From ade1e489b663bcc556729eae7c6753f652df8e5f Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Thu, 8 Oct 2026 13:09:31 -0400 Subject: [PATCH] fix(s130): openssl-libs justifications re-pinned to Red Hat's 3.5.8-2 rebuild Signed-off-by: Ayla Croft --- ci/headless/justifications.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ci/headless/justifications.yaml b/ci/headless/justifications.yaml index 61ef4ea..e99da5b 100644 --- a/ci/headless/justifications.yaml +++ b/ci/headless/justifications.yaml @@ -84,9 +84,10 @@ justifications: # openssl-libs: added by this image (the crypto NIF links libcrypto). Red Hat lists no fix for # either; `dnf upgrade` ran against the installroot at build time, so this is the newest build - # UBI's repositories carried. + # UBI's repositories carried. Re-pinned 2026-10-08 from 3.5.8-1 to Red Hat's 3.5.8-2 rebuild, which + # the scan still reports as not fixed for both. - finding: "CVE-2026-75804" - package: "openssl-libs-1:3.5.8-1.el9_8" + package: "openssl-libs-1:3.5.8-2.el9_8" packagePath: null severity: "high" scanSource: "grype" @@ -97,7 +98,7 @@ justifications: application implements TLS in Erlang without libssl. Red Hat lists no fix; the build ran dnf upgrade, so this is the newest openssl-libs UBI carried. - finding: "CVE-2026-84782" - package: "openssl-libs-1:3.5.8-1.el9_8" + package: "openssl-libs-1:3.5.8-2.el9_8" packagePath: null severity: "high" scanSource: "grype"