From 707afad3a3d8715c77ac5eb26461a1c12f1df12e Mon Sep 17 00:00:00 2001 From: Roi Glinik Date: Wed, 2 Sep 2026 18:55:02 +0300 Subject: [PATCH 1/2] ROB-1256 Backport perl/glibc/git CVE fixes from Debian forky Debian trixie ships no fix for the perl CVEs flagged by the scanner (CVE-2026-57433, CVE-2026-13221, CVE-2026-57432, CVE-2026-15534, CVE-2026-19487) - all marked "vulnerable, no DSA" on the Debian security tracker. The only fix is forky's perl-base 5.42.3-1, which pre-depends on glibc >= 2.43, and forky's git (needed to match the perl version apt resolves against) requires the same. Extends the existing per-package forky pin (already used for libssh2/libattr1/libacl1) to also cover: - perl-base, perl, perl-modules-5.42, libperl5.42 - libc6, libc-bin, libc-gconv-modules-extra, libcrypt1 - git, git-man, liberror-perl Nothing else resolves against forky - verified via a full package diff between the old and new image that no unrelated package (libssl3t64, curl, coreutils, etc.) moved. Co-Authored-By: Claude Sonnet 5 --- Dockerfile | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 23a5e2464..765e3c4d4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -84,10 +84,23 @@ RUN apt-get update \ && apt-get install -y --no-install-recommends libexpat1 libc6 libc-bin libcap2 \ && rm -rf /var/lib/apt/lists/* +# Debian trixie ships no fix for libssh2/attr/acl or perl ("vulnerable, no DSA" in the +# Debian security tracker), so the patched packages are pulled from forky with a +# per-package pin. Nothing else is resolved against testing - the preferences file below +# blocks every forky package except the ones named, and the sources are removed again in +# the same layer. +# - libssh2/libattr1/libacl1: CVE-2026-58050/58051/66032/66033/66034/66035, CVE-2026-54371, +# CVE-2026-54369/54370. +# - perl-base/perl: CVE-2026-57433, CVE-2026-13221, CVE-2026-57432, CVE-2026-15534, +# CVE-2026-19487. forky's perl pre-depends on glibc >= 2.43, so libc6/libc-bin/ +# libc-gconv-modules-extra/libcrypt1 come along too. git hard-depends on perl (Debian +# builds them from the same source with locked versions), so git/git-man/liberror-perl/ +# perl-modules-5.42/libperl5.42 are pulled up to forky's git 2.53.0 as well - trying to +# pin perl-base alone makes apt remove git instead of upgrading it. RUN echo 'deb http://deb.debian.org/debian forky main' > /etc/apt/sources.list.d/forky.list \ - && printf 'Package: libssh2-1t64 libattr1 libacl1\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \ + && printf 'Package: libssh2-1t64 libattr1 libacl1 perl-base perl perl-modules-5.42 libperl5.42 liberror-perl git git-man libc6 libcrypt1 libc-bin libc-gconv-modules-extra\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \ && apt-get update \ - && apt-get install -y --no-install-recommends libssh2-1t64 libattr1 libacl1 \ + && apt-get install -y --no-install-recommends libssh2-1t64 libattr1 libacl1 perl-base perl perl-modules-5.42 libperl5.42 liberror-perl git git-man libc6 libcrypt1 libc-bin libc-gconv-modules-extra \ && rm -f /etc/apt/sources.list.d/forky.list /etc/apt/preferences.d/99-forky \ && rm -rf /var/lib/apt/lists/* From 17fa64134814740ede0fb45fc2bc09c1ebb0d5e6 Mon Sep 17 00:00:00 2001 From: Roi Glinik Date: Thu, 3 Sep 2026 10:22:36 +0300 Subject: [PATCH 2/2] ROB-1256 Harden forky apt pin with :any architecture qualifiers CodeRabbit flagged that the pin block's package names are unqualified, which apt_preferences(5) treats as native-arch-only - since arm64 is registered as a foreign architecture (dpkg --add-architecture arm64, pre-existing), an arm64 resolution of any of these packages wouldn't be covered by the allowlist or blocked by the "Package: *" catch-all. No arm64 package actually gets pulled today (verified: dpkg -l has zero :arm64 entries on both an amd64 and an arm64 build), so this was latent, not exploitable in the current dependency graph. Fixed anyway as cheap defense-in-depth by qualifying every entry (and the catch-all) with :any. Rebuilt for linux/amd64 and diffed the full package list against the pre-fix image: zero difference, confirming the change is purely a policy hardening with no effect on what actually gets resolved. Co-Authored-By: Claude Sonnet 5 --- Dockerfile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 765e3c4d4..38bb3ccdb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -88,7 +88,9 @@ RUN apt-get update \ # Debian security tracker), so the patched packages are pulled from forky with a # per-package pin. Nothing else is resolved against testing - the preferences file below # blocks every forky package except the ones named, and the sources are removed again in -# the same layer. +# the same layer. Package names are ":any"-qualified (and so is the "Package: *" block) +# because arm64 is registered as a foreign architecture below - an unqualified name only +# pins the native arch, which would leave arm64 resolution unpinned/unblocked. # - libssh2/libattr1/libacl1: CVE-2026-58050/58051/66032/66033/66034/66035, CVE-2026-54371, # CVE-2026-54369/54370. # - perl-base/perl: CVE-2026-57433, CVE-2026-13221, CVE-2026-57432, CVE-2026-15534, @@ -98,7 +100,7 @@ RUN apt-get update \ # perl-modules-5.42/libperl5.42 are pulled up to forky's git 2.53.0 as well - trying to # pin perl-base alone makes apt remove git instead of upgrading it. RUN echo 'deb http://deb.debian.org/debian forky main' > /etc/apt/sources.list.d/forky.list \ - && printf 'Package: libssh2-1t64 libattr1 libacl1 perl-base perl perl-modules-5.42 libperl5.42 liberror-perl git git-man libc6 libcrypt1 libc-bin libc-gconv-modules-extra\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \ + && printf 'Package: libssh2-1t64:any libattr1:any libacl1:any perl-base:any perl:any perl-modules-5.42:any libperl5.42:any liberror-perl:any git:any git-man:any libc6:any libcrypt1:any libc-bin:any libc-gconv-modules-extra:any\nPin: release n=forky\nPin-Priority: 990\n\nPackage: *:any\nPin: release n=forky\nPin-Priority: -1\n' > /etc/apt/preferences.d/99-forky \ && apt-get update \ && apt-get install -y --no-install-recommends libssh2-1t64 libattr1 libacl1 perl-base perl perl-modules-5.42 libperl5.42 liberror-perl git git-man libc6 libcrypt1 libc-bin libc-gconv-modules-extra \ && rm -f /etc/apt/sources.list.d/forky.list /etc/apt/preferences.d/99-forky \