From 1a1a0d3b898dda007571392edad8801553bb0503 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 23 Aug 2026 10:35:50 +0000 Subject: [PATCH 1/2] Fix attr and acl CVEs by upgrading libattr1 and libacl1 to fixed versions CVE-2026-54371 (attr < 2.6.0) and CVE-2026-54369 / CVE-2026-54370 (acl < 2.4.0) are symlink-traversal / TOCTOU local privilege escalation flaws flagged on the python:3.12-slim base image. Debian trixie has no fixed build yet (the fix will only arrive in a future point release), and the libraries cannot be removed since coreutils, tar, sed and passwd pre-depend on them. Install only libattr1 1:2.6.0-1 and libacl1 2.4.0-1 from Debian unstable (uploaded 2026-06-29), pinned at low priority so no other package is pulled from there, and assert the resulting versions are at or above the fixed ones. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01H47V4EqDNXhaiCMY8iALhS --- Dockerfile | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/Dockerfile b/Dockerfile index ab1caf07..4efdde1f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,6 +9,19 @@ ENV PATH="/app/venv/bin:$PATH" RUN apt-get update && \ dpkg --add-architecture arm64 +# Upgrade libattr1 and libacl1 to the fixed versions (CVE-2026-54371 in +# attr < 2.6.0; CVE-2026-54369 and CVE-2026-54370 in acl < 2.4.0). Trixie has +# no fixed build yet (fix arrives only in a future point release), so these +# two leaf libraries are pulled from unstable, pinned low so that nothing +# else is upgraded from there. +RUN echo 'deb http://deb.debian.org/debian unstable main' > /etc/apt/sources.list.d/unstable.list \ + && printf 'Package: *\nPin: release a=unstable\nPin-Priority: 100\n' > /etc/apt/preferences.d/unstable \ + && apt-get update \ + && apt-get install -y --no-install-recommends -t unstable libattr1 libacl1 \ + && rm /etc/apt/sources.list.d/unstable.list /etc/apt/preferences.d/unstable \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libattr1)" ge 1:2.6.0 \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libacl1)" ge 2.4.0 + # Set the working directory WORKDIR /app From 0ff0eae14a4a1ea8b62208e5f5843b6ffeae7dee Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 23 Aug 2026 11:38:46 +0000 Subject: [PATCH 2/2] Use package-specific apt pin instead of -t unstable -t unstable sets priority 990 for every package in unstable, overriding the generic priority-100 pin, so unrelated dependencies could have been pulled from unstable. Pin only libattr1 and libacl1 to unstable at 990 and install without -t; everything else (including libc6) stays on trixie, verified via apt-cache policy in the built image. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01H47V4EqDNXhaiCMY8iALhS --- Dockerfile | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 4efdde1f..571cc0cd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,12 +12,13 @@ RUN apt-get update && \ # Upgrade libattr1 and libacl1 to the fixed versions (CVE-2026-54371 in # attr < 2.6.0; CVE-2026-54369 and CVE-2026-54370 in acl < 2.4.0). Trixie has # no fixed build yet (fix arrives only in a future point release), so these -# two leaf libraries are pulled from unstable, pinned low so that nothing -# else is upgraded from there. +# two leaf libraries are pulled from unstable via a package-specific pin; +# everything else in unstable stays at priority 100 so no other package +# (e.g. libc6) can be upgraded from there. RUN echo 'deb http://deb.debian.org/debian unstable main' > /etc/apt/sources.list.d/unstable.list \ - && printf 'Package: *\nPin: release a=unstable\nPin-Priority: 100\n' > /etc/apt/preferences.d/unstable \ + && printf 'Package: *\nPin: release a=unstable\nPin-Priority: 100\n\nPackage: libattr1 libacl1\nPin: release a=unstable\nPin-Priority: 990\n' > /etc/apt/preferences.d/unstable \ && apt-get update \ - && apt-get install -y --no-install-recommends -t unstable libattr1 libacl1 \ + && apt-get install -y --no-install-recommends libattr1 libacl1 \ && rm /etc/apt/sources.list.d/unstable.list /etc/apt/preferences.d/unstable \ && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libattr1)" ge 1:2.6.0 \ && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libacl1)" ge 2.4.0