From 83430fccb2a2f965e5446271c88297cdf6a741a6 Mon Sep 17 00:00:00 2001 From: Andrew Frieze Date: Mon, 9 Nov 2026 09:40:08 -0700 Subject: [PATCH] [CET-22313] Bump APT_CACHE_BUST to clear zlib1g CVE-2026-76844 and CVE-2026-85091 The daily scan fails on all three agent images because of two zlib heap overflows. Debian's fix (zlib1g 1:1.3.dfsg+really1.3.1-1+deb13u1, DSA-6613-1) is already in trixie-security, but the build keeps serving a cached apt-get upgrade layer. Bumping APT_CACHE_BUST rebuilds that layer. The tunnel server is on bookworm-slim, which has no zlib fix yet, so its Dockerfile is unchanged. Co-Authored-By: Claude Opus 5.5 --- docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 7bfdf29..4b4ad27 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -52,7 +52,7 @@ WORKDIR /agent # when the scheduled Trivy scan flags OS-package CVEs whose fixes are already # in the archive — the cache is just serving a stale layer. Leaves the rest of # the build (Go, Node + snyk-broker install) hitting cache as normal. -ARG APT_CACHE_BUST=2026-11-05 +ARG APT_CACHE_BUST=2026-11-09 # NOTE: build-essential is deliberately NOT installed here. It pulls in a full # C/C++ toolchain whose libc6-dev dependency drags in linux-libc-dev (the Linux # kernel headers), and that single package generates a steady stream of HIGH