CVE-2023-47108

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

Summary

The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go

// UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable
// for use in a grpc.NewServer call.
func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {

out of the box adds labels

• net.peer.sock.addr
• net.peer.sock.port

that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.

Details

An attacker can easily flood the peer address and port for requests.

PoC

Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it.

Impact

In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc.

Others

It is similar to already reported vulnerabilities.

• GHSA-rcjv-mgp8-qvmr (open-telemetry/opentelemetry-go-contrib)

• GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib)
• GHSA-cg3q-j54f-5p7p (prometheus/client_golang)

Workaround for affected versions

As a workaround to stop being affected, a view removing the attributes can be used.

The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

Solution provided by upgrading

In PR #4322, to be released with v0.46.0, the attributes were removed.

References

• #4322

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels net.peer.sock.addr and net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.

The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service.

These are all security issues fixed in the etcd-3.5.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the etcd-for-k8s1.27-3.5.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the etcd-for-k8s1.28-3.5.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the etcd-for-k8s1.29-3.5.12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the okteto-2.28.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerd-1.7.21-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-26.1.5_ce-2.1 package on the GA media of openSUSE Tumbleweed.

This update for etcd fixes the following issues:

Update to version 3.5.12:

• Bump golang.org/x/crypto to v0.17+ to address CVE-2023-48795
• test: fix TestHashKVWhenCompacting: ensure all goroutine finished
• print error log when creating peer listener failed
• mvcc: Printing etcd backend database related metrics inside scheduleCompaction function
• dependency: update go version to 1.20.13
• commit bbolt transaction if there is any pending deleting operations
• add tests to test tx delete consistency.
• Don't flock snapshot files
• Backport adding digest for etcd base image.
• Add a unit tests and missing flags in etcd help.
• Add missing flag in etcd help.
• Backport testutils.ExecuteUntil to 3.5 branch
• member replace e2e test
• Check if be is nil to avoid panic when be is overriden with nil by recoverSnapshotBackend on line 517
• Don't redeclare err and snapshot variable, fixing validation of consistent index and closing database on defer
• test: enable gofail in release e2e test.
• [3.5] backport health check e2e tests.
• tests: Extract e2e cluster setup to separate package

• Update to version 3.5.11:

  • etcdserver: add linearizable_read check to readyz.
  • etcd: Update go version to 1.20.12
  • server: disable redirects in peer communication
  • etcdserver: add metric counters for livez/readyz health checks.
  • etcdserver: add livez and ready http endpoints for etcd.
  • http health check bug fixes
  • server: Split metrics and health code
  • server: Cover V3 health with tests
  • server: Refactor health checks
  • server: Run health check tests in subtests
  • server: Rename test case expect fields
  • server: Use named struct initialization in healthcheck test
  • Backport server: Don't follow redirects when checking peer urls.
  • Backport embed: Add tracing integration test.
  • Backport server: Have tracingExporter own resources it initialises.
  • Backport server: Add sampling rate to distributed tracing.
  • upgrade github.com/stretchr/testify,google.golang.org/genproto/googleapis/api,google.golang.org/grpc to make it consistent
  • CVE-2023-47108: Backport go.opentelemetry.io/[email protected] and go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/[email protected]
  • github workflow: run arm64 tests on every push
  • etcd: upgrade go version from 1.20.10 to 1.20.11
  • bump bbolt to 1.3.8 for etcd 3.5
  • 3.5: upgrade gRPC-go to 1.58.3
  • Backport corrupt check test fix 'etcd server shouldn't wait for the ready notification infinitely on startup'
  • etcdserver: add cluster id check for hashKVHandler
  • [release-3.5]: upgrade gRPC-go to v1.52.0
  • backport #14125 to release-3.5: Update to grpc-1.47 (and fix the connection-string format)
  • Return to default write scheduler since golang.org/x/[email protected] started using round robin
  • Bump go to v1.20.10 Part of https://github.com/etcd-io/etcd/issues/16740
  • bump golang.org/x/net to 0.17.0 Part of https://github.com/etcd-io/etcd/issues/16740
  • etcd: upgrade go version to 1.20.9
  • Remove obsolete http 1.0 version.
  • fix:Ensure that go version is only defined in one file for release-3.5
  • Fix panic in etcd validate secure endpoints
  • dependency: bump golang to 1.20.8
  • Backport redirect metrics data into file to reduce output.
  • test.sh: increase timeout for grpcproxy test
  • test: add v3 curl test to cover maintenance hash/hashkv REST API
  • api: fix duplicate gateway url issue
  • pkg: add a verification on the pagebytes which must be > 0
  • tests: Backport deflake for TestWatchDelay
  • tests: Backport deflake for TestPageWriterRandom
  • Backport adding unit test for socket options.
  • Backport export reuse-port and reuse-address
  • Fix goword failure in rafthttp/transport.go.
  • Backport update to golang 1.20 minor release.
  • bump go version to 1.19.12
  • Update workflows to use makefile recipes for unit, integration & e2e-release.
  • Backport Makefile recipes for common test…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…

This update for containerd fixes the following issues:

• Update to containerd v1.7.21
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)
• CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)

This update for containerd fixes the following issues:

• Update to containerd v1.7.21
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)
• CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)

This update for etcd fixes the following issues:

Update to version 3.5.12:

Security fixes:

• CVE-2018-16873: Fixed remote command execution in cmd/go (bsc#1118897)
• CVE-2018-16874: Fixed directory traversal in cmd/go (bsc#1118898)
• CVE-2018-16875: Fixed CPU denial of service in crypto/x509 (bsc#1118899)
• CVE-2018-16886: Fixed improper authentication issue when RBAC and client-cert-auth is enabled (bsc#1121850)
• CVE-2020-15106: Fixed panic in decodeRecord method (bsc#1174951)
• CVE-2020-15112: Fixed improper checks in entry index (bsc#1174951)
• CVE-2021-28235: Fixed information discosure via debug function (bsc#1210138)
• CVE-2022-41723: Fixed quadratic complexity in HPACK decoding in net/http (bsc#1208270, bsc#1208297)
• CVE-2023-29406: Fixed insufficient sanitization of Host header in go net/http (bsc#1213229)
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (bsc#1217070)
• CVE-2023-48795: Fixed prefix truncation breaking ssh channel integrity (aka Terrapin Attack) in crypto/ssh (bsc#1217950, bsc#1218150)

Other changes:

• Added hardening to systemd service(s) (bsc#1181400)
• Fixed static /tmp file issue (bsc#1199031)
• Fixed systemd service not starting (bsc#1183703)

Full changelog:

https://github.com/etcd-io/etcd/compare/v3.3.1...v3.5.12

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Allow a parallel docker-stable RPM to exists in repositories.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)

• Mark docker-buildx as required since classic 'docker build' has been deprecated since Docker 23.0. (bsc#1230331)

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. (bsc#1230333)

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070 bsc#1229806
  • CVE-2023-45142. bsc#1228553 bsc#1229806

• Update to Docker 26.1.4-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2614

• Update to Docker 26.1.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2610

• Update --add-runtime to point to correct binary path.

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Allow a parallel docker-stable RPM to exists in repositories.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)

• Mark docker-buildx as required since classic 'docker build' has been deprecated since Docker 23.0. (bsc#1230331)

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. (bsc#1230333)

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070 bsc#1229806
  • CVE-2023-45142. bsc#1228553 bsc#1229806

• Update to Docker 26.1.4-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2614

• Update to Docker 26.1.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2610

• Update --add-runtime to point to correct binary path.

This update for containerd fixes the following issues:

• Update to containerd v1.7.21. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.21 Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553

• Update to containerd v1.7.17. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.17

• Update to containerd v1.7.16. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.16 CVE-2023-45288 bsc#1221400

• Update to containerd v1.7.15. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.15

• Update to containerd v1.7.14. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.14

• Update to containerd v1.7.13. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.13

• Update to containerd v1.7.12. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.12

• Update to containerd v1.7.11. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.11 GHSA-jq35-85cj-fj4p bsc#1224323

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Add %{_sysconfdir}/audit/rules.d to filelist.

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070
  • CVE-2023-45142. bsc#1228553

This update for docker fixes the following issues:

• This update includes fixes for:

  • CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324)
  • CVE-2023-47108: Fixed otelgrpc: DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality (bsc#1217070 bsc#1229806)
  • CVE-2023-45142: Fixed otelhttp,otelhttptrace,otelrestful: DoS vulnerability (bsc#1228553 bsc#1229806)

• Update to Docker 27.5.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#2741 bsc#1237335

• Update to docker-buildx 0.20.1. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.20.1

• Update to Docker 27.4.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#2741

• Update to docker-buildx 0.19.3. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.3

• Update to Docker 27.4.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#274

  https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Update to Go 1.22.

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

This update for docker-compose fixes the following issues:

Update to version 2.33.1:

• Improvements

  • Add support for gw_priority, enable_ipv4 (requires docker v28.0) by @thaJeztah in #12570

• Fixes

  • Run watch standalone if menu fails to start by @ndeloof in #12536
  • Report error using non-file secret|config with read-only service by @ndeloof in #12531
  • Don't display bake suggestion when using --progress with quiet or json option by @glours in #12561
  • Fix pull --parallel and --no-parallel deprecation warnings missing by @maxproske in #12555
  • Fix error message when detach is implied by wait by @ndeloof in #12566

• Dependencies

  • build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by @dependabot in #12556
  • build(deps): bump google.golang.org/grpc from 1.68.1 to 1.70.0 by @dependabot in #12494
  • go.mod: update to docker v28.0.0 by @thaJeztah in #12545

Update to version 2.33.0:

• Important

  • This release introduce support for Bake to manage builds as an alternative to the internal buildkit client. This new feature can be enabled by setting COMPOSE_BAKE=1 variable. Bake will become the default builder in a future release.

• Improvements

  • let user know bake is now supported by @ndeloof in #12524
  • support additional_context reference to another service by @ndeloof in #12485
  • add support for BUILDKIT_PROGRESS by @ndeloof in #12458
  • add --with-env flag to publish command by @glours in #12482
  • Update ls --quiet help description by @maxproske in #12541
  • Publish warn display env vars by @glours in #12486

• Fixes

  • Fix bake support by @ndeloof in #12507
  • Update link in stats --help output by @maxproske in #12523
  • Properly handle "builtin" seccomp profile by @r-bk in #12478
  • manage watch applied to mulitple services by @ndeloof in #12469

• Internal

  • use main branch for docs upstream validation workflow by @crazy-max in #12487
  • fix provenance for binaries and generate sbom by @crazy-max in #12479
  • add codeowners file by @glours in #12480
  • remove exit code per error type used by legacy metrics system by @ndeloof in #12502
  • Dockerfile: update golangci-lint to v1.63.4 by @thaJeztah in #12546
  • Full test coverage for compatibility cmd by @maxproske in #12528
  • don't send raw os.Args to opentelemetry but a pseudo command line by @ndeloof in #12530
  • add docker engine v28.x to the test-matrix by @thaJeztah in #12539
  • enable copyloopvar linter by @thaJeztah in #12542
  • go.mod: remove toolchain directive by @thaJeztah in #12551

• Dependencies

  • bump buildx v0.20.1 by @ndeloof in #12488
  • bump docker to v27.5.1 by @ndeloof in #12491
  • bump compose-go v2.4.8 by @ndeloof in #12543
  • bump golang.org/x/sys from 0.28.0 to 0.30.0 by @dependabot in #12529
  • bump github.com/moby/term v0.5.2 by @thaJeztah in #12540
  • bump github.com/otiai10/copy from 1.14.0 to 1.14.1 by @dependabot in #12493
  • bump github.com/jonboulle/clockwork from 0.4.0 to 0.5.0 by @dependabot in #12430
  • bump github.com/spf13/pflag from 1.0.5 to 1.0.6 by @dependabot in #12548
  • bump golang.org/x/sync from 0.10.0 to 0.11.0 by @dependabot in #12547
  • bump gotest.tools/v3 from 3.5.1 to 3.5.2 by @dependabot in #12549

Update to version 2.32.4:

• add missing tag for build during merge workflow
• ci: re-use local source to build binary images
• ci: use local source for binary builds

Update to version 2.32.3:

• ci: update bake-action to v6
• simplification
• image can be set to a local ID, that isn't a valid docker ref
• can't render progress concurrently with buildkit
• exclude one-off container running convergence
• Only override service mac if set on the main network.

Update to version 2.32.2:

*…