Upgrading libbrotli package for existing versions of CloudBees CI

Last Reviewed:2026-11-06()
3 minute readKnowledge base

Issue

In the security advisory https://www.cloudbees.com/security-advisories/cloudbees-security-advisory-2026-10-28

There is a vulnerability in the libbrotli package shipped with CloudBees CI container images prior to version 2.580.2.38434:

CloudBees CI bundles version of libbrotli vulnerable to CVE-2026-111497

Environment

Resolution

This issue is resolved in CloudBees CI version 2.580.2.38434.

Workaround

These workarounds are not applicable to versions of CloudBees CI that are older than 2.528.2.34846, or already at or above 2.580.2.38434.

There are also other CVEs fixed in that release, and this article does not work around those: https://www.cloudbees.com/security-advisories/cloudbees-security-advisory-2026-10-28

We have developed and published a workaround for one such issue from the same advisory: eMudhra intermediate CA compromise workarounds for CloudBees CI

Each workaround below upgrades the libbrotli package to a newer version that is not affected by the issue. The corrected version of the package is "libbrotli-1.0.9-10.el9_8.1".

CloudBees CI on modern cloud platforms

  1. Create a Dockerfile that creates a patched version of the affected operations center image:

    FROM cloudbees/cloudbees-cloud-core-oc:YOUR_CURRENT_TAG AS base

FROM registry.access.redhat.com/ubi9 AS build
COPY --from=base / /cbroot
RUN dnf update -y && \
    dnf install --installroot /cbroot -y --setopt=install_weak_deps=False libbrotli && \
    dnf clean --installroot /cbroot all

FROM base
COPY --from=build /cbroot/ .
    ▼

    Replace YOUR_CURRENT_TAG with the tag of the image currently deployed.

  2. Build the patched image:

    docker image build -t cloudbees/cloudbees-cloud-core-oc:YOUR_CURRENT_TAG-libbrotli-patch .
    ▼

    Replace YOUR_CURRENT_TAG with the tag of the image currently deployed.

  3. Create a Dockerfile that creates a patched version of the affected controller image:

    FROM cloudbees/cloudbees-core-mm:YOUR_CURRENT_TAG AS base

FROM registry.access.redhat.com/ubi9 AS build
COPY --from=base / /cbroot
RUN dnf update -y && \
    dnf install --installroot /cbroot -y --setopt=install_weak_deps=False libbrotli && \
    dnf clean --installroot /cbroot all

FROM base
COPY --from=build /cbroot/ .
    ▼

    Replace YOUR_CURRENT_TAG with the tag of the image currently deployed.

  4. Build the patched image:

    docker image build -t cloudbees/cloudbees-core-mm:YOUR_CURRENT_TAG-libbrotli-patch .
    ▼

  5. Redeploy your controller and operations center containers using the YOUR_CURRENT_TAG-libbrotli-patch image.

    1. Tag the container images for your registry, and push them to your registry.

    2. Configure your operations center to that registry using the helm values:

      OperationsCenter:
  image:
    # OperationsCenter.image.registry -- Docker registry for {OC}
    registry: TODO
    # OperationsCenter.image.repository -- Docker image repository for {OC}
    repository: 'cloudbees-cloud-core-oc'
    # OperationsCenter.image.tag -- Docker image tag for {OC}
    tag: TODO
    # OperationsCenter.image.pullPolicy -- https://kubernetes.io/docs/concepts/containers/images/#updating-images
    pullPolicy: null
  # Image pull secrets
  # Enable this option when using a private registry.
  # https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-by-providing-credentials-on-the-command-line
  # OperationsCenter.ImagePullSecrets -- Name of image pull secret to pull private Docker images or an array of image pull secrets
  ImagePullSecrets: TODO
      ▼

    3. The controller workaround can be deployed by following Using private image repository in operations center controller provisioning

CloudBees CI on traditional platforms running in containers

  1. Create a Dockerfile that creates a patched version of the affected operations center image:

    FROM cloudbees/cloudbees-core-oc:YOUR_CURRENT_TAG AS base

FROM registry.access.redhat.com/ubi9 AS build
COPY --from=base / /cbroot
RUN dnf update -y && \
    dnf install --installroot /cbroot -y --setopt=install_weak_deps=False libbrotli && \
    dnf clean --installroot /cbroot all

FROM base
COPY --from=build /cbroot/ .
    ▼

    Replace YOUR_CURRENT_TAG with the tag of the image currently deployed.

  2. Build the patched image:

    docker image build -t cloudbees/cloudbees-core-oc:YOUR_CURRENT_TAG-libbrotli-patch .
    ▼

  3. Create a Dockerfile that creates a patched version of the affected controller image:

    FROM cloudbees/cloudbees-core-cm:YOUR_CURRENT_TAG AS base

FROM registry.access.redhat.com/ubi9 AS build
COPY --from=base / /cbroot
RUN dnf update -y && \
    dnf install --installroot /cbroot -y --setopt=install_weak_deps=False libbrotli && \
    dnf clean --installroot /cbroot all

FROM base
COPY --from=build /cbroot/ .
    ▼

    Replace YOUR_CURRENT_TAG with the tag of the image currently deployed.

  4. Build the patched image:

    docker image build -t cloudbees/cloudbees-core-cm:YOUR_CURRENT_TAG-libbrotli-patch .
    ▼

  5. Redeploy your controller and operations center containers using the YOUR_CURRENT_TAG-libbrotli-patch images.

Verify the workaround

Run the patched containers, and then run the following command inside of the container to verify that the library has been successfully updated:

sha1sum /usr/lib64/libbrotlienc.so.1.0.9
▼

A successful verification of the workaround will display the SHA1 checksum of the updated library from "libbrotli-1.0.9-10.el9_8.1" for your CPU architecture (note that this will change when UBI9 is updated):

4eb5f2f00639c17c550a5bee3f3c00353102c762  /usr/lib64/libbrotlienc.so.1.0.9 (on arm64 architecture)
be22a097e1301721a93631627fa9d47f12492a60  /usr/lib64/libbrotlienc.so.1.0.9 (on amd64 architecture)
▼

A failed verification will indicate that the library has a different checksum, such as:

c8df2cd7061ff563434e70c27489ada95d3611d1  /usr/lib64/libbrotlienc.so.1.0.9
▼
This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.