Skip to content

fix(docker): pin nginx in the deployment recipes #5942

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
haoyu-haoyu wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(docker): pin nginx in the deployment recipes #5942

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion platform/app/.recipes/Nginx-Dcm4chee-Keycloak/dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ ENV APP_CONFIG=config/docker-nginx-dcm4chee-keycloak.js
RUN yarn run build

# Stage 2: Setup the NGINX environment with OAuth2 Proxy
FROM nginx:alpine
FROM nginx:1.27.1-alpine

# Install dependencies for oauth2-proxy
RUN apk add --no-cache curl
Expand Down
2 changes: 1 addition & 1 deletion platform/app/.recipes/Nginx-Dcm4chee/dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ ENV APP_CONFIG=config/docker-nginx-dcm4chee.js
RUN yarn run build

# # Stage 2: Bundle the built application into a Docker container which runs NGINX using Alpine Linux
FROM nginx:alpine
FROM nginx:1.27.1-alpine

# # Create directories for logs and html content if they don't already exist
RUN mkdir -p /var/log/nginx /var/www/html
Expand Down
2 changes: 1 addition & 1 deletion platform/app/.recipes/Nginx-Orthanc-Keycloak/dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ ENV APP_CONFIG=config/docker-nginx-orthanc-keycloak.js
RUN yarn run build

# Use nginx as the base image
FROM nginx:alpine
FROM nginx:1.27.1-alpine

# Install dependencies for oauth2-proxy
RUN apk add --no-cache curl
Expand Down
2 changes: 1 addition & 1 deletion platform/app/.recipes/Nginx-Orthanc/dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ ENV APP_CONFIG=config/docker-nginx-orthanc.js
RUN yarn run build

# # Stage 2: Bundle the built application into a Docker container which runs NGINX using Alpine Linux
FROM nginx:alpine
FROM nginx:1.27.1-alpine
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps Bot Apr 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Pinned version is missing CVE-2024-7347 patch

Pinning over a floating tag is exactly the right approach here, but nginx:1.27.1-alpine was released August 14, 2024 and is missing the patch for CVE-2024-7347 — an out-of-bounds read in ngx_http_mp4_module that can allow a crafted MP4 file to crash the process or leak memory. The fix shipped in nginx 1.27.2 on September 4, 2024, just three weeks later.

The same version is pinned in all four recipe Dockerfiles:

  • platform/app/.recipes/Nginx-Orthanc/dockerfile:30
  • platform/app/.recipes/Nginx-Dcm4chee/dockerfile:30
  • platform/app/.recipes/Nginx-Orthanc-Keycloak/dockerfile:33
  • platform/app/.recipes/Nginx-Dcm4chee-Keycloak/dockerfile:25

Please bump to nginx:1.27.4-alpine (or the current latest stable/mainline) in all four files to preserve reproducibility without introducing a known CVE.

Suggested change
FROM nginx:1.27.1-alpine
FROM nginx:1.27.4-alpine


# # Create directories for logs and html content if they don't already exist
RUN mkdir -p /var/log/nginx /var/www/html
Expand Down