Repository navigation
fix(zeus): remediate seven v5 PCRE2 findings with native 10.49 RPMs - #20
Conversation
Build checksum-pinned upstream PCRE2 10.49 with JIT/Unicode and upstream regressions; preserve libpcre2-8.so.0 and compare every UBI exported 8-bit API. Replace both runtime and syntax RPMs after repository refresh. Verify package versions, loaded library, Git/grep and DNF dependency closure. Addresses CVE-2026-86145, -103111, -89161, -89158, -89157, -89160 and -89156 from Zeus v5. Agent: ChatGPT Work Codex /root LLM: GPT-6
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 43fc51ceec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| install -pm755 .libs/libpcre2-8.so.0.* %{buildroot}%{_libdir}/ | ||
| ln -s "$(basename .libs/libpcre2-8.so.0.*)" %{buildroot}%{_libdir}/libpcre2-8.so.0 |
There was a problem hiding this comment.
The replacement RPM packages only libpcre2-8.so.0*, but the UBI/CentOS pcre2 package being upgraded also owns and provides libpcre2-posix.so.3 (package file list). During the upgrade, RPM removes the old package's POSIX library because the new package no longer contains it, so any downstream native program using PCRE2's POSIX API will fail to load; the current symbol comparison and smoke tests miss this because they inspect only libpcre2-8. Package the newly built libpcre2-posix.so.3* alongside the 8-bit runtime.
Useful? React with 👍 / 👎.
Zeus 2.0.0-v5 contains pcre2 and pcre2-syntax 10.44-1.el10.3 even after the existing DNF refresh. Xray associates seven CVEs with pcre2-syntax; the vulnerable code is in the same source package's regex runtime. Replace both RPMs with upstream 10.49 built on UBI10.
Findings
Change and checks
Validation: local Python syntax passed. Attempt 1 passed all four upstream test-suite targets, then failed because the RPM spec used LICENCE instead of LICENCE.md. Corrected the filename and addressed review feedback to preserve the POSIX runtime and compare its exports. Attempt 2 exposed a build-directory RPATH in the POSIX library copied before libtool's installation step. Corrected packaging to use the upstream install/relink step. Attempt 3 passed: https://github.com/rcamarda390/my-docker-images/actions/runs/37069645836 (commit 1969456). All four upstream PCRE2 test targets passed, both library export comparisons had no missing symbols, RPM installation and DNF dependency checks passed, and final-image verification passed both during build and in the non-root container smoke test. Trivy completed with one HIGH (node-forge CVE-2026-85393, whose existing source-backport regression passed); the two pre-existing scoped pip-vendored VEX assessments remain unchanged. Health and blocking-scan steps were skipped by existing workflow configuration. Nothing was published. This is not an Xray rescan or clearance of the remaining report. No Docker engine is available locally.
Remaining findings and limits
The attached v5 report contains 291 distinct CVEs. This PR addresses seven, not the whole report. Existing v5 build logs already verify standalone setuptools 84.0.0 and msgpack 1.2.3, pip's scoped bundled-code assessment, and the node-forge source regression. Those Xray rows remain subject to scan review; global package upgrades do not by themselves clear bundled or RPM copies. Remaining Node/OS and AI SDK associations still need vendor/source applicability checks. No findings are hidden, no scan gate is weakened, and no clean Xray claim is made.
Next remediation targets
Risk: this temporarily carries an upstream runtime newer than UBI10's package. ABI/smoke checks and the upstream suite gate it. Remove the carry once UBI10 supplies equivalent fixes. Rollback is reverting this PR and rebuilding a new immutable revision; do not overwrite v5.
Primary sources:
Agent: ChatGPT Work Codex /root
LLM: GPT-6