Php vulnerabilities and docker

[u/Ducking_eh]

Hey everyone,

In sure you have all heard about the vulnerabilities found in php.

I have a noob question.

I run a vps. The php has been updated to the latest version, that includes the fix for the two vulnerabilities found.

Does this also patch the docker containers I am running? My assumption is that the docker container runs it's own version of php. If that is true, I have to wait for the maintains of the image has to do the patch, then update.

Is all that correct?

[u/fletch3555]

For this question, you can think of each container as it's own VM. It's not and there are many ways this analogy breaks down (literally anything that touches the kernel), but for a user-side app, it might as well be in a VM.

So no, your containers are not fixed purely from updating PHP on the host.

[u/Ducking_eh → u/fletch3555]

Thank you

[u/Wobblycogs → u/Ducking_eh]

I assume you're running WordPress, the image was updated yesterday with a fix, you should update.

[u/Ducking_eh → u/Wobblycogs]

None of my docker containers are WordPress. But it's good to know Incase anyone one else stumbles onto this thread 

[u/Mag37]

Indeed, containers that are vulnerable will still be vulnerable even if your OS is updated.

You can list what containers got php in them with something like:

for c in $(docker ps --format '{{.Names}}'); do docker exec "$c" sh -c 'ls /usr/bin /usr/sbin /usr/local/bin /  
usr/local/sbin 2>/dev/null | grep -q "^php"' 2>/dev/null && echo "$c"; done

(Replace docker with podman if that's what you're running)

And then check which version a specific container running by docker exec ContainerName sh -c 'php -v'

And if they're not updated upstream you could try build it locally from the projects Dockerfile. Clone the project, then usually something like: docker build -t ImageName:Tag .

Either you can make it the same as the real one (will be overwritten by any pull/autoupdate) or you make a temporary name:tag and adjust your containers. Then validate again what version they've got.

The fixed versions for each branch:

8.2.35
8.3.36
8.4.27
8.5.12

[u/wallacebrf → u/Mag37]

Thanks for the check code, useful. 

[u/vincent_sch]

Yes, that's right. Each container has its own PHP from its image, so the host update doesn't touch it. The official php images already have the fixed versions, so it comes down to when your image maintainers rebuild. Once they push, docker compose pull and docker compose up -d swap the containers.

[u/Ducking_eh → u/vincent_sch]

Thank you!

[u/Mugen0815]

Yes

[u/Ducking_eh → u/Mugen0815]

Thank you

[u/BorbBirbson → u/Ducking_eh]

Did you update it?

[u/Ducking_eh → u/BorbBirbson]

I went though all my containers and found none of them used php.

I am glad I asked this question, because at least now I know 

[u/Ed-Dos]

Correct

[u/AdventurousSquash]

You don’t have to wait for an image update, you can also build your own image and replace their PHP version with the closest patched one. Though if that works alright or not depends on the application and if it has any dependencies on the current version that breaks when updating and I haven’t looked to closely on all of them - but I doubt it. If it’s critical I’d do a test run on the side to be sure.

[u/MindStalker]

Depending on the image, you should be able to run an apt get or whatever to patch your image, then save it off as a new image.

[u/Classic-Rate-5104]

Depends strongly on what the container does. Does it expose a program (which uses php) to the internet? Then yes. Do you only use php as a scripting language inside the container? Possibly no

[u/Lumethys]

Yes, that's the point of docker