search

yiisoft / yii2-docker

Official Docker images suitable for Yii 2.0
https://www.yiiframework.com/
BSD 3-Clause "New" or "Revised" License
381 stars 202 forks source link

Curl/libcurl vulnerabilities #171

Closed novakovicdavid closed 9 months ago

novakovicdavid commented 11 months ago

Hello,

Details of the announced curl vulnerabilities have been released to the public:

https://github.com/curl/curl/discussions/12026 https://curl.se/docs/CVE-2023-38545.html https://curl.se/docs/CVE-2023-38546.html

I believe ex. docker image yiisoftware/yii2-php:8.2-apache ships with a vulnerable version of curl/libcurl.

Is it being looked into?

Thanks in advance!

schmunk42 commented 11 months ago

It has to be fixed in the underlying Debian image, then it has to be built on Docker Hub, this triggers a rebuild of PHP images on Docker Hub, then we can (manually) trigger an update or wait for the weekly builds.

If you see that the bug is fixed in the PHP (base-)image, let us know.

schmunk42 commented 9 months ago

This should be fixed, please reopen if not.