Описание
Security update for amazon-ecs-init
This update for amazon-ecs-init fixes the following issues:
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276744).
- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279329).
- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279231).
Changes for amazon-ecs-init:
- Update to version 1.107.0
- Feature - Add MPS GPU Sharing capability (#5139)
- Enhancement - Add MPS control daemon health gate task resource (#5107)
- Enhancement - Surface MPS control-daemon impairment reason as StatusReason (#5125)
- Enhancement - Attach the MPS control daemon health gate to MPS tasks (#5119)
- Enhancement - Add ACCELERATED_COMPUTE health check for the MPS control daemon (#5124)
- Enhancement - Fetch GPG keys from S3 instead of GitHub in ECS Anywhere install script (#5130)
- Enhancement - Bump github.com/prometheus/common from 0.66.1 to 0.71.0 in /ecs-agent (#5117)
- Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.32 to 1.20.4 in /agent (#5128)
- Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.35 in /ecs-init (#5133)
- Enhancement - Bump google.golang.org/grpc from 1.82.1 to 1.83.1, this also updated go.opentelemetry.io/otel to v1.44.0 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5123)
- Enhancement - Bump k8s.io/api from 0.28.1 to 0.37.0 in /agent (#5118)
- Enhancement - Correct broken systemd link in README (#5129)
- Enhancement - Bump golang.org/x/text and related dependencies (#5100)
- Enhancement - Bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.18.33 to 1.18.38 in /ecs-agent (#5093)
- Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.35.2 to 1.44.7 in /agent (#5094)
- Enhancement - Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3 (#5108)
- Enhancement - Update Go version to 1.26.7 (#5105)
- Enhancement - Add amazon-ecs-agent.gpg and amazon-ssm-agent.gpg to the CodePipeline release artifacts (#5101)
- Enhancement - IMDS credentials scanner/refresher: Add logging and validations (#5091)
- Enhancement - Bump github.com/containerd/cgroups/v3 from 3.0.4 to 3.1.3 in /agent (#5081)
- Enhancement - Bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /ecs-agent and /agent (#5085)
- Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.29 to 1.19.32 in /ecs-agent, /agent and /ecs-init (#5080)
- Bugfix - fix(handlers): raise fault rate limit to 1 rps (#5092)
- Feature - Nvidia MPS GPU sharing (not yet enabled)
- Add MPS control-daemon health probe (#5095)
- Add per-GPU memory accounting to host resource manager (#5090)
- Allow MPS containers to colocate on a shared GPU (#5083)
- Mount MPS control binary and pipe dir into the agent container (#5086)
- Move MPS pipe directory to /run/mps-ecs (#5102)
- Enhancement - Add retry for EFS volume creation to handle plugin timeout errors caused by concurrent mount operation (#5077)
- Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.32.23 to 1.32.31 in /agent (#5064)
- Enhancement - Bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /ecs-agent/daemonimages/csidriver (#5056)
- Enhancement - Bump github.com/gorilla/mux from 1.8.0 to 1.8.1 in /ecs-agent (#5063)
- Enhancement - add nos3readcache S3 Files mount option (#5062)
- Add ecs.capability.gpu-sharing-mps capability for NVIDIA MPS GPU sharing (#5053)
- Inject NVIDIA MPS env vars and pipe mount into MPS containers (#5082)
- Map ACS GPU sharingStrategy onto the internal container model for MPS (#5076)
- Gate gpu-sharing-mps on complete per-GPU memory- (#5075) (#5075)
- Regenerate ACS model for GPU sharingStrategy and validate it (#5071)
- Report per-GPU memory at container instance registration for GPU sharing (#5061)
- Regenerate ECS SDK with gpuInfo on PlatformDevice (#5060)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1276744
- SUSE Bug 1279231
- SUSE Bug 1279329
- SUSE CVE CVE-2026-41178 page
- SUSE CVE CVE-2026-84303 page
- SUSE CVE CVE-2026-84304 page
Описание
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-41178
- SUSE Bug 1276509
Описание
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.
Затронутые продукты
Ссылки
- CVE-2026-84303
- SUSE Bug 1278268
- SUSE Bug 1280553
Описание
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Затронутые продукты
Ссылки
- CVE-2026-84304
- SUSE Bug 1278271
- SUSE Bug 1280553