admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ecae56559c5aca1a8d0625efa4affe657ae83d33
felhom.eu/documentation/audits/http2shell-2026-10-27/HOMELAB-LIST.md
T
admin f5a4995da5
gates / gates (push) Successful in 3m27s
Details
security watch sees runtimes (R-1327) and DooPlex (R-1328); HTTP2Shell rows R-1329–R-1332; R-1326 closed 
- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and
  layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io).
- security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images,
  filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step).
- dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d).
- Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved.
- audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log.
- 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).
2026-10-27 23:23:02 +01:00

8.1 KiB
Raw Blame History

DooPlex (homelab) — what to update, from the security watch (R-1328)

Read only: Felhom changes nothing on DooPlex. Source: the watch's run of 2026-10-27 night over documentation/security-watch/dooplex-workloads.txt (homelab-manifests image: lines; Helm-chart images are NOT in it). „Catalog ahead" = the Felhom catalog already ships a different (walked) tag of the same image.

Image DooPlex tag Where What is bad (fixed in) Catalog ahead
actualbudget/actual-server 26.10.0 actualbudget-system/actualbudget.yaml CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) 26.9.0
advplyr/audiobookshelf 2.37.1 audiobookshelf-system/audiobookshelf.yaml CVE-2026-111497 — Node.js 24.21.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) —
codewithcj/sparkyfitness_server v1.9.0 workout-system/sparkyfitness.yaml CVE-2026-111497 — Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) v0.17.3
crocodilestick/calibre-web-automated dev calibre-system/cwa.yaml CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) v4.0.8
docker.io/calcom/cal.com v6.2.0 booking-system/booking.yaml CVE-2026-111497 — Node.js 20.20.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4, 24.22.1, 26.12.1) —
flomp/wanderer-db v0.21.0 wanderer-system/wanderer.yaml GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) v0.20.0
flomp/wanderer-web v0.21.0 wanderer-system/wanderer.yaml GHSA-vprp-gr6m-j375 — ActivityPub inbox delivery allows blind Server-Side Request Forgery (SSRF) to internal network resources (fixed: v0.21.2); GHSA-3xp7-7492-j2q6 — ActivityPub Attachment URLs Allow Server-Side Request Forgery (SSRF) to Internal Network Resources (fixed: v0.21.2); GHSA-j9m4-8qwf-jvx6 — SSRF via ActivityPub List Image Attachments Allows Requests to Internal Network Resources (fixed: v0.21.2) v0.20.0
ghcr.io/gethomepage/homepage v1.13.2 homepage-system/homepage-orsi.yaml, homepage-system/homepage.yaml GHSA-669x-4pg4-w24r — Homepage service proxy allows client-controlled methods and bodies to configured widget endpoints (fixed: 2.2.0); CVE-2026-111497 — Node.js 22.22.3 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 22.23.4) —
ghcr.io/immich-app/immich-machine-learning v2.7.5 immich-system/immich.yaml GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) v3.2.4
ghcr.io/immich-app/immich-server v2.7.5 immich-system/immich.yaml GHSA-q89f-h332-8q2h — Authenticated SVG upload reaches ImageMagick coders and enables RCE (fixed: v3.2.4); GHSA-h5w4-vjv4-9r5q — Incorrect sanitization of continue URL on the /maintenance endpoint (fixed: a version after 3.1.0 (the notice names none)); GHSA-g4w3-c888-cr93 — A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API (fixed: v3.2.0) v3.2.4
ghcr.io/lukegus/termix release-2.9.2 termix-system/termix.yaml CVE-2026-111497 — Node.js 26.10.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 26.12.1) 2.8.0
ghcr.io/paperless-ngx/paperless-ngx 3.3.4 paperless-system/paperless.yaml CVE-2026-111497 — Python Brotli 1.2.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322 (fixed: 1.2.1) 2.20.15
gitea/gitea 1.26.2 gitea-system/gitea.yaml GHSA-wx44-9m3m-rjqx — Locked issues and comments still accept reactions through the web UI (fixed: 28.2.0); GHSA-4jmf-h2cm-hg7w — Cross-Site Request Forgery on POST /{owner}/{repo}/topics (fixed: 28.2.0); GHSA-8j56-f865-gqq2 — Draft releases include attachment metadata from other repositories (fixed: 28.2.0) 1.27.3
grafana/grafana 13.2.4 mon-system/monitoring.yaml GHSA-8xmm-x63g-f6xv — Stored XSS in ResourcePicker component (fixed: no fixed version named yet); GHSA-4724-7jwc-3fpw — Spoofing originalUrl of snapshots (fixed: the range is unreadable — check by hand); GHSA-2x6g-h2hg-rq84 — Email addresses and usernames can not be trusted (fixed: the range is unreadable — check by hand) —
louislam/uptime-kuma 2.5.6 uptimekuma-system/uptimekuma.yaml GHSA-qjxc-h5jf-c7rj — GCP and selected cloud providers provide metadata endpoints to the local network which can be queried to extra (fixed: the range is unreadable — check by hand); release:louislam/uptime-kuma@2.5.8 — ⬆️ Security Fixes (fixed: 2.5.8); release:louislam/uptime-kuma@2.5.7 — ⬆️ Security Fixes (fixed: 2.5.7) 2.5.7
outlinewiki/outline 1.11.0 outline-system/outline.yaml GHSA-x4w3-9p9j-cprh — users.update_role reveals whether a user id from another team exists and which role it has (fixed: 1.12.0); GHSA-rq53-m97j-f2pg — Unpublished documents remain publicly accessible and their shares cannot be revoked (fixed: 1.12.0); GHSA-h6ff-rw9x-5mq2 — Authenticated members can publish documents into private collections through a retained parent link (fixed: 1.12.0) 1.12.0
redis 8.10.2 plantit-system/plantit.yaml GHSA-c8h9-259x-jff4 — Invalid Memory Access in Redis RESTORE Command May Lead to Remote Code Execution (fixed: the range is unreadable — check by hand); GHSA-8ghh-qpmp-7826 — Lua Use-After-Free may lead to remote code execution (fixed: no fixed version named yet); GHSA-93m2-935m-8rj3 — Use-After-Free in unblock client flow may lead to remote code execution (fixed: no fixed version named yet) 7.4-alpine
rommapp/romm 5.4.0 arcade-system/romm.yaml release:rommapp/romm@5.4.1 — While we don't believe RomM instances are vulnerable, we recommend upgrading as soon as possible (fixed: 5.4.1); CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) 5.4.1
vabene1111/recipes 2.6.15 tandoor-system/tandoor.yaml CVE-2026-111497 — Node.js 24.18.1 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body c (fixed: 24.22.1) —

19 images to update.

NOT CHECKED (the watch could not read them)

  • advplyr/audiobookshelf:2.37.1 — https://hub.docker.com/v2/repositories/advplyr/audiobookshelf/tags: The read operation timed out
  • gitea.dooplex.hu/admin/felhom-act-runner:0.1.0 — registry gitea.dooplex.hu: no anonymous token route
  • gitea.dooplex.hu/admin/jarr:latest — registry gitea.dooplex.hu: no anonymous token route
  • gitea.dooplex.hu/admin/recipe-importer:latest — registry gitea.dooplex.hu: no anonymous token route
  • gitea.dooplex.hu/admin/revfulop-calendar:1.6.2 — registry gitea.dooplex.hu: no anonymous token route
  • gitea.dooplex.hu/admin/sparkyfitness-export:0.3.0 — registry gitea.dooplex.hu: no anonymous token route
  • gitea.dooplex.hu/admin/wan-probe:0.1.0 — registry gitea.dooplex.hu: no anonymous token route
  • minio/minio:latest — Docker registry tags of minio/minio: HTTP 401; manifest minio/minio:latest: HTTP 401
Reference in new issue View Git Blame Copy Permalink