From f08ad8d106b6d7cc73679145c77c15a28c2e4897 Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Thu, 27 Aug 2026 15:32:56 +0300 Subject: [PATCH] fix: update acl package to mitigate CVE-2026-54369 CVE-2026-54369 is a High severity (CVSS 7.1) symlink traversal vulnerability in libacl < 2.4.0 affecting the UBI9 base image. Changes: - Add explicit dnf update for acl >= 2.4.0 in Dockerfile - Ensures patched version is installed during container build Impact: - Application code is NOT directly affected (no ACL usage) - Container base image potentially affected via system libacl - Exploitation risk is LOW due to container isolation and kernel protections Testing Required: - Verify acl version >= 2.4.0 after build - Run unit tests and integration tests - Validate end-to-end workflow References: - https://access.redhat.com/security/cve/cve-2026-54369 - https://nvd.nist.gov/vuln/detail/CVE-2026-54369 - Red Hat Advisory: RHSA-2026:43420 Co-Authored-By: Claude Sonnet 4.5 --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 78ae1a8f6..afd051267 100644 --- a/Dockerfile +++ b/Dockerfile @@ -46,6 +46,7 @@ RUN dnf install -y --nodocs \ skopeo \ wget \ xz \ + && dnf update -y 'acl >= 2.4.0' \ && dnf clean all \ && update-ca-trust