Thanks for the report. Just for a future note, we do have our security details listed in SECURITY.md which links to our responsible disclosure policy.

Reporting vulnerabilities in a private conversation helps protect other users and gives us a chance to disclose vulnerabilities after they already have been patched.

Since the conversation is already public, I am okay with continuing to work in the open to resolve this issue.

Our usual template for reporting a vulnerability is like this:

# Summary
...

# Vulnerability details
...

# Impact
...

# Proof of concept
...

# Mitigation
...

I also looked at the link you provided and noticed:

• The vulnerability was downgraded to "MEDIUM"
• If I am reading the link correctly, the patch is not yet available for Ubuntu 20.04? See the image below:

Moving forward

1. What scanner did you use so I can verify it's no longer vulnerable?
2. Do you know of any other mitigation steps other than just updating?

from docker-php.

Hey @jaydrogers, thank you for the responding.
I used AWS scanner. But I don't really know the details of this.
Actually I need to explain to my boss about the vulnerabilities in order to be allowed to use your image.

from docker-php.