openssl version

[cordoval]

FROM php:7.1.11-fpm-alpine

is installing 1.0.2k-r0

but it should install

1.0.2m-r0

is there a reason why?

[yosifkit]

The alpine:3.4 image was updated ~24 days ago, while the openssl package was ~18 days ago. We rely heavily on Docker build cache so that the images aren't constantly being rebuilt for no reason. Unfortunately there is nothing between the base image and the line in the Dockerfile installing openssl that would tell it to discard the docker build cache.

php/7.1/alpine3.4/fpm/Dockerfile

Lines 7 to 27 in 287a157

	FROM alpine:3.4
	# persistent / runtime deps
	ENV PHPIZE_DEPS \
	autoconf \
	dpkg-dev dpkg \
	file \
	g++ \
	gcc \
	libc-dev \
	make \
	pcre-dev \
	pkgconf \
	re2c
	RUN apk add --no-cache --virtual .persistent-deps \
	ca-certificates \
	curl \
	tar \
	xz \
	# https://github.com/docker-library/php/issues/494
	openssl

We could probably do something like we do in the tomcat images and pin a specific version so that we can force a build cache bust, but with the two CVEs (CVE-2017-3736 and CVE-2017-3735) fixed in 1.0.2m being "very difficult" and "not believed likely" to exploit it does not seem worth the effort at this time. I think we can instead wait for the next Alpine image rebuild.

[cordoval]

"i am satisfied with my care" ~ Big Hero 6
thanks

[tianon]