search

roottusk / vapi

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.
GNU General Public License v3.0
1.17k stars 303 forks source link

Updating php/apache base image #27

Closed AndyG-0 closed 2 years ago

AndyG-0 commented 2 years ago

The php/apache base image in the dockerfile has some known vulnerabilities in it. Upgrading to the latest version(php:8.1.2-apache) removes the vulnerabilities but breaks the code. I have not had time to dig into the errors yet to see what it would take to get it to work with the latest php docker image.

roottusk commented 2 years ago

I think version 8.x and 7.x would be having major syntax changes , I tried running with php:7.4.26-apache image and it seems to run well ( yet to get into any error) , migrating it to 8.x though would require some work .

AndyG-0 commented 2 years ago

Not sure why I didn't try a higher minor version of the major version first but I can say that php:7.4.27-apache removes any critical vulnerabilities. I haven't had a chance to fully test yet but I'm guessing it's probably ok. 7.4.26 had less vulnerabilities but still had some.

AndyG-0 commented 2 years ago

28 would also update this to 7.4.27.