admin
f5a4995da5
gates / gates (push) Successful in 3m27s
- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io). - security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images, filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step). - dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d). - Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved. - audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log. - 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).
32 lines
2.5 KiB
JSON
32 lines
2.5 KiB
JSON
{
|
|
"_comment": [
|
|
"The runtime table of the security watch (R-1327): runtime parts that ship INSIDE an app or box image and have",
|
|
"their own security notices, which the app's notices never repeat. One row per part. `fixed` maps a release LINE",
|
|
"(the leading numbers, as many as the row's `line_parts`) to the first fixed version on that line; a line below the",
|
|
"highest listed line that has no entry is END OF LIFE (no fix will come — the advisory says so); a line above it",
|
|
"is newer than the notice and not affected. `from` is the first affected version. `groups` limits a row to some pin",
|
|
"groups (the OS packages: our own box/build images only — R-1307's scope; for apps the image's own runtime rows",
|
|
"apply). Facts of 2026-10-27, CVE-2026-111497 (HTTP2Shell / Node2Shell), from the CVE record, the Node.js security",
|
|
"release of 2026-10-21 and PYSEC-2026-4322/4323 — read in the session, sources in the night report."
|
|
],
|
|
"rows": [
|
|
{"part": "node", "label": "Node.js", "id": "CVE-2026-111497", "severity": "critical", "line_parts": 1,
|
|
"from": "0", "fixed": {"22": "22.23.4", "24": "24.22.1", "26": "26.12.1"},
|
|
"summary": "Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process",
|
|
"link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"},
|
|
{"part": "brotli", "label": "Python Brotli", "id": "CVE-2026-111497", "severity": "critical", "line_parts": 2,
|
|
"from": "1.0.3", "fixed": {"1.0": "1.0.10", "1.1": "1.1.1", "1.2": "1.2.1"},
|
|
"summary": "Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322",
|
|
"link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"},
|
|
{"part": "brotlicffi", "label": "Python brotlicffi", "id": "CVE-2026-111497", "severity": "critical", "line_parts": 2,
|
|
"from": "0", "fixed": {"1.2": "1.2.1.0"},
|
|
"summary": "Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4323",
|
|
"link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"},
|
|
{"part": "apk:brotli-libs", "label": "Alpine brotli-libs", "id": "CVE-2026-111497", "severity": "critical",
|
|
"line_parts": 2, "from": "1.0.3", "fixed": {"1.0": "1.0.10", "1.1": "1.1.1", "1.2": "1.2.1"},
|
|
"groups": ["box", "build"],
|
|
"summary": "the Brotli library of the image's Alpine base (HTTP2Shell)",
|
|
"link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"}
|
|
]
|
|
}
|