Mailcow-dockerized: Urgent security issue in NGINX/php-fpm

[lotg2020]

A new security risk has emerged around NGINX, documented in CVE-2019-11043.
This exploit allows for remote code execution on some NGINX and php-fpm configurations.

In particular, this allows breaking into Nextcloud instances and encrypting the data.

Is there a need for action with regard to Mailcow?

https://nextcloud.com/blog/urgent-security-issue-in-nginx-php-fpm/
https://www.php.net/archive/2019.php#2019-10-24-1

[Braintelligence]

As you've linked yourself one thing you can do now is changing the nginx.conf.
php-fpm-mailcow already runs 7.3.11

[lotg2020]

Thank you very much for your quick feedback.

So the changes to "nginx.conf" have no effect on Mailcow?

[Braintelligence]

To be precise: you should change the nextcloud.conf - this shouldn't have any effect on other vhosts if you don't mess up the conf-content.

[andryyy]

I think we updated the images a few minutes after the updated Docker images were released. :)

[MAGICCC]

Dupe of https://github.com/mailcow/mailcow-dockerized/issues/3091
Fixed by https://github.com/mailcow/mailcow-dockerized/commit/e101900787f839d11f6dc1d0d62f9b053c0f45a9