search

docker-library / php

Docker Official Image packaging for PHP
https://php.net
MIT License
3.77k stars 2k forks source link

release a new version to solve curl high CVE #1449

Closed mvisser-nhb closed 9 months ago

mvisser-nhb commented 9 months ago

curl 8.4 is out on alpine package manager with a fix. https://pkgs.alpinelinux.org/packages?name=curl&branch=edge&repo=&arch=&maintainer=

please do a release of all images with curl version >=7.69

More information about the vulneribility here: https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/

jamesmehorter commented 9 months ago

+1

There were actually two cve patched in 8.4

yosifkit commented 9 months ago

Yup, already planning on it: https://github.com/docker-library/official-images/pull/15508#issuecomment-1754068543

mgriego commented 9 months ago

hey @yosifkit , it looks like that covers the Debian base images... what about the downstream images? This issue is specifically about the PHP images, which are downstream of the alpine, debian, etc images...? I'm not seeing any updates yet for this one.

yosifkit commented 9 months ago

All images FROM debian will be rebuilt. That's how the official images are designed; every image update causes dependent images to rebuild (which can take some time). You can see the build queue on the Official Images build server: https://doi-janky.infosiftr.net/

mgriego commented 9 months ago

I don't envy that build server........

tobybellwood commented 9 months ago

I may not have looked in the right place, but I can't see an equivalent FROM alpine job running - is that in the schedule for later, or are we better to overpatch ourselves for now, given the load on the build server?

maxvisser commented 9 months ago

I would highly recommend to maybe force update this repo by adding something like:

apk add --no-cache 'curl>=8.4' `# temp version pinning needed for CVE fix`

I added this to my downstream project. @tobybellwood @mgriego

maxvisser commented 9 months ago

made a PR to fix this ASAP. I see that it is still not triggered @yosifkit https://github.com/docker-library/php/pull/1451

jamesmehorter commented 9 months ago

Why was this closed? The alpine PHP images have not yet been updated?

https://hub.docker.com/_/php/tags?page=1&name=alpine

jamesmehorter commented 9 months ago

@J0WI please advise thank you

I see some new 8.3 images at the link above, and some 8.2 images were updated, but what about all the others?

LaurentGoderre commented 8 months ago

The latest minor versions of all of those were updated with the fix.