Skip to content

fix: pin systemd packages to 257.13-1~deb13u1 for multiple CVEs#1563

Closed
Hugo-Pare wants to merge 1 commit into
mainfrom
fix-systemd-vulnerabilities
Closed

fix: pin systemd packages to 257.13-1~deb13u1 for multiple CVEs#1563
Hugo-Pare wants to merge 1 commit into
mainfrom
fix-systemd-vulnerabilities

Conversation

@Hugo-Pare
Copy link
Copy Markdown
Collaborator

@Hugo-Pare Hugo-Pare commented May 25, 2026

Summary

  • Pin libsystemd0 and libudev1 to 257.13-1~deb13u1
  • Fixes CVE-2026-40226 (low) - nspawn escape-to-host
  • Fixes CVE-2026-40225 (low) - udev local root execution
  • Fixes CVE-2026-29111 (low) - PID 1 assert/freeze
  • Fixes CVE-2026-4105 (low) - machined improper access control

Test plan

  • Docker build succeeds
  • Image scans clean for systemd CVEs

🤖 Generated with Claude Code

Copilot AI review requested due to automatic review settings May 25, 2026 18:50
@Hugo-Pare Hugo-Pare self-assigned this May 25, 2026
@Hugo-Pare Hugo-Pare added the skip_jira_status_check Skips Autobots statsu checks that verify jira issue in the PR title label May 25, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 25, 2026

✅ FOSSA Guard: Licensing (SolaceLabs_solace-agent-mesh) • PASSED

Compared against main (3cb0c3c74fd41214b4727c8eaca27d7a4f885730) • 0 new, 5 total (5 in base)

Scan Report | View Details in FOSSA

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 25, 2026

✅ FOSSA Guard: Vulnerability (SolaceLabs_solace-agent-mesh) • PASSED

Compared against main (3cb0c3c74fd41214b4727c8eaca27d7a4f885730) • 0 new, 5 total (5 in base)

Scan Report | View Details in FOSSA

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Pins Debian systemd-related runtime libraries in the container image to specific patched versions to address the CVEs listed in the PR description, ensuring reproducible and vulnerability-mitigated builds.

Changes:

  • Pinned libsystemd0 to 257.13-1~deb13u1 in the builder stage APT install list.
  • Pinned libudev1 to 257.13-1~deb13u1 in the builder stage APT install list.
  • Applied the same pins in the runtime stage APT install list.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread Dockerfile
Comment thread Dockerfile
@Hugo-Pare Hugo-Pare force-pushed the fix-systemd-vulnerabilities branch from 03417ba to daa9ebc Compare May 25, 2026 18:58
Fixes CVE-2026-40226, CVE-2026-40225, CVE-2026-29111, CVE-2026-4105
(systemd vulnerabilities - all low severity)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@Hugo-Pare Hugo-Pare force-pushed the fix-systemd-vulnerabilities branch from daa9ebc to 5bc6166 Compare May 25, 2026 19:01
@sonarqube-solacecloud
Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

@Hugo-Pare Hugo-Pare closed this May 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

skip_jira_status_check Skips Autobots statsu checks that verify jira issue in the PR title

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants