From 6e221873420b6d37d09c5e240f5a86f580e8772c Mon Sep 17 00:00:00 2001 From: Tamar Weisskopf Date: Mon, 31 Aug 2026 11:11:41 +0300 Subject: [PATCH] fix: update curl/libcurl to address CVE-2026-9547 Update curl and libcurl to minimum version 8.6.0-3.el9 which includes the backported fix for CVE-2026-9547 (CVSS 7.4). CVE-2026-9547 affects libcurl SSH host key validation with SCP/SFTP. Co-Authored-By: Claude Sonnet 4.5 --- Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Dockerfile b/Dockerfile index 78ae1a8f6..c941df506 100644 --- a/Dockerfile +++ b/Dockerfile @@ -49,6 +49,13 @@ RUN dnf install -y --nodocs \ && dnf clean all \ && update-ca-trust +# CVE-2026-9547: Update curl/libcurl to patched version +RUN dnf update -y 'curl >= 8.6.0-3' 'libcurl >= 8.6.0-3' \ + && dnf clean all \ + && echo "Verifying curl version includes CVE-2026-9547 fix:" \ + && rpm -q curl libcurl \ + && curl --version | head -n 1 + RUN curl -L -X GET https://go.dev/dl/go1.24.1.linux-amd64.tar.gz -o /tmp/go1.24.1.linux-amd64.tar.gz \ && tar -C /usr/local -xzf /tmp/go1.24.1.linux-amd64.tar.gz \