mirror of
https://github.com/mailcow/mailcow-dockerized.git
synced 2026-11-10 18:41:01 +00:00
woodfairy
0a0686ef19
The current nginx, clamd and postfix images ship a brotli decoder in the affected range 1.0.3 - 1.2.0 (CVE-2026-111497, CVSS 9.8, listed in CISA KEV): - nginx:1.30.6-2 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0) - clamd:1.4.6-1 brotli-libs 1.2.0-r1 (fixed in Alpine 3.24: 1.2.1-r0) - postfix:3.10.12-1 libbrotli1 1.1.0-2+b7 (fixed in trixie-security: 1.1.0-2+deb13u1, DSA-6582-1) All other mailcow images already contain a fixed version. clamd and postfix only need a rebuild, which pulls the fixed packages. The postfix rebuild also picks up Debian's postfix 3.10.13, hence the new tag postfix:3.10.13-1. The nginx image never upgraded the packages of its base image, so it only got fixes when nginx:<version>-alpine was republished. It now runs apk upgrade like clamd and acme do.
20 lines
432 B
Docker
20 lines
432 B
Docker
FROM nginx:1.30.6-alpine
|
|
LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
|
|
|
|
ENV PIP_BREAK_SYSTEM_PACKAGES=1
|
|
|
|
RUN apk upgrade --no-cache && \
|
|
apk add --no-cache nginx \
|
|
python3 \
|
|
py3-pip && \
|
|
pip install --upgrade pip && \
|
|
pip install Jinja2
|
|
|
|
RUN mkdir -p /etc/nginx/includes
|
|
|
|
COPY ./bootstrap.py /
|
|
COPY ./docker-entrypoint.sh /
|
|
|
|
ENTRYPOINT ["/docker-entrypoint.sh"]
|
|
CMD ["nginx", "-g", "daemon off;"]
|