Skip to content

Fix security vulnerabilities in libattr1 and libacl1 #548

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
naomi-robusta merged 2 commits into from
Aug 23, 2026
Merged

Fix security vulnerabilities in libattr1 and libacl1 #548

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a1a0d3
Fix attr and acl CVEs by upgrading libattr1 and libacl1 to fixed vers…
claude Aug 23, 2026
0ff0eae
Use package-specific apt pin instead of -t unstable
claude Aug 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,20 @@ ENV PATH="/app/venv/bin:$PATH"
RUN apt-get update && \
dpkg --add-architecture arm64

# Upgrade libattr1 and libacl1 to the fixed versions (CVE-2026-54371 in
# attr < 2.6.0; CVE-2026-54369 and CVE-2026-54370 in acl < 2.4.0). Trixie has
# no fixed build yet (fix arrives only in a future point release), so these
# two leaf libraries are pulled from unstable via a package-specific pin;
# everything else in unstable stays at priority 100 so no other package
# (e.g. libc6) can be upgraded from there.
RUN echo 'deb http://deb.debian.org/debian unstable main' > /etc/apt/sources.list.d/unstable.list \
&& printf 'Package: *\nPin: release a=unstable\nPin-Priority: 100\n\nPackage: libattr1 libacl1\nPin: release a=unstable\nPin-Priority: 990\n' > /etc/apt/preferences.d/unstable \
&& apt-get update \
&& apt-get install -y --no-install-recommends libattr1 libacl1 \
Comment thread
naomi-robusta marked this conversation as resolved.
&& rm /etc/apt/sources.list.d/unstable.list /etc/apt/preferences.d/unstable \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libattr1)" ge 1:2.6.0 \
&& dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libacl1)" ge 2.4.0

# Set the working directory
WORKDIR /app

Expand Down
Loading