Update image to mitigate CVE-2023-44487 vulnerability about docker-nginx-unprivileged

[abscondment]

I took a look at opening a PR to change the stable images to 1.24.0-r7, but updating PKG_RELEASE to 7 caused some unexpected changes that made the rest of the docker build fail. Configuration directories/files seem to have been relocated between these releases, so it seems like it might be a breaking change for many users.

[bebosudo]

Any update on this effort?

[alessfg]

Yep! Although it might not be the one you were looking for. There are no active plans to release patches to specifically address this CVE in the stable branch. The CVE only comes into play in certain NGINX HTTP/2 configurations, and as such we are recommending users tweak their config instead per the instructions here (https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/).

If you want a "patched" version of NGINX (it's more of a system stability update than a "patch"), I would suggest switching from the stable to the mainline branch.

Alternatively, feel free to use the Alpine NGINX package (that's the 1.24.0-r7 package you are seeing as being fixed) instead of the one built by us (which is still at 1.24.0-r1).