chore(deps): update dependency containerd/containerd to v1.7.18

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
containerd/containerd	patch	1.7.17 -> 1.7.18

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

containerd/containerd (containerd/containerd)

v1.7.18: containerd 1.7.18

Compare Source

Welcome to the v1.7.18 release of containerd!

The eighteenth patch release for containerd 1.7 contains various updates along
with an updated version of Go. Go 1.22.4 and 1.21.11 include a fix for a symlink
time of check to time of use race condition during directory removal.

Highlights

• Update Go version to 1.21.11 (#​10298)
• Remove uses of platforms.Platform alias (#​10277)
• Migrate log imports to github.com/containerd/log (#​10269)
• Migrate errdefs package to github.com/containerd/errdefs (#​10266)
• Fix usage of "unknown" platform (#​10261)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Derek McGowan
• Sebastiaan van Stijn
• Akhil Mohan
• Austin Vazquez
• Phil Estes

Changes

16 commits

• Prepare release notes for v1.7.18 (#​10301)
  • 9426aab62 Prepare release notes for v1.7.18
• Update Go version to 1.21.11 (#​10298)
  • cdd3ea913 Update Go version to 1.21.11
• Remove uses of platforms.Platform alias (#​10277)
  • 1e3c662d6 [release/1.7] remove uses of platforms.Platform alias
• Migrate log imports to github.com/containerd/log (#​10269)
  • 0af6825b1 migrate logs imports to github.com/containerd/log module
• Migrate errdefs package to github.com/containerd/errdefs (#​10266)
  • 308341a44 replace uses of github.com/containerd/containerd/errdefs
  • 47ff8cfce migrate errdefs package to github.com/containerd/errdefs module
• Fix usage of "unknown" platform (#​10261)
  • f4d11912a core/image: fix usage of "unknown" platform
• Explicitly set release latest to true (#​10265)
  • 5b0480009 Explicitly set release latest to true
  • d669b100d build(deps): bump softprops/action-gh-release from 1 to 2

Changes from containerd/errdefs

6 commits

• Add common files (containerd/errdefs#1)
  • 78f3494 Add Github actions configuration
  • 46f1770 Add go.mod configuration
  • 959121a Add README.md
• Add LICENSE (containerd/errdefs#2)
  • 33a2275 Add LICENSE

Dependency Changes

• github.com/containerd/errdefs v0.1.0 new
• google.golang.org/genproto b8732ec -> e6e6cda
• google.golang.org/genproto/googleapis/api b8732ec -> 007df8e
• google.golang.org/genproto/googleapis/rpc b8732ec -> d307bd8

Previous release can be found at v1.7.17

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/containerd:1.7.18

📦 Image Reference ghcr.io/uniget-org/tools/containerd:1.7.18

digest	sha256:8786898c33227829522bf1d8bc751c8adb3b14e135bd83ebcb3a71e2f413d858
vulnerabilities
platform	linux/amd64
size	49 MB
packages	128

go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.45.0 (golang) pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc@0.45.0 Allocation of Resources Without Limits or Throttling Affected range <0.46.0 Fixed version 0.46.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Summary The grpc Unary Server Interceptor opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go // UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable // for use in a grpc.NewServer call. func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor { out of the box adds labels net.peer.sock.addr net.peer.sock.port that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. Details An attacker can easily flood the peer address and port for requests. PoC Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it. Impact In order to be affected, the program has to configure a metrics pipeline, use UnaryServerInterceptor, and does not filter any client IP address and ports via middleware or proxies, etc. Others It is similar to already reported vulnerabilities. GHSA-rcjv-mgp8-qvmr (open-telemetry/opentelemetry-go-contrib) GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib) GHSA-cg3q-j54f-5p7p (prometheus/client_golang) Workaround for affected versions As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider. Solution provided by upgrading In PR #4322, to be released with v0.46.0, the attributes were removed. References #4322

k8s.io/apiserver 0.26.2 (golang) pkg:golang/k8s.io/apiserver@0.26.2 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <1.15.10 Fixed version 1.15.10, 1.16.7, 1.17.3 CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L Description The Kubernetes API server component has been found to be vulnerable to a denial of service attack via successful API requests.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/9380833030.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/9380833030.