redmine:6.1 ships unpatched libbrotli1 (CVE-2026-111497)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
Research direction
Start with the Dockerfile and image build configuration for the redmine:6.1 tag, then check how the Debian base image selects security updates. Rebuild the image so it contains libbrotli1 version 1.1.0-2+deb13u1; verify the resulting package version and image digest.
Written by the indexing model from the issue text.
Description
The current redmine:6.1 image includes libbrotli1 1.1.0-2+b7, which is affected by CVE-2026-111497 (out-of-bounds write in the Brotli decoder, public PoC available).
Debian fixed this in 1.1.0-2+deb13u1 (DSA-6582-1, trixie-security, 23 Oct 2026).
Could the image be rebuilt so it picks up the fixed package?
- Image:
redmine:6.1 - Digest:
sha256:df99e23e481281e3570eb7eb532655b0031f7a8c7195fe82d8b305b42882da73
- Dominant language
- Shell
- Stars
- 236
- Forks
- 171
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker-library/redmine
-
Difficulty 3/5 1-2 days Newbie friendliness 51/100
docker-library/redmine#429 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
docker-library/redmine#428 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
docker-library/redmine#408 · 1 reaction ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
docker-library/redmine#403 · 1 comment ·
-
Difficulty 2/5 Half a day Newbie friendliness 50/100
docker-library/redmine#388 · 1 comment ·
All issues in docker-library/redmine
Similar issues
-
Renovate config partially updates OVMS URLPossibly taken @farshidtz claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
Regression: IME preedit still shown in plaintext on lock/polkit — #13002 fix is not in 4.0.6Possibly taken @AnPod claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
fullsend-ai/agents#1833 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
gnosis/gnosis_vpn#661 ·
Maintainers usually reply within 1 day
-
triage
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
github/copilot-cli#5287 ·