Skip to content

fix(docker): update owncloud/php:22.04 to PHP 1:7.4.33-31+freexian22.04.1 - #584

Merged
oc-tmueller merged 1 commit into
masterfrom
fix/php-7.4-cve-2026-109618
Oct 22, 2026
Merged

oc-tmueller merged 1 commit into
masterfrom
fix/php-7.4-cve-2026-109618

Conversation

@oc-tmueller

Copy link
Copy Markdown
Member

Pins owncloud/php:22.04 to sha256:81a353b1…, published 2026-10-22 08:42 UTC. That image carries Freexian's 1:7.4.33-31+freexian22.04.1+php+1, which fixes CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp). Both affect Apache mod_php, which these images use.

Verified on the pulled image:

  • All 19 php7.4 packages are 1:7.4.33-31 on amd64 and arm64.
  • A 50 MB multipart body with post_max_size=1G and memory_limit=512M returns 200 with no fatal. On the previous -30 image it gave a 500 and Allowed memory size … exhausted … in Unknown on line during request startup.

This is the 22.04 (ownCloud 10.16) counterpart of #582, which did the same for 24.04.

🤖 Generated with Claude Code

…04.1

Pulls in Freexian's fix for CVE-2026-109618 and CVE-2026-109619.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
@oc-tmueller
oc-tmueller merged commit 8e7f89c into master Oct 22, 2026
5 checks passed
@oc-tmueller
oc-tmueller deleted the fix/php-7.4-cve-2026-109618 branch October 22, 2026 09:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant