@swamp/cve/http2shell: Ubuntu missing from LIBBROTLI_TRACKER and NODE_TRACKER

1h ago

#4256

CI: an accepted attestation approves the PR, and anything else fails the attestation job

2h ago

#4248

Scheduled flaky-test detection is failing

5h ago

#4238

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

7h ago

#4236

Failed remote methods lose named command-result output handles at Serve

Team12h ago

#4235

Whole run-index rewrites block serve dispatch as retained inputs grow

Team13h ago

#4234

Worker control WebSocket reports Frame too large and aborts small native dispatches

Team13h ago

#4233

Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history

15h ago

#4232

Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild

1d ago

#4225

vault put --server: accept the value on stdin (keep secrets out of argv)

Team1d ago

#4224

swamp serve exhausts its heap when a workflow's run history carries large inputs: every run save parses and rewrites the whole .runs-index.json

15h ago

#4223

Hot reload can keep an old local behavior registry and memoized bundle after external catalog indexing (1602; e459 regression passes)

Team1d ago

#4222

Add expiring service-account token requests and authorization checks to RBAC

Team1d ago

#4217

Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

1d ago

#4215

verify-build upgrade gate silently skips models whose version is a constant

1d ago

#4213

@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling

1d ago

#4212

agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)

1d ago

#4210

agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)

2d ago

#4208

Docs: document the datastore durable setting and its macOS ordering in the manual

1d ago

#4203

Docs: working offline against swamp serve (leases, outbox, flush, quarantine) for swamp-club#4195

1d ago

#4202

Swamp Club collective GUI: show the swamp serve instances currently connected to a collective

Enterprise1d ago

#4200

Docs: swamp data query --sort, --cursor and nextCursor in the data reference

1d ago

#4199

A malformed --ca-cert file is reported as an unreadable OS certificate store

2d ago

#4198

TLS hint blames a missing root CA and macOS for every invalid peer certificate failure

2d ago

#4196

workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS

2d ago

#4193

S3/GCS repairUnpushedFiles: the pull it asks for after a lost last-synced index does not stop it re-uploading copies a peer deleted

2d ago

#4190

swamp-uat private-registry tests leave npm/<port> dirs in the shared Deno cache

2d ago

#4188

Read-model catch-up of many data versions slows sharply under load

2d ago

#4186

A resume runs settled work after the teardown gated on it has already run, and nothing tears that work down

2d ago

#4184

A step settled after the abort overwrites the expression-context entry of a same-named step that ran in another job

2d ago

#4183

The extractContentMetadata property test generates invalid source and fails at random

2d ago

#4181

A limited model.output.search copies and sorts the whole listing on the event loop for each request, so that step still scales with the window

2d ago

#4179

A lone step in a job still starts under the aborted signal when another job has suspended the run

2d ago

#4170

CLI command to change an existing extension's visibility (private → public)

Team2d ago

#4169

Docs: team-mode model leases (swamp behavior lease, lease status in datastore lock status)

1d ago

#4165

serve (token mode): --admins accepts idp-group entries that can never match

2d ago

#4163

build-swamp-extension example: code-review isn't given the quality evidence, so the reviewer reports quality as missing

Team2d ago

#4162

Filesystem control-plane put races empty-parent cleanup (cron pending-run ENOENT)

Team2d ago

#4161

deployment: getLogs method (deployment-aware pod log tailing)

2d ago

#4158

Agent sessions extension: import Codex sessions

2d ago

#4147

model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)

3d ago

#4132

Docs: v3 serve team mode, followers forward writes and the advertise-address and ca-cert serve flags (swamp-club#4120)

3d ago

#4131

Skill/docs: document registry listing limits, static-extraction rules, and splitting large APIs by domain

3d ago

#4130

Check registry listing limits in extension quality/push and suggest splitting into per-domain extensions

3d ago

#4129

Over-limit contentMetadata publishes a blank extension page; archive fallback extracts nothing

3d ago

#4127

swamp inbox: with a filter active, sitting on the last row pages through the whole inbox in the background

3d ago

#4124

@swamp/video/brand: follow-ups from the initial review (render hang, odd sizes, Chromium errors)

3d ago

#4119

@swamp/video: follow-ups from the initial review (card length, input validation, OCR frames on disk)

3d ago

#4106

@swamp/video/hyprland: recording hotkeys, retake marker and phone-mirror window rules

3d ago

#4105

@swamp/video/obs: optional OBS recording with per-person hardware config for @swamp/video

3d ago

← Back to list

01Issue

BugOpenExtensionsPublic

AssigneesNone

Relationships

#4259 @swamp/cve/http2shell: Ubuntu missing from LIBBROTLI_TRACKER and NODE_TRACKER

Opened by muck · 11/1/2026

Problem

The scanner reports Ubuntu hosts as Medium for CVE-2026-111497 even after the distro fix is installed. LIBBROTLI_TRACKER and NODE_TRACKER in models/_lib/advisory.ts have no Ubuntu entries, so the check cannot recognise a backported fix and judges the version string alone. Ubuntu keeps the upstream version number when it backports, so a fixed package still looks old.

Observed

On Ubuntu 26.04 with libbrotli1 1.2.0-3ubuntu0.1 installed, the scanner reports a Medium finding. Ubuntu lists that build as fixed, and lists its nodejs package as not affected.

Expected

No finding on an Ubuntu host running a fixed build.

Suggested fix

Add Ubuntu entries to both trackers, for example from USN-8956:

26.04 libbrotli1: fixed in 1.2.0-3ubuntu0.1
24.04 (noble) fixed build: 1.1.0-2ubuntu0.1
nodejs: not affected

Environment

Extension version 2026.10.25.1, tracker snapshot 2026-10-24T18:00Z
There is no config option to supply a distro fix or suppress the finding

Related: #3889

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

Extension: @swamp/cve/http2shell@2026.10.25.1
swamp: 20261030.222321.0-sha.709f5920
OS: darwin (aarch64)
Deno: 2.9.8
Shell: /bin/zsh

02Bog Flow

Open

11/1/2026, 11:01:37 PM

No activity in this phase yet.

03Sludge Pulse

system commented 11/1/2026, 11:01:37 PM

Classified automatically when this issue was filed.

Source: Extensions

If you feel this classification is incorrect, add a ripple to tell us so.