PHP vulnerability 2 CVE's - Nextcloud (maybe other images to?)

[Mat-DB]

Hi!

I wanted to ask when we can expect an updated image with the patched version of PHP for Nextcloud? (and maybe other containers to?)

Thanks in advance!

Kind regards,
Matthias

[BitBernd]

What about piwigo?

[Roxedus]

As soon as Alpine has built the package, we will trigger builds for the relevant containers.

[osos]

I see a lot of manual triggers, but none of them have resulted in new builds. Any timeline on when the PHP is patched?

[Roxedus]

No. The Alpine team is working hard on this.

[easyjoh]

Nextcloud package seems ready now.

Thank you !

[febsn]

Big thanks!

[EconomicTouristsArmLate]

https://hub.docker.com/r/linuxserver/dokuwiki/ is affected as well

(upstream images https://github.com/dokuwiki/docker are already rebuilt with patched php)

[j0nnymoe]

Yes all our php based containers are affected.

[fireheadman]

sub'd for updates

[teambvd]

Looks like the patches have been put into place for all the php84 components in the image within the alpine repo, though I've not found updated images up to this point, so just in case others are awaiting a fix:
apk upgrade $(apk info | grep '^php84')

Be sure you've put your instance in maintenance mode prior to running, and restart the container following - found no issues with my NC33 instance, though of course this is an 'at your own risk' type thing.

[Mat-DB]

You should make sure to be on the latest minor version that is released.
So look at the release page and there you can see which major and minor version is patched.

Hope this helps!

[teambvd]

I am - problem is, there is no linuxserver build which includes this for anything except NC35, and even then, it's not pushed to dockerhub yet. I've long found that running the latest major NC build to be great only for masochists, and so stick with the oldest currently supported major release. That introduces some new problems as LSIO doesn't seem to parallel nextcloud's support timelines (last NC33 release was over a month ago, though official support from NC runs through early next year)... But I'd rather have the pain of occasional manual updates than risk the platform-breaking bugs that seem to come every time a new major version comes out (admittedly often due to plugins, though even official plugins are still plagued by this).

[aptalca]

We support the latest stable and the previous stable, so currently 35 and 34

even then, it's not pushed to dockerhub yet

?? The builds were pushed two days ago for both 35 and 34: linuxserver/docker-nextcloud@35.0.2-ls458...35.0.2-ls459 and linuxserver/docker-nextcloud@previous-34.0.5-ls123...previous-34.0.5-ls124

[lightlike]

I think that this is a misunderstanding due to the way linuxserver tags its docker images.
The last version (in this case 34) gets tagged with *version*-previous as soon as the new one gets released.
You cannot get the latest 34 builds by just using 34.0.5.

This is a bit counter-intuitive when first coming across it but can be worked around.
It is sadly also not made clear in the readme but you can see it in any of the container registries.

So if you want to get the latest image you should use linuxserver/nextcloud:34.0.5-previous

[aptalca]

https://www.linuxserver.io/blog/docker-tags-so-many-tags-so-little-time#3-version-tag-dynamic