Repository navigation
Security: Upgrade curl to 8.23.0 in the Alpine images - #743
Open
MarjovanLier wants to merge 1 commit into
Open
MarjovanLier wants to merge 1 commit into
MarjovanLier wants to merge 1 commit into
Conversation
The official PHP Alpine 3.23 and 3.24 images still ship curl and libcurl 8.22.0-r0, which Trivy reports as critical (CVE-2026-86409 and seven related CVEs). Alpine already publishes 8.23.0-r0, so every variation now lists both packages and the install helper upgrades them at build time, the same way as the Brotli fix. Debian is not changed: apt has no newer curl for Bookworm or Trixie. Remove the packages once the official images ship 8.23.0. Signed-off-by: Marjo Wenzel van Lier <marjo.vanlier@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR upgrades
curlandlibcurlto 8.23.0-r0 in every Alpine image.curlandlibcurlinDEPENDENCY_PACKAGES_ALPINEdocker-php-serversideup-dep-install-alpinerunsapk add --upgrade, so a listed package is upgraded to the patched versioncurl 8.22.0 CVEs
Trivy reports curl 8.22.0-r0 as critical (CVSS 9.1, "HTTP/2 upload Use-After-Free") and lists these CVEs as fixed in 8.23.0-r0:
CVE-2026-86409, CVE-2026-86410, CVE-2026-86411, CVE-2026-86412, CVE-2026-87866, CVE-2026-92386, CVE-2026-92387, CVE-2026-92392
The published images are affected. For example,
serversideup/php:8.5-fpm-nginx-alpine-v5.0.5shipscurl-8.22.0-r0andlibcurl-8.22.0-r0. PHP's curl extension, FrankenPHP (linked with-lcurl) and theHEALTHCHECKof the web server images all use the system libcurl, so the package upgrade covers all of them.8.22.0-r08.23.0-r08.22.0-r08.23.0-r08.14.1-r28.14.1-r4, the latest in the 3.22 repositoryI did not check whether
8.14.1-r4contains fixes for these CVEs.Debian is not changed. In
php:8.5-fpm-bookwormandphp:8.5-fpm-trixie, apt has no newer curl than the installed7.88.1-10+deb12u15and8.14.1-2+deb13u7.Remove the packages once the official images ship 8.23.0, the same as the Brotli packages from #737.
fpm-apachehas no Alpine images, but it gets the same lines so that all five Dockerfiles stay the same, as withbrotli-libs.Tested locally
All arm64, PHP 8.5.12.
8.23.0-r0, and PHPcurl_version()reports 8.23.08.23.0-r0hadolint passes on all five Dockerfiles. CI is the first build of fpm, frankenphp, Alpine 3.22 and amd64. This PR comes from a fork, so the arm64 image tests run only when a maintainer starts "Docker Publish (PR Images)" with this PR number.
How to test
scripts/dev.sh --variation fpm-nginx --version 8.5 --os alpine3.24 docker run --rm --entrypoint sh serversideup/php:8.5-fpm-nginx-alpine3.24 -c 'apk info -v | grep curl' scripts/test-image.sh serversideup/php:8.5-fpm-nginx-alpine3.24Release
The production workflow builds from the latest release tag, and the weekly rebuild also uses that tag (
v5.0.5). The fix reaches the public tags only after a new release, for examplev5.0.6.