{"schema_version":"1.7.5","id":"openSUSE-SU-2026:21265-1","published":"2026-07-06T16:05:20Z","modified":"2026-07-09T10:00:12.245936180Z","related":["CVE-2024-45310","CVE-2025-22868","CVE-2026-10722","CVE-2026-33186","CVE-2026-39821"],"upstream":["CVE-2024-45310","CVE-2025-22868","CVE-2026-10722","CVE-2026-33186","CVE-2026-39821"],"summary":"Security update for cadvisor","details":"This update for cadvisor fixes the following issues:\n\nChanges in cadvisor:\n\n- update to 0.60.3:\n  * Move OOM watching out of the lib module into the binary\n  * lib/model: make ContainerStats sub-stats pointers to convey\n    collection presence\n- update to 0.60.1:\n  * cpuload/netlink: report the real error and skip the reader on\n    cgroup v2\n  * deploy: add lib/go.mod to the image build's dependency cache\n- update to 0.60.0:\n  * Exposing additional cgroup v2 memory.stat metrics\n  * lib: introduce github.com/google/cadvisor/lib — a lean,\n    kubelet-focused library module\n- bump x/net to 0.55 (bsc#1266645, CVE-2026-39821)\n\n- update to 0.57.0 (bsc#1260305, CVE-2026-33186):\n  * integration: add more Docker container handler tests\n  * integration: add containerd container handler tests\n  * integration: add Prometheus metrics endpoint tests\n  * fix: support podman `volatile-containers.json` and/or\n    `containers.json`\n  * proposed roadmap for cAdvisor\n  * remove log message when you can't read productName\n  * Refactor Github Action per b/485167538\n  * fix crio deadlock in getting crio sandbox containers\n  * Add container_creation_time_seconds (previously:\n    container_start_time_seconds); use runtime start time for\n    container_start_time_seconds (podman & docker)\n  * deps: github.com/moby/moby/client v0.4.0, moby/api v1.54.1,\n    containerd/ttrpc v1.2.8\n  * fix(build): update k8s-staging-test-infra image in integ\n    tests\n  * feat(manager/container): add configurable initial splay and\n    max jitter factors\n  * feat(manager): add constraint data in OOM events\n  * fix: add v-prefixed GHCR image tags for release consistency\n  * build(deps): bump the go_modules group across 2 directories\n    with 1 update\n  * Expose cgroup v2 memory.events as Prometheus metrics\n  * deploy: bump base images to Alpine 3.23\n\n- Update to version 0.56.2:\n  * docker: fix nil pointer dereference when GraphDriver is nil\n  * Update healthcheck.sh\n  * Update entrypoint.sh\n  * docker: migrate to github.com/moby/moby modules\n  * Update containerd, docker, moby, and opencontainers dependencies\n  * update README\n  * Update copyright year in healthcheck.sh\n  * Update copyright year in entrypoint.sh\n  * Added cadvisor boilerplate header to deploy/entrypoint.sh\n  * Added cadvisor boilerplate header to deploy/healthcheck.sh\n  * Add EXPOSE 8080 to document default port\n  * Fix healthcheck to respect custom port flag\n  * Add entrypoint wrapper to preserve -logtostderr flag\n  * add std in summary\n  * fix formatting\n  * Update container/docker/factory.go\n  * Update factory.go\n  * Update factory.go\n  * Update factory.go\n  * Fix for issue #3772\n  * docs: replace references to docker registry `gcr.io` with `ghcr.io`\n  * Expose s390x CPU Topology to Prometheus\n\n- update to 0.55.1:\n  * manager: fix race condition in Stop() using sync.Once\n  * manager: fix race condition in Stop() using sync.Once\n- update to 0.55.0:\n  * Reduce lock contention in manager package\n  * container/podman: fix `zfsFilesystem` and `zfsParent` being\n    swapped.\n  * devicemapper: use atomic.Value for lock-free cache reads\n  * Reduce lock contention in cache/memory package\n  * zfs: use atomic.Value for lock-free cache reads\n  * fix: docker health check status not updating\n  * align docker and podman implementations\n  * disable CGO for fully static binaries\n  * close stale PRs and Issues\n  * refactor(container): Migrate to std lib context package\n  * add workflow_dispatch to stale github action\n  * plugin factory: remove useless RegisterPlugin log output\n  * feat(summary): add count in percentiles\n  * machine: fixes for unix.Uname use\n  * feat: add LoadTaskProcess api in containerd client\n  * feat: add exit code in container deletion events\n  * feat: add CRI-O integration tests\n  * test: reorganize integration tests and add CRI-O test\n    coverage\n  * refactor: remove duplicate tests from api package and add\n    missing CRI-O tests\n  * fix: update golang.org/x/crypto to v0.45.0 to fix security\n    vulnerabilities\n  * container/(docker|podman): rewrite obtaining IP-address\n  * Upgrade GitHub Actions to latest versions\n  * Upgrade GitHub Actions for Node 24 compatibility\n  * feat: add fs io cost metrics\n  * go.mod: github.com/docker/go-connections v0.6.0\n  * fs: introduce pluggable filesystem architecture\n  * Apply build tags liberally for supported environments (linux)\n  * Replace godirwalk with os.ReadDir from standard library\n  * feat: add cpu burst metrics\n- update to 0.54.1:\n  * chore: update cAdvisor image registry and version in\n    DaemonSet\n  * ci: update Ubuntu version to 24.04 in GitHub Actions\n    workflows\n  * chore: re-enable golangci-lint checks and fix violations\n  * container/docker: GetStats: prevent nil-pointer\n- update to 0.54.0:\n  * Let us try to use ghcr.io for container images\n  * Add a GH action to create release binaries\n  * use qemu/docker to build arch specific binaries\n  * add -buildvcs=false to GH action\n  * fix(3643) add containerd-snapshotter support\n  * Update README.md with latest Docker image version and\n    registry\n  * Rebase to alpine 3.22, install thin-provisioning-tools from\n    main repo\n  * feat: add metric for container health check status  (DOCKER-\n    Specific!)\n  * Update golang and deps\n- update to version 0.54.1:\n  * container/docker: GetStats: prevent nil-pointer\n  * chore: re-enable golangci-lint checks and fix violations\n  * fix: use Docker-embedded containerd socket in integration tests\n  * refactor: remove Mesos container support\n  * ci: add diagnostic logging for docker/containerd debugging\n  * fix: persist containerd client error to prevent nil pointer dereference\n  * ci: update Ubuntu version to 24.04 in GitHub Actions workflows\n  * chore: update cAdvisor image registry and version in DaemonSet\n  * fix: handle nil Health state in docker container handler\n  * ci: update Go version to 1.25 in GitHub Actions workflows\n  * fix: update dependencies to address security vulnerabilities\n  * add health status tests\n  * feat: Update docker container handler to include health status in stats\n  * Rebase to alpine 3.22, install thin-provisioning-tools from main repo\n  * Update README.md Docker image reference\n  * fix(3643) add containerd-snapshotter support\n  * add -buildvcs=false to GH action\n  * use qemu/docker to build arch specific binaries\n  * Add a GH action to create release binaries\n  * Let us try to use ghcr.io for container images (#3699)\n\n- update to 0.53.0 (bsc#1257429, CVE-2024-45310,\n    bsc#1267788, CVE-2026-10722):\n  * fix potential hang on containerd client.LoadContainer\n  * Bump dependencies to latest (June 2, 2025)\n  * fix: fix call Errorf with wrong err\n  * Fixed possible data race\n  * Use built-in error wrapping instead of pkg/errors\n\n- update to 0.52.1:\n  * Make resctrl optional/pluggable\n- update to 0.52.0:\n  * bump containerd related deps: api v1.8.0; errdefs v1.0.0;\n    ttrpc v1.2.6\n  * chore: Update Prometheus libraries\n  * ci: golangci-lint bump, fixes, and cleanups\n  * bump runc to v1.2.4\n  * Add Pressure Stall Information Metrics\n  * Switch to opencontainers/cgroups repository (includes update\n    from golang 1.22 to 1.24)\n  * Bump to newer opencontainers/image-spec @ v1.1.1\n- update to 0.49.2:\n  * Cp fix test\n  * Revert \"reduce_logs_for_kubelet_use_crio\"\n","affected":[{"package":{"name":"cadvisor","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cadvisor&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.60.3-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"cadvisor":"0.60.3-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21265-1.json"}}],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1239291"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257429"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260305"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266645"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267788"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-45310"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22868"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-10722"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33186"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"}]}