Critical PHP CVE released and patched today. When will Zabbix docker catch up?

[ZabbixSeeker]

A vulnerability for full remote code execution on PHP applications was released today. It was also hotpatched today.

This is super critical.

Do we have any information on when Zabbix will patch zabbix in its docker container?

[ZabbixSeeker]

Here is a workaround for you guys meanwhile. Assuming ubuntu. Assuming php version 8.5 in your container. You can check it with php -v.
1. exec bash in the container as root.
2. apt update
3. apt install --only-upgrade -y 'php8.5-*'
4. check: dpkg-query -W php8.5-fpm .... should be at least this patch: 8.5.4-0ubuntu1.5
5. restart the web container

You are welcome.

[dsdsdk]

Thank you for workaround.

I see some php update from yesterday, but not for Alpine image, anyone know why? https://github.com/zabbix/zabbix-doc....4/Dockerfiles

[ZabbixSeeker]

The images are still outdated. They need to rebuild.

The change you're referring to at this point has in itself no meaningful security implications either.

[ZabbixSeeker]

There will probably be an implicit unintended patch when the image for the next zabbix patch version 7.0.33(?) is released, if the one who builds it doesn't build it with docker cache on. My expectations regarding any other actions, at least in reasonable time, is low.

[GermanFP]

In my case, I use Docker Compose with Nginx on an Alpine image.

I followed these steps:

- I logged into the container as root.
- I ran the update command for PHP only: `apk upgrade $(apk info | grep ‘^php84’)`
- Then I restarted the container.