{
  "app": "php-ringpromoter-cve-patching",
  "security_floor_php": "8.3.8",
  "base_image": "php:8.3.19-cli-alpine",
  "patch_method": "bump official php image tag + apk upgrade + avoid cgi/fpm footguns",
  "cves": [
    {
      "id": "CVE-2012-1823",
      "year": 2012,
      "severity": "CRITICAL",
      "summary": "PHP-CGI argument injection (query-string → PHP options)",
      "where_in_docker": "Any image/runtime that exposes php-cgi behind a web server",
      "patch_in_dockerfile": "Do not use php-cgi; prefer cli/fpm with locked nginx; keep current PHP",
      "status": "mitigated_by_architecture"
    },
    {
      "id": "CVE-2015-4024",
      "year": 2015,
      "severity": "HIGH",
      "summary": "multipart/form-data DoS / parsing issues in older PHP",
      "where_in_docker": "php:5.x / early 7.x official tags",
      "patch_in_dockerfile": "FROM php:7.0+ then keep minor security tags; retire EOL 5.x",
      "status": "patched_by_upgrade"
    },
    {
      "id": "CVE-2019-11043",
      "year": 2019,
      "severity": "CRITICAL",
      "summary": "nginx + php-fpm PATH_INFO RCE (Nextcloud-class configs)",
      "where_in_docker": "php:*-fpm combined with rewrite that appends $request_uri",
      "patch_in_dockerfile": "Bump to php:7.1.33+/7.2.24+/7.3.11+ AND fix proxy config (try_files; no $request_uri)",
      "status": "mitigated_by_architecture"
    },
    {
      "id": "CVE-2021-21708",
      "year": 2022,
      "severity": "HIGH",
      "summary": "Use-after-free in PHP filter / related core fixes in 8.0/8.1 lines",
      "where_in_docker": "Stale php:8.0 / 8.1.x tags before security cut",
      "patch_in_dockerfile": "Bump FROM to patched minor (docker-library security PRs)",
      "status": "patched_by_upgrade"
    },
    {
      "id": "CVE-2024-4577",
      "year": 2024,
      "severity": "CRITICAL",
      "summary": "PHP-CGI argument injection bypass of CVE-2012-1823 (esp. Windows Best-Fit)",
      "where_in_docker": "php < 8.1.29 / 8.2.20 / 8.3.8 especially cgi/apache tags",
      "patch_in_dockerfile": "FROM php:8.3.8-cli-alpine or newer; avoid cgi; RUN version floor check",
      "fixed_in": ["8.1.29", "8.2.20", "8.3.8"],
      "status": "patched_by_upgrade"
    },
    {
      "id": "CVE-2024-2408",
      "year": 2024,
      "severity": "HIGH",
      "summary": "openssl_private_decrypt Marvin attack without implicit rejection",
      "where_in_docker": "PHP linked to OpenSSL without rsa_pkcs1_implicit_rejection",
      "patch_in_dockerfile": "Current php:8.3-cli-alpine (OpenSSL 3.x distro build) + apk upgrade",
      "status": "patched_by_upgrade"
    },
    {
      "id": "CVE-2024-11235",
      "year": 2025,
      "severity": "HIGH",
      "summary": "Use-after-free in php_request_shutdown (GHSA-rwp7-7vc6-8477)",
      "where_in_docker": "php before 8.1.32 / 8.2.28 / 8.3.19 / 8.4.5",
      "patch_in_dockerfile": "FROM php:8.3.19-cli-alpine (or newer security tag)",
      "fixed_in": ["8.1.32", "8.2.28", "8.3.19", "8.4.5"],
      "status": "patched_by_upgrade"
    },
    {
      "id": "CVE-2025-1219",
      "year": 2025,
      "severity": "HIGH",
      "summary": "libxml streams wrong content-type on redirect",
      "where_in_docker": "Same security releases as Mar 2025 PHP cut",
      "patch_in_dockerfile": "Bump PHP_IMAGE to 8.3.19+; rebuild & rescan",
      "status": "patched_by_upgrade"
    },
    {
      "id": "CVE-2024-56171",
      "year": 2025,
      "severity": "HIGH",
      "summary": "libxml2 use-after-free (OS package inside Alpine/Debian layers)",
      "where_in_docker": "apk/deb libxml2 in php:*-alpine base",
      "patch_in_dockerfile": "apk upgrade --no-cache (or new base digest) then Trivy/Grype gate",
      "status": "patched_by_os_upgrade"
    },
    {
      "id": "CVE-2025-24928",
      "year": 2025,
      "severity": "HIGH",
      "summary": "libxml2 stack buffer overflow in validation",
      "where_in_docker": "libxml2 in Alpine layer of php images",
      "patch_in_dockerfile": "apk upgrade; pin newer php:*-alpine digest after docker-library rebuild",
      "status": "patched_by_os_upgrade"
    }
  ]
}