Repository navigation
Set session.upload_progress.enabled=0 - #2614
Merged
Merged
Conversation
Apply recommend mitigation for the upcoming CVE-2026-115560. We use session.serialize_handler=igbinary which is not explicitly mentioned in the advisory but igbinary is also just an extension and not part of the PHP core. So better safe than sorry. https://www.php.net/archive/2026.php#2026-10-23-1 Signed-off-by: J0WI <J0WI@users.noreply.github.com>
Member
|
Thanks for staying on top of this, @J0WI. And all your work in general maintaining this image set. |
eayanwale
added a commit
to eayanwale/onevoice-storage
that referenced
this pull request
Oct 27, 2026
…#125) The 30.0.0 image ran PHP 8.2.24, which is vulnerable to CVE-2026-109618/109619. The Nextcloud 30 image is end of life, so it never got the fix. Production was upgraded 30.0.0 -> 30.0.17 -> 31 -> 32 -> 33 -> 34.0.5 on the stock images. This puts the OneVoice layer back on top of 34.0.5 (PHP 8.5.12). - Dockerfile: base on nextcloud:34.0.5-fpm. - #76 patch re-derived for 34.0.5. readObject() still does a single fopen() with no retry. Checksum guard updated to the 34.0.5 upstream file. - zz-onevoice.ini: session.upload_progress.enabled = 0. Upstream did the same in nextcloud/docker#2614. - compose.yml: 34.0.5-fpm-ov1 tag, plus the cloudflared service that has been live on the host but was never committed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Apply recommend mitigation for the upcoming CVE-2026-115560.
We use session.serialize_handler=igbinary which is not explicitly mentioned in the advisory but igbinary is also just an extension and not part of the PHP core. So better safe than sorry.
https://www.php.net/archive/2026.php#2026-10-23-1