search

docker-library / php

Docker Official Image packaging for PHP
https://php.net
MIT License
3.77k stars 2k forks source link

Apache HTTP Server 2.4.58 security fixes for: CVE-2023-45802, CVE-2023-43622, and CVE-2023-31122 #1453

Closed adeleke-aat closed 7 months ago

adeleke-aat commented 8 months ago

Apache HTTP Server 2.4.58 was released on 19/10/23 which includes security fixes for CVE-2023-45802, CVE-2023-43622, and CVE-2023-31122

yosifkit commented 8 months ago

The php images just use Apache HTTP server from Debian packages and there are no fixes available, so there is nothing we can do to update the image. (The Debian Security Team is very good at applying fixes for important security updates; I am unsure why there is no message as to why they are not fixed.)

adeleke-aat commented 8 months ago

Okay, thanks for the response.

tianon commented 7 months ago

See also https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves

webaholik commented 5 months ago

@yosifkit - This may need to be reopened at this point these 3 CVEs shouldn't continue to sit around. The Docker image for httpd:latest also uses Debian, and they have Apache 2.4.58 included.

Please review:

tianon commented 5 months ago

We get our builds of Apache2 from Debian, and the Debian Security Team have declined to fix these (" (Minor issue)" as noted above), and Docker Hub's vulnerability scanning takes this into account: https://hub.docker.com/layers/library/php/apache/images/sha256-ebaa9b96a98463fe81241d70b37e24b3ed885706349aaa55aa43c475704f5c22?context=explore (this is the current php:apache on amd64 -- note these three are not listed there either)