Skip to content

[Snyk] Security upgrade nginx from 1.25 to 1.28.0 - #787

Closed
itsouvalas wants to merge 1 commit into
masterfrom
snyk-fix-95d9a9b70898a855999a4c21264f6bd4
Closed

[Snyk] Security upgrade nginx from 1.25 to 1.28.0#787
itsouvalas wants to merge 1 commit into
masterfrom
snyk-fix-95d9a9b70898a855999a4c21264f6bd4

Conversation

@itsouvalas

@itsouvalas itsouvalas commented Apr 30, 2025

Copy link
Copy Markdown
Contributor

snyk-top-banner

Snyk has created this PR to fix 2 vulnerabilities in the dockerfile dependencies of this project.

Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image.

Snyk changed the following file(s):

  • docker/demo/Dockerfile

We recommend upgrading to nginx:1.28.0, as this image has only 94 known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Integer Overflow or Wraparound
SNYK-DEBIAN12-AOM-7197979		   714  
critical severity CVE-2024-37371
SNYK-DEBIAN12-KRB5-7411315		   714  
critical severity CVE-2024-37371
SNYK-DEBIAN12-KRB5-7411315		   714  
critical severity CVE-2024-37371
SNYK-DEBIAN12-KRB5-7411315		   714  
critical severity CVE-2024-37371
SNYK-DEBIAN12-KRB5-7411315		   714  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

@wayneeseguin wayneeseguin mentioned this pull request Jul 27, 2026
Merged
@wayneeseguin

wayneeseguin commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Closing — superseded by #814, merged to develop as 1d8faee.

Both nginx images now run nginx:1.31-trixie (nginx 1.31.3, image rebuilt 2026-07-16), which is ahead of the nginx:1.28.0 proposed here.

This PR was not merged as-is for three reasons:

  • nginx:1.28.0 is itself stale. Current mainline is 1.31.3 and current stable is 1.30.4.

  • The bookworm line is a dead end. nginx publishes no bookworm variant past 1.29 — 1.30-bookworm and 1.31-bookworm do not exist. nginx:1.27-bookworm was last rebuilt 2025-06-11 and nginx:1.29-bookworm on 2025-09-30, so merging any bookworm-era tag would have left the base a year behind and re-opened the same alert on the next scan. Clearing it required moving to Debian trixie.

  • It covers only half the exposure. This changes docker/demo/Dockerfile alone. docker/webdav/Dockerfile ran the same stale base and ships as quay.io/shieldproject/webdav; Move nginx images to 1.31 on Debian trixie #814 updates both.

#814 was verified by building both images and exercising them: demo returns 200 on GET /; webdav handles PUT (201), GET (200), MKCOL (201), DELETE (204), and autoindex. --with-http_dav_module, the nginx user (uid 101), and bash are all present on the new base.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@itsouvalas @wayneeseguin @snyk-bot