chore(deps): update dependency marcosnils/bin to v0.17.1

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
marcosnils/bin	patch	0.17.0 -> 0.17.1

---

Release Notes

marcosnils/bin (marcosnils/bin)

v0.17.1

Compare Source

Changelog

• 10be63c add support GITHUB_TOKEN env var (#​176)
• eb65e2d feat: Bump Go version to 1.20 (#​169)
• f715904 feat: Detect Go version in the pipeline (#​175)
• 4aaa173 remove depracated goreleaser config

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/bin:0.17.2

📦 Image Reference ghcr.io/uniget-org/tools/bin:0.17.2

digest	sha256:f3c1f66acd9c8989272a8ffe84ee473cdbc449b62c6aa4bbab6fd501446412db
vulnerabilities
platform	linux/amd64
size	5.4 MB
packages	48

github.com/containerd/containerd 1.5.5 (golang) pkg:golang/github.com/containerd/containerd@1.5.5 Improper Preservation of Permissions Affected range >=1.5.0 <1.5.9 Fixed version 1.5.9 CVSS Score 8 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Description Impact Containers launched through containerd’s CRI implementation on Linux systems which use the SELinux security module and containerd versions since v1.5.0 can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bind mounts in a hostPath volume. This relabeling elevates permissions for the container, granting full read/write access over the affected files and directories. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. If you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not affected by this issue. Patches This bug has been fixed in containerd 1.5.9. Because file labels persist independently of containerd, users should both update to these versions as soon as they are released and validate that all files on their host are correctly labeled. Workarounds Ensure that no sensitive files or directories are used as a hostPath volume source location. Policy enforcement mechanisms such a Kubernetes Pod Security Policy AllowedHostPaths may be specified to limit the files and directories that can be bind-mounted to containers. For more information If you have any questions or comments about this advisory: Open an issue in containerd Email us at security@containerd.io Exposure of Sensitive Information to an Unauthorized Actor Affected range >=1.5.0 <1.5.10 Fixed version 1.5.10 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description Impact A bug was found in containerd where containers launched through containerd’s CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. Patches This bug has been fixed in containerd 1.6.1, 1.5.10 and 1.4.13. Users should update to these versions to resolve the issue. Workarounds Ensure that only trusted images are used. Credits The containerd project would like to thank Felix Wilhelm of Google Project Zero for responsibly disclosing this issue in accordance with the containerd security policy. For more information If you have any questions or comments about this advisory: Open an issue in containerd Email us at security@containerd.io Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range >=1.5.0 <1.5.7 Fixed version 1.5.7 CVSS Score 5.9 CVSS Vector CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Description Impact A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. Patches This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Workarounds Limit access to the host to trusted users. Update directory permission on container bundles directories. For more information If you have any questions or comments about this advisory: Open an issue in github.com/containerd/containerd Email us at security@containerd.io Uncontrolled Resource Consumption Affected range <1.5.16 Fixed version 1.5.16 CVSS Score 5.7 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H Description Impact A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stream server, a goroutine is launched to handle terminal resize events if a TTY is requested. If the user's process fails to launch due to, for example, a faulty command, the goroutine will be stuck waiting to send without a receiver, resulting in a memory leak. Kubernetes and crictl can both be configured to use containerd's CRI implementation and the stream server is used for handling container IO. Patches This bug has been fixed in containerd 1.6.12 and 1.5.16. Users should update to these versions to resolve the issue. Workarounds Ensure that only trusted images and commands are used and that only trusted users have permissions to execute commands in running containers. For more information If you have any questions or comments about this advisory: Open an issue in containerd Email us at security@containerd.io To report a security issue in containerd: Report a new vulnerability Email us at security@containerd.io Uncontrolled Resource Consumption Affected range <1.5.18 Fixed version 1.5.18 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Description Impact When importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service. Patches This bug has been fixed in containerd 1.6.18 and 1.5.18. Users should update to these versions to resolve the issue. Workarounds Ensure that only trusted images are used and that only trusted users have permissions to import images. Credits The containerd project would like to thank David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the containerd security policy during a security fuzzing audit sponsored by CNCF. For more information If you have any questions or comments about this advisory: Open an issue in containerd Email us at security@containerd.io To report a security issue in containerd: Report a new vulnerability Email us at security@containerd.io Uncontrolled Resource Consumption Affected range <1.5.13 Fixed version 1.5.13 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Description Impact A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume memory without bound during invocation of the ExecSync API. This can cause containerd to consume all available memory on the computer, denying service to other legitimate workloads. Kubernetes and crictl can both be configured to use containerd's CRI implementation; ExecSync may be used when running probes or when executing processes via an "exec" facility. Patches This bug has been fixed in containerd 1.6.6 and 1.5.13. Users should update to these versions to resolve the issue. Workarounds Ensure that only trusted images and commands are used. References Similar fix in cri-o's CRI implementation GHSA-fcm2-6c3h-pg6j Credits The containerd project would like to thank David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the containerd security policy during a security audit sponsored by CNCF and facilitated by OSTIF. For more information If you have any questions or comments about this advisory: Open an issue in containerd Email us at security@containerd.io Improper Privilege Management Affected range <1.5.18 Fixed version 1.5.18 CVSS Score 5.3 CVSS Vector CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Description Impact A bug was found in containerd where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. Patches This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. Workarounds Ensure that the "USER $USERNAME" Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to ENTRYPOINT ["su", "-", "user"] to allow su to properly set up supplementary groups. References https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/ Docker/Moby: CVE-2022-36109, fixed in Docker 20.10.18 CRI-O: CVE-2022-2995, fixed in CRI-O 1.25.0 Podman: CVE-2022-2989, fixed in Podman 3.0.1 and 4.2.0 Buildah: CVE-2022-2990, fixed in Buildah 1.27.1 Note that CVE IDs apply to a particular implementation, even if an issue is common. For more information If you have any questions or comments about this advisory: Open an issue in containerd Email us at security@containerd.io To report a security issue in containerd: Report a new vulnerability Email us at security@containerd.io Access of Resource Using Incompatible Type ('Type Confusion') Affected range >=1.5.0 <1.5.8 Fixed version 1.5.8 CVSS Score 3 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N Description Impact In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of containerd prior to 1.4.12 and 1.5.8 treat the Content-Type header as trusted and deserialize the document according to that header. If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image. Patches This issue has been fixed in containerd 1.4.12 and 1.5.8. Image pulls for manifests that contain a “manifests” field or indices which contain a “layers” field are rejected. Workarounds Ensure you only pull images from trusted sources. References GHSA-mc8v-mgrf-8f4m GHSA-77vh-xpmg-72qh For more information If you have any questions or comments about this advisory: Open an issue in containerd Email us at security@containerd.io OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range >=1.5.0 <1.5.8 Fixed version 1.4.12, 1.5.8 Description In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header.

golang.org/x/crypto 0.0.0-20210322153248-0c34fe9e7dc2 (golang) pkg:golang/golang.org/x/crypto@0.0.0-20210322153248-0c34fe9e7dc2 Use of a Broken or Risky Cryptographic Algorithm Affected range <0.0.0-20220314234659-1baeb1ce4c0b Fixed version 0.0.0-20220314234659-1baeb1ce4c0b CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. Affected range <0.0.0-20211202192323-5770296d904e Fixed version 0.0.0-20211202192323-5770296d904e CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an unauthenticated attacker to panic an SSH server. When using AES-GCM or ChaCha20Poly1305, consuming a malformed packet which contains an empty plaintext causes a panic.

golang.org/x/net 0.0.0-20210924151903-3ad01bbaa167 (golang) pkg:golang/golang.org/x/net@0.0.0-20210924151903-3ad01bbaa167 Affected range <0.0.0-20220906165146-f3363e06e74c Fixed version 0.0.0-20220906165146-f3363e06e74c CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. Affected range <0.0.0-20211209124913-491a49abca63 Fixed version 0.0.0-20211209124913-491a49abca63 Description An attacker can cause unbounded memory growth in servers accepting HTTP/2 requests.

github.com/docker/distribution 2.7.1+incompatible (golang) pkg:golang/github.com/docker/distribution@2.7.1+incompatible Undefined Behavior for Input to API Affected range <2.8.2-beta.1 Fixed version 2.8.2-beta.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Impact Systems that run distribution built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious /v2/_catalog API endpoint request. Patches Upgrade to at least 2.8.2-beta.1 if you are running v2.8.x release. If you use the code from the main branch, update at least to the commit after f55a6552b006a381d9167e328808565dd2bf77dc. Workarounds There is no way to work around this issue without patching. Restrict access to the affected API endpoint: see the recommendations section. References /v2/_catalog endpoint accepts a parameter to control the maximum amount of records returned (query string: n). When not given the default n=100 is used. The server trusts that n has an acceptable value, however when using a maliciously large value, it allocates an array/slice of n of strings before filling the slice with data. This behaviour was introduced ~7yrs ago [1]. Recommendation The /v2/_catalog endpoint was designed specifically to do registry syncs with search or other API systems. Such an endpoint would create a lot of load on the backend system, due to overfetch required to serve a request in certain implementations. Because of this, we strongly recommend keeping this API endpoint behind heightened privilege and avoiding leaving it exposed to the internet. For more information If you have any questions or comments about this advisory: Open an issue in distribution repository Email us at cncf-distribution-security@lists.cncf.io [1] faulty commit Access of Resource Using Incompatible Type ('Type Confusion') Affected range <2.8.0 Fixed version 2.8.0 CVSS Score 3 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N Description Impact Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion. Patches Upgrade to at least v2.8.0-beta.1 if you are running v2.x release. If you use the code from the main branch, update at least to the commit after b59a6f827947f9e0e67df0cfb571046de4733586. Workarounds There is no way to work around this issue without patching. References Due to an oversight in the OCI Image Specification that removed the embedded mediaType field from manifests, a maliciously crafted OCI Container Image can cause registry clients to parse the same image in two different ways without modifying the image’s digest by modifying the Content-Type header returned by a registry. This can invalidate a common pattern of relying on container image digests for equivalence. For more information If you have any questions or comments about this advisory: Open an issue in distribution Open an issue in distribution-spec Email us at cncf-distribution-security@lists.cncf.io OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range Fixed version v2.8.0 Description Impact Systems that rely on digest equivalence for image attestations may be vulnerable to type confusion.

github.com/docker/docker 17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible (golang) pkg:golang/github.com/docker/docker@17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible Insertion of Sensitive Information into Log File Affected range <18.09.8 Fixed version 18.09.8 CVSS Score 7.5 CVSS Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Description In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.

golang.org/x/sys 0.0.0-20210925032602-92d5a993a665 (golang) pkg:golang/golang.org/x/sys@0.0.0-20210925032602-92d5a993a665 Improper Privilege Management Affected range <0.0.0-20220412211240-33da011f77ad Fixed version 0.0.0-20220412211240-33da011f77ad CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Description Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Reporting in syscall. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible. Specific Go Packages Affected golang.org/x/sys/unix

github.com/opencontainers/image-spec 1.0.1 (golang) pkg:golang/github.com/opencontainers/image-spec@1.0.1 Access of Resource Using Incompatible Type ('Type Confusion') Affected range <1.0.2 Fixed version 1.0.2 CVSS Score 3 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N Description Impact In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index. Patches The Image Specification will be updated to recommend that both manifest and index documents contain a mediaType field to identify the type of document. Release v1.0.2 includes these updates. Workarounds Software attempting to deserialize an ambiguous document may reject the document if it contains both “manifests” and “layers” fields or “manifests” and “config” fields. References GHSA-mc8v-mgrf-8f4m For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/opencontainers/image-spec Email us at security@opencontainers.org https://github.com/opencontainers/image-spec/commits/v1.0.2 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.0.2 Fixed version 1.0.2 Description Impact In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index. Patches The Image Specification will be updated to recommend that both manifest and index documents contain a mediaType field to identify the type of document.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/6392683278.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/6392683278.