← Back to context

Comment by spenvo

9 hours ago

Edit: and it's live now 1hour 43minutes after. Edit 2x: well I spoke too soon. not actually live - the 8.4.27 tag appeared, but it's still an empty shell with no amd64 image to build from. Maybe other architectures can be built from though. Ugh. Now we're at 2hours 24minutes in. I know process steps take time/can't be rushed, and I know people mean well and surely some are unappreciated for what they do. That said: this debacle is making me want to reassess my deployment pipeline choices.

how does Docker not yet have a new, official PHP image ready, given such a big heads up? https://hub.docker.com/_/php Nuts this wasn't ready to flip on at :00 (or even earlier given the PoC exploit and even the official PHP fixes were out well before). Now we are 52 minutes past due. (posting comment again, because the other thread i posted in was marked as dupe.)

18 comments

spenvo

Reply
andrin  8 hours ago

They even committed the fixed version to the repo, but it seems no images where pushed: https://github.com/docker-library/php/commit/e3eaff845f7a9f7...

Edit: Seems like GitHub has issues with merging PRs: https://github.com/docker-library/official-images/pull/22541

  • maaarghk  8 hours ago

    It went a few seconds ago. I was also surprised they didn't have advance access but thinking about it, with the whole thing being a public Github pipeline, it's unclear how they could have achieved it whilst simultaneously keeping the patch private. Is there precedent?

jMyles  9 hours ago

Yeah, I was very surprised to wake up just now and find docker still vulnerable.

spenvo  7 hours ago

And now, at 2hrs 55mins past the PHP release, the amd64 image is available. Although it appears that the servers hosting the image are getting hugged to death because I can't actually download it.