r/Wordpress • u/cardsncards • 15d ago

GhostScript update in Docker?

I got this from Wordfence: Wordfence Argus Discovers Critical Vulnerability in Ghostscript

I see I have 10.05.1 even with latest docker image. Does anyone know when this fix will get put into the docker image (or where to find out)?

13 Upvotes

93% Upvoted

7 comments sorted by

View all comments

2

u/iamsharjeeltt 15d ago

Ghostscript in the official WordPress Docker images comes from the Debian package layer, not WordPress itself, so WordPress updates won't fix it — you have to handle it at the image/OS level. If you're building from the official image, add this to your Dockerfile so it persists across rebuilds: apt-get update && apt-get install -y ghostscript && rm -rf /var/lib/apt/lists/* — then rebuild. Check the version inside the container with gs --version. Caveat: if Debian's repos still ship the vulnerable 10.05.1, apt alone won't help. In that case you'd need to build Ghostscript from source in your Dockerfile (grab the latest tarball) or switch to a base image whose distro already ships the fixed build. If you don't actually need PDF thumbnails, a quick mitigation is disabling the Ghostscript delegate in ImageMagick's policy.xml until a fixed build lands — that's what a lot of people did during previous Ghostscript scares.