admin
f5a4995da5
- scripts/image_runtime.py: Node / Python Brotli / brotlicffi / apk / dpkg read from an image's registry config and layers (no pull; HEAD for the nightly digest; zstd via the zstd program where present; quay.io, index.docker.io). - security_watch.py: a „runtime" source (security_watch_runtimes.json), cached by digest in state.json (154 images, filled on DooPlex tonight); ghcr.io tag lists are paged; the DooPlex group (own block, homelab next-step). - dooplex_inventory.py + documentation/security-watch/dooplex-workloads.txt (89 images, homelab-manifests 5aeec8d). - Tests W10–W12 (58 checks) + test_image_runtime.py (13), each red-proved. - audits/http2shell-2026-10-27: the Home Assistant lane walk (proven), HOMELAB-LIST.md (19 to update), the run log. - 08 §11 design line; 09 §3 decision 276 (HA monthly = same main version; decided by CC unattended).
2.2 KiB
HTTP2Shell (CVE-2026-111497) — 2026-10-27 night, unattended after 22:40 CET
The Brotli decoder bug in Node.js (fixed 22.23.4 / 24.22.1 / 26.12.1; 20, 23, 25 get no fix) and Python brotli
(fixed 1.0.10 / 1.1.1 / 1.2.1) / brotlicffi (1.2.1.0). Sources read in the session: the CVE record via security
press (Brandefense, Aikido, SOCRadar, Phoenix Security), PYSEC-2026-4322/4323.
What the images carry (read from the registries, scripts/image_runtime.py, no pull)
Checked against the live containers on demo-hp 9201 where one runs: Home Assistant 2026.9.4 Python Brotli 1.2.0 (live: 1.2.0), RomM 5.3.1 Node 24.18.1 (live: v24.18.1), Paperless 2.20.15 Brotli 1.1.0 (live: 1.1.0). The candidates: Home Assistant 2026.10.4 Brotli 1.2.1; RomM 5.4.1 (the newest) still Node 24.18.1; Immich v3.3.5 Node 24.22.1.
The whole catalog (the watch's filling run, --no-mail): 20 catalog apps and one box program carry a bad runtime
(R-1332); DooPlex: 19 images to update (HOMELAB-LIST.md, R-1328). Positive controls named: Home Assistant, RomM;
negative control audiobookshelf 2.37.2 CURRENT.
Steps (drill only — the live push waits for the operator)
- Home Assistant 2026.9.4 → 2026.10.4, a lane step (
09§3 decision 276):walks/home-assistant/— proven on 9202 through the guarded Update (135 s), the seeded owner logged in after, soak peak 30.6 % (anon), no kill, no restart; written to the drill (3c8ebb5, superseded stepsteps/4f987bb4b035eef9.yml). - Immich v3.2.4 → v3.3.5, a lane step (R-1322):
walks/immich/(see its walk.txt). 9202's old Immich was removed through the product first (its drive folder kept: the drive path could not be resolved — R-442, right). - Wanderer hidden (D59): drill
ee18bff; the live change iswanderer-hidden.patch(not committed to the live catalog at night). - RomM: no fixed release exists (R-1330). Paperless: decodes only replies to its own outbound calls (R-1331).
Decided by CC unattended (operator may reverse)
Home Assistant as a lane step (decision 276); the runtime cache filled on DooPlex with the stored Docker Hub login instead of a zstd dependency in CI (08 §11); no Paperless step; RomM kept (pick in STATUS); the live catalog changes kept as patches, not commits, at night.