How to get libheic

תמיכה התקנה
1

I’ve got a client who was running an old version and apparently got hacked due to security issues in ImageMagick and/or libheif. They’re updated to latest ESR now, but they still have 1.23.1 and they insist on the 1.23.4 that’s in SECURITY: Update libheif to 1.23.4 (#1127) · discourse/discourse_docker@97c20dc · GitHub

Are there plans to bump the base image soon? If not, is the best/easier thing to do is edit templates/web.template.yml and update the base image there? (And then hope that I remember to un-edit it when the base image does get bumped?)

2

I wouldn’t recommend manually overriding the base image - that’ll mean using an image which we haven’t tested for production use. Plus there is the risk of forgetting to unpin, as you said.

I’ll look at whether we can bump the image soon. But it’s worth noting that all image-processing is now sandboxed to defend against the kind of vulnerabilities which were present in libheif:

3

Image is bumped: Bump default base image to discourse/base:2.0.20260915-0028 (#1130) · discourse/discourse_docker@9384b12 · GitHub

4 
root@live:/var/discourse# echo $(docker exec web_only bash -c 'find /usr/lib/ -name libheif*')
/usr/lib/x86_64-linux-gnu/libheif.so.1.23.4 /usr/lib/x86_64-linux-gnu/libheif.so.1

Thanks!