Skip to content

fix(security): upgrade curl and libcurl in runtime images #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
knittingcode merged 1 commit into from
Oct 26, 2026
Merged

fix(security): upgrade curl and libcurl in runtime images #39

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions docker/api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,11 @@ ARG COMPOSER_IMAGE=composer:2.9.7@sha256:02062f7719ec9433a9d4256cfba1c792db96dc9
FROM ${COMPOSER_IMAGE} AS composer

FROM ${PHP_IMAGE} AS base
# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base
# image still ships; remove once the base includes it
# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and curl/libcurl
# >= 8.23.0-r0 fix CVE-2026-92392 (HIGH), which the pinned base image still
# ships; remove once the base includes them
# (docs/security/container-vulnerabilities.md).
RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' \
RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0' \
&& apk add --no-cache fcgi postgresql-libs \
&& apk add --no-cache --virtual .build-deps $PHPIZE_DEPS postgresql-dev \
&& docker-php-ext-install -j"$(nproc)" pdo_pgsql \
Expand Down
8 changes: 5 additions & 3 deletions docker/db/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,11 @@
ARG POSTGRES_IMAGE=postgres:18.6-alpine3.24@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873

FROM ${POSTGRES_IMAGE}
# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base
# image still ships (docs/security/container-vulnerabilities.md).
RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' \
# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and libcurl
# >= 8.23.0-r0 fixes CVE-2026-92392 (HIGH), which the pinned base image still
# ships (docs/security/container-vulnerabilities.md). The base image has
# libcurl but no curl tool, so only the library is upgraded.
RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'libcurl>=8.23.0-r0' \
&& rm -f /usr/local/bin/gosu
# Database roles (ADR-018): created on a new volume by the initdb hook, and
# checked or upgraded by bin/devenv through flowcrm-db-roles.
Expand Down
7 changes: 4 additions & 3 deletions docker/edge/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,10 @@ COPY docker/edge/caddy/main.go ./
RUN go build -trimpath -ldflags "-s -w" -o /out/caddy . && /out/caddy version

FROM ${CADDY_IMAGE} AS caddy-base
# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH), which the pinned base
# image still ships (docs/security/container-vulnerabilities.md).
RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0'
# brotli-libs >= 1.2.1-r0 fixes CVE-2026-111497 (HIGH) and curl/libcurl
# >= 8.23.0-r0 fix CVE-2026-92392 (HIGH), which the pinned base image still
# ships (docs/security/container-vulnerabilities.md).
RUN apk add --no-cache --upgrade 'brotli-libs>=1.2.1-r0' 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0'
# The rebuilt binary has no file capabilities: port 8080 needs none, and a
# container without capabilities could not exec a binary that requests one.
COPY --from=caddy-build /out/caddy /usr/bin/caddy
Expand Down
26 changes: 26 additions & 0 deletions docs/security/container-vulnerabilities.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,32 @@ repositories. No base image ships it yet, so `docker/api/Dockerfile`,
version cannot be installed). Remove the upgrade when the pinned base
images include the fix. No exception was added.

## CVE-2026-92392: `curl` and `libcurl` (runtime images)

Published after the last green scan of `main` (run 40223497868,
2026-10-25); found by the scan of PR #38 (run 40383573386, 2026-10-26), not
by a change of the project. The Alpine packages `curl` and `libcurl`
8.22.0-r0 (HIGH) come from the pinned base images:

| Image | Base (Alpine) | Affected packages |
|---|---|---|
| api (`prod`, `dev`) | PHP 8.5.12 FPM (3.24.2) | `curl`, `libcurl` |
| edge (`prod`, `dev`) | Caddy 2.11.7 (3.23.6) | `curl`, `libcurl` |
| db | PostgreSQL 18.6 (3.24.2) | `libcurl` (no `curl` tool) |

8.23.0-r0 fixes it and is in the Alpine 3.23 and 3.24 `main` repositories
for x86_64 and aarch64 (built 2026-10-25). The current builds of the base
image tags were created on 2026-10-21, before the fix, so refreshing the
pinned digests would not help. `docker/api/Dockerfile` and
`docker/edge/Dockerfile` upgrade both packages
(`apk add --upgrade 'curl>=8.23.0-r0' 'libcurl>=8.23.0-r0'`),
`docker/db/Dockerfile` upgrades `libcurl` only, so no package is added to an
image; the build fails if the fixed version cannot be installed. The
project's own health checks do not use `curl` (they use `cgi-fcgi` and
`wget`), but the packages belong to the base images and are not removed.
Remove the upgrade when the pinned base images include the fix. No exception
was added.

## Deferred hardening items

- `framework.trusted_hosts` is not configured: behind the edge, Symfony
Expand Down