NO-JIRA: Bump containerd to v1.7.33 to fix CVE

[matejvasek]

Summary

Addresses CVE-2026-53488 (CRI label injection / host-root exec in containerd). Bumps github.com/containerd/containerd from v1.7.24 to v1.7.33.

Additional Info

As for the RIT process documentation the Jira ticket is not attached to this PR, I quote:

In some cases, a symbol level analysis will show that the component is not actually exposed to the vulnerability. In these cases the package should still be updated, but not attached to the bug.

Call-graph reachability analysis (VTA, 429K edges) confirmed that the vulnerable CRI plugin code (pkg/cri/) is not vendored and not reachable from production code. The only reachable containerd code is containerd/archive.Apply, used for OCI image layer unpacking.

References

• GHSA-xhf5-7wjv-pqxp
• CVE-2026-53488

[openshift-ci-robot]

@matejvasek: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

Addresses CVE-2026-53488 (CRI label injection / host-root exec in containerd). Bumps github.com/containerd/containerd from v1.7.24 to v1.7.33.

Additional Info

As for the RIT process documentation the Jira ticket is not attached to this PR, I quote:

In some cases, a symbol level analysis will show that the component is not actually exposed to the vulnerability. In these cases the package should still be updated, but not attached to the bug.

Call-graph reachability analysis (VTA, 429K edges) confirmed that the vulnerable CRI plugin code (pkg/cri/) is not vendored and not reachable from production code. The only reachable containerd code is containerd/archive.Apply, used for OCI image layer unpacking.

References

• GHSA-xhf5-7wjv-pqxp
• CVE-2026-53488

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tmshort]

There's no bug associated with is?
I'm also a bit concerned that there's no CI running?
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: matejvasek, tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [tmshort]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tmshort]

Before this is LGTM'd and verified, has it been built?

[matejvasek]

There's no bug associated with is?
I'm also a bit concerned that there's no CI running?

The bug associated with this is OCPBUGS-95463, but we do not actually call the vulnerable functions. IIUC in such a case no bug should be associated in PR, since the bump is not necessary -- we don not really fix anything, but we still want to bump the dependency to avoid automatically reported vulnerabilities.

The absence of CI is really not confidence inspiring.

I tried make build locally and it worked.