Update module github.com/docker/docker to v20.10.21 - autoclosed
This MR contains the following updates:
Package | Type | Update | Change |
---|---|---|---|
github.com/docker/docker | require | patch |
v20.10.17+incompatible -> v20.10.21
|
Release Notes
docker/docker
v20.10.21
This release of Docker Engine contains updated versions of Docker Compose, Docker Scan, Containerd, added packages for Ubuntu 22.10, and some minor bug fixes and enhancements.
Client
- Remove "experimental" gates around "--platform" in bash completion docker/cli#3824.
Daemon
- Allow "allow-nondistributable-artifacts" to be configured for Docker Hub moby/moby#44313.
- Fix an
Invalid standard handle identifie
panic when registering the docker daemon as a service from a legacy CLI on Windows moby/moby#44326.
Builder
- Fix running git commands in Cygwin on Windows moby/moby#44332.
- Update bundled BuildKit version to to fix "output clipped, log limit 1MiB reached" errors moby/moby#44339.
Packaging
- Provide packages for Ubuntu 22.10 "Kinetic Kudu".
- Update Docker Compose to v2.12.2.
- Update Docker Scan to v0.21.0.
- Update containerd (
containerd.io
package) to v1.6.9.
v20.10.20
This release of Docker Engine contains partial mitigations for a Git vulnerability
(CVE-2022-39253), and has updated handling of image:tag@digest
image references.
The Git vulnerability allows a maliciously crafted Git repository, when used as a build context, to copy arbitrary filesystem paths into resulting containers/images; this can occur in both the daemon, and in API clients, depending on the versions and tools in use.
The mitigations available in this release and in other consumers of the daemon API
are partial and only protect users who build a Git URL context (e.g. git+protocol://
).
As the vulnerability could still be exploited by manually run Git commands that interact
with and check out submodules, users should immediately upgrade to a patched version of
Git to protect against this vulernability. Further details are available from the GitHub
blog ("Git security vulnerabilities announced").
Client
- Added a mitigation for CVE-2022-39253, when using the classic Builder with a Git URL as the build context.
Daemon
- Updated handling of
image:tag@digest
references. When pulling an image using theimage:tag@digest
("pull by digest"), image resolution happens through the content-addressable digest and theimage
andtag
are not used. While this is expected, this could lead to confusing behavior, and could potentially be exploited through social engineering to run an image that is already present in the local image store. Docker now checks if the digest matches the repository name used to pull the image, and otherwise will produce an error.
Builder
- Updated handling of
image:tag@digest
references. Refer to the "Daemon" section above for details. - Added a mitigation to the classic Builder and updated BuildKit to v0.8.3-31-gc0149372, for CVE-2022-39253.
v20.10.19
This release of Docker Engine comes with some bug-fixes, and an updated version of Docker Compose.
Builder
- Fix an issue that could result in a panic during
docker builder prune
ordocker system prune
moby/moby#44122.
Daemon
- Fix a bug where using
docker volume prune
would remove volumes that were still in use if the daemon was running with "live restore" and was restarted moby/moby#44238.
Packaging
- Update Docker Compose to v2.11.2.
- Update Go runtime to 1.18.7, which contains fixes for CVE-2022-2879, CVE-2022-2880, and CVE-2022-41715.
v20.10.18
This release of Docker Engine comes with a fix for a low-severity security issue,
some minor bug fixes, and updated versions of Docker Compose, Docker Buildx,
containerd
, and runc
.
Client
- Add Bash completion for Docker Compose docker/cli#3752.
Builder
- Fix an issue where file-capabilities were not preserved during build moby/moby#43876.
- Fix an issue that could result in a panic caused by a concurrent map read and map write moby/moby#44067
Daemon
- Fix a security vulnerability relating to supplementary group permissions, which could allow a container process to bypass primary group restrictions within the container CVE-2022-36109, GHSA-rc4r-wh2q-q6c4.
- seccomp: add support for Landlock syscalls in default policy moby/moby#43991.
- seccomp: update default policy to support new syscalls introduced in kernel 5.12 - 5.16 moby/moby#43991.
- Fix an issue where cache lookup for image manifests would fail, resulting in a redundant round-trip to the image registry moby/moby#44109.
- Fix an issue where
exec
processes and healthchecks were not terminated when they timed out moby/moby#44018.
Packaging
- Update Docker Buildx to v0.9.1.
- Update Docker Compose to v2.10.2.
- Update containerd (
containerd.io
package) to v1.6.8. - Update runc to v1.1.4.
- Update Go runtime to 1.18.6, which contains fixes for CVE-2022-27664 and CVE-2022-32190.
Configuration
-
If you want to rebase/retry this MR, check this box
This MR has been generated by Renovate Bot.