Closed iyuhptop closed 1 year ago
See #104, specifically:
- CVE-2022-29162: does not change process capabilities
My code is pulled from tag 1.14... Maybe gosu should create a new release?
CVEs that do not apply to builds of
gosu
: ... If you use (or maintain) a security scanner which reports any of these againstgosu
, please report them to the security vendor as false positives.
I try to keep the main development branch up-to-date with newer package versions, but I have no plans to make a new release of
gosu
unless there is a compelling reason to do so (changes to/CVEs in the actual codepathsgosu
invokes, changes togosu
itself, etc).
Got , Thank you
As the title says, v1.0.1 use runc with version v1.0.1 contains a vulnerability: CVE-2022-29162 , can we upgrade the runc version to v1.1.4 ? The vulnerability is fixed in: 1.1.2