Skip to content

fix(security): upgrade libgcrypt20 to patch CVE-2026-41989 #116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
schubydoo merged 1 commit into from
Jun 1, 2026
Merged

fix(security): upgrade libgcrypt20 to patch CVE-2026-41989 #116

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 11 additions & 7 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,12 +72,16 @@ RUN set -eux; \
# - `dockerize --output-oci PATH` → write a portable OCI image archive.
# Published as `:slim` and `:X.Y[.Z]-slim`.
#
# Why the libgnutls upgrade: the pinned base lags Debian's security archive (it
# ships 3.7.9-2+deb12u6; deb12u7 fixes the GnuTLS CVE batch — CVE-2026-33845,
# CVE-2026-42010, and others). `--only-upgrade` (no exact pin) always moves
# forward, so it is a harmless no-op once the base catches up — unlike a pinned
# `=deb12u7`, which would fail the build by implying a downgrade. Drop it once
# the base no longer lags.
# Why the apt upgrades: the pinned base lags Debian's security archive, so we
# pull forward specific patched libs the scanners flag:
# - libgnutls30: base ships 3.7.9-2+deb12u6; deb12u7 fixes the GnuTLS CVE
# batch — CVE-2026-33845, CVE-2026-42010, and others.
# - libgcrypt20: base ships 1.10.1-3; 1.10.1-3+deb12u1 (DSA-6294-1) fixes
# CVE-2026-41989, a heap overflow / DoS via crafted ECDH ciphertext to
# gcry_pk_decrypt.
# `--only-upgrade` (no exact pin) always moves forward, so each is a harmless
# no-op once the base catches up — unlike a pinned `=deb12u7`, which would fail
# the build by implying a downgrade. Drop a package once the base no longer lags.
# -----------------------------------------------------------------------------
FROM python:3.14-slim-bookworm@sha256:a9bee15510a364124aa24692899d269835683b883de42f7ebec8c293cf679ccb AS slim

Expand All @@ -88,7 +92,7 @@ ENV PYTHONDONTWRITEBYTECODE=1 \

RUN set -eux; \
apt-get update; \
apt-get install --no-install-recommends -y --only-upgrade libgnutls30; \
apt-get install --no-install-recommends -y --only-upgrade libgnutls30 libgcrypt20; \
rm -rf /var/lib/apt/lists/*

COPY --from=builder /src/dist/*.whl /tmp/
Expand Down
Loading