SUSE-SU-2022:2341-1: important: Security update for containerd, docker and runc - openSUSE Security Announce

8 Jul 2022


      SUSE Security Update: Security update for containerd, docker and runc
______________________________________________________________________________
Announcement ID:    SUSE-SU-2022:2341-1
Rating:             important
References:         #1192051 #1199460 #1199565 #1200088 #1200145
Cross-References:   CVE-2022-29162 CVE-2022-31030
CVSS scores:
                    CVE-2022-29162 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                    CVE-2022-29162 (SUSE): 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
                    CVE-2022-31030 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products:
                    SUSE CaaS Platform 4.0
                    SUSE Enterprise Storage 6
                    SUSE Enterprise Storage 7
                    SUSE Enterprise Storage 7.1
                    SUSE Linux Enterprise High Performance Computing 15-ESPOS
                    SUSE Linux Enterprise High Performance Computing 15-LTSS
                    SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS
                    SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS
                    SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS
                    SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS
                    SUSE Linux Enterprise High Performance Computing 15-SP3
                    SUSE Linux Enterprise High Performance Computing 15-SP4
                    SUSE Linux Enterprise Micro 5.1
                    SUSE Linux Enterprise Micro 5.2
                    SUSE Linux Enterprise Module for Containers 15-SP3
                    SUSE Linux Enterprise Module for Containers 15-SP4
                    SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3
                    SUSE Linux Enterprise Server 15-LTSS
                    SUSE Linux Enterprise Server 15-SP1-BCL
                    SUSE Linux Enterprise Server 15-SP1-LTSS
                    SUSE Linux Enterprise Server 15-SP2-BCL
                    SUSE Linux Enterprise Server 15-SP2-LTSS
                    SUSE Linux Enterprise Server 15-SP3
                    SUSE Linux Enterprise Server 15-SP4
                    SUSE Linux Enterprise Server for SAP 15
                    SUSE Linux Enterprise Server for SAP 15-SP1
                    SUSE Linux Enterprise Server for SAP 15-SP2
                    SUSE Linux Enterprise Server for SAP Applications 15-SP3
                    SUSE Linux Enterprise Server for SAP Applications 15-SP4
                    SUSE Linux Enterprise Storage 7.1
                    SUSE Manager Proxy 4.1
                    SUSE Manager Proxy 4.2
                    SUSE Manager Proxy 4.3
                    SUSE Manager Retail Branch Server 4.1
                    SUSE Manager Retail Branch Server 4.2
                    SUSE Manager Retail Branch Server 4.3
                    SUSE Manager Server 4.1
                    SUSE Manager Server 4.2
                    SUSE Manager Server 4.3
                    openSUSE Leap 15.3
                    openSUSE Leap 15.4
______________________________________________________________________________
An update that solves two vulnerabilities and has three
   fixes is now available.
Description:
This update for containerd, docker and runc fixes the following issues:
containerd:
- CVE-2022-31030: Fixed denial of service via invocation of the ExecSync
     API (bsc#1200145)
docker:
- Update to Docker 20.10.17-ce. See upstream changelog online at
     https://docs.docker.com/engine/release-notes/#201017. (bsc#1200145)
runc:
Update to runc v1.1.3.
Upstream changelog is available from
   https://github.com/opencontainers/runc/releases/tag/v1.1.3.
* Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
     s390 and s390x. This solves the issue where syscalls the host kernel did
     not support would return `-EPERM` despite the existence of the `-ENOSYS`
     stub code (this was due to how s390x does syscall multiplexing).
   * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works
     as intended; this fix does not affect runc binary itself but is
     important for libcontainer users such as Kubernetes.
   * Inability to compile with recent clang due to an issue with duplicate
     constants in libseccomp-golang.
   * When using systemd cgroup driver, skip adding device paths that don't
     exist, to stop systemd from emitting warnings about those paths.
   * Socket activation was failing when more than 3 sockets were used.
   * Various CI fixes.
   * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
   - Fixed issues with newer syscalls (namely faccessat2) on older kernels on
     s390(x) caused by that platform's syscall multiplexing semantics.
     (bsc#1192051 bsc#1199565)
Update to runc v1.1.2.
Upstream changelog is available from
   https://github.com/opencontainers/runc/releases/tag/v1.1.2.
Security issue fixed:
- CVE-2022-29162: A bug was found in runc where runc exec --cap executed
     processes with non-empty inheritable Linux process capabilities,
     creating an atypical Linux environment. (bsc#1199460)
- `runc spec` no longer sets any inheritable capabilities in the created
     example OCI spec (`config.json`) file.
Update to runc v1.1.1.
Upstream changelog is available from
   https://github.com/opencontainers/runc/releases/tag/v1.1.1.
* runc run/start can now run a container with read-only /dev in OCI spec,
     rather than error out. (#3355)
   * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
     libcontainer systemd v2 manager no longer errors out if one of the files
     listed in /sys/kernel/cgroup/delegate do not exist in container's
     cgroup. (#3387, #3404)
   * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
     error. (#3406)
   * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
     of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)
Update to runc v1.1.0.
Upstream changelog is available from
   https://github.com/opencontainers/runc/releases/tag/v1.1.0.
- libcontainer will now refuse to build without the nsenter package being
     correctly compiled (specifically this requires CGO to be enabled). This
     should avoid folks accidentally creating broken runc binaries (and
     incorrectly importing our internal libraries into their projects).
     (#3331)
Update to runc v1.1.0~rc1.
Upstream changelog is available from
   https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
+ Add support for RDMA cgroup added in Linux 4.11.
   * runc exec now produces exit code of 255 when the exec failed. This may
     help in distinguishing between runc exec failures (such as invalid
     options, non-running container or non-existent binary etc.) and failures
     of the command being executed.
   + runc run: new --keep option to skip removal exited containers artefacts.
     This might be useful to check the state (e.g. of cgroup controllers)
     after the container has���exited.
   + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
     (the latter is just an alias for SCMP_ACT_KILL).
   + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
     users to create sophisticated seccomp filters where syscalls can be
     efficiently emulated by privileged processes on the host.
   + checkpoint/restore: add an option (--lsm-mount-context) to set a
     different LSM mount context on restore.
   + intelrdt: support ClosID parameter.
   + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
     to use for the process being executed.
   + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a
     cgroup v1 machine a cgroup2 filesystem is mounted to
     /sys/fs/cgroup/unified, runc run/exec now adds the container to the
     appropriate cgroup under it).
   + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
     behaviour.
   + mounts: add support for bind-mounts which are inaccessible after
     switching the user namespace. Note that this does not permit the
     container any additional access to the host filesystem, it simply allows
     containers to have bind-mounts configured for paths the user can access
     but have restrictive access control settings for other users.
   + Add support for recursive mount attributes using mount_setattr(2). These
     have the same names as the proposed mount(8) options -- just prepend r
     to the option name (such as rro).
   + Add runc features subcommand to allow runc users to detect what features
     runc has been built with. This includes critical information such as
     supported mount flags, hook names, and so on. Note that the output of
     this command is subject to change and will not be considered stable
     until runc 1.2 at the earliest. The runtime-spec specification for this
     feature is being developed in opencontainers/runtime-spec#1130.
   * system: improve performance of /proc/$pid/stat parsing.
   * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
     the ownership of certain cgroup control files (as per
     /sys/kernel/cgroup/delegate) to allow for proper deferral to the
     container process.
   * runc checkpoint/restore: fixed for containers with an external bind
     mount which destination is a symlink.
   * cgroup: improve openat2 handling for cgroup directory handle hardening.
     runc delete -f now succeeds (rather than timing out) on a paused
     container.
   * runc run/start/exec now refuses a frozen cgroup (paused container in
     case of exec). Users can disable this using --ignore-paused.
   - Update version data embedded in binary to correctly include the git
     commit of the release.
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.4:
zypper in -t patch openSUSE-SLE-15.4-2022-2341=1
- openSUSE Leap 15.3:
zypper in -t patch openSUSE-SLE-15.3-2022-2341=1
- SUSE Manager Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2341=1
- SUSE Manager Retail Branch Server 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2341=1
- SUSE Manager Proxy 4.1:
zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2341=1
- SUSE Linux Enterprise Server for SAP 15-SP2:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2341=1
- SUSE Linux Enterprise Server for SAP 15-SP1:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2022-2341=1
- SUSE Linux Enterprise Server for SAP 15:
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2022-2341=1
- SUSE Linux Enterprise Server 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2341=1
- SUSE Linux Enterprise Server 15-SP2-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-2341=1
- SUSE Linux Enterprise Server 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-2341=1
- SUSE Linux Enterprise Server 15-SP1-BCL:
zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-BCL-2022-2341=1
- SUSE Linux Enterprise Server 15-LTSS:
zypper in -t patch SUSE-SLE-Product-SLES-15-2022-2341=1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-2341=1
- SUSE Linux Enterprise Module for Containers 15-SP4:
zypper in -t patch SUSE-SLE-Module-Containers-15-SP4-2022-2341=1
- SUSE Linux Enterprise Module for Containers 15-SP3:
zypper in -t patch SUSE-SLE-Module-Containers-15-SP3-2022-2341=1
- SUSE Linux Enterprise Micro 5.2:
zypper in -t patch SUSE-SUSE-MicroOS-5.2-2022-2341=1
- SUSE Linux Enterprise Micro 5.1:
zypper in -t patch SUSE-SUSE-MicroOS-5.1-2022-2341=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-2341=1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-2341=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-2341=1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-2341=1
- SUSE Linux Enterprise High Performance Computing 15-LTSS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-2341=1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS:
zypper in -t patch SUSE-SLE-Product-HPC-15-2022-2341=1
- SUSE Enterprise Storage 7.1:
zypper in -t patch SUSE-Storage-7.1-2022-2341=1
- SUSE Enterprise Storage 7:
zypper in -t patch SUSE-Storage-7-2022-2341=1
- SUSE Enterprise Storage 6:
zypper in -t patch SUSE-Storage-6-2022-2341=1
- SUSE CaaS Platform 4.0:
To install this update, use the SUSE CaaS Platform 'skuba' tool. It
      will inform you if it detects new updates and let you then trigger
      updating of the complete cluster in a controlled way.
Package List:
- openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      docker-kubic-20.10.17_ce-150000.166.1
      docker-kubic-debuginfo-20.10.17_ce-150000.166.1
      docker-kubic-kubeadm-criconfig-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- openSUSE Leap 15.4 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
      docker-fish-completion-20.10.17_ce-150000.166.1
      docker-kubic-bash-completion-20.10.17_ce-150000.166.1
      docker-kubic-fish-completion-20.10.17_ce-150000.166.1
      docker-kubic-zsh-completion-20.10.17_ce-150000.166.1
      docker-zsh-completion-20.10.17_ce-150000.166.1
- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      docker-kubic-20.10.17_ce-150000.166.1
      docker-kubic-debuginfo-20.10.17_ce-150000.166.1
      docker-kubic-kubeadm-criconfig-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- openSUSE Leap 15.3 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
      docker-fish-completion-20.10.17_ce-150000.166.1
      docker-kubic-bash-completion-20.10.17_ce-150000.166.1
      docker-kubic-fish-completion-20.10.17_ce-150000.166.1
      docker-kubic-zsh-completion-20.10.17_ce-150000.166.1
      docker-zsh-completion-20.10.17_ce-150000.166.1
- SUSE Manager Server 4.1 (ppc64le s390x x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Manager Server 4.1 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Manager Retail Branch Server 4.1 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Manager Retail Branch Server 4.1 (x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Manager Proxy 4.1 (x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Manager Proxy 4.1 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (ppc64le x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server for SAP 15-SP2 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (ppc64le x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server for SAP 15-SP1 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server for SAP 15 (ppc64le x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server for SAP 15 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (aarch64 ppc64le s390x x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server 15-SP2-LTSS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server 15-SP2-BCL (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server 15-SP2-BCL (x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (aarch64 ppc64le s390x x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server 15-SP1-LTSS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server 15-SP1-BCL (x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server 15-SP1-BCL (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server 15-LTSS (aarch64 s390x):
runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Server 15-LTSS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Server 15-LTSS (s390x):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64):
containerd-ctr-1.6.6-150000.73.2
- SUSE Linux Enterprise Module for Containers 15-SP4 (aarch64 ppc64le s390x x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Module for Containers 15-SP4 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Module for Containers 15-SP3 (aarch64 ppc64le s390x x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Module for Containers 15-SP3 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
      docker-fish-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise Micro 5.2 (aarch64 s390x x86_64):
containerd-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise Micro 5.1 (aarch64 s390x x86_64):
containerd-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (aarch64 x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (aarch64 x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (aarch64 x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (aarch64 x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Linux Enterprise High Performance Computing 15-LTSS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
- SUSE Linux Enterprise High Performance Computing 15-ESPOS (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Enterprise Storage 7.1 (aarch64 x86_64):
runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Enterprise Storage 7 (aarch64 x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Enterprise Storage 7 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE Enterprise Storage 6 (aarch64 x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
- SUSE Enterprise Storage 6 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE CaaS Platform 4.0 (noarch):
docker-bash-completion-20.10.17_ce-150000.166.1
- SUSE CaaS Platform 4.0 (x86_64):
containerd-1.6.6-150000.73.2
      containerd-ctr-1.6.6-150000.73.2
      docker-20.10.17_ce-150000.166.1
      docker-debuginfo-20.10.17_ce-150000.166.1
      runc-1.1.3-150000.30.1
      runc-debuginfo-1.1.3-150000.30.1
References:
https://www.suse.com/security/cve/CVE-2022-29162.html
   https://www.suse.com/security/cve/CVE-2022-31030.html
   https://bugzilla.suse.com/1192051
   https://bugzilla.suse.com/1199460
   https://bugzilla.suse.com/1199565
   https://bugzilla.suse.com/1200088
   https://bugzilla.suse.com/1200145