gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-19 23:06:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): bump containerd to v2.2.4 to clear CVE-2026-46680 (#1199)

Browse Source 
The compose-builder stage now pulls containerd/v2 v2.2.4 alongside the
existing otel security bumps. containerd v2.2.3 (the version pinned by
docker/compose v5.1.3) carries CVE-2026-46680, a runAsNonRoot evasion in
the runtime executor; v2.2.4 is the upstream patch release that fixes
it. The vulnerable code path is daemon-side and was never reachable from
compose, but bumping at the dependency level removes the entry from the
SBOM rather than relying on a VEX suppression.

Removed the corresponding statement from security/vex/sencho.openvex.json
and bumped version + last_updated.

The remaining three statements (docker/docker daemon CVEs) stay
suppressed: the fix lives on a new github.com/moby/moby/v2 module path,
and compose has not migrated imports yet, so no resolvable version bump
clears them.
This commit is contained in:
Anso
2026-05-24 18:22:27 -04:00
committed by GitHub
parent 7ec6fe05bb
commit 0951a0e792
2 changed files with 14 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/vex/sencho.openvex.json
+2 -17
View File
@@ -4,8 +4,8 @@
"author": "Studio Saelix",
"role": "Vendor",
"timestamp": "2026-05-18T00:00:00Z",
"last_updated": "2026-05-22T00:00:00Z",
"version": 6,
"last_updated": "2026-05-24T00:00:00Z",
"version": 7,
"statements": [
{
"vulnerability": {
@@ -51,21 +51,6 @@
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "The race condition is in the Docker Engine daemon-side bind-mount resolution path that backs `docker cp`, where a concurrent rename can redirect a copy operation onto a host path. docker-compose v5.1.3 statically bundles docker/docker v28.5.2+incompatible as a client-side library for API types and codecs; it never serves the daemon-side cp endpoint and never resolves bind mounts on the host. Sencho invokes compose only for up/down/ps operations against local user-authored compose files and does not invoke `docker cp` through compose. The vulnerable daemon-side code path is not reachable. The fix lives on the github.com/moby/moby/v2 module path; until upstream compose migrates to the v2 import path, v28.5.2+incompatible is the only Go-module-resolvable version of the affected library that compose can reference."
},
{
"vulnerability": {
"@id": "https://www.cve.org/CVERecord?id=CVE-2026-46680",
"name": "CVE-2026-46680",
"description": "containerd user ID handling bypass allows runAsNonRoot evasion"
},
"products": [
{
"@id": "pkg:golang/github.com/containerd/containerd/v2@v2.2.3"
}
],
"status": "not_affected",
"justification": "vulnerable_code_not_in_execute_path",
"impact_statement": "The vulnerability is in containerd's runtime executor: when starting a container whose OCI spec carries a Kubernetes `runAsNonRoot: true` security context, a crafted user ID handling sequence lets the process run as root despite the enforcement check. The vulnerable code path is reached only by containerd-shim invoking runc with a populated runtime spec, i.e., daemon-side execution by the containerd runtime itself. docker-compose v5.1.3 statically bundles `github.com/containerd/containerd/v2 v2.2.3` as a client-side library for gRPC types, API stubs, and shared utilities used to talk to a containerd daemon; it does not execute containers and does not enforce `runAsNonRoot`. Sencho invokes compose only for up/down/ps operations against user-authored compose files, which do not carry Kubernetes pod security contexts. The runtime-executor code path is not reachable. Upstream compose will pick up the fixed containerd (v2.2.4 / v2.3.1) on a future tag; until then v2.2.3 is the resolved version in compose v5.1.3's module graph."
}
]
}