Pullrun

v0.7.6 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 11h Containers & Orchestration

✓ No known CVEs patched

This release patches 3 known CVEs

Affected surfaces

rce_ssrf breaking_upgrade

Summary

AI summary

Updates Critical fixes, High fixes, and Initramfs distribution across a mixed release.

Full changelog

builder.rs — canonicalize context_dir, reject ../abs paths, validate symlinks don't escape
block_sync.rs / sync_puller.rs — Digest::compute(data) before put_blob_blocking, discard on mismatch
runtime_service.go — return req.Config.Metadata.Uid as PodSandboxId
store.go — idRegexp.MatchString(id) at RegisterNode/DeleteWorkload gRPC boundary

store.rs — refcount_lock Mutex around increment_refcount/decrement_refcount
puller.rs — parse OS first, ARCH second, return (arch, os)
main.go — bind 127.0.0.1:8080/:8081 instead of :8080/:8081
firewall.rs — use bridge_cidr param instead of hardcoded 10.42.0.0/16 in disable_nat

terminal_unix.go / terminal_windows.go — accept stop channel, clean goroutine exit
builder.rs — copy host /etc/resolv.conf, remove before layer scan

builder.rs canonicalizes context_dir, rejects ../abs paths, and validates symlinks do not escape – prevents path traversal attacks
block_sync.rs / sync_puller.rs compute Digest before put_blob_blocking and discard mismatches – mitigates integrity tampering
store.go enforces idRegexp validation at RegisterNode/DeleteWorkload gRPC boundaries – blocks malformed ID injection

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Pullrun

Get notified when new releases ship.

About Pullrun