From c46997c137043d6dc133f8704d1b87a9cc113d93 Mon Sep 17 00:00:00 2001 From: Sebastian Szyja Date: Mon, 26 Oct 2026 20:42:09 +0100 Subject: [PATCH] fix(security): upgrade curl and libcurl in runtime images CVE-2026-92392 (HIGH) affects curl and libcurl 8.22.0-r0, which the runtime images inherit from their pinned base images (PHP 8.5.12 FPM and PostgreSQL 18.6 on Alpine 3.24, Caddy 2.11.7 on Alpine 3.23). The scan of run 40383573386 fails for api-prod, edge-prod and db. The api and edge images now install curl and libcurl >= 8.23.0-r0 and the db image libcurl >= 8.23.0-r0 (it has no curl tool) with apk add --upgrade, so the build fails if the fixed version is unavailable. The current builds of the base image tags predate the fixed packages, so a digest refresh would not fix it. The scan policy is unchanged and no exception was added; the upgrade is removed once the base images ship the fix (documented in docs/security/container-vulnerabilities.md). --- docker/api/Dockerfile | 7 +++--- docker/db/Dockerfile | 8 ++++--- docker/edge/Dockerfile | 7 +++--- docs/security/container-vulnerabilities.md | 26 ++++++++++++++++++++++ 4 files changed, 39 insertions(+), 9 deletions(-) diff --git a/docker/api/Dockerfile b/docker/api/Dockerfile index ba72f9e..c729eb5 100644 --- a/docker/api/Dockerfile +++ b/docker/api/Dockerfile @@ -11,10 +11,11 @@ ARG COMPOSER_IMAGE=composer:2.9.7@sha256:02062f7719ec9433a9d4256cfba1c792db96dc9 FROM ${COMPOSER_IMAGE} AS composer FROM ${PHP_IMAGE} AS base -# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base -# image still ships; remove once the base includes it +# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and curl/libcurl +# >= 8.23.0-r0 fix CVE-2026-92392 (HIGH), which the pinned base image still +# ships; remove once the base includes them # (docs/security/container-vulnerabilities.md). -RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' \ +RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0' \ && apk add --no-cache fcgi postgresql-libs \ && apk add --no-cache --virtual .build-deps $PHPIZE_DEPS postgresql-dev \ && docker-php-ext-install -j"$(nproc)" pdo_pgsql \ diff --git a/docker/db/Dockerfile b/docker/db/Dockerfile index becf190..fcfe378 100644 --- a/docker/db/Dockerfile +++ b/docker/db/Dockerfile @@ -8,9 +8,11 @@ ARG POSTGRES_IMAGE=postgres:18.6-alpine3.24@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873 FROM ${POSTGRES_IMAGE} -# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base -# image still ships (docs/security/container-vulnerabilities.md). -RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' \ +# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and libcurl +# >= 8.23.0-r0 fixes CVE-2026-92392 (HIGH), which the pinned base image still +# ships (docs/security/container-vulnerabilities.md). The base image has +# libcurl but no curl tool, so only the library is upgraded. +RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'libcurl>=8.23.0-r0' \ && rm -f /usr/local/bin/gosu # Database roles (ADR-018): created on a new volume by the initdb hook, and # checked or upgraded by bin/devenv through flowcrm-db-roles. diff --git a/docker/edge/Dockerfile b/docker/edge/Dockerfile index 6cc6156..d421000 100644 --- a/docker/edge/Dockerfile +++ b/docker/edge/Dockerfile @@ -20,9 +20,10 @@ COPY docker/edge/caddy/main.go ./ RUN go build -trimpath -ldflags "-s -w" -o /out/caddy . && /out/caddy version FROM ${CADDY_IMAGE} AS caddy-base -# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base -# image still ships (docs/security/container-vulnerabilities.md). -RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' +# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and curl/libcurl +# >= 8.23.0-r0 fix CVE-2026-92392 (HIGH), which the pinned base image still +# ships (docs/security/container-vulnerabilities.md). +RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0' # The rebuilt binary has no file capabilities: port 8080 needs none, and a # container without capabilities could not exec a binary that requests one. COPY --from=caddy-build /out/caddy /usr/bin/caddy diff --git a/docs/security/container-vulnerabilities.md b/docs/security/container-vulnerabilities.md index 57a411a..bf58b60 100644 --- a/docs/security/container-vulnerabilities.md +++ b/docs/security/container-vulnerabilities.md @@ -159,6 +159,32 @@ repositories. No base image ships it yet, so `docker/api/Dockerfile`, version cannot be installed). Remove the upgrade when the pinned base images include the fix. No exception was added. +## CVE-2026-92392: `curl` and `libcurl` (runtime images) + +Published after the last green scan of `main` (run 40223497868, +2026-10-25); found by the scan of PR #38 (run 40383573386, 2026-10-26), not +by a change of the project. The Alpine packages `curl` and `libcurl` +8.22.0-r0 (HIGH) come from the pinned base images: + +| Image | Base (Alpine) | Affected packages | +|---|---|---| +| api (`prod`, `dev`) | PHP 8.5.12 FPM (3.24.2) | `curl`, `libcurl` | +| edge (`prod`, `dev`) | Caddy 2.11.7 (3.23.6) | `curl`, `libcurl` | +| db | PostgreSQL 18.6 (3.24.2) | `libcurl` (no `curl` tool) | + +8.23.0-r0 fixes it and is in the Alpine 3.23 and 3.24 `main` repositories +for x86_64 and aarch64 (built 2026-10-25). The current builds of the base +image tags were created on 2026-10-21, before the fix, so refreshing the +pinned digests would not help. `docker/api/Dockerfile` and +`docker/edge/Dockerfile` upgrade both packages +(`apk add --upgrade 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0'`), +`docker/db/Dockerfile` upgrades `libcurl` only, so no package is added to an +image; the build fails if the fixed version cannot be installed. The +project's own health checks do not use `curl` (they use `cgi-fcgi` and +`wget`), but the packages belong to the base images and are not removed. +Remove the upgrade when the pinned base images include the fix. No exception +was added. + ## Deferred hardening items - `framework.trusted_hosts` is not configured: behind the edge, Symfony