search

zodern / meteor-up

Production Quality Meteor Deployment to Anywhere
http://meteor-up.com/
MIT License
1.27k stars 280 forks source link

Request: Upgrade nginx version to 1.22.1 to avoid Memory Disclosure vulnerability #1367

Open wildhart opened 4 days ago

wildhart commented 4 days ago

A new deployment with mup latest (v1.5.11) uses docker image zodern/nginx-proxy:v1.1.0 which contains nginx 1.21.6.

After some vulnerability testing, I get this report:

image

Would it be possible to update nginx to >= 1.22.1

Looks like it would have to use nginx-proxy:1.02 which would give nginx:1.23.2

It would be useful if we could specify a custom nginx docker image in the mup.js file somewhere - could that be possible?

wildhart commented 4 days ago

Apologies, this is probably a dupe of #1348 and #1228, but I just wanted to higlight that the current verison inludes vulnerabilities...