Repository navigation
[CET-22313] Bump APT_CACHE_BUST to clear zlib1g CVE-2026-76844 and CVE-2026-85091 - #184
Merged
Merged
Conversation
…E-2026-85091 The daily scan fails on all three agent images because of two zlib heap overflows. Debian's fix (zlib1g 1:1.3.dfsg+really1.3.1-1+deb13u1, DSA-6613-1) is already in trixie-security, but the build keeps serving a cached apt-get upgrade layer. Bumping APT_CACHE_BUST rebuilds that layer. The tunnel server is on bookworm-slim, which has no zlib fix yet, so its Dockerfile is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AFrieze
marked this pull request as ready for review
November 9, 2026 18:19
hannavigil
approved these changes
Nov 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: CET-22313
Summary
-grpc) and the Node 22 agent. The cause is two fixable zlib CVEs, CVE-2026-76844 and CVE-2026-85091. Both are heap buffer overflows in zlib's gz* write path.APT_CACHE_BUSTto2026-11-09indocker/Dockerfile. That forces theapt-get upgradelayer to rebuild and pick up the fixedzlib1g(1:1.3.dfsg+really1.3.1-1+deb13u1, DSA-6613-1), which is already intrixie-security.server/docker/Dockerfileis unchanged. The tunnel server is onbookworm-slim, and Debian has no bookworm fix for these CVEs yet, so the scan'signore-unfixedsetting already skips them and a rebuild would not change anything.What else the rebuild pulls
I ran
apt-get update && apt list --upgradableinside the currentmain,main-grpcandmain-node22images.zlib1gis the only upgradable package in all three.stable-slimis still at 13.7, the same point release the current images use. A local build of theruntime-basestage with this change installszlib1g 1:1.3.dfsg+really1.3.1-1+deb13u1and leaves nothing upgradable.Verifying
The PR build scans all three agent variants, and those scans should pass here. After merge, re-run
Scan for Vulnerabilitiesor wait for the next daily run; all 4 legs should pass.🤖 Generated with Claude Code