Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Image ships unpatched PHP: alpine:3.22 base pins php83 to 8.3.29 (Dec 2025), affected by CVE-2026-109618 / CVE-2026-109619

Aperta Adatta ai principianti
  • Qualcosa non va?
#1,856 1 commento 7 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
docker, php
Ambito
build-system, devops, security

Direzione di ricerca

Leggi il Dockerfile su main, in particolare le righe dell’immagine base Alpine per builder e runner e il comando apk add. Riproduci la versione installata con il comando Docker fornito, poi controlla l’immagine creata dopo aver cambiato la base; il lavoro è terminato quando include PHP 8.3.36 o una versione successiva. L’issue chiede anche un controllo di build che fallisca quando PHP resta indietro rispetto a una branch Alpine supportata.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug 🐛
What installation are you running?

Production (netalertx) 📦

Is there an existing issue for this?
The issue occurs in the following browsers. Select at least 2.
  • Firefox
  • Chrome
  • Edge
  • Safari (unsupported) - PRs welcome
  • N/A - This is an issue with the backend
Current Behavior

The published image ships PHP from Alpine 3.22's community repository, where php83 has been frozen at 8.3.29-r0 since 2025-12-21 — Alpine's support window for community packages on that branch has passed, so no PHP security updates reach it.

PHP 8.3.29 is affected by CVE-2026-109618 and CVE-2026-109619 — unauthenticated remote code execution in PHP, CVSS 9.2, fixed upstream on 2026-10-21 in PHP 8.3.36. The NetAlertX web UI is served by PHP-FPM, so it is in the affected configuration.

Because the version is pinned by the base image rather than by the image's build date, pulling the newest tag or rebuilding does not change it. Users who respond to the advisory by updating will still be on 8.3.29.

This is a packaging issue, not a fault in the application code — NetAlertX itself behaves correctly.

Possible precedent: #968 ("Update base image to Alpine 3.21") was a similar base bump.

Happy to test a build on a bumped base if that would help.

Expected Behavior

The image ships a PHP that still receives security updates — currently php83 8.3.36-r0 or later, which is available in Alpine 3.24.

Ideally the build would also fail loudly if the installed php83 falls behind the newest supported Alpine branch, so this cannot recur silently. A rebuild on its own does not catch it, because the stale version comes back identical.

Steps To Reproduce

Nothing deployment-specific is required — the version is a property of the published image.

  1. Read the installed PHP version straight out of the image:
docker run --rm --entrypoint php ghcr.io/netalertx/netalertx:latest -v

Observed: PHP 8.3.29. Expected after a fix: PHP 8.3.36 or later.

If the entrypoint override is awkward, this gives the same answer from the package database:

docker run --rm --entrypoint apk ghcr.io/netalertx/netalertx:latest list --installed php83
  1. Confirm where it comes from — Dockerfile on main, both stages:
FROM alpine:3.22 AS builder
FROM alpine:3.22 AS runner
...
RUN apk add --no-cache sqlite php83 php83-fpm php83-cgi php83-curl php83-sqlite3 php83-session ...
  1. Compare php83 across Alpine branches (community, x86_64) to see why a rebuild cannot help:
Alpine branch php83 version Built
v3.22 (current base) 8.3.29-r0 2025-12-21
v3.23 8.3.31-r0 2026-05-07
v3.24 8.3.36-r0 2026-10-21

8.3.36 is the release that fixes both CVEs.

Relevant app.conf settings
Not applicable — the issue is not configuration-dependent. It reproduces on a default install of the published image with no settings changed, as step 1 above shows without starting the application at all.
docker-compose.yml
Not applicable, and deliberately omitted — the PHP version is a property of the image rather than of any deployment, so no compose file is needed to reproduce it. A bare


services:
  netalertx:
    image: ghcr.io/netalertx/netalertx:latest


is sufficient, and step 1 reproduces it with no compose file at all.
Debug or Trace enabled
  • I have read and followed the steps in the wiki link above and provided the required debug logs and the log section covers the time when the issue occurs.
Relevant app.log section

Not applicable — there is no runtime error to capture. The application starts and runs normally; the problem is the version of the PHP interpreter serving the UI, not its behaviour. app.log would show a healthy startup and is not evidence either way.

Docker Logs

Not applicable for the same reason — the container logs are clean, which is part of the point: nothing in normal operation surfaces this. The closest useful output is the version probe:

$ docker run --rm --entrypoint php ghcr.io/netalertx/netalertx:latest -v
PHP 8.3.29 (cli) ...
Lingua principale
Python
Stelle
7.2k
Fork
456
Merge medio
17h 59m
PR unite (30g)
26

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di netalertx/NetAlertX

Tutte le issue di netalertx/NetAlertX

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.