CVE-2021-41190

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

Impact

In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently.

Patches

The OCI Distribution Specification will be updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations.

Workarounds

Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields.

References

https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/opencontainers/distribution-spec/
• Email us at [email protected]

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

• opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

• buildah: possible information disclosure and modification (CVE-2022-2990)

• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both "manifests" and "layers" fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both "manifests" and "layers" fields or "manifests" and "config" fields if they are unable to update to version 1.0.1 of the spec.

A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." (or "/"), when running as root. (CVE-2021-29136) Dde to incorrect use of a default URL, singularity action commands (run/shell/exec) specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint (cloud.sylabs.io) rather than the configured remote endpoint. An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container. Only action commands (run/shell/exec) against library:// URIs are affected. Other commands such as pull / push respect the configured remote endpoint. (CVE-2021-32635) If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. (CVE-2021-41190)

Information disclosure flaw was found in Buildah (CVE-2021-3602) podman allows forwarding hosts ports to vm from within vm (CVE-2021-4024) Allows use "../" separators in containernetworking/cni to reference binaries such as 'reboot' in network configuration (CVE-2021-20206) github.com/containers/storage ddos via crafted tar file (CVE-2021-20291) buildah improper checking of X.509 certificate (CVE-2021-34558) buildah improper Content-Type checking (CVE-2021-41190) podman privilege escalation (CVE-2022-1227) podman incorrect handling of the supplementary groups (CVE-2022-2989) buildah incorrect handling of the supplementary groups (CVE-2022-2990) skopeo/podman Denial of Service through unbounded cardinality, and potential memory exhaustion (CVE-2022-21698) buildah/podman AddHostKey denail of service (CVE-2022-27191) podman inheritable file capabilities (CVE-2022-27649) buildah inheritable file capabilities (CVE-2022-27651)

This update for singularity fixes the following issues:

Update to 3.8.5:

• CVE-2021-41190: Fixed OCI manifest and index parsing confusion (boo#1193273).
• Building Singularity from source requires go greater or equal 1.16. We now aim to support the two most recent stable versions of Go. This corresponds to the Go Release Maintenance Policy
• Sourcing a script based on PATH is now permitted, fixing a regression introduced in 3.6.0.
• Environment variables in container definition files are properly scoped, fixing a regression introduced in 3.8.0.
• Fix the oras contexts to avoid hangs upon failed pushes to Harbor registry.

This update for containerd, docker fixes the following issues:

• CVE-2021-41089: Fixed 'cp' can chmod host files (bsc#1191015).
• CVE-2021-41091: Fixed flaw that could lead to data directory traversal in moby (bsc#1191434).
• CVE-2021-41092: Fixed exposed user credentials with a misconfigured configuration file (bsc#1191334).
• CVE-2021-41103: Fixed file access to local users in containerd (bsc#1191121).
• CVE-2021-41190: Fixed OCI manifest and index parsing confusion (bsc#1193273).

This update for conmon, libcontainers-common, libseccomp, podman fixes the following issues:

podman was updated to 3.4.4.

Security issues fixed:

• fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion

• fix CVE-2021-4024 [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs

• fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost

• Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade path from podman < 3.1.2

Update to version 3.4.4:

• Bugfixes

  • Fixed a bug where the podman exec command would, under some circumstances, print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  • Fixed a bug where named volumes created as part of container creation (e.g. podman run --volume avolume:/a/mountpoint or similar) would be mounted with incorrect permissions (#12523).
  • Fixed a bug where the podman-remote create and podman-remote run commands did not properly handle the --entrypoint='' option (to clear the container's entrypoint) (#12521).

• Update to version 3.4.3:

  • Security

    • This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
    • This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.

  • Features

    • The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).

  • Bugfixes

    • Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
    • Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
    • Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
    • Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
    • Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
    • Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
    • Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
    • Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
    • Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
    • Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
    • Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
    • Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
    • Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
    • Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
    • Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra ' (#11416).

  • API

    • The Libpod Play Kube…

These are all security issues fixed in the containerd-1.4.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-20.10.11_ce-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the singularity-3.8.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the podman-3.4.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the umoci-0.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-stable-24.0.9_ce-15.1 package on the GA media of openSUSE Tumbleweed.

This update for containerd, docker fixes the following issues:

• CVE-2021-41089: Fixed 'cp' can chmod host files (bsc#1191015).
• CVE-2021-41091: Fixed flaw that could lead to data directory traversal in moby (bsc#1191434).
• CVE-2021-41092: Fixed exposed user credentials with a misconfigured configuration file (bsc#1191334).
• CVE-2021-41103: Fixed file access to local users in containerd (bsc#1191121).
• CVE-2021-41190: Fixed OCI manifest and index parsing confusion (bsc#1193273).

This update for containerd, docker fixes the following issues:

• CVE-2021-41089: Fixed 'cp' can chmod host files (bsc#1191015).
• CVE-2021-41091: Fixed flaw that could lead to data directory traversal in moby (bsc#1191434).
• CVE-2021-41092: Fixed exposed user credentials with a misconfigured configuration file (bsc#1191334).
• CVE-2021-41103: Fixed file access to local users in containerd (bsc#1191121).
• CVE-2021-41190: Fixed OCI manifest and index parsing confusion (bsc#1193273).

This update for containerd, docker fixes the following issues:

• CVE-2022-24769: Fixed incorrect default inheritable capabilities (bsc#1197517).
• CVE-2022-23648: Fixed directory traversal issue (bsc#1196441).
• CVE-2021-41190: Fixed parsing confusions in OCI manifest and index (bsc#1193273).
• CVE-2022-27191: Fixed a crash in a golang.org/x/crypto/ssh server (bsc#1197284).
• CVE-2021-43565: Fixed a panic in golang.org/x/crypto by empty plaintext packet (bsc#1193930).

This update for conmon, libcontainers-common, libseccomp, podman fixes the following issues:

podman was updated to 3.4.4.

Security issues fixed:

• fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion

• fix CVE-2021-4024 [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs

• fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as orginating from localhost

• Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade path from podman < 3.1.2

Update to version 3.4.4:

• Bugfixes

  • Fixed a bug where the podman exec command would, under some circumstances, print a warning message about failing to move conmon to the appropriate cgroup (#12535).
  • Fixed a bug where named volumes created as part of container creation (e.g. podman run --volume avolume:/a/mountpoint or similar) would be mounted with incorrect permissions (#12523).
  • Fixed a bug where the podman-remote create and podman-remote run commands did not properly handle the --entrypoint='' option (to clear the container's entrypoint) (#12521).

• Update to version 3.4.3:

  • Security

    • This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777.
    • This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients.

  • Features

    • The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287).

  • Bugfixes

    • Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065).
    • Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933).
    • Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438).
    • Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189).
    • Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263).
    • Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642).
    • Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248).
    • Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed (#12329).
    • Fixed a bug where podman machine start would exit before SSH on the started VM was accepting connections (#11532).
    • Fixed a bug where the podman run command with signal proxying (--sig-proxy) enabled could print an error if it attempted to send a signal to a container that had just exited (#8086).
    • Fixed a bug where the podman stats command would not return correct information for containers running Systemd as PID1 (#12400).
    • Fixed a bug where the podman image save command would fail on OS X when writing the image to STDOUT (#12402).
    • Fixed a bug where the podman ps command did not properly handle PS arguments which contained whitespace (#12452).
    • Fixed a bug where the podman-remote wait command could fail to detect that the container exited and return an error under some circumstances (#12457).
    • Fixed a bug where the Windows MSI installer for podman-remote would break the PATH environment variable by adding an extra ' (#11416).

  • API

    • The Libpod Play Kube…

This update for podman fixes the following issues:

podman was updated to version 4.3.1:

4.3.1:

• Bugfixes

• Fixed a deadlock between the podman ps and podman container inspect commands

• Misc

• Updated the containers/image library to v5.23.1

4.3.0:

• Features

• A new command, podman generate spec, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
• A new command, podman update, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted
• A new command, podman kube down, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to podman kube play --down, but it now has its own command).
• The podman kube play command now supports Kubernetes secrets using Podman's secrets backend.
• Systemd-managed pods created by the podman kube play command now integrate with sd-notify, using the io.containers.sdnotify annotation (or io.containers.sdnotify/$name for specific containers).
• Systemd-managed pods created by podman kube play can now be auto-updated, using the io.containers.auto-update annotation (or io.containers.auto-update/$name for specific containers).
• The podman kube play command can now read YAML from URLs, e.g. podman kube play https://example.com/demo.yml
• The podman kube play command now supports the emptyDir volume type
• The podman kube play command now supports the HostUsers field in the pod spec.
• The podman play kube command now supports binaryData in ConfigMaps.
• The podman pod create command can now set additional resource limits for pods using the new --memory-swap, --cpuset-mems, --device-read-bps, --device-write-bps, --blkio-weight, --blkio-weight-device, and --cpu-shares options.
• The podman machine init command now supports a new option, --username, to set the username that will be used to connect to the VM as a non-root user
• The podman volume create command's -o timeout= option can now set a timeout of 0, indicating volume plugin operations will never time out.
• Added support for a new volume driver, image, which allows volumes to be created that are backed by images.
• The podman run and podman create commands support a new option, --env-merge, allowing environment variables to be specified relative to other environment variables in the image (e.g. podman run --env-merge 'PATH=$PATH:/my/app' ...)
• The podman run and podman create commands support a new option, --on-failure, to allow action to be taken when a container fails health checks, with the following supported actions: none (take no action, the default), kill (kill the container), restart (restart the container), and stop (stop the container).
• The --keep-id option to podman create and podman run now supports new options, uid and gid, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. --userns=keep-id:uid=11 will made the user running Podman to UID 11 in the container)
• The podman generate systemd command now supports a new option, --env/-e, to set environment variables in the generated unit file
• The podman pause and podman unpause commands now support the --latest, --cidfile, and --filter options.
• The podman restart command now supports the --cidfile and --filter options.
• The podman rm command now supports the --filter option to select which containers will be removed.
• The podman rmi command now supports a new option, --no-prune, to prevent the removal of dangling parents of removed images.
• The --dns-opt option to podman create, podman run, and podman pod create has received a new alias, --dns-option, to improve Docker compatibility.
• The podman command now features a new global flag,…

This update for podman fixes the following issues:

podman was updated to version 4.3.1:

4.3.1:

• Bugfixes

• Fixed a deadlock between the podman ps and podman container inspect commands

• Misc

• Updated the containers/image library to v5.23.1

4.3.0:

• Features

• A new command, podman generate spec, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
• A new command, podman update, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted
• A new command, podman kube down, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to podman kube play --down, but it now has its own command).
• The podman kube play command now supports Kubernetes secrets using Podman's secrets backend.
• Systemd-managed pods created by the podman kube play command now integrate with sd-notify, using the io.containers.sdnotify annotation (or io.containers.sdnotify/$name for specific containers).
• Systemd-managed pods created by podman kube play can now be auto-updated, using the io.containers.auto-update annotation (or io.containers.auto-update/$name for specific containers).
• The podman kube play command can now read YAML from URLs, e.g. podman kube play https://example.com/demo.yml
• The podman kube play command now supports the emptyDir volume type
• The podman kube play command now supports the HostUsers field in the pod spec.
• The podman play kube command now supports binaryData in ConfigMaps.
• The podman pod create command can now set additional resource limits for pods using the new --memory-swap, --cpuset-mems, --device-read-bps, --device-write-bps, --blkio-weight, --blkio-weight-device, and --cpu-shares options.
• The podman machine init command now supports a new option, --username, to set the username that will be used to connect to the VM as a non-root user
• The podman volume create command's -o timeout= option can now set a timeout of 0, indicating volume plugin operations will never time out.
• Added support for a new volume driver, image, which allows volumes to be created that are backed by images.
• The podman run and podman create commands support a new option, --env-merge, allowing environment variables to be specified relative to other environment variables in the image (e.g. podman run --env-merge 'PATH=$PATH:/my/app' ...)
• The podman run and podman create commands support a new option, --on-failure, to allow action to be taken when a container fails health checks, with the following supported actions: none (take no action, the default), kill (kill the container), restart (restart the container), and stop (stop the container).
• The --keep-id option to podman create and podman run now supports new options, uid and gid, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. --userns=keep-id:uid=11 will made the user running Podman to UID 11 in the container)
• The podman generate systemd command now supports a new option, --env/-e, to set environment variables in the generated unit file
• The podman pause and podman unpause commands now support the --latest, --cidfile, and --filter options.
• The podman restart command now supports the --cidfile and --filter options.
• The podman rm command now supports the --filter option to select which containers will be removed.
• The podman rmi command now supports a new option, --no-prune, to prevent the removal of dangling parents of removed images.
• The --dns-opt option to podman create, podman run, and podman pod create has received a new alias, --dns-option, to improve Docker compatibility.
• The podman command now features a new global flag,…

This update for umoci fixes the following issues:

Update to umoci v0.5.0. Upstream changelog is available from

https://github.com/opencontainers/umoci/releases/tag/v0.5.0 bsc#1243388

A security flaw was found in the OCI image-spec, where it is possible to cause a blob with one media-type to be interpreted as a different media-type. As umoci is not a registry nor does it handle signatures, this vulnerability had no real impact on umoci but for safety we implemented the now-recommended media-type embedding and verification. CVE-2021-41190

Other changes in this release:

• Several large reworks and API-related changes to the umoci's overlayfs support. This is only available to Go API users.
• The runtime-spec config.json generated by umoci is updated to be more modern and work properly with modern runc versions.
• The default gzip compression blocksize has been adjusted to match Docker.
• zstd-compressed images are now fully supported. Users can explcitily request the compression algorithm for newly-generated layers with the --compress option.

This update for docker-stable fixes the following issues:

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. (bsc#1250596)

• Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Backport https://github.com/moby/moby/pull/48517. bsc#1247362

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.

This update for docker-stable fixes the following issues:

Note this update contains a already fixed references mostly.

• Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. bsc#1250596

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Update to Go 1.23 for building now that upstream has switched their 23.0.x LTSS to use Go 1.23.

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.