SLoeuillet opened a new issue, #70229:
URL: https://github.com/apache/doris/issues/70229
### Urgent: Broccoli2Shell (CVE-2026-111497)
CVE-2026-111497 ("Broccoli2Shell") is an out-of-bounds write in the Brotli
decoder that can lead to remote code execution. CVSS 9.8, EPSS ~83 %, and it is
being exploited.
Every current release image is affected. Checked on `apache/doris:fe-4.1.5`:
```
$ docker run --rm --entrypoint sh apache/doris:fe-4.1.5 -c 'dpkg-query -W
libbrotli1'
libbrotli1 1.0.9-2build6 # Ubuntu 22.04.5; fixed in 1.0.9-2ubuntu0.1
```
The package comes in through `libcurl4`, so it is in every image built on
`apache/doris:base-6.0` / `Dockerfile_base_slim`. A fix only needs a rebuild of
the base (`apt-get upgrade`) and of the release images.
**Ask 1 (urgent):** rebuild and re-push the supported release tags
(`*-4.1.5`, `*-4.1.4.1`, `*-4.0.8`) on a patched base.
### Smaller images
`Dockerfile_base_slim` (#60458) is a good start, but `-slim` tags stopped at
4.1.0. The full images are ~4 GB and ship debug tooling (gdb, bpfcc, kernel
headers, python2-dev…) that most production users never run, and that grows the
CVE surface.
**Ask 2:** publish `-slim` for every release, and consider making it the
default.
### Base OS
Both bases are `FROM ubuntu:22.04`, whose standard support ends in April
2027.
**Ask 3:** move the base to the current LTS, Ubuntu **26.04**, or 24.04 at
minimum, and keep to LTS releases only.
If it helps, I can open the PRs: `Dockerfile_base` / `Dockerfile_base_slim`
on Ubuntu 26.04 LTS, and the release workflow publishing `-slim` for each
version. Happy to test candidate images too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
