admin
f5a4995da5
gates / gates (push) Successful in 3m27s
- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io). - security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images, filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step). - dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d). - Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved. - audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log. - 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).
33 lines
2.2 KiB
Markdown
33 lines
2.2 KiB
Markdown
# HTTP2Shell (CVE-2026-111497) — 2026-10-27 night, unattended after 22:40 CET
|
|
|
|
The Brotli decoder bug in Node.js (fixed 22.23.4 / 24.22.1 / 26.12.1; 20, 23, 25 get no fix) and Python `brotli`
|
|
(fixed 1.0.10 / 1.1.1 / 1.2.1) / `brotlicffi` (1.2.1.0). Sources read in the session: the CVE record via security
|
|
press (Brandefense, Aikido, SOCRadar, Phoenix Security), PYSEC-2026-4322/4323.
|
|
|
|
## What the images carry (read from the registries, `scripts/image_runtime.py`, no pull)
|
|
|
|
Checked against the live containers on demo-hp 9201 where one runs: Home Assistant 2026.9.4 Python Brotli 1.2.0 (live:
|
|
1.2.0), RomM 5.3.1 Node 24.18.1 (live: v24.18.1), Paperless 2.20.15 Brotli 1.1.0 (live: 1.1.0). The candidates: Home
|
|
Assistant 2026.10.4 Brotli **1.2.1**; RomM 5.4.1 (the newest) still Node 24.18.1; Immich v3.3.5 Node **24.22.1**.
|
|
|
|
**The whole catalog (the watch's filling run, `--no-mail`):** 20 catalog apps and one box program carry a bad runtime
|
|
(R-1332); DooPlex: 19 images to update (`HOMELAB-LIST.md`, R-1328). Positive controls named: Home Assistant, RomM;
|
|
negative control audiobookshelf 2.37.2 CURRENT.
|
|
|
|
## Steps (drill only — the live push waits for the operator)
|
|
|
|
- **Home Assistant 2026.9.4 → 2026.10.4**, a lane step (`09` §3 decision 276): `walks/home-assistant/` — proven on 9202
|
|
through the guarded Update (135 s), the seeded owner logged in after, soak peak 30.6 % (anon), no kill, no restart;
|
|
written to the drill (`3c8ebb5`, superseded step `steps/4f987bb4b035eef9.yml`).
|
|
- **Immich v3.2.4 → v3.3.5**, a lane step (R-1322): `walks/immich/` (see its walk.txt). 9202's old Immich was removed
|
|
through the product first (its drive folder kept: the drive path could not be resolved — R-442, right).
|
|
- **Wanderer hidden** (D59): drill `ee18bff`; the live change is `wanderer-hidden.patch` (not committed to the live
|
|
catalog at night).
|
|
- RomM: no fixed release exists (R-1330). Paperless: decodes only replies to its own outbound calls (R-1331).
|
|
|
|
## Decided by CC unattended (operator may reverse)
|
|
|
|
Home Assistant as a lane step (decision 276); the runtime cache filled on DooPlex with the stored Docker Hub login
|
|
instead of a zstd dependency in CI (08 §11); no Paperless step; RomM kept (pick in STATUS); the live catalog changes
|
|
kept as patches, not commits, at night.
|