nginx vulnerabilities

[rvanheesbyon]

Hi Phusion,

Our security scans have found several vulnerabilities related to nginx 1.18, which is installed in the passenger/nodejs image. As this is used in our production image, we need a fast solution for this. I'd like to request an updated image using nginx >=1.24.

• CVE-2022-41741
• CVE-2023-44487
• CVE-2021-3618
• CVE-2022-41742
• CVE-2024-7347

Thanks!
Richard

[ajhodgson]

The fixes for all those CVEs have been backported by Ubuntu into the Jammy release of nginx 1.18 (where needed). Jammy will continue to receive regular security updates until April 2027.

[ajhodgson]

Oh and apparently Cam just merged #413 which will update the source image to one based on Noble, which does contain nginx 1.24. So whenever that gets a release.

[rvanheesbyon]

That's great, thanks for the update!