woodfairy 0a0686ef19 [Nginx][Clamd][Postfix] Rebuild images for brotli CVE-2026-111497 ...

The current nginx, clamd and postfix images ship a brotli decoder in the
affected range 1.0.3 - 1.2.0 (CVE-2026-111497, CVSS 9.8, listed in CISA KEV):

- nginx:1.30.6-2   brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0)
- clamd:1.4.6-1    brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0)
- postfix:3.10.12-1 libbrotli1 1.1.0-2+b7 (fixed in trixie-security:
  1.1.0-2+deb13u1, DSA-6582-1)

All other mailcow images already contain a fixed version.

clamd and postfix only need a rebuild, which pulls the fixed packages.
The postfix rebuild also picks up Debian's postfix 3.10.13, hence the
new tag postfix:3.10.13-1. The
nginx image never upgraded the packages of its base image, so it only got
fixes when nginx:<version>-alpine was republished. It now runs
apk upgrade like clamd and acme do.

2026-11-08 00:49:55 +01:00

..

bootstrap.py

[Nginx] Limit request body size, configurable via NGINX_MAX_BODY_SIZE

2026-10-28 16:54:26 +01:00

docker-entrypoint.sh

[Nginx] Invert SKIP container condition

2025-02-03 12:22:13 +01:00

Dockerfile

[Nginx][Clamd][Postfix] Rebuild images for brotli CVE-2026-111497

2026-11-08 00:49:55 +01:00