From d3df10dafd5ac11751dcb39677f8f06f336de352 Mon Sep 17 00:00:00 2001 From: Scott Karp Date: Sun, 25 Oct 2026 01:56:58 +0000 Subject: [PATCH] talmudic-engine: take Debian's libbrotli1 fix for CVE-2026-111497 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Brotli decoder out-of-bounds write (Brotli 1.0.3–1.2.0, fixed 1.2.1) was checked against every deployed image on 2026-10-25. No decoder is on any attacker-reachable path: Gitea's Go binary has no Brotli, vav and korban carry no libbrotli and no Python Brotli module, ingress-nginx has the module unloaded and only ever encodes. Three dormant copies remain: Gitea's Alpine brotli-libs 1.2.0 (no rebuilt image on Docker Hub yet), ingress-nginx's brotli-libs 1.1.0, and this image's libbrotli1 1.0.9-2 from the swipl:9.2.2 base, linked only by libcurl3-gnutls which nothing here calls. This one is ours to close. bookworm-security has 1.0.9-2+deb12u1; the runtime stage now upgrades that single package and nothing else, so the SWI-Prolog 9.2.2 pin (Construction §1.1) stands. Co-Authored-By: Claude Fable 5.1 --- deploy/docker/Dockerfile.talmudic_engine | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/deploy/docker/Dockerfile.talmudic_engine b/deploy/docker/Dockerfile.talmudic_engine index 1a32bfaa..458f1f8b 100644 --- a/deploy/docker/Dockerfile.talmudic_engine +++ b/deploy/docker/Dockerfile.talmudic_engine @@ -21,6 +21,19 @@ RUN swipl -g "consult('src/main'),halt(0)" -t "halt(1)" # === RUNTIME STAGE === FROM --platform=linux/amd64 swipl:9.2.2 +# CVE-2026-111497 (Brotli decoder out-of-bounds write, October 2026). +# The swipl:9.2.2 base carries Debian bookworm's libbrotli1 1.0.9-2, +# pulled in by libcurl3-gnutls. Nothing in this image decodes Brotli: +# swipl does not link it, there is no curl binary, and the engine reads +# JSON from vav over a Unix socket. The copy was dormant, not a path. +# Debian fixed it in 1.0.9-2+deb12u1 (bookworm-security); take that one +# package without moving the pinned base. The pin on SWI-Prolog 9.2.2 +# (Construction §1.1) is the point of the base image, so this is +# --only-upgrade of the one library, not a general upgrade. +RUN apt-get update \ + && apt-get install -y --no-install-recommends --only-upgrade libbrotli1 \ + && rm -rf /var/lib/apt/lists/* + RUN useradd --create-home --shell /bin/bash bikoret USER bikoret