From 8d2c832159c362ea09a74488317dacd3eadb4b67 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20A=2EP?=
 <53834183+Jossec101@users.noreply.github.com>
Date: Mon, 26 Oct 2026 13:39:02 +0100
Subject: [PATCH] fix: swap the Lambda base image's .NET 10.0.13 runtime for
 10.0.14 (CVE-2026-111497)

---
 RemoteSigner/Dockerfile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/RemoteSigner/Dockerfile b/RemoteSigner/Dockerfile
index 5f81a73..73a43e4 100644
--- a/RemoteSigner/Dockerfile
+++ b/RemoteSigner/Dockerfile
@@ -1,4 +1,12 @@
+FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/aspnet:10.0.14 AS runtime
+
 FROM --platform=linux/amd64 public.ecr.aws/lambda/dotnet:10 AS base
+# The Lambda base image still ships .NET 10.0.13, vulnerable to CVE-2026-111497 (Brotli decoder).
+# Swap in the patched 10.0.14 runtime; drop this once the base image ships 10.0.14 or later.
+RUN rm -rf /var/lang/bin/shared/Microsoft.NETCore.App/10.0.13 /var/lang/bin/shared/Microsoft.AspNetCore.App/10.0.13
+COPY --from=runtime /usr/share/dotnet/shared/Microsoft.NETCore.App/10.0.14 /var/lang/bin/shared/Microsoft.NETCore.App/10.0.14
+COPY --from=runtime /usr/share/dotnet/shared/Microsoft.AspNetCore.App/10.0.14 /var/lang/bin/shared/Microsoft.AspNetCore.App/10.0.14
+ENV DOTNET_VERSION=10.0.14
 
 FROM --platform=linux/amd64 mcr.microsoft.com/dotnet/sdk:10.0 as build
 WORKDIR /src