External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-10-30 06:13:24 -02:30
Code Issues Packages Projects Releases Wiki Activity

Bump Brotli to address CVE-2026-111497 (#16759)

Browse Source 
CVE-2026-111497 - Bump Brotli to 1.2.1

Add Brotli>=1.2.1 pin to requirements.in to address CVE-2026-111497
(Out-of-Bounds Write in Google Brotli Decoder).
Regenerated requirements.txt via make docker_update_requirements.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Jake Jackson <24478650+thedoubl3j@users.noreply.github.com>
This commit is contained in:
Rodrigo Toshiaki Horie
2026-10-27 14:48:47 -03:00
committed by GitHub
co-authored by Claude Sonnet 4.6 Jake Jackson
parent 53ee6a4a52
commit b6a16ac82a
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
requirements/requirements.in
+1
View File
@@ -6,6 +6,7 @@ azure-identity
azure-keyvault azure-keyvault
boto3 boto3
botocore botocore
Brotli>=1.2.1 # CVE-2026-111497, required by aiohttp[speedups]
cachetools # Used by awx/conf/settings.py for TTLCache cachetools # Used by awx/conf/settings.py for TTLCache
channels channels
channels-redis channels-redis
requirements/requirements.txt
+4 -2
View File
@@ -76,8 +76,10 @@ botocore==1.40.46
# -r /awx_devel/requirements/requirements.in # -r /awx_devel/requirements/requirements.in
# boto3 # boto3
# s3transfer # s3transfer
brotli==1.2.0 brotli==1.2.1
# via aiohttp # via
# -r /awx_devel/requirements/requirements.in
# aiohttp
cachetools==6.2.0 cachetools==6.2.0
# via -r /awx_devel/requirements/requirements.in # via -r /awx_devel/requirements/requirements.in
# certifi @ git+https://github.com/ansible/system-certifi.git@devel # git requirements installed separately # certifi @ git+https://github.com/ansible/system-certifi.git@devel # git requirements installed separately