apache: Update to 2.4.33

[mahnunchik]

It would be awesome to have php:apace upgraded to apache 2.4.33. Which supports mod_md: https://letsencrypt.org/2017/10/17/acme-support-in-apache-httpd.html

[tianon]

We use Apache directly from Debian, so we can't really update that easily. 😞

[mahnunchik]

Maybe there is sense to install apache like in the apache image: https://github.com/docker-library/httpd/blob/3af22f20b54cbb7c76ef4c3b12bd9dcf6cae862b/2.4/Dockerfile

[tianon]

That would be a fairly large breaking change, not to mention a large increase in the already incredibly-long compilation times for our many, many variants of PHP.

Since this repository is focused on providing a PHP experience close to what PHP upstream recommends, we opted for using Debian's Apache packages (especially since the way Debian sets up Apache is very commonly understood by PHP developers in general).

[AndryBray]

This is very important problem. Latest apache version has a lot of bug fixes and vulnerabilities fixes.
Working on PCI scope it's a big problem... no way to change it upgrading through dockerfile?

[AndryBray]

@mahnunchik did you find any solution for this? thanks

[mahnunchik]

@AndryBray no, I'm thinking about building image based on apache and php images.

[tianon]

As far as vulnerabilities are concerned, see https://security-tracker.debian.org/tracker/source-package/apache2.

[AndryBray]

thanks @tianon
I didn't see refreshing the image it was including the patched version.

[rogervila]

Debian stretch has apache 2.4.25, but Debian buster has apache 2.4.34

Maybe a new serie of Dockerfiles that pull from debian:buster-slim would be the solution

[mahnunchik]

@tianon I really need acme support...

[jlyon]

This is more pressing now with the highly publicized https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211

[phy25]

This is more pressing now with the highly publicized https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211

See https://security-tracker.debian.org/tracker/CVE-2019-0211; stretch (security) is good.

Just not sure if this is using stretch or stretch (security).

[yosifkit]

Moving CVE-2019-0211 to new discussion since this issue was originally about getting a new version for new features, not a security update. See #810