From eb9abecd59cc888c85dc2a34ef205e057698ad71 Mon Sep 17 00:00:00 2001 From: Jean Chen Date: Tue, 14 Jul 2026 14:40:31 -0400 Subject: [PATCH] bump containerd to fix CVE-2026-53488 Add containerd to the explicit INSTALL_PKGS in the Dockerfile so the image is rebuilt with the patched RPM (>= 1.7.33/2.x fixed versions) that validates image config labels before propagating them to the container, preventing host-root command execution via the CRI plugin. Resolves: OCPBUGS-96722 Signed-off-by: Jean Chen Co-authored-by: Cursor --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 4e9e3eb..52f4537 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,6 +16,7 @@ RUN rm -rf /opt/bin/local-scripts && ln -s /opt/bin/network-tools /usr/bin/netwo # Make sure to maintain alphabetical ordering when adding new packages. RUN INSTALL_PKGS="\ + containerd \ conntrack-tools \ iproute \ nginx \