From a74eb133c4d94dbe65e3aa11b0cc60acdce938a8 Mon Sep 17 00:00:00 2001 From: Prakash Surya Date: Thu, 9 Jul 2026 17:55:42 +0000 Subject: [PATCH] DLPX-97858 misc-debs: backport gzip 1.12-1ubuntu3.2 (USN-8512-1) Pin the fixed Ubuntu USN-8512-1 gzip binary (1.12-1ubuntu3.2) into the release appliance via misc-debs. Remediates CVE-2026-41992 (DLPX-97858). The release build ships 1.12-1ubuntu3.1. Co-Authored-By: Claude Opus 4.8 (1M context) --- packages/misc-debs/config.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/packages/misc-debs/config.sh b/packages/misc-debs/config.sh index 19fa7c7..7e5162c 100644 --- a/packages/misc-debs/config.sh +++ b/packages/misc-debs/config.sh @@ -53,6 +53,12 @@ function fetch() { # Source: https://s3.amazonaws.com/mountpoint-s3-release/latest/x86_64/mount-s3.deb # Required by HM-5952 (Hyperscale Snowflake connector S3 staging mounts). DLPXECO-13872. "mount-s3_1.22.3_amd64.deb 259a793b1233258b35ce5ce902df177393542fd76dd2a606f07e800e28591df6" + # + # gzip 1.12-1ubuntu3.2 - Ubuntu USN-8512-1 (Gzip vulnerability). + # Pin the fixed gzip binary into the release appliance to remediate + # CVE-2026-41992 (DLPX-97858). + # Fetched from the Ubuntu 24.04 LTS (noble) noble-security/noble-updates archive. + "gzip_1.12-1ubuntu3.2_amd64.deb 4067522fbffe22672e4cf683bfc32e4a304bc872cf76f10049ab36d1a9eedb91" ) local url="http://artifactory.delphix.com/artifactory/linux-pkg/misc-debs"