From c5b32dfc4cd5d6efdaa68004ea478bf98b4dca54 Mon Sep 17 00:00:00 2001 From: bunkerity Date: Wed, 16 Dec 2020 15:47:02 +0100 Subject: [PATCH] fix CVE-2020-1971 again --- Dockerfile | 2 +- Dockerfile-amd64 | 2 +- Dockerfile-arm32v7 | 2 +- Dockerfile-arm64v8 | 2 +- Dockerfile-i386 | 2 +- autoconf/Dockerfile | 2 +- autoconf/Dockerfile-amd64 | 2 +- autoconf/Dockerfile-arm32v7 | 2 +- autoconf/Dockerfile-arm64v8 | 2 +- autoconf/Dockerfile-i386 | 2 +- scripts/certbot-renew-hook.sh | 1 + scripts/certbot-renew.sh | 11 +---------- scripts/referrers.sh | 1 - scripts/user-agents.sh | 1 - ui/Dockerfile | 2 +- ui/Dockerfile-amd64 | 2 +- ui/Dockerfile-arm32v7 | 2 +- ui/Dockerfile-arm64v8 | 2 +- ui/Dockerfile-i386 | 2 +- 19 files changed, 17 insertions(+), 27 deletions(-) diff --git a/Dockerfile b/Dockerfile index badf48f..daca783 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ COPY prepare.sh /tmp/prepare.sh RUN chmod +x /tmp/prepare.sh && /tmp/prepare.sh && rm -f /tmp/prepare.sh # Fix CVE-2020-28928, CVE-2020-8231 & CVE-2020-1971 -RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" +RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache diff --git a/Dockerfile-amd64 b/Dockerfile-amd64 index 4a2389f..50fed53 100644 --- a/Dockerfile-amd64 +++ b/Dockerfile-amd64 @@ -23,7 +23,7 @@ COPY prepare.sh /tmp/prepare.sh RUN chmod +x /tmp/prepare.sh && /tmp/prepare.sh && rm -f /tmp/prepare.sh # Fix CVE-2020-28928, CVE-2020-8231 & CVE-2020-1971 -RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" +RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache diff --git a/Dockerfile-arm32v7 b/Dockerfile-arm32v7 index 021e626..4f8ffc9 100644 --- a/Dockerfile-arm32v7 +++ b/Dockerfile-arm32v7 @@ -30,7 +30,7 @@ COPY prepare.sh /tmp/prepare.sh RUN chmod +x /tmp/prepare.sh && /tmp/prepare.sh && rm -f /tmp/prepare.sh # Fix CVE-2020-28928, CVE-2020-8231 & CVE-2020-1971 -RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" +RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache diff --git a/Dockerfile-arm64v8 b/Dockerfile-arm64v8 index 8987671..6f85a36 100644 --- a/Dockerfile-arm64v8 +++ b/Dockerfile-arm64v8 @@ -30,7 +30,7 @@ COPY prepare.sh /tmp/prepare.sh RUN chmod +x /tmp/prepare.sh && /tmp/prepare.sh && rm -f /tmp/prepare.sh # Fix CVE-2020-28928, CVE-2020-8231 & CVE-2020-1971 -RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" +RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache diff --git a/Dockerfile-i386 b/Dockerfile-i386 index 6eb0fb8..664d57a 100644 --- a/Dockerfile-i386 +++ b/Dockerfile-i386 @@ -23,7 +23,7 @@ COPY prepare.sh /tmp/prepare.sh RUN chmod +x /tmp/prepare.sh && /tmp/prepare.sh && rm -f /tmp/prepare.sh # Fix CVE-2020-28928, CVE-2020-8231 & CVE-2020-1971 -RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" +RUN apk --no-cache add "musl-utils>1.1.24-r2" "curl>7.67.0-r1" "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /www /http-confs /server-confs /modsec-confs /modsec-crs-confs /cache diff --git a/autoconf/Dockerfile b/autoconf/Dockerfile index d2eba01..2de9053 100644 --- a/autoconf/Dockerfile +++ b/autoconf/Dockerfile @@ -11,7 +11,7 @@ COPY autoconf/* /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/autoconf/Dockerfile-amd64 b/autoconf/Dockerfile-amd64 index 2cf31d4..664de80 100644 --- a/autoconf/Dockerfile-amd64 +++ b/autoconf/Dockerfile-amd64 @@ -11,7 +11,7 @@ COPY autoconf/* /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/autoconf/Dockerfile-arm32v7 b/autoconf/Dockerfile-arm32v7 index a9a1827..1590b35 100644 --- a/autoconf/Dockerfile-arm32v7 +++ b/autoconf/Dockerfile-arm32v7 @@ -18,7 +18,7 @@ COPY autoconf/* /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/autoconf/Dockerfile-arm64v8 b/autoconf/Dockerfile-arm64v8 index ec4bc84..5f6f6b0 100644 --- a/autoconf/Dockerfile-arm64v8 +++ b/autoconf/Dockerfile-arm64v8 @@ -18,7 +18,7 @@ COPY autoconf/* /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/autoconf/Dockerfile-i386 b/autoconf/Dockerfile-i386 index 45b60b2..d79cf6e 100644 --- a/autoconf/Dockerfile-i386 +++ b/autoconf/Dockerfile-i386 @@ -11,7 +11,7 @@ COPY autoconf/* /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/scripts/certbot-renew-hook.sh b/scripts/certbot-renew-hook.sh index c16ff04..7e5a889 100644 --- a/scripts/certbot-renew-hook.sh +++ b/scripts/certbot-renew-hook.sh @@ -1,5 +1,6 @@ #!/bin/sh +# load some functions . /opt/scripts/utils.sh job_log "[CERTBOT] certificates have been renewed" diff --git a/scripts/certbot-renew.sh b/scripts/certbot-renew.sh index a63fd76..996b900 100644 --- a/scripts/certbot-renew.sh +++ b/scripts/certbot-renew.sh @@ -1,5 +1,6 @@ #!/bin/sh +# load some functions . /opt/scripts/utils.sh # ask new certificates if needed @@ -10,13 +11,3 @@ if [ "$?" -eq 0 ] ; then else job_log "[CERTBOT] renew operation failed" fi - -# fix rights -chown -R root:nginx /etc/letsencrypt -chmod -R 740 /etc/letsencrypt -find /etc/letsencrypt -type d -exec chmod 750 {} \; - -# reload nginx -if [ -f /tmp/nginx.pid ] ; then - /usr/sbin/nginx -s reload > /dev/null 2>&1 -fi diff --git a/scripts/referrers.sh b/scripts/referrers.sh index cee35ad..b4996ed 100755 --- a/scripts/referrers.sh +++ b/scripts/referrers.sh @@ -38,7 +38,6 @@ if [ "$lines" -gt 1 ] ; then fi else job_log "[BLACKLIST] can't update referrers list" - fi rm -f /tmp/map-referrer.conf 2> /dev/null diff --git a/scripts/user-agents.sh b/scripts/user-agents.sh index fa0f187..5541495 100755 --- a/scripts/user-agents.sh +++ b/scripts/user-agents.sh @@ -40,7 +40,6 @@ if [ "$lines" -gt 1 ] ; then fi else job_log "[BLACKLIST] can't update user-agent list" - fi rm -f /tmp/map-user-agent.conf 2> /dev/null diff --git a/ui/Dockerfile b/ui/Dockerfile index 2d5b813..537cc2b 100644 --- a/ui/Dockerfile +++ b/ui/Dockerfile @@ -11,7 +11,7 @@ COPY ui/ /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/ui/Dockerfile-amd64 b/ui/Dockerfile-amd64 index 811b19d..42d0890 100644 --- a/ui/Dockerfile-amd64 +++ b/ui/Dockerfile-amd64 @@ -11,7 +11,7 @@ COPY ui/ /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/ui/Dockerfile-arm32v7 b/ui/Dockerfile-arm32v7 index 55e072e..fcfe520 100644 --- a/ui/Dockerfile-arm32v7 +++ b/ui/Dockerfile-arm32v7 @@ -18,7 +18,7 @@ COPY ui/ /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/ui/Dockerfile-arm64v8 b/ui/Dockerfile-arm64v8 index 738f3c5..b094112 100644 --- a/ui/Dockerfile-arm64v8 +++ b/ui/Dockerfile-arm64v8 @@ -18,7 +18,7 @@ COPY ui/ /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx diff --git a/ui/Dockerfile-i386 b/ui/Dockerfile-i386 index adb6457..ec60ddd 100644 --- a/ui/Dockerfile-i386 +++ b/ui/Dockerfile-i386 @@ -11,7 +11,7 @@ COPY ui/ /opt/entrypoint/ RUN chmod +x /opt/entrypoint/*.py /opt/entrypoint/*.sh # Fix CVE-2020-1971 -RUN apk add "libcrypto1.1>1.1.1g-r0" +RUN apk add "libcrypto1.1>1.1.1g-r0" "libssl1.1>1.1.1g-r0" VOLUME /etc/nginx