CRI-O - v1.23.4
Security
CRI-O v1.23.4
The release notes have been generated for the commit range
v1.23.3...a6a1e6e on Fri, 21 Oct 2022 11:17:29 EDT.
Downloads
Download one of our static release bundles via our Google Cloud Bucket:
- cri-o.amd64.a6a1e6ebf4c4baca7ca7d57f069a4e0cd89056cd.tar.gz
- cri-o.amd64.a6a1e6ebf4c4baca7ca7d57f069a4e0cd89056cd.tar.gz.sha256sum
- cri-o.arm64.a6a1e6ebf4c4baca7ca7d57f069a4e0cd89056cd.tar.gz
- cri-o.arm64.a6a1e6ebf4c4baca7ca7d57f069a4e0cd89056cd.tar.gz.sha256sum
Changelog since v1.23.3
Changes by Kind
Feature
- CRI-O now logs the stage of container or pod creation under system load. This allows users to find why their creation requests are stalling. (#6303, @haircommander)
Bug or Regression
- Fix CVE-2022-27652 by dropping and refusing to add any inheritable capabilities (#5770, @haircommander)
- Fix a bug where ExecSync requests (exec probes) could use an arbitrary amount of memory and disk. Output from ExecSync requests is now limited to 16MB (the amount that exec output was limited to in the dockershim). Disk limiting requires conmon 2.1.2 to work. See https://github.com/cri-o/cri-o/security/advisories/GHSA-fcm2-6c3h-pg6j and CVE-2022-1708 for more information. (#5937, @haircommander)
- Fix a bug where child processes of containers in the host's PID namespace appear to leak after the child exits (#5977, @haircommander)
- Fix a panic caused by using the improper Result structure version when setting up CNI plugins (#6320, @juanfresia)
- Revert fix for CVE-2022-27652 by re-adding inheritable capabilities. While there is a workaround, we believe this causes regression mid cycle with is contrary to CRI-O's backporting policy. The risk of the CVE is low, and so there is little risk in reverting here. (#6168, @haircommander)
- Update
cni_default_network
to not be commented by default in the output ofcrio config
(#5566, @haircommander)
Uncategorized
- Fix a bug where a container is stuck in INIT because CRI-O believes it to be paused, and never updates the state (#6143, @openshift-cherrypick-robot)
- Fix a bug where exit files were never cleaned up from
/run/crio/exits
(#6171, @openshift-cherrypick-robot) - Fix a rare deadlock while communicating to systemd (RHBZ 2082344) (#5961, @openshift-cherrypick-robot)
- Use default umask
0o022
if CRI-O runs under a different umask value. (#6053, @openshift-cherrypick-robot)
Dependencies
Added
Changed
- github.com/containernetworking/cni: v1.0.1 → v1.1.1
- github.com/containernetworking/plugins: v1.0.1 → v1.1.1
- github.com/containers/storage: v1.37.0 → v1.37.2
- github.com/cri-o/ocicni: b388448 → v0.4.0
- github.com/fsnotify/fsnotify: v1.5.1 → v1.5.4
- github.com/google/pprof: cbba55b → 94a9f03
- github.com/onsi/gomega: v1.17.0 → v1.19.0
- github.com/yuin/goldmark: v1.4.0 → v1.4.1
- golang.org/x/crypto: 32db794 → 089bfa5
- golang.org/x/mod: v0.4.2 → 9b9b3d8
- golang.org/x/net: d4b1ae0 → 27dd868
- golang.org/x/sys: 2c5d950 → 33da011
- golang.org/x/term: 6886f2d → 03fcf44
- golang.org/x/tools: d4cc65f → v0.1.10
Removed
Nothing has changed.
Security
Details
date
Oct. 21, 2022, 2:15 p.m.
name
v1.23.4
type
Patch
official page
👇
Register or login to:
- 🔍View and search all CRI-O releases.
- 🛠️Create and share lists to track your tools.
- 🚨Setup notifications for major, security, feature or patch updates.
- 🚀Much more coming soon!