openSUSE-SU-2026:22035-1

openSUSE-SU-2026:22035-1 · Security update for amazon-ecs-init

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

This update for amazon-ecs-init fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276744). - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279329). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279231). Changes for amazon-ecs-init: - Update to version 1.107.0 * Feature - Add MPS GPU Sharing capability (#5139) * Enhancement - Add MPS control daemon health gate task resource (#5107) * Enhancement - Surface MPS control-daemon impairment reason as StatusReason (#5125) * Enhancement - Attach the MPS control daemon health gate to MPS tasks (#5119) * Enhancement - Add ACCELERATED_COMPUTE health check for the MPS control daemon (#5124) * Enhancement - Fetch GPG keys from S3 instead of GitHub in ECS Anywhere install script (#5130) * Enhancement - Bump github.com/prometheus/common from 0.66.1 to 0.71.0 in /ecs-agent (#5117) * Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.32 to 1.20.4 in /agent (#5128) * Enhancement - Bump github.com/containerd/containerd from 1.7.33 to 1.7.35 in /ecs-init (#5133) * Enhancement - Bump google.golang.org/grpc from 1.82.1 to 1.83.1, this also updated go.opentelemetry.io/otel to v1.44.0 in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5123) * Enhancement - Bump k8s.io/api from 0.28.1 to 0.37.0 in /agent (#5118) * Enhancement - Correct broken systemd link in README (#5129) * Enhancement - Bump golang.org/x/text and related dependencies (#5100) * Enhancement - Bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.18.33 to 1.18.38 in /ecs-agent (#5093) * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/secretsmanager from 1.35.2 to 1.44.7 in /agent (#5094) * Enhancement - Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3 (#5108) * Enhancement - Update Go version to 1.26.7 (#5105) * Enhancement - Add amazon-ecs-agent.gpg and amazon-ssm-agent.gpg to the CodePipeline release artifacts (#5101) * Enhancement - IMDS credentials scanner/refresher: Add logging and validations (#5091) * Enhancement - Bump github.com/containerd/cgroups/v3 from 3.0.4 to 3.1.3 in /agent (#5081) * Enhancement - Bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /ecs-agent and /agent (#5085) * Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.29 to 1.19.32 in /ecs-agent, /agent and /ecs-init (#5080) * Bugfix - fix(handlers): raise fault rate limit to 1 rps (#5092) * Feature - Nvidia MPS GPU sharing (not yet enabled) * Add MPS control-daemon health probe (#5095) * Add per-GPU memory accounting to host resource manager (#5090) * Allow MPS containers to colocate on a shared GPU (#5083) * Mount MPS control binary and pipe dir into the agent container (#5086) * Move MPS pipe directory to /run/mps-ecs (#5102) * Enhancement - Add retry for EFS volume creation to handle plugin timeout errors caused by concurrent mount operation (#5077) * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from 1.32.23 to 1.32.31 in /agent (#5064) * Enhancement - Bump google.golang.org/grpc from 1.79.3 to 1.82.1 in /ecs-agent/daemonimages/csidriver (#5056) * Enhancement - Bump github.com/gorilla/mux from 1.8.0 to 1.8.1 in /ecs-agent (#5063) * Enhancement - add nos3readcache S3 Files mount option (#5062) * Add ecs.capability.gpu-sharing-mps capability for NVIDIA MPS GPU sharing (#5053) * Inject NVIDIA MPS env vars and pipe mount into MPS containers (#5082) * Map ACS GPU sharingStrategy onto the internal container model for MPS (#5076) * Gate gpu-sharing-mps on complete per-GPU memory- (#5075) (#5075) * Regenerate ACS model for GPU sharingStrategy and validate it (#5071) * Report per-GPU memory at container instance registration for GPU sharing (#5061) * Regenerate ECS SDK with gpuInfo on PlatformDevice (#5060)

Correctif disponible

Publication

2026-10-06T14:54:50Z

Mise à jour

2026-10-09T17:23:14.417092217Z

Pile logicielle: system

Vérifiez votre serveur →