apach2 upgrade to version 2.4.58 in library/wordpress:php8.2-apache and library/wordpress:php8.1-apache

[Jijo070]

I am currently using library/wordpress:php8.2-apache and library/wordpress:php8.1-apache for my WordPress images and they come with apache2 2.4.57, which has vulnerabilities. Is there an update available in these images which use apache2 2.4.58 instead of apache2 2.4.57?
This latest version of apache2 was released on October 19, 2023
https://dlcdn.apache.org/httpd/CHANGES_2.4.58

[yosifkit]

Same answer as #802 (comment)

$ docker run -it --rm wordpress:php8.2-apache bash
Unable to find image 'wordpress:php8.2-apache' locally
php8.2-apache: Pulling from library/wordpress
a378f10b3218: Already exists
20ad076dff2e: Pull complete
6d17b5cade1b: Pull complete
d71c28a64564: Pull complete
1bfddb7ff535: Pull complete
8d5225155d20: Pull complete
4b78f518026d: Pull complete
c91e4e0e6eb8: Pull complete
d84503eddcea: Pull complete
56b87d4f1b89: Pull complete
cecf366f324e: Pull complete
c79b72fb5486: Pull complete
900c64be9242: Pull complete
01317173e91e: Pull complete
07b03bb7a09c: Pull complete
ef898c5a7d72: Pull complete
487405d9b58c: Pull complete
1b59ad57c4b2: Pull complete
407998003748: Pull complete
075ed11229c5: Pull complete
702fc03f45c4: Pull complete
Digest: sha256:87556c9dd939eead369479f27dedfbb872140fc105c121b2b4eaffb86079ca8a
Status: Downloaded newer image for wordpress:php8.2-apache
root@282cae440cde:/var/www/html# apt update
Get:1 http://deb.debian.org/debian bookworm InRelease [151 kB]
Get:2 http://deb.debian.org/debian bookworm-updates InRelease [52.1 kB]
Get:3 http://deb.debian.org/debian-security bookworm-security InRelease [48.0 kB]
Get:4 http://deb.debian.org/debian bookworm/main amd64 Packages [8780 kB]
Get:5 http://deb.debian.org/debian bookworm-updates/main amd64 Packages [6408 B]
Get:6 http://deb.debian.org/debian-security bookworm-security/main amd64 Packages [92.8 kB]
Fetched 9131 kB in 1s (8326 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
root@282cae440cde:/var/www/html# apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@282cae440cde:/var/www/html#

[Jijo070]

@yosifkit This just upgrades apache2 to 2.4.57 and not 2.4.58

[Jijo070]

@yosifkit

$ docker run -it --rm wordpress:php8.2-apache bash
Unable to find image 'wordpress:php8.2-apache' locally
php8.2-apache: Pulling from library/wordpress
1bc163a14ea6: Pull complete
1b6db690faaa: Pull complete
a52439f35154: Pull complete
7b2675dd3270: Pull complete
37ad28fcd1b0: Pull complete
0d265bb40130: Pull complete
34c24de3ade9: Pull complete
bb98870ac5ca: Pull complete
9ecd65ea3112: Pull complete
396970b9acf2: Pull complete
bfa376a834ea: Pull complete
a8f74002bf38: Pull complete
51fd6c078630: Pull complete
c0050cb74f10: Pull complete
81c4384b1469: Pull complete
4bb4b5aa8329: Pull complete
d880d55cd0d0: Pull complete
649ed54d60db: Pull complete
0df7295a1712: Pull complete
3406b680b601: Pull complete
35f1af0fd9ef: Pull complete
Digest: sha256:87556c9dd939eead369479f27dedfbb872140fc105c121b2b4eaffb86079ca8a
Status: Downloaded newer image for wordpress:php8.2-apache
root@437d1333c7f3:/var/www/html# docker ps -a
bash: docker: command not found
root@437d1333c7f3:/var/www/html# ls -sla
total 12
4 drwxrwxrwt 3 www-data www-data 4096 Oct 31 23:36 .
4 drwxr-xr-x 1 root     root     4096 Oct 12 08:13 ..
4 drwxrwxrwt 5 www-data www-data 4096 Oct 31 23:36 wp-content
root@437d1333c7f3:/var/www/html# apt update
Get:1 http://deb.debian.org/debian bookworm InRelease [151 kB]
Get:2 http://deb.debian.org/debian bookworm-updates InRelease [52.1 kB]
Get:3 http://deb.debian.org/debian-security bookworm-security InRelease [48.0 kB]
Get:4 http://deb.debian.org/debian bookworm/main arm64 Packages [8681 kB]
Get:5 http://deb.debian.org/debian bookworm-updates/main arm64 Packages [6408 B]
Get:6 http://deb.debian.org/debian-security bookworm-security/main arm64 Packages [90.0 kB]
Fetched 9028 kB in 2s (4032 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
root@437d1333c7f3:/var/www/html# apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@437d1333c7f3:/var/www/html# apache2 -v
Server version: Apache/2.4.57 (Debian)
Server built:   2023-04-13T03:26:51

[yosifkit]

Correct, 2.4.57-2 is the newest apache2 package available in Debian Bookworm as of today. It very likely has backported vulnerability fixes (as is normal with distro packages). It is not going to always be the same version as upstream releases since Debian cares deeply about stability.

So, we cannot update to 2.4.58 until it is in a Debian package for the Debian release that we are on (Bookworm).