You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable
// for use in a grpc.NewServer call.
func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor {
out of the box adds labels
net.peer.sock.addr
net.peer.sock.port
that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent.
Details
An attacker can easily flood the peer address and port for requests.
PoC
Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it.
Impact
In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc.
Others
It is similar to already reported vulnerabilities.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.7.16->1.7.17Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
containerd/containerd (containerd/containerd)
v1.7.17: containerd 1.7.17Compare Source
Welcome to the v1.7.17 release of containerd!
The seventeenth patch release for containerd 1.7 contains various fixes and updates.
Highlights
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
43 commits
114b07b97Prepare release notes for v1.7.17803aaa680Remove internal LoopConfig struct7bd3be948Swap internal ioctl implementation with golang.org/x/sysa0739dc0eUse LOOP_CONFIGURE when creating loop devices1573ea598Update ctr image pull all platforms32b594f1bUpdate unpacker to always fetch all5a03a3aeeUpdate hcsshim tag to v0.11.59a1eda40fupdate ttrpc tag to 1.2.4ad85652faPreserve CL_UNPRIVILEGED locked flags during remount of bind mounts582f3f43dUpdate instrumentation fuzzer with new flaga5d13689bvendor: github.com/containerd/imgcrypt@v1.1.8f853bc129vendor: golang.org/x/net@v0.23.0837972979vendor: golang.org/x/net@v0.21.056aa87792vendor: golang.org/x/net@v0.20.04e6335ebdvendor: golang.org/x/net@v0.19.01c6c745c6vendor: golang.org/x/term@v0.17.01077d38c9vendor: golang.org/x/sys@v0.18.0c53b635f9Update toolchain to Go 1.21.10 and 1.22.34b52104f0vendor: golang.org/x/crypto@v0.18.02f65c83b0vendor: golang.org/x/term@v0.16.08a76171f7vendor: golang.org/x/sys@v0.16.0d45778523vendor: golang.org/x/term@v0.15.0, golang.org/x/text@v0.14.024038de8cvendor: golang.org/x/sys@v0.15.0eb930375cAdd lease test for metadata snapshotter9f6c61ab9Update metadata snapshotter to lease on exists24dd403abUpdate image-spec to v1.1.0189b69e24go.mod: github.com/opencontainers/image-spec v1.1.0-rc3388fb336bUpdate grpc to v1.59.000347b7faAdd check for unsupported config versionsChanges from containerd/imgcrypt
53 commits
956b4d3CHANGES: Updated CHANGES document for 1.1.8 release9e8e1c1ctr: Sync code with containerd v1.6.23 ctr7d2cca5build(deps): bump containerd from 1.6.20 to 1.6.230f2559ectr: Sync code with containerd v1.6.20 ctrc48dd78cmd: Copy IntToInt32Array into img package and use it6d48a4ebuild(deps): bump ocicrypt from 1.1.7 to 1.1.81bc94a2github: Use golangci-lint v1.54.1 and adjust config file9065f1dgithub: Test with go 1.21 and go 1.2074986f3go.mod: Require go 1.20a2a8273build(deps): bump google.golang.org/grpc from 1.47.0 to 1.53.0286470atest: Test creating and running of container with key file missingaa517cctest: Fix order of parameters and remove unnecessary key parameterec72311test: Add comments to test case2959ec0test: To be able to run testLocalKeys alone add missing env variablea7f2760build(deps): upgrade github.com/containerd/containerd from 1.6.18 to 1.6.20002abacimages: Change 'any' to 'anything' to avoid clash with built-in type 'any'5780eccimages: Replace unused function parameters with '_'7dc8592ci: Update golangci-lint to v1.52.290e4f77build(deps): bump github.com/opencontainers/runc from 1.1.2 to 1.1.58fc037ftests: Upgrade toml written by test case to version 20b31bebci: Run tests with go 1.19 and 1.20 (abandon 1.18)523674cbuild(deps): Update to minimum required go v1.1996a2314build(deps): Upgrade to github.com/containers/ocicrypt@v1.1.71c50555bulid(deps): Update to golang.org/x/net@v0.7.09645d39build(deps): Update to minimum required go v1.188daaa45build(deps): bump github.com/containerd/containerd from 1.6.12 to 1.6.1812e84f5README: Fix a typo4e5a73ebuild(deps): bump github.com/containerd/containerd from 1.6.8 to 1.6.1216a071bUpdate golangci-lint to v1.50.1981a3fdRemove references to package io/ioutil06827a1Update containerd project checks package in CIf6a39e1Update GitHub actions packages in CI workflow6383351Update GitHub actions CI workflow OS runner imagesb6e16dbCI/CD: Run CodeQL on PRs and once a monthChanges from containerd/ttrpc
10 commits
272c857Bump google.golang.org/protobuf from 1.31.0 to 1.33.01b4f6f8client: Fix deadlock when writing to pipe blocks13b8289Bump golang.org/x/net from 0.17.0 to 0.23.0589a593Update GitHub Actions CI to resolve deprecation warnings73b6a91Add optional feature in protobuf compilerDependency Changes
3a7f492-> v1.1.078d3cae->7828495782d3b1->b8732ec782d3b1->b8732eccbb8c96->b8732ecPrevious release can be found at v1.7.16
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.