CVE-2024-25621
Fixed in a distro release EPSS <1%CVSS 7.3
containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
Products: containerd
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/containerd/containerd | 1.7.29 |
| Go | github.com/containerd/containerd/v2 | 2.0.7 |
| Go | github.com/containerd/containerd/v2 | 2.1.5 |
| Go | github.com/containerd/containerd/v2 | 2.2.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | amazon-ecs-agent-fips | 1.100.1-r2 |
| Chainguard | apm-server-7.17 | 7.17.29-r5 |
| Chainguard | apm-server-7.17-compat | 7.17.29-r5 |
| Chainguard | apm-server-fips-7.17 | 7.17.29-r5 |
| Chainguard | apm-server-fips-7.17-compat | 7.17.29-r5 |
| Chainguard | auditbeat-7 | 7.17.29-r5 |
| Chainguard | auditbeat-7-oci-entrypoint | 7.17.29-r5 |
| Chainguard | auditbeat-fips-7 | 7.17.29-r6 |
| Chainguard | beats-7 | 7.17.29-r5 |
| Chainguard | beats-fips-7 | 7.17.29-r6 |
| Chainguard | buildctl | 0.25.2-r2 |
| Chainguard | buildkitd | 0.25.2-r2 |
| Chainguard | cert-manager-1.12 | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-acmesolver | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-cainjector | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-controller | 1.12.17-r10 |
| Chainguard | cert-manager-1.12-webhook | 1.12.17-r10 |
| Chainguard | cert-manager-acmesolver-1.12 | 1.12.17-r10 |
| Chainguard | cert-manager-acmesolver-1.12-bitnami-compat | 1.12.17-r10 |
| Chainguard | cert-manager-acmesolver-1.12-iamguarded-compat | 1.12.17-r10 |
| Chainguard | cert-manager-cainjector-1.12 | 1.12.17-r10 |
| Chainguard | cert-manager-cainjector-1.12-bitnami-compat | 1.12.17-r10 |
| Chainguard | cert-manager-cainjector-1.12-iamguarded-compat | 1.12.17-r10 |
| Chainguard | cert-manager-cmctl | 2.3.0-r6 |
| Chainguard | cert-manager-cmctl-fips | 2.3.0-r6 |
| Chainguard | cert-manager-controller-1.12 | 1.12.17-r10 |
| Chainguard | cert-manager-controller-1.12-bitnami-compat | 1.12.17-r10 |
| Chainguard | cert-manager-controller-1.12-iamguarded-compat | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12 | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-acmesolver | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-cainjector | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-cmctl | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-controller | 1.12.17-r10 |
| Chainguard | cert-manager-fips-1.12-webhook | 1.12.17-r10 |
| Chainguard | cert-manager-webhook-1.12 | 1.12.17-r10 |
| Chainguard | cert-manager-webhook-1.12-bitnami-compat | 1.12.17-r10 |
| Chainguard | cert-manager-webhook-1.12-iamguarded-compat | 1.12.17-r10 |
| Chainguard | cg | 0.2.174-r0 |
| Chainguard | chainctl | 0.2.175-r0 |
| Chainguard | chartmuseum | 0.16.3-r9 |
| Chainguard | chartmuseum-fips | 0.16.3-r7 |
| Chainguard | cilium-cli | 0.18.8-r1 |
| Chainguard | cloudbeat | 9.2.1-r0 |
| Chainguard | cloudbeat-8.17 | 8.17.10-r3 |
| Chainguard | cloudbeat-8.18 | 8.18.8-r3 |
| Chainguard | cloudbeat-8.19 | 8.19.6-r2 |
| Chainguard | cloudbeat-9.0 | 9.0.8-r3 |
| Chainguard | cloudbeat-9.1 | 9.1.6-r2 |
| Chainguard | cloudbeat-fips-8.17 | 8.17.10-r4 |
| Chainguard | cloudbeat-fips-8.18 | 8.18.8-r3 |
| Chainguard | cloudbeat-fips-8.19 | 8.19.6-r2 |
| Chainguard | cloudbeat-fips-9.0 | 9.0.8-r3 |
| Chainguard | cloudbeat-fips-9.1 | 9.1.6-r2 |
| Chainguard | cloudbeat-fips-9.2 | 9.2.0-r2 |
| Chainguard | cluster-api-helm-controller | 0.4.1-r2 |
| Chainguard | cluster-api-helm-controller-compat | 0.4.1-r2 |
| Chainguard | cluster-api-helm-controller-fips | 0.4.1-r2 |
| Chainguard | cluster-api-helm-controller-fips-compat | 0.4.1-r2 |
| Chainguard | cmctl-1.12 | 1.12.17-r10 |
| Chainguard | cmctl-1.12-fips | 1.12.17-r10 |
| Chainguard | cmctl-fips-1.12 | 1.12.17-r10 |
| Chainguard | consul-k8s-1.1 | 1.1.18-r20 |
| Chainguard | consul-k8s-1.1-cli | 1.1.18-r20 |
| Chainguard | consul-k8s-1.3 | 1.3.9-r21 |
| Chainguard | consul-k8s-1.3-cli | 1.3.9-r21 |
| Chainguard | consul-k8s-1.4-cli | 1.4.10-r8 |
| Chainguard | consul-k8s-1.5 | 1.5.9-r7 |
| Chainguard | consul-k8s-1.5-cli | 1.5.9-r7 |
| Chainguard | consul-k8s-1.6-cli | 1.6.10-r2 |
| Chainguard | consul-k8s-1.7-cli | 1.7.7-r1 |
| Chainguard | consul-k8s-fips-1.1 | 1.1.18-r18 |
| Chainguard | consul-k8s-fips-1.1-cli | 1.1.18-r18 |
| Chainguard | consul-k8s-fips-1.3 | 1.3.9-r19 |
| Chainguard | consul-k8s-fips-1.3-cli | 1.3.9-r19 |
| Chainguard | consul-k8s-fips-1.4 | 1.4.10-r7 |
| Chainguard | consul-k8s-fips-1.4-cli | 1.4.10-r7 |
| Chainguard | consul-k8s-fips-1.5 | 1.5.9-r7 |
| Chainguard | consul-k8s-fips-1.5-cli | 1.5.9-r7 |
| Chainguard | consul-k8s-fips-1.6-cli | 1.6.10-r2 |
| Chainguard | consul-k8s-fips-1.7 | 1.7.7-r1 |
| Chainguard | consul-k8s-fips-1.7-cli | 1.7.7-r1 |
| Chainguard | containerd-1 | 1.7.29-r0 |
| Chainguard | containerd-shim-runc-v2-1 | 1.7.29-r1 |
| Chainguard | containerd-shim-runc-v2-1 | 1.7.29-r0 |
| Chainguard | containerd-stress-1 | 1.7.29-r1 |
| Chainguard | ctop | 0.7.7-r34 |
| Chainguard | ctr-1 | 1.7.29-r0 |
| Chainguard | dagger | 0.19.6-r0 |
| Chainguard | datadog-agent | 7.72.1-r0 |
| Chainguard | datadog-agent-7.71 | 7.71.2-r6 |
| Chainguard | datadog-agent-7.71 | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-core-integrations | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-fakeintake | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-jmx | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-oci-compat | 7.71.2-r5 |
| Chainguard | datadog-agent-7.71-s6-overlay | 7.71.2-r5 |
| Chainguard | datadog-agent-fips | 7.72.1-r0 |
| Chainguard | datadog-agent-fips-7.71 | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-fakeintake | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-jmx | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-oci-compat | 7.71.2-r4 |
| Chainguard | datadog-agent-fips-7.71-s6-overlay | 7.71.2-r4 |
| Chainguard | datadog-cluster-agent-7.71 | 7.71.2-r5 |
| Chainguard | datadog-cluster-agent-7.71-oci-compat | 7.71.2-r5 |
| Chainguard | datadog-cluster-agent-fips-7.71 | 7.71.2-r4 |
| Chainguard | datadog-cluster-agent-fips-7.71-oci-compat | 7.71.2-r4 |
| Chainguard | docker-cli-buildx | 0.29.1-r2 |
| Chainguard | docker-cli-buildx-fips | 0.29.1-r2 |
| Chainguard | docker-compose | 2.40.3-r1 |
| Chainguard | docker-credential-cgr | 0.2.175-r0 |
| Chainguard | dockerd | 28.5.2-r3 |
| Chainguard | dogstatsd | 7.72.1-r0 |
| Chainguard | dogstatsd-7.71 | 7.71.2-r5 |
| Chainguard | eksctl | 0.216.0-r1 |
| Chainguard | envoy-gateway-egctl | 1.5.4-r1 |
| Chainguard | falco-no-driver | 0.43.0-r0 |
| Chainguard | filebeat-7 | 7.17.29-r5 |
| Chainguard | filebeat-7-oci-entrypoint | 7.17.29-r5 |
| Chainguard | filebeat-fips-7 | 7.17.29-r6 |
| Chainguard | flux-helm-controller | 1.4.3-r1 |
| Chainguard | flux-helm-controller-bitnami-compat | 1.4.3-r1 |
| Chainguard | flux-helm-controller-iamguarded-compat | 1.4.3-r1 |
| Chainguard | flux-source-controller | 1.7.3-r1 |
| Chainguard | flux-source-controller-bitnami-compat | 1.7.3-r1 |
| Chainguard | flux-source-controller-fips | 1.7.3-r2 |
| Chainguard | flux-source-controller-fips-iamguarded-compat | 1.7.3-r2 |
| Chainguard | flux-source-controller-iamguarded-compat | 1.7.3-r1 |
| Chainguard | fluxcd-source-controller-bitnami-compat | 1.7.3-r1 |
| Chainguard | fuse-overlayfs-snapshotter | 2.1.7-r0 |
| Chainguard | gatekeeper-3.18-gator | 3.18.3-r11 |
| Chainguard | gatekeeper-3.19-compat | 3.19.3-r8 |
| Chainguard | gatekeeper-3.19-gator | 3.19.3-r8 |
| Chainguard | gatekeeper-3.20 | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-compat | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-crds | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-crds-compat | 3.20.1-r3 |
| Chainguard | gatekeeper-3.20-gator | 3.20.1-r3 |
| Chainguard | gem-check | 0.0.32-r1 |
| Chainguard | gitlab-operator | 2.5.1-r1 |
| Chainguard | gitlab-operator-fips | 2.5.1-r1 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r3 |
| Chainguard | gitlab-rails-ce-18.2 | 18.2.8-r1 |
| Chainguard | gitlab-rails-ce-18.2 | 18.2.8-r3 |
| Chainguard | gitlab-rails-ce-18.3 | 18.3.5-r1 |
| Chainguard | gitlab-rails-ce-18.4 | 18.4.3-r1 |
| Chainguard | gitlab-rails-ce-18.5 | 18.5.1-r1 |
| Chainguard | gitlab-rails-ce-assets-18.1 | 18.1.6-r3 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 18.3.5-r1 |
| Chainguard | gitlab-rails-ce-assets-18.4 | 18.4.3-r1 |
| Chainguard | gitlab-rails-ce-assets-18.5 | 18.5.1-r1 |
| Chainguard | gitlab-rails-ce-assets-fips-18.2 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | 18.3.5-r3 |
| Chainguard | gitlab-rails-ce-assets-fips-18.5 | 18.5.1-r3 |
| Chainguard | gitlab-rails-ce-doc-18.1 | 18.1.6-r3 |
| Chainguard | gitlab-rails-ce-doc-18.3 | 18.3.5-r1 |
| Chainguard | gitlab-rails-ce-doc-18.4 | 18.4.3-r1 |
| Chainguard | gitlab-rails-ce-doc-18.5 | 18.5.1-r1 |
| Chainguard | gitlab-rails-ce-doc-fips-18.2 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-doc-fips-18.5 | 18.5.1-r3 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r2 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r7 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 18.2.8-r4 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 18.3.5-r3 |
| Chainguard | gitlab-rails-ce-fips-18.4 | 18.4.3-r3 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 18.5.1-r3 |
| Chainguard | gogatekeeper | 4.3.0-r1 |
| Chainguard | gogatekeeper-compat | 4.3.0-r1 |
| Chainguard | google-osconfig-agent | 20251028.00-r2 |
| Chainguard | gosh | 0.0.32-r1 |
| Chainguard | grype | 0.103.0-r1 |
| Chainguard | header-check | 0.0.32-r1 |
| Chainguard | headlamp | 0.37.0-r1 |
| Chainguard | headlamp-fips | 0.37.0-r2 |
| Chainguard | headlamp-fips-compat | 0.37.0-r2 |
| Chainguard | heartbeat-7 | 7.17.29-r5 |
| Chainguard | heartbeat-7-oci-entrypoint | 7.17.29-r5 |
| Chainguard | heartbeat-fips-7 | 7.17.29-r6 |
| Chainguard | heartbeat-fips-7-oci-entrypoint | 7.17.29-r6 |
| Chainguard | helm | 3.19.0-r2 |
| Chainguard | helm-3 | 3.19.2-r1 |
| Chainguard | helm-4 | 4.0.1-r1 |
| Chainguard | helm-diff | 3.13.1-r2 |
| Chainguard | helm-diff-fips | 3.13.1-r2 |
| Chainguard | helm-fips | 3.19.0-r3 |
| Chainguard | helm-mapkubeapis | 0.6.1-r5 |
| Chainguard | helm-operator | 1.41.1-r6 |
| Chainguard | helm-operator-compat | 1.41.1-r6 |
| Chainguard | helm-operator-fips | 1.41.1-r6 |
| Chainguard | helm-operator-fips-compat | 1.41.1-r6 |
| Chainguard | helm-push | 0.10.4-r36 |
| Chainguard | helm-set-status | 0.3.0-r6 |
| Chainguard | help-check | 0.0.32-r1 |
| Chainguard | k3s | 1.34.1.1-r3 |
| Chainguard | k3s-1.31 | no fix |
| Chainguard | k3s-1.32 | 0 |
| Chainguard | k3s-1.33 | 0 |
| Chainguard | k3s-embedded | 1.34.1.1-r3 |
| Chainguard | k3s-images | 1.34.1.1-r3 |
| Chainguard | k3s-multicall | 1.34.1.1-r3 |
| Chainguard | k3s-multicall-1.32 | 0 |
| Chainguard | k3s-multicall-1.33 | 0 |
| Chainguard | k3s-static | 1.34.1.1-r3 |
| Chainguard | k3s-static-1.31 | no fix |
| Chainguard | k3s-static-1.32 | 0 |
| Chainguard | k3s-static-1.33 | 0 |
| Chainguard | k8sgpt | 0.4.26-r1 |
| Chainguard | k8ssandra-client | 0.8.3-r2 |
| Chainguard | k8ssandra-client-compat | 0.8.3-r2 |
| Chainguard | k8ssandra-client-fips | 0.8.3-r3 |
| Chainguard | k9s | 0.50.16-r2 |
| Chainguard | k9s-fips | 0.50.16-r3 |
| Chainguard | kaniko | 1.25.4-r0 |
| Chainguard | kaniko | 1.25.3-r3 |
| Chainguard | kaniko-compat | 1.25.3-r3 |
| Chainguard | kaniko-fips | 1.24.0-r8 |
| Chainguard | kaniko-warmer | 1.25.3-r3 |
| Chainguard | kaniko-warmer | 1.25.4-r0 |
| Chainguard | kaniko-warmer-fips | 1.24.0-r8 |
| Chainguard | kargo | 1.8.3-r1 |
| Chainguard | kargo-oci-compat | 1.8.3-r1 |
| Chainguard | kots | 1.128.3-r1 |
| Chainguard | kots-compat | 1.128.3-r1 |
| Chainguard | kots-symlink-compat | 1.128.3-r1 |
| Chainguard | kube-arangodb-1.2 | 1.2.50-r2 |
| Chainguard | kube-arangodb-1.3 | 1.3.1-r2 |
| Chainguard | kube-arangodb-1.3-compat | 1.3.1-r2 |
| Chainguard | kube-arangodb-fips-1.2 | 1.2.50-r2 |
| Chainguard | kube-arangodb-fips-1.3 | 1.3.1-r2 |
| Chainguard | kubescape | 3.0.44-r0 |
| Chainguard | kubescape-operator | 0.2.112-r0 |
| Chainguard | kubevela | 1.10.4-r3 |
| Chainguard | kubevela-fips-vela-cli | 1.10.4-r3 |
| Chainguard | kubevela-fips-vela-core | 1.10.4-r3 |
| Chainguard | kubevela-vela-cli | 1.10.4-r3 |
| Chainguard | kubevela-vela-core | 1.10.4-r3 |
| Chainguard | kubevela-vela-core-compat | 1.10.4-r3 |
| Chainguard | kubevela-vela-core-fips | 1.10.4-r3 |
| Chainguard | ldd-check | 0.0.32-r1 |
| Chainguard | livekit-cli | 2.12.8-r1 |
| Chainguard | manifest-tool | 2.2.1-r2 |
| Chainguard | melange | 0.32.0-r2 |
| Chainguard | metricbeat-7 | 7.17.29-r5 |
| Chainguard | metricbeat-7-oci-entrypoint | 7.17.29-r5 |
| Chainguard | metricbeat-fips-7 | 7.17.29-r6 |
| Chainguard | nerdctl | 2.2.0-r0 |
| Chainguard | nerdctl-fips | 2.2.0-r0 |
| Chainguard | neuvector-controller | 5.4.7-r1 |
| Chainguard | neuvector-enforcer | 5.4.7-r1 |
| Chainguard | neuvector-scanner | 3.974-r1 |
| Chainguard | neuvector-scanner-fips | 3.974-r1 |
| Chainguard | neuvector-scanner-monitor | 3.974-r1 |
| Chainguard | neuvector-scanner-monitor-fips | 3.974-r1 |
| Chainguard | neuvector-scanner-task | 3.974-r1 |
| Chainguard | neuvector-scanner-task-fips | 3.974-r1 |
| Chainguard | neuvector-upgrader | 5.4.7-r1 |
| Chainguard | newrelic-infrastructure-agent | 1.71.0-r1 |
| Chainguard | newrelic-infrastructure-agent-fips | 1.71.0-r2 |
| Chainguard | no-docs-check | 0.0.32-r1 |
| Chainguard | opa | 1.10.1-r1 |
| Chainguard | opa-envoy | 1.10.0-r1 |
| Chainguard | opa-fips | 1.10.1-r1 |
| Chainguard | opa-fips-envoy | 1.10.0-r1 |
| Chainguard | osv-scanner | 2.2.4-r2 |
| Chainguard | osv-scanner | 2.2.4-r1 |
| Chainguard | package-type-check | 0.0.32-r1 |
| Chainguard | rancher-2.10 | no fix |
| Chainguard | rancher-2.11 | no fix |
| Chainguard | rancher-2.12 | 2.12.3-r1 |
| Chainguard | rancher-agent-2.10 | no fix |
| Chainguard | rancher-agent-2.11 | no fix |
| Chainguard | rancher-agent-2.12 | 2.12.3-r1 |
| Chainguard | rancher-agent-2.9 | no fix |
| Chainguard | rancher-fleet | 0.13.4-r1 |
| Chainguard | rancher-fleet-agent | 0.13.4-r1 |
| Chainguard | rancher-fleet-agent-fips | 0.13.4-r2 |
| Chainguard | rancher-fleet-cli | 0.13.4-r1 |
| Chainguard | rancher-fleet-cli-fips | 0.13.4-r2 |
| Chainguard | rancher-fleet-controller | 0.13.4-r1 |
| Chainguard | rancher-fleet-controller-fips | 0.13.4-r2 |
| Chainguard | rancher-fleet-fips | 0.13.4-r2 |
| Chainguard | rancher-fleet-fips-agent | 0.13.4-r2 |
| Chainguard | rancher-fleet-termination-log | 0.13.4-r1 |
| Chainguard | rancher-helm-3 | 3.19.0-r2 |
| Chainguard | skaffold | 2.16.1-r4 |
| Chainguard | skaffold-fips | 2.16.1-r4 |
| Chainguard | spegel | 0.5.1-r1 |
| Chainguard | steampipe | 2.3.2-r1 |
| Chainguard | syft | 1.37.0-r1 |
| Chainguard | symlink-check | 0.0.32-r1 |
| Chainguard | syspeek | 0.0.32-r1 |
| Chainguard | tekton-pipelines-entrypoint-0.62 | 0.62.9-r9 |
| Chainguard | tekton-pipelines-entrypoint-fips-0.68 | 0.68.1-r7 |
| Chainguard | teleport-18 | 18.3.1-r1 |
| Chainguard | trivy | 0.67.2-r3 |
| Chainguard | trivy-fips | 0.67.2-r3 |
| Chainguard | trivy-operator | 0.29.0-r3 |
| Chainguard | trivy-operator-fips | 0.29.0-r3 |
| Chainguard | tw | 0.0.32-r1 |
| Chainguard | tw-pip-check | 0.0.32-r1 |
| Chainguard | twt | 0.0.32-r1 |
| Chainguard | usrmerge-tool | 0.0.32-r1 |
| Chainguard | vela-cli | 1.10.4-r3 |
| Chainguard | vela-core | 1.10.4-r3 |
| Chainguard | ver-check | 0.0.32-r1 |
| Chainguard | verify-service | 0.0.32-r1 |
| Chainguard | wolfictl | 0.38.21-r2 |
| Chainguard | xeol | 0.10.8-r17 |
| Chainguard | xeol-compat | 0.10.8-r17 |
| Chainguard | xeol-fips | 0.10.8-r16 |
| Chainguard | zarf | 0.65.1-r1 |
| Chainguard | zot | 2.1.10-r1 |
| Debian 11 | containerd | 1.4.13~ds1-1~deb11u6 |
| Debian 12 | containerd | 1.6.20~ds1-1+deb12u2 |
| Debian 13 | containerd | 1.7.24~ds1-6+deb13u1 |
| Debian 14 | containerd | 1.7.24~ds1-9 |
| SUSE Enterprise Storage 7.1 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Micro 5.2 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Micro 5.3 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Micro 5.4 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Micro 5.5 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Module for Containers 15 SP6 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Module for Containers 15 SP7 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | containerd | 1.7.29-16.105.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | containerd | 1.7.29-16.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | containerd | 1.7.29-150000.128.1 |
| SUSE Linux Micro 6.0 | containerd | 1.7.29-1.1 |
| SUSE Linux Micro 6.1 | containerd | 1.7.29-slfo.1.1_1.1 |
| Ubuntu 22.04 LTS | containerd | 1.6.12-0ubuntu1~22.04.10 |
| Ubuntu 24.04 LTS | containerd-app | 1.7.28-0ubuntu1~24.04.2 |
| Ubuntu 25.10 | containerd | 1.7.24~ds1-8ubuntu1.1 |
| Ubuntu 25.10 | containerd-app | 2.1.3-0ubuntu3.1 |
| Ubuntu Pro 16.04 LTS | containerd | 1.2.6-0ubuntu1~16.04.6+esm6 |
| Ubuntu Pro 18.04 LTS | containerd | 1.6.12-0ubuntu1~18.04.1+esm3 |
| Ubuntu Pro 20.04 LTS | containerd | 1.6.12-0ubuntu1~20.04.8+esm1 |
| Ubuntu Pro 20.04 LTS | containerd-app | 1.7.24-0ubuntu1~20.04.2+esm1 |
| Ubuntu Pro 22.04 LTS | containerd-app | 1.7.28-0ubuntu1~22.04.1+esm1 |
| Ubuntu Pro 24.04 LTS | containerd | 1.6.24~ds1-1ubuntu1.3+esm2 |
| Wolfi | buildctl | 0.25.2-r2 |
| Wolfi | buildkitd | 0.25.2-r2 |
| Wolfi | cert-manager-1.12 | 1.12.17-r10 |
| Wolfi | cert-manager-1.12-acmesolver | 1.12.17-r10 |
| Wolfi | cert-manager-1.12-cainjector | 1.12.17-r10 |
| Wolfi | cert-manager-1.12-controller | 1.12.17-r10 |
| Wolfi | cert-manager-1.12-webhook | 1.12.17-r10 |
| Wolfi | cert-manager-cmctl | 2.3.0-r6 |
| Wolfi | chartmuseum | 0.16.3-r9 |
| Wolfi | cilium-cli | 0.18.8-r1 |
| Wolfi | cluster-api-helm-controller | 0.4.1-r2 |
| Wolfi | cluster-api-helm-controller-compat | 0.4.1-r2 |
| Wolfi | cmctl-1.12 | 1.12.17-r10 |
| Wolfi | consul-k8s-1.5 | 1.5.9-r7 |
| Wolfi | consul-k8s-1.5-cli | 1.5.9-r7 |
| Wolfi | consul-k8s-1.6-cli | 1.6.10-r2 |
| Wolfi | consul-k8s-1.7-cli | 1.7.7-r1 |
| Wolfi | containerd-1 | 1.7.29-r0 |
| Wolfi | containerd-shim-runc-v2-1 | 1.7.29-r0 |
| Wolfi | containerd-shim-runc-v2-1 | 1.7.29-r1 |
| Wolfi | containerd-stress-1 | 1.7.29-r1 |
| Wolfi | ctop | 0.7.7-r34 |
| Wolfi | ctr-1 | 1.7.29-r0 |
| Wolfi | dagger | 0.19.6-r0 |
| Wolfi | datadog-agent | 7.72.1-r0 |
| Wolfi | docker-cli-buildx | 0.29.1-r2 |
| Wolfi | docker-compose | 2.40.3-r1 |
| Wolfi | dockerd | 28.5.2-r3 |
| Wolfi | dogstatsd | 7.72.1-r0 |
| Wolfi | eksctl | 0.216.0-r1 |
| Wolfi | envoy-gateway-egctl | 1.5.4-r1 |
| Wolfi | falco-no-driver | 0.43.0-r0 |
| Wolfi | flux-helm-controller | 1.4.3-r1 |
| Wolfi | flux-helm-controller-bitnami-compat | 1.4.3-r1 |
| Wolfi | flux-helm-controller-iamguarded-compat | 1.4.3-r1 |
| Wolfi | flux-source-controller | 1.7.3-r1 |
| Wolfi | flux-source-controller-bitnami-compat | 1.7.3-r1 |
| Wolfi | flux-source-controller-iamguarded-compat | 1.7.3-r1 |
| Wolfi | fluxcd-source-controller-bitnami-compat | 1.7.3-r1 |
| Wolfi | fuse-overlayfs-snapshotter | 2.1.7-r0 |
| Wolfi | gatekeeper-3.18-gator | 3.18.3-r11 |
| Wolfi | gatekeeper-3.19-compat | 3.19.3-r8 |
| Wolfi | gatekeeper-3.19-gator | 3.19.3-r8 |
| Wolfi | gatekeeper-3.20 | 3.20.1-r3 |
| Wolfi | gatekeeper-3.20-compat | 3.20.1-r3 |
| Wolfi | gatekeeper-3.20-crds | 3.20.1-r3 |
| Wolfi | gatekeeper-3.20-crds-compat | 3.20.1-r3 |
| Wolfi | gatekeeper-3.20-gator | 3.20.1-r3 |
| Wolfi | gem-check | 0.0.32-r1 |
| Wolfi | gogatekeeper | 4.3.0-r1 |
| Wolfi | gogatekeeper-compat | 4.3.0-r1 |
| Wolfi | gosh | 0.0.32-r1 |
| Wolfi | grype | 0.103.0-r1 |
| Wolfi | header-check | 0.0.32-r1 |
| Wolfi | headlamp | 0.37.0-r1 |
| Wolfi | helm | 3.19.0-r2 |
| Wolfi | helm-3 | 3.19.2-r1 |
| Wolfi | helm-4 | 4.0.1-r1 |
| Wolfi | helm-mapkubeapis | 0.6.1-r5 |
| Wolfi | helm-operator | 1.41.1-r6 |
| Wolfi | helm-operator-compat | 1.41.1-r6 |
| Wolfi | helm-push | 0.10.4-r36 |
| Wolfi | helm-set-status | 0.3.0-r6 |
| Wolfi | help-check | 0.0.32-r1 |
| Wolfi | k3s | 1.34.1.1-r3 |
| Wolfi | k3s-1.32 | 0 |
| Wolfi | k3s-1.33 | 0 |
| Wolfi | k3s-embedded | 1.34.1.1-r3 |
| Wolfi | k3s-images | 1.34.1.1-r3 |
| Wolfi | k3s-multicall | 1.34.1.1-r3 |
| Wolfi | k3s-multicall-1.32 | 0 |
| Wolfi | k3s-multicall-1.33 | 0 |
| Wolfi | k3s-static | 1.34.1.1-r3 |
| Wolfi | k3s-static-1.32 | 0 |
| Wolfi | k3s-static-1.33 | 0 |
| Wolfi | k8sgpt | 0.4.26-r1 |
| Wolfi | k8ssandra-client | 0.8.3-r2 |
| Wolfi | k8ssandra-client-compat | 0.8.3-r2 |
| Wolfi | k9s | 0.50.16-r2 |
| Wolfi | kaniko | 1.25.3-r3 |
| Wolfi | kaniko | 1.25.4-r0 |
| Wolfi | kaniko-compat | 1.25.3-r3 |
| Wolfi | kaniko-warmer | 1.25.3-r3 |
| Wolfi | kaniko-warmer | 1.25.4-r0 |
| Wolfi | kargo | 1.8.3-r1 |
| Wolfi | kargo-oci-compat | 1.8.3-r1 |
| Wolfi | kots | 1.128.3-r1 |
| Wolfi | kots-compat | 1.128.3-r1 |
| Wolfi | kots-symlink-compat | 1.128.3-r1 |
| Wolfi | kube-arangodb-1.3 | 1.3.1-r2 |
| Wolfi | kube-arangodb-1.3-compat | 1.3.1-r2 |
| Wolfi | kubescape | 3.0.44-r0 |
| Wolfi | kubescape-operator | 0.2.112-r0 |
| Wolfi | kubevela | 1.10.4-r3 |
| Wolfi | kubevela-vela-cli | 1.10.4-r3 |
| Wolfi | kubevela-vela-core | 1.10.4-r3 |
| Wolfi | kubevela-vela-core-compat | 1.10.4-r3 |
| Wolfi | ldd-check | 0.0.32-r1 |
| Wolfi | manifest-tool | 2.2.1-r2 |
| Wolfi | melange | 0.32.0-r2 |
| Wolfi | nerdctl | 2.2.0-r0 |
| Wolfi | neuvector-controller | 5.4.7-r1 |
| Wolfi | neuvector-enforcer | 5.4.7-r1 |
| Wolfi | neuvector-scanner | 3.974-r1 |
| Wolfi | neuvector-scanner-monitor | 3.974-r1 |
| Wolfi | neuvector-scanner-task | 3.974-r1 |
| Wolfi | newrelic-infrastructure-agent | 1.71.0-r1 |
| Wolfi | no-docs-check | 0.0.32-r1 |
| Wolfi | opa | 1.10.1-r1 |
| Wolfi | opa-envoy | 1.10.0-r1 |
| Wolfi | osv-scanner | 2.2.4-r1 |
| Wolfi | osv-scanner | 2.2.4-r2 |
| Wolfi | package-type-check | 0.0.32-r1 |
| Wolfi | rancher-2.12 | 2.12.3-r1 |
| Wolfi | rancher-agent-2.12 | 2.12.3-r1 |
| Wolfi | rancher-fleet | 0.13.4-r1 |
| Wolfi | rancher-fleet-agent | 0.13.4-r1 |
| Wolfi | rancher-fleet-cli | 0.13.4-r1 |
| Wolfi | rancher-fleet-controller | 0.13.4-r1 |
| Wolfi | rancher-fleet-termination-log | 0.13.4-r1 |
| Wolfi | rancher-helm-3 | 3.19.0-r2 |
| Wolfi | skaffold | 2.16.1-r4 |
| Wolfi | spegel | 0.5.1-r1 |
| Wolfi | steampipe | 2.3.2-r1 |
| Wolfi | syft | 1.37.0-r1 |
| Wolfi | symlink-check | 0.0.32-r1 |
| Wolfi | syspeek | 0.0.32-r1 |
| Wolfi | teleport-18 | 18.3.1-r1 |
| Wolfi | trivy | 0.67.2-r3 |
| Wolfi | trivy-operator | 0.29.0-r3 |
| Wolfi | tw | 0.0.32-r1 |
| Wolfi | tw-pip-check | 0.0.32-r1 |
| Wolfi | twt | 0.0.32-r1 |
| Wolfi | usrmerge-tool | 0.0.32-r1 |
| Wolfi | vela-cli | 1.10.4-r3 |
| Wolfi | vela-core | 1.10.4-r3 |
| Wolfi | ver-check | 0.0.32-r1 |
| Wolfi | verify-service | 0.0.32-r1 |
| Wolfi | wolfictl | 0.38.21-r2 |
| Wolfi | xeol | 0.10.8-r17 |
| Wolfi | xeol-compat | 0.10.8-r17 |
| Wolfi | zarf | 0.65.1-r1 |
| Wolfi | zot | 2.1.10-r1 |
| openSUSE Leap 15.6 | containerd | 1.7.29-150000.128.1 |
| openSUSE Leap 16.0 | containerd | 1.7.33-160000.1.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | containerd | 1.7.29-1.1 |