Upgrade zlib due to https://security.alpinelinux.org/vuln/CVE-2026-27171#136
Upgrade zlib due to https://security.alpinelinux.org/vuln/CVE-2026-27171#136amirvaza wants to merge 1 commit intovalkey-io:mainlinefrom
Conversation
|
Anything stops us from merging? :) |
| setpriv \ | ||
| openssl \ | ||
| libgcc \ | ||
| zlib=1.3.2-r0 \ |
There was a problem hiding this comment.
pinning this version would need to be updated once a new version is out.
Has alpine released a new patch for this CVE?
We can just rebuild all and it will patch all the images
There was a problem hiding this comment.
Alpine 3.23 has zlib=1.3.2-r0 https://pkgs.alpinelinux.org/package/v3.23/main/x86_64/zlib
We would only need to rebuild the image
There was a problem hiding this comment.
The alpine base image is two months old and contains the vuln https://hub.docker.com/layers/library/alpine/3.23.3/images/sha256-59855d3dceb3ae53991193bd03301e082b2a7faa56a514b03527ae0ec2ce3a95
There was a problem hiding this comment.
How can we change from pinning the versions to auto update? as maintaining this would be an added effort
4 participants
No description provided.