Repository navigation
chore: modify the kokoro dockerfile remove a PHP vulnerability - #9814
Hectorhammett wants to merge 2 commits into
Conversation
| FROM gcr.io/gcp-runtimes/ubuntu_20_0_4@sha256:666805a878d9cd58ce9dfd6f423e2d0e3bdf01eea0cddd2be3a88244c1d4dfa5 | ||
| ENV PHP_DIR=/opt/php82 | ||
| ENV PHP_VERSION=8.2.30 | ||
| ENV PHP_VERSION=8.2.35 |
There was a problem hiding this comment.
this is the most important change, and I feel like it should be in a separate PR so we can get it merged and released immediately
| env: | ||
| update: true |
There was a problem hiding this comment.
This forces the Php setup to update the PHP version.
If the docker image we are using contains a PHP version, using this will force to ignore the version it has and update it.
I added this because some images sometimes have an unpatched version and didn't want to depend on them to actually having the patched on.
| php-version: '8.2' | ||
| tools: pecl | ||
| extensions: grpc | ||
| ini-values: session.upload_progress.enabled=0 |
There was a problem hiding this comment.
this seems a bit overkill if we know shivammathur/setup-php is using the most recent patched version
| - name: Verify PHP version | ||
| run: | | ||
| php -r ' | ||
| $min = ["8.2" => "8.2.35", "8.3" => "8.3.36", "8.4" => "8.4.27", "8.5" => "8.5.12"]; | ||
| $minor = PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION; | ||
| if (!isset($min[$minor]) || version_compare(PHP_VERSION, $min[$minor], "<")) { | ||
| fwrite(STDERR, sprintf("Unpatched PHP version %s detected (minimum required: %s)\n", PHP_VERSION, $min[$minor] ?? "8.2.35")); | ||
| exit(1); | ||
| } | ||
| echo "Verified patched PHP version: " . PHP_VERSION . PHP_EOL; | ||
| ' |
There was a problem hiding this comment.
this seems a bit overkill since we know shivammathur/setup-php is using the most recent patched versions
|
Closing this PR as we decided to just extract the PHP version section into a different PR and merged that one instead. |
There is a Remote code execution vulnerability discovered in PHP.
Went ahead and updated our workflow files and the kokoro docker file to ensure that we are using the patched versions of PHP and in the case that one of the workflows is using an unpatched version (Which should not be the case) it disables the feature that makes the vulnerability available as it is not a required feature for our workflows.