zegit-zoo/zegit-forgejo-runner
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: upgrade brotli-libs and gate on it (KEV CVE-2026-111497) #15

Merged
markus merged 1 commits from claude/fix/brotli-kev into master 2026-11-07 10:22:25 +00:00
Conversation 1 Commits 1 Files Changed 1
+12
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 09e32c1186 - Show all commits
Dockerfile
+12
View File
@@ -93,5 +93,17 @@ RUN apk add --no-cache \
font-noto \ font-noto \
postgresql-client postgresql-client
# CVE-2026-111497 (brotli decoder out-of-bounds write, CISA KEV, due 2026-11-10): the
# forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add` above never
# upgrades a package the base already has. git-remote-http and curl link it through
# libcurl. Upgrade it explicitly and fail the build if it is still behind, so a base
# bump can never quietly bring the vulnerable version back. Drop this once the upstream
# runner base ships brotli-libs >= 1.2.1.
RUN set -eux; \
apk upgrade --no-cache brotli-libs; \
v="$(apk list --installed brotli-libs | sed -n 's/^brotli-libs-\([0-9][^ ]*\) .*/\1/p')"; \
echo "brotli-libs ${v}"; \
[ "$(apk version -t "${v}" 1.2.1-r0)" != "<" ] || { echo "brotli-libs ${v} is older than 1.2.1-r0 (CVE-2026-111497)"; exit 1; }
# Match the runner pod's runAsUser (1000); keep the image non-root by default. # Match the runner pod's runAsUser (1000); keep the image non-root by default.
USER 1000 USER 1000