Docker-nginx: Security Vulnerability CVE-2021-3518 and CVE-2021-3517 reported in nginx:1.21-alpine@* › libxml2/[email protected]

[RahulVerma-mindbody]

Out-of-bounds Write
Vulnerable module: libxml2/libxml2
Introduced through: libxml2/[email protected]
Fixed in: 2.9.10-r7
Detailed paths
Introduced through: nginx:1.21-alpine@* › libxml2/[email protected]

[RahulVerma-mindbody]

Use After Free
Vulnerable module: libxml2/libxml2
Introduced through: libxml2/[email protected]
Fixed in: 2.9.10-r7
Detailed paths
Introduced through: nginx:1.20.1-alpine@* › libxml2/[email protected]

[ihtfp69]

Can this be upgraded manually or via a dockerfile to address the issue temporarily?

RUN apk add --update --no-cache 'libxml2==2.9.10-r7'

[RahulVerma-mindbody]

Can this be upgraded manually or via a dockerfile to address the issue temporarily?

RUN apk add --update --no-cache 'libxml2==2.9.10-r7'

Yup. I did same and worked.

[thresheek]

You can just rebuild the dockerfile as is, without any additions, and apk will pull a fixed version.

[rsenthilnathan25]

@RahulVerma-mindbody - I tried the same and getting the below error,

fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/community/x86_64/APKINDEX.tar.gz
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/main: temporary error (try again later)
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/community: temporary error (try again later)
ERROR: unable to select packages:
libxml2-2.9.10-r6:
breaks: world[libxml2=2.9.10-r7]
satisfies: nginx-module-xslt-1.19.10-r1[so:libxml2.so.2]
libxslt-1.1.34-r0[so:libxml2.so.2]
The command '/bin/sh -c apk add --update --no-cache 'libxml2==2.9.10-r7'' returned a non-zero code: 3

Please let me know, what might be missing?

[rsenthilnathan25]

It was proxy issue, please ignore my previous comment.

[RodrigoHamuy]

Do you know when this patch is going to be pushed to the nginx:alpine docker hub image? Thanks.

[ememisya]

This is still a problem even though the alpine version states 3.13.15

$ docker run -ti nginx:stable-alpine /bin/sh
Unable to find image 'nginx:stable-alpine' locally
stable-alpine: Pulling from library/nginx
540db60ca938: Already exists
b824a2584ece: Pull complete
82d0e0426b2d: Pull complete
ed76aa154407: Pull complete
ef4cf5a20f8a: Pull complete
9d3441de5d5e: Pull complete
Digest: sha256:4ca0ee2d0f82bd18879a5d6f51365db49d7fcfd4768c113820c387a676ce7ac5
Status: Downloaded newer image for nginx:stable-alpine
/ # cat /etc/alpine-release
3.13.5
/ # apk info -vv | grep 'libxml'
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/main: No such file or directory
WARNING: Ignoring https://dl-cdn.alpinelinux.org/alpine/v3.13/community: No such file or directory
libxml2-2.9.10-r6 - XML parsing library, version 2