfo v0.7.2
|
|
github.com/moby/sys/sequential v0.6.0
|
|
github.com/moby/sys/signal v0.7.1
|
|
github.com/moby/sys/symlink v0.3.0
|
|
github.com/moby/sys/user v0.4.0
|
|
github.com/moby/sys/userns v0.1.0
|
|
github.com/opencontainers/go-digest v1.0.0
|
|
github.com/opencontainers/image-spec v1.1.1
|
|
github.com/opencontainers/runtime-spec v1.3.0
|
|
github.com/opencontainers/runtime-tools v0.9.1-0.20251114084447-edf4cb3d2116
|
|
github.com/opencontainers/selinux v1.13.1
|
|
github.com/pelletier/go-toml/v2 v2.3.0
|
|
github.com/prometheus/client_golang v1.23.2
|
|
github.com/prometheus/client_model v0.6.2
|
|
github.com/sirupsen/logrus v1.9.4
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/tchap/go-patricia/v2 v2.3.3
|
|
github.com/urfave/cli/v2 v2.27.7
|
|
github.com/vishvananda/netlink v1.3.1
|
|
github.com/vishvananda/netns v0.0.5
|
|
go.etcd.io/bbolt v1.4.3
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0
|
|
go.opentelemetry.io/otel v1.43.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0
|
|
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0
|
|
go.opentelemetry.io/otel/sdk v1.43.0
|
|
go.opentelemetry.io/otel/trace v1.43.0
|
|
golang.org/x/mod v0.35.0
|
|
golang.org/x/sync v0.20.0
|
|
golang.org/x/sys v0.43.0
|
|
golang.org/x/time v0.15.0
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d
|
|
google.golang.org/grpc v1.80.0
|
|
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
|
|
k8s.io/apimachinery v0.36.0
|
|
k8s.io/client-go v0.36.0
|
|
k8s.io/cri-api v0.36.0
|
|
k8s.io/cri-client v0.36.0
|
|
k8s.io/cri-streaming v0.36.0
|
|
k8s.io/klog/v2 v2.140.0
|
|
k8s.io/streaming v0.36.0
|
|
k8s.io/utils v0.0.0-20260319190234-28399d86e0b5
|
|
tags.cncf.io/container-device-interface v1.1.0
|
|
)
|
|
|
|
require (
|
|
cyphar.com/go-pathrs v0.2.1 // indirect
|
|
github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cilium/ebpf v0.16.0 // indirect
|
|
github.com/containers/ocicrypt v1.2.1 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/cyphar/filepath-securejoin v0.6.0 // indirect
|
|
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
|
github.com/godbus/dbus/v5 v5.1.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
|
|
github.com/golang/protobuf v1.5.4 // indirect
|
|
github.com/google/deck v0.0.0-20230104221208-105ad94aa8ae // indirect
|
|
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
|
|
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/knqyf263/go-plugin v0.9.0 // indirect
|
|
github.com/mdlayher/socket v0.5.1 // indirect
|
|
github.com/miekg/pkcs11 v1.1.1 // indirect
|
|
github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
|
|
github.com/moby/spdystream v0.5.1 // indirect
|
|
github.com/moby/sys/capability v0.4.0 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/prometheus/common v0.67.5 // indirect
|
|
github.com/prometheus/procfs v0.19.2 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/sasha-s/go-deadlock v0.3.5 // indirect
|
|
github.com/smallstep/pkcs7 v0.1.1 // indirect
|
|
github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
|
|
github.com/tetratelabs/wazero v1.11.0 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
|
|
go.opencensus.io v0.24.0 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
|
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.3 // indirect
|
|
golang.org/x/crypto v0.49.0 // indirect
|
|
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
|
|
golang.org/x/net v0.52.0 // indirect
|
|
golang.org/x/oauth2 v0.35.0 // indirect
|
|
golang.org/x/term v0.41.0 // indirect
|
|
golang.org/x/text v0.35.0 // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
k8s.io/api v0.36.0 // indirect
|
|
k8s.io/component-base v0.36.0 // indirect
|
|
k8s.io/kube-openapi v0.0.0-20260319004828-5883c5ee87b9 // indirect
|
|
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
|
|
sigs.k8s.io/randfill v1.0.0 // indirect
|
|
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
|
|
sigs.k8s.io/yaml v1.6.0 // indirect
|
|
tags.cncf.io/container-device-interface/specs-go v1.1.0 // indirect
|
|
)
|