Closed anouarchattouna closed 2 years ago
The only part of runc
's code we actually use is github.com/opencontainers/runc/libcontainer/user
(and by extension, github.com/opencontainers/runc/libcontainer/system
), and neither of those actually had any changes between v1.0.1 and v1.0.3 (so this is an overzealous scan result, similar to #98):
$ git diff v1.0.1..v1.0.3 -- libcontainer/user libcontainer/system
$
Should we skip this CVE or there is a chance that a new gosu release will come out soon?
Yes, I don't see a strong reason to to make a new release to "fix" CVEs which already don't apply to the existing release, so I'd suggest reporting it to your scanning vendor so they can flag it appropriately. :sweat_smile:
Could you please make a new release to include runc
v1.0.3
(done here https://github.com/tianon/gosu/pull/96 but not released)?