From 0a0686ef1940f9723de3a04ce88fe437917ff982 Mon Sep 17 00:00:00 2001 From: woodfairy <66573402+woodfairy@users.noreply.github.com> Date: Sun, 8 Nov 2026 00:46:44 +0100 Subject: [PATCH] [Nginx][Clamd][Postfix] Rebuild images for brotli CVE-2026-111497 The current nginx, clamd and postfix images ship a brotli decoder in the affected range 1.0.3 - 1.2.0 (CVE-2026-111497, CVSS 9.8, listed in CISA KEV): - nginx:1.30.6-2 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0) - clamd:1.4.6-1 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0) - postfix:3.10.12-1 libbrotli1 1.1.0-2+b7 (fixed in trixie-security: 1.1.0-2+deb13u1, DSA-6582-1) All other mailcow images already contain a fixed version. clamd and postfix only need a rebuild, which pulls the fixed packages. The postfix rebuild also picks up Debian's postfix 3.10.13, hence the new tag postfix:3.10.13-1. The nginx image never upgraded the packages of its base image, so it only got fixes when nginx:-alpine was republished. It now runs apk upgrade like clamd and acme do. --- data/Dockerfiles/nginx/Dockerfile | 3 ++- docker-compose.yml | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/data/Dockerfiles/nginx/Dockerfile b/data/Dockerfiles/nginx/Dockerfile index c4230482a..8d1b004a9 100644 --- a/data/Dockerfiles/nginx/Dockerfile +++ b/data/Dockerfiles/nginx/Dockerfile @@ -3,7 +3,8 @@ LABEL maintainer "The Infrastructure Company GmbH " ENV PIP_BREAK_SYSTEM_PACKAGES=1 -RUN apk add --no-cache nginx \ +RUN apk upgrade --no-cache && \ + apk add --no-cache nginx \ python3 \ py3-pip && \ pip install --upgrade pip && \ diff --git a/docker-compose.yml b/docker-compose.yml index c6e07d7c5..c7cd91a4e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -68,7 +68,7 @@ services: - redis clamd-mailcow: - image: ghcr.io/mailcow/clamd:1.4.6-1 + image: ghcr.io/mailcow/clamd:1.4.6-2 restart: always depends_on: unbound-mailcow: @@ -348,7 +348,7 @@ services: - dovecot postfix-mailcow: - image: ghcr.io/mailcow/postfix:3.10.12-1 + image: ghcr.io/mailcow/postfix:3.10.13-1 depends_on: mysql-mailcow: condition: service_started @@ -428,7 +428,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: ghcr.io/mailcow/nginx:1.30.6-2 + image: ghcr.io/mailcow/nginx:1.30.6-3 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: