{"id":"openSUSE-SU-2026:22035-1","summary":"Security update for amazon-ecs-init","details":"This update for amazon-ecs-init fixes the following issues:\n\n- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS\n  via oversized inputs (bsc#1276744).\n- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization\n  policies via mixed-case or canonical-case header matches (bsc#1279329).\n- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279231).\n\nChanges for amazon-ecs-init:\n\n- Update to version 1.107.0\n * Feature - Add MPS GPU Sharing capability (#5139)\n * Enhancement - Add MPS control daemon health gate task resource\n (#5107)\n * Enhancement - Surface MPS control-daemon impairment reason\n as StatusReason (#5125)\n * Enhancement - Attach the MPS control daemon health gate to\n MPS tasks (#5119)\n * Enhancement - Add ACCELERATED_COMPUTE health check for the\n MPS control daemon (#5124)\n * Enhancement - Fetch GPG keys from S3 instead of GitHub in\n ECS Anywhere install script (#5130)\n * Enhancement - Bump github.com/prometheus/common from 0.66.1\n to 0.71.0 in /ecs-agent (#5117)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials\n from 1.19.32 to 1.20.4 in /agent (#5128)\n * Enhancement - Bump github.com/containerd/containerd from 1.7.33\n to 1.7.35 in /ecs-init (#5133)\n * Enhancement - Bump google.golang.org/grpc from 1.82.1 to 1.83.1,\n this also updated go.opentelemetry.io/otel to v1.44.0\n in /ecs-agent, /ecs-agent/daemonimages/csidriver and /agent (#5123)\n * Enhancement - Bump k8s.io/api from 0.28.1 to 0.37.0 in /agent (#5118)\n * Enhancement - Correct broken systemd link in README (#5129)\n * Enhancement - Bump golang.org/x/text and related dependencies (#5100)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/feature/ec2/imds\n from 1.18.33 to 1.18.38 in /ecs-agent (#5093)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/service/secretsmanager\n from 1.35.2 to 1.44.7 in /agent (#5094)\n * Enhancement - Bump github.com/gorilla/websocket from 1.5.0 to 1.5.3\n (#5108)\n * Enhancement - Update Go version to 1.26.7 (#5105)\n * Enhancement - Add amazon-ecs-agent.gpg and amazon-ssm-agent.gpg\n to the CodePipeline release artifacts (#5101)\n * Enhancement - IMDS credentials scanner/refresher: Add logging\n and validations (#5091)\n * Enhancement - Bump github.com/containerd/cgroups/v3 from 3.0.4\n to 3.1.3 in /agent (#5081)\n * Enhancement - Bump google.golang.org/grpc from 1.81.1 to 1.82.1\n in /ecs-agent and /agent (#5085)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/credentials from\n 1.19.29 to 1.19.32 in /ecs-agent, /agent and /ecs-init (#5080)\n * Bugfix - fix(handlers): raise fault rate limit to 1 rps (#5092)\n * Feature - Nvidia MPS GPU sharing (not yet enabled)\n * Add MPS control-daemon health probe (#5095)\n * Add per-GPU memory accounting to host resource manager (#5090)\n * Allow MPS containers to colocate on a shared GPU (#5083)\n * Mount MPS control binary and pipe dir into the agent container\n (#5086)\n * Move MPS pipe directory to /run/mps-ecs (#5102)\n * Enhancement - Add retry for EFS volume creation to handle plugin\n timeout errors caused by concurrent mount operation (#5077)\n * Enhancement - Bump github.com/aws/aws-sdk-go-v2/config from\n 1.32.23 to 1.32.31 in /agent (#5064)\n * Enhancement - Bump google.golang.org/grpc from 1.79.3 to 1.82.1\n in /ecs-agent/daemonimages/csidriver (#5056)\n * Enhancement - Bump github.com/gorilla/mux from 1.8.0 to 1.8.1\n in /ecs-agent (#5063)\n * Enhancement - add nos3readcache S3 Files mount option (#5062)\n * Add ecs.capability.gpu-sharing-mps capability for NVIDIA MPS\n GPU sharing (#5053)\n * Inject NVIDIA MPS env vars and pipe mount into MPS containers\n (#5082)\n * Map ACS GPU sharingStrategy onto the internal container model\n for MPS (#5076)\n * Gate gpu-sharing-mps on complete per-GPU memory- (#5075) (#5075)\n * Regenerate ACS model for GPU sharingStrategy and validate it (#5071)\n * Report per-GPU memory at container instance registration\n for GPU sharing (#5061)\n * Regenerate ECS SDK with gpuInfo on PlatformDevice (#5060)\n","modified":"2026-10-09T17:23:14.417092217Z","published":"2026-10-06T14:54:50Z","related":["CVE-2026-41178","CVE-2026-84303","CVE-2026-84304"],"upstream":["CVE-2026-41178","CVE-2026-84303","CVE-2026-84304"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276744"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279231"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279329"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-41178"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84303"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84304"}],"affected":[{"package":{"name":"amazon-ecs-init","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/amazon-ecs-init&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.107.0-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"amazon-ecs-init":"1.107.0-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22035-1.json"}}],"schema_version":"1.9.0"}