Security Vulnerability Report: Critical CVEs in webdevops/php-nginx:8.4-alpine

Summary

During a container security scan using Trivy, we identified 3 CRITICAL vulnerabilities in the webdevops/php-nginx:8.4-alpine image. The vulnerabilities originate from the bundled go-replace binary which uses an outdated version of Go's standard library (stdlib v1.19.1).

Affected Image

Steps to Reproduce

# Pull the affected image
docker pull webdevops/php-nginx:8.4-alpine
Run Trivy scan
docker run --rm aquasec/trivy image --severity CRITICAL webdevops/php-nginx:8.4-alpine

Root Cause

The go-replace binary bundled inside the image was compiled with Go v1.19.1, which contains multiple known critical vulnerabilities in the html/template and net/netip packages.

Impact

These vulnerabilities affect any deployment using webdevops/php-nginx:8.4-alpine as a base image, potentially exposing applications to:

• Template injection attacks via backtick handling
• JavaScript whitespace injection in HTML templates
• Unexpected IPv4/IPv6 address handling behavior

Requested Action

Please update the go-replace binary to use Go 1.22.4 or later to remediate all 3 CVEs listed above.

References

• https://avd.aquasec.com/nvd/cve-2023-24538
• https://avd.aquasec.com/nvd/cve-2023-24540
• https://avd.aquasec.com/nvd/cve-2024-24790
• https://pkg.go.dev/vuln/GO-2023-1736