evantaly opened a new issue, #9258: URL: https://github.com/apache/devlake/issues/9258
### Search before asking - [X] I had searched in the [issues](https://github.com/apache/devlake/issues?q=is%3Aissue) and found no similar issues. ### What happened All three `v1.0.3-beta18` images contain a Brotli library that is vulnerable to CVE-2026-111497. Security scanners flag the images as Critical. Our admission policy (Wiz) blocks the images. We had to stop our DevLake deployment (Kubernetes, Helm). `v1.0.3-beta18` is the latest release. No released image contains the fix. **The vulnerability** - Out-of-bounds write in the Brotli decoder (`c/dec/decode.c`), CWE-787. - A remote attacker without authentication can use a crafted stream to disclose memory, cause a denial of service, or possibly execute code. - CVSS v4.0: 9.2 Critical (score from the CNA, Google). - Affected: Brotli 1.0.3 to 1.2.0. Fixed: 1.0.10, 1.1.1, 1.2.1 (released 2026-10-21). Sources: - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497 - Brotli fix releases: [v1.2.1](https://github.com/google/brotli/releases/tag/v1.2.1), [v1.1.1](https://github.com/google/brotli/releases/tag/v1.1.1), [v1.0.10](https://github.com/google/brotli/releases/tag/v1.0.10) - Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2026-111497 - Alpine secdb (fix in `brotli 1.2.1-r0`): https://secdb.alpinelinux.org/v3.24/main.json - Node.js security release for the same CVE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases **Affected images** (tag `v1.0.3-beta18`, `linux/amd64`, pushed 2026-09-27) | Image | Base | Package | Installed | Fixed | | --- | --- | --- | --- | --- | | `apache/devlake` | Debian 12 (`python:3.11-slim-bookworm`) | `libbrotli1` | `1.0.9-2+b6` | `1.0.9-2+deb12u1` (DLA-4855-1) | | `apache/devlake-config-ui` | Debian 13 (`nginxinc/nginx-unprivileged:1.31.5`) | `libbrotli1` | `1.1.0-2+b7` | `1.1.0-2+deb13u1` (DSA-6582-1) | | `apache/devlake-dashboard` | Alpine 3.24.1 (`grafana/grafana:13.2.2`) | `brotli-libs` | `1.2.0-r1` | `1.2.1-r0` | In the two Debian images, `libcurl4` / `libcurl4t64` and `libfreetype6` depend on `libbrotli1`. ### What do you expect to happen The current release images contain the fixed Brotli packages, so that security scanners do not block them. A new release or a re-push of `v1.0.3-beta18` is sufficient for us. ### How to reproduce Show the installed Brotli package in each image: ```sh docker run --rm --entrypoint dpkg-query apache/devlake:v1.0.3-beta18 -W libbrotli1 docker run --rm --entrypoint dpkg-query apache/devlake-config-ui:v1.0.3-beta18 -W libbrotli1 docker run --rm --entrypoint apk apache/devlake-dashboard:v1.0.3-beta18 info -v brotli-libs ``` Compare the versions with the "Fixed" column above. A scanner (for example Trivy or Wiz) reports CVE-2026-111497 for all three images. ### Anything else A rebuild with pinned base tags does not change the packages that come from the base image. Use base tags that contain the fix, or add `apt-get upgrade` / `apk upgrade` to the Dockerfiles. ### Version v1.0.3-beta18 ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
