Change Details

https://security-tracker.debian.org/tracker/CVE-2024-21626 Has the details, but the gist is that runc versions prior to * `1.0.0~rc93+ds1-5+deb11u3` for bullseye * `1.1.5+ds1-1+deb12u1` for bookworm * `1.0.0~rc6+dfsg1-3+deb10u2` for buster are susceptible to container escape attacks. This task is to coordinate deploying the fixes. Since runc is a cli tool, without a long running daemon, we don't need any system container restarts (e.g. containerd/docker). However, it's prudent to force a restart of all containers/pods in our environments so that we don't end up with forgotten containers that remain vulnerable.

https://security-tracker.debian.org/tracker/CVE-2024-21626 Has the details, but the gist is that runc versions prior to * `1.0.0~rc93+ds1-5+deb11u3` for bullseye * `1.1.5+ds1-1+deb12u1` for bookworm * all current versions for buster are susceptible to container escape attacks. This task is to coordinate deploying the fixes. Since runc is a cli tool, without a long running daemon, we don't need any system container restarts (e.g. containerd/docker). However, it's prudent to force a restart of all containers/pods in our environments so that we don't end up with forgotten containers that remain vulnerable.

https://security-tracker.debian.org/tracker/CVE-2024-21626 Has the details, but the gist is that runc versions prior to * `1.0.0~rc93+ds1-5+deb11u3` for bullseye * `1.1.5+ds1-1+deb12u1` for bookworm * `1.0.0~rc6+dfsg1-3+deb10u2`* all current versions for buster are susceptible to container escape attacks. This task is to coordinate deploying the fixes. Since runc is a cli tool, without a long running daemon, we don't need any system container restarts (e.g. containerd/docker). However, it's prudent to force a restart of all containers/pods in our environments so that we don't end up with forgotten containers that remain vulnerable.