[Security] Critical CVEs in webdevops/php-nginx:8.4-alpine - golang stdlib v1.19.1 in go-replace binary

[muhmasum50]

Security Vulnerability Report: Critical CVEs in webdevops/php-nginx:8.4-alpine

Summary

During a container security scan using Trivy, we identified 3 CRITICAL vulnerabilities in the webdevops/php-nginx:8.4-alpine image. The vulnerabilities originate from the bundled go-replace binary which uses an outdated version of Go's standard library (stdlib v1.19.1).

---

Affected Image

Field	Value
Image	webdevops/php-nginx:8.4-alpine
Component	go-replace binary (bundled in image)
Affected Library	golang stdlib v1.19.1

---

Steps to Reproduce

# Pull the affected image
docker pull webdevops/php-nginx:8.4-alpine
Run Trivy scan
docker run --rm aquasec/trivy image --severity CRITICAL webdevops/php-nginx:8.4-alpine

---

Root Cause

The go-replace binary bundled inside the image was compiled with Go v1.19.1, which contains multiple known critical vulnerabilities in the html/template and net/netip packages.

---

Impact

These vulnerabilities affect any deployment using webdevops/php-nginx:8.4-alpine as a base image, potentially exposing applications to:

• Template injection attacks via backtick handling
• JavaScript whitespace injection in HTML templates
• Unexpected IPv4/IPv6 address handling behavior

---

Requested Action

Please update the go-replace binary to use Go 1.22.4 or later to remediate all 3 CVEs listed above.

---

References

• https://avd.aquasec.com/nvd/cve-2023-24538
• https://avd.aquasec.com/nvd/cve-2023-24540
• https://avd.aquasec.com/nvd/cve-2024-24790
• https://pkg.go.dev/vuln/GO-2023-1736

[Kanti]

checked with

docker pull webdevops/php-nginx:8.4-alpine
docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v trivy-cache:/root/.cache/ \
  aquasec/trivy image \
  --image-src docker \
  --severity CRITICAL \
  --exit-code 1 \
  webdevops/php-nginx:8.4-alpine

now has 0 Vulnerabilities reported.