zegit-zoo/zegit-forgejo-runner
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: upgrade brotli-libs and gate on it (KEV CVE-2026-111497)

Browse Source 
The forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add`
never upgrades a package the base already has. Upgrade it explicitly
(-> 1.2.1-r0) and fail the build if it is still older, so a base bump
cannot bring the vulnerable version back. Markus approved 2026-11-07.

Tested locally: builds for linux/amd64 and linux/arm64,
"Upgrading brotli-libs (1.2.0-r0 -> 1.2.1-r0)", gate passes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
atomicbackspace-agent[bot]andClaude Opus 5.5 committed 2026-11-07 11:03:40 +01:00
1 parent 9608037173
commit 09e32c1186
1 file changed
+12
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile
+12
View File
@@ -93,5 +93,17 @@ RUN apk add --no-cache \
font-noto \
postgresql-client
# CVE-2026-111497 (brotli decoder out-of-bounds write, CISA KEV, due 2026-11-10): the
# forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add` above never
# upgrades a package the base already has. git-remote-http and curl link it through
# libcurl. Upgrade it explicitly and fail the build if it is still behind, so a base
# bump can never quietly bring the vulnerable version back. Drop this once the upstream
# runner base ships brotli-libs >= 1.2.1.
RUN set -eux; \
apk upgrade --no-cache brotli-libs; \
v="$(apk list --installed brotli-libs | sed -n 's/^brotli-libs-\([0-9][^ ]*\) .*/\1/p')"; \
echo "brotli-libs ${v}"; \
[ "$(apk version -t "${v}" 1.2.1-r0)" != "<" ] || { echo "brotli-libs ${v} is older than 1.2.1-r0 (CVE-2026-111497)"; exit 1; }
# Match the runner pod's runAsUser (1000); keep the image non-root by default.
USER 1000