# changelog

author: Java SIG <java-devel@lists.fedoraproject.org> - 1.0.12-2
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Cory McIntire <cory@cpanel.net> - 2.4.46-5
changelog:
  - EA-9463: Resolve Apache startup race conditions
             Enable mod_systemd for further startup enhancements


author: Travis Holloway <t.holloway@cpanel.net> - 2.4.49-2
changelog:
  - EA-10123: Patch apache 2.4.49: Correctly decrement active_daemons also in the case that the child process decides on its own to die because of MaxRequestsPerChild.


author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
  - EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
  	- CVE-2023-31122: mod_macro buffer over-read
  	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
  	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
  - EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
  	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
  	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
  	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
  - EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
  	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
  	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
  	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
  	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
  	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
  	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
  	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
  	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
  - EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
  	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Daniel Muey <dan@cpanel.net> - 1.0-157
changelog:
  - ZC-5669: Add undocumented & unsupported touchfile to disable 009-phpconf.pl's user setting validation


author: Daniel Muey <dan@cpanel.net> - 1.0-175
changelog:
  - ZC-9061: Detect and inform admin of non-existent home directory
  - ZC-9058: Have nobody check set primary group to nobody


author: Dan Muey <dan@cpanel.net> - 1.0-178
changelog:
  - ZC-9109: Do ensure-nobody script pre transaction so post transaction script can relay on it being there


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.92-1.cloudlinux
changelog:
  - Epoch bumped to 1
  - Removed Vendor tags
  - 491_mod_bw.conf and setbwlimit files added to the sources list


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.4-4
changelog:
  - Change bwlimited.conf to 0644 so that normal users can load modules
    the same as Apache while testing their configuration with 'httpd -t'
  - Also renamed configuration to 490_mod_bwlimited.conf to match the
    naming scheme of our other files.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-1
changelog:
  - EA-7191: Initial implementation of mod_cpanel:
      * Handle requests to suspended users in apache without requiring
        an include file to be generated on the product side.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.4-1
changelog:
  - EA-7821: Don't strip symbools from the debug package.
  - EA-7822: Handle edge cases where request_rec->filename == NULL.
      * Some modules that hook into the map_to_storage process (eg. mod_pagespeed),
        can alter the request_rec in an unexpected manner, that resulted
        result in a segfault.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
  - General cleanup (EA-5395)
  - Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
  - Switch to rpm macros


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author: Tim Mullin <tim@cpanel.net> - 2.9.3-18
changelog:
  - EA-10239: Increase compiler optimization level to help mitigate performance loss from large rulesets


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Tim Mullin <tim@cpanel.net> - 0.7.2-25
changelog:
  - EA-7525: Fixed 0008-Support-phprc_paths-section-in-suphp.conf.patch, targetMode used before initialized


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 0.7.2-25.cloudlinux.1
changelog:
  - EA4D-97: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea- and alt-php


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.7.2-30.cloudlinux.1
changelog:
  - EA4D-323: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea-php* and alt-php*


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Tim Mullin <tim@cpanel.net> - 1.6.3-1
changelog:
  - EA-11199: Update apr-util from v1.6.1 to v1.6.3
  - CVE-2022-25147
      Integer Overflow or Wraparound vulnerability in apr_base64 functions
      of Apache Portable Runtime Utility (APR-util) allows an attacker to
      write beyond bounds of a buffer.


author: Daniel Muey <dan@cpanel.net> - 1.0-37
changelog:
  - ZC-7307: Specify default directory index and PHP FPM’s `security_limit_extensions` that so they can be updated without requiring a ULC updated/backport


author: Dan Muey <dan@cpanel.net> - 1.0-48
changelog:
  - ZC-9307: Rolling “ea-cpanel-tools” back to “0a3c415”: ea-apache24-mod-passenger shows up under Apache modules so additional packages was not necessary


author: Dan Muey <dan@cpanel.net> - 1.0-54
changelog:
  - ZC-9758: Add ea-nginx-brotli to additional packages list && do http2-like toggle off recommendations
  - ZC-9759: add `container_based_packages` list to ea4-metainfo.json


author: Julian Brown <julian.brown@cpanel.net> - 1.0-56
changelog:
  - ZC-9849: Add pkg_manifest.json and add target to ea_current_to_profile
  - ZC-9854: Add ea-nginx-njs to additional packages and recommendations.


author: Dan Muey <dan@cpanel.net> - 1.0-57
changelog:
  - ZC-9886: Add meta info to target-os profile && update EA4-production manifest when updating EA4 manifest
  - EA-10600: Add PHP 7.3 to EOL recommendations


author: Dan Muey <dan@cpanel.net> - 1.0-65
changelog:
  - ZC-10447: update manifest for A9 and PHP 8.2, make PHP 8.1 the default for EA4
  - ZC-10581: update ea4 recommendations to match the PHP reality


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.0-71
changelog:
  - ZC-10474: Add ea-nginx-headers-more to `additional_packages`
  - ZC-10320: Add Ubuntu 22 to manifest


author: Dan Muey <dan@cpanel.net> - 1.0-72
changelog:
  - ZC-10955: Update manifest for post reset of OBS flags (Makefile disables only; no manual disables)


author: Dan Muey <dan@cpanel.net> - 1.0-78
changelog:
  - ZC-11033: Add support for packages w/out an `ea-` prefix in EA4 profiles
  - ZC-11135: Add ea-nodejs18 and ea-nodejs20 to additional packages list
  - ZC-11149: Add touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited to readme


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.0-86.cloudlinux.1
changelog:
  - add strong requires for ea-profiles-cloudlinux >= 4:1.0-68.2
  - EA4D-244: Update EOL ea-php versions


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Dan Muey <dan@cpanel.net> - 2.9.7-1
changelog:
  - EA-7043: Update from v2.9.4 to v2.9.7
  - fixed %setup so that we do not need to modify tarball (EA-6094)
  - remove unreferenced 2.9.4-remove-pyverify_fd patch


author: Cory McIntire <cory@cpanel.net> - 2.10.3-1
changelog:
  - EA-11205: Update ea-libxml2 from v2.9.7 to v2.10.3
  - [CVE-2022-23308] Use-after-free of ID and IDREF attributes
  - [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
  - [CVE-2022-2309] Reset nsNr in xmlCtxtReset
  - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE


author: Cory McIntire <cory@cpanel.net> - 2.10.4-1
changelog:
  - EA-11352: Update ea-libxml2 from v2.10.3 to v2.10.4
  - [CVE-2023-29469] Hashing of empty dict strings isn't deterministic
  - [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType


author: Cory McIntire <cory@cpanel.net> - 2.11.1-1
changelog:
  - EA-11388: Update ea-libxml2 from v2.10.4 to v2.11.1
      - Security Fixes
      - Fix use-after-free in xmlParseContentInternal() (David Kilzer)
      - xmllint: Fix use-after-free with --maxmem
      - parser: Fix OOB read when formatting error message
      - entities: Rework entity amplification checks


author: Cory McIntire <cory@cpanel.net> - 2.11.5-2
changelog:
  - EA-11822: Rolling “ea-libxml2” back to “04c4b9a40fbd4c0f07e1b66ab71f24a66aa7f90d”: libxml2 upstream updated to 2.12 and changed a lot of .h files, apache/php need patches


author: Cory McIntire <cory@cpanel.net> - 2.12.6-1
changelog:
  - EA-12022: Update ea-libxml2 from v2.12.4 to v2.12.6
  - [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking


author: Cory McIntire <cory@cpanel.net> - 2.12.6-2
changelog:
  - EA-12252: Rolling “ea-libxml2” back to “0e1f4ea2052c4cb2643ebd9d51394223643c6fc2”: breaks scl-phps


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
  - EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.6-1
changelog:
  - EA-12713: Update ea-libxml2 from v2.13.5 to v2.13.6
    - [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements
    - [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd


author: Cory McIntire <cory@cpanel.net> - 1.10-2
changelog:
  - EA-12397: Rolling “ea-libzip” back to “a55dc085a3c6d8ccc95613a7f6acf4589fe405c2”: Version issues in happening in PHP compliations with this update


author: Jack Hayhurst <jakdept@gmail.com> - 1.4.35-4
changelog:
  - Change config install location in spec file to match init files
  - modified from github PR #1, also fixed changelog versions


author: Andy Baugh <thomas.baugh@cpanel.net> - 1.5.12-2
changelog:
  - CPANEL-26786: Add "provides" entry for memcached, as we actually conflict
    with the base package due to installing to the same place (but it is the
    same software package ultimately, so may as well have it act as an
    alternative instead of conflicting).


author: Daniel Muey <dan@cpanel.net> - 3.0.4-3
changelog:
  - ZC-7506: Support `/usr/local/cpanel/3rdparty/share/geoipfree/IpToCountry.dat` as a value for `SecGeoLookupDb`
  - ZC-7507: Add lua support


author: Dan Muey <dan@cpanel.net> - 1.0.3-2
changelog:
  - ZC-10395: Build/manage `modules/ngx_http_modsecurity_module.so` and nginx modsec hooks in this pkg


author: Daniel Muey <dan@cpanel.net> - 1.0.1-4
changelog:
  - ZC-7769: factor in that `active_configs` still has the vendor info even if the vendor is disabled per `active_configs`


author: Cory McIntire <cory@cpanel.net> - 1.57.0-1
changelog:
  - EA-11729: Update ea-nghttp2 from v1.56.0 to v1.57.0
  - CVE-2023-44487 - The HTTP/2 protocol allows a denial of service (server resource consumption)


author: Cory McIntire <cory@cpanel.net> - 1.61.0-1
changelog:
  - EA-12069: Update ea-nghttp2 from v1.60.0 to v1.61.0
  - CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage


author: Dan Muey <dan@cpanel.net> - 1.21.4-6
changelog:
  - ZC-9343: Change worker_processes to auto
  - ZC-9343: Allow setting `worker_processes` via /etc/nginx/ea-nginx/settings.json
  - ZC-9343: When writing settings.json make it human readable
  - ZC-7303: Support IP based requests (ZC-9586: only use an IP once)
  - ZC-9384: Use mycpanel.pem if its there


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.5-2
changelog:
  - EA-10283: Only perform regex check for WordPress login for domains that have at least one WordPress site installed


author: Dan Muey <dan@cpanel.net> - 1.21.5-5
changelog:
  - ZC-9700: Do not use predictable cPanel-localhost header
  - ZC-9700: ensure random value is regenerated if missing or older than 30 minutes; ensure users can not see the value
  - EA-10464: Avoid redirect to https for service subdomain DCV validation


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-2
changelog:
  - EA-10503: Update standalone config to ensure 404 for non-existent php files
  - EA-10285: Have 'ea-nginx config --all' update user configs in parallel


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-5
changelog:
  - EA-10493: The server_name directive needs the public/external IP on systems configured to use a NAT


author: Dan Muey <dan@cpanel.net> - 1.21.6-11
changelog:
  - ZC-9698: Proxy robots.txt (and favicon) since it can be dynamic (e.g. wordpress + .htaccess)
  - ZC-9844: Add flag file to use micro caching as the cache defaults


author: Dan Muey <dan@cpanel.net> - 1.21.6-13
changelog:
  - ZC-9931: Ensure that a pre-existing cache.json/settings.json is respected when ea-nginx is installed
  - ZC-9371: enable keepalive support
  - ZC-9939: optimize proxy sub-domain configuration
  - ZC-9952: Allow setting `worker_shutdown_timeout` via /etc/nginx/ea-nginx/settings.json
  - EA-10673: Increase `proxy_headers_hash_bucket_size` to 128 in cpanel-proxy-xt.conf


author: Dan Muey <dan@cpanel.net> - 1.22.0-2
changelog:
  - ZC-9940: Change worker_processes default back to 1
  - ZC-9940: Have worker_shutdown_timeout default to 10 seconds


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-3
changelog:
  - EA-10892: Avoid configuring shared IPs in multiple server blocks when configuring nginx asynchronously


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-4
changelog:
  - EA-10671: Calculate 'server_names_hash_bucket_size' and 'server_names_hash_max_size' at config time
  - EA-10913: Update ea-nginx.conf when adding/updating a config file for a single user


author: Tim Mullin <tim@cpanel.net> - 1.23.2-2
changelog:
  - EA-10999: Update logic to check if service is listening on ports 80 or 443
  - EA-10985: Drop logrotate configuration for domain logs since cpanellogd handles the rotation


author: Tim Mullin <tim@cpanel.net> - 1.23.2-4
changelog:
  - EA-11004: Fix Passenger restart failures after reboot
  - EA-10670: Add better guards against bad userdata to configuration script


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-5
changelog:
  - EA-10769: Allow custom config files to be moved across partitions when ea-nginx is installed
  - EA-11025: If user generated config is detected as bad after configuration, remove the config file to avoid taking all sites down


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-7
changelog:
  - EA-11048: Move '/var/log/nginx' to a backup location during uninstall
  - EA-11069: Increase open files limit for master and worker processes
  - EA-10574: Remove deprecated configure option --with-ipv6
  - EA-10874: Remove fallback logic in scripts::ea_nginx::_get_application_paths()


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-8
changelog:
  - EA-11078: Fix uninitialized value warning for non-user requests when the USER_ID touch file exists
  - EA-11093: Increase nginx buffer when calculating server_names_hash_bucket_size
  - EA-10891: Refactor logging initialization to be its own sub


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.23.3-3
changelog:
  - ZC-10317: Update ngx_http_pipelog_module to v1.0.3
  - ZC-10484: Remove SIGKILL from various nginx files
  - ZC-10517: Address Ubuntu creating addiotional splitlog processes
  - ZC-10593: Close out fd's during reload/shutdown
  - EA-11088: Account for mail subdomains of addon and parked domains when configuring the server_name directive
  - EA-11121: Add ipv6 subdomain to server_name directive when account has an ipv6 address assigned
  - EA-10890: Refactor _render_and_append() to use more data from global config data


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.3-7
changelog:
  - EA-11269: Reduce frequency of nginx restarts during cpanellogd's domain log processing when piped logging is enabled


author: 2023 Danila Vershinin <dvershinin@cloudlinux.com> - 1:1.23.4-2.cloudlinux.1
changelog:
  - AP2NGX-4 updated patch allowing more contexts for a number of NGINX directives
  - AP2NGX-14 added patch that allows customizing root locations in server blocks


author: Travis Holloway <t.holloway@cpanel.net> - 1.24.0-2
changelog:
  - EA-11131: Ensure userdata reflects apache port changes when ea-nginx is removed
  - EA-11132: Ensure '/var/log/nginx.uninstall' does not exist before moving active log files there


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.25.1-1.cloudlinux.1
changelog:
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Cory McIntire <cory@cpanel.net> - 1.25.1-1
changelog:
  - EA-11496: Update ea-nginx from v1.25.0 to v1.25.1
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Dan Muey <dan@cpanel.net> - 1.25.1-4
changelog:
  - ZC-11149: support touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.25.3-1.cloudlinux.1
changelog:
  - AP2NGX-70: Add support of lsapi Virtual Hosts to ea-nginx
  - AP2NGX-77: Fixed invalid number of arguments in the "client_max_body_size" directive


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.25.4-1.cloudlinux.1
changelog:
  - AP2NGX-81: Fix regression issus introduced by AP2NGX-70
  - AP2NGX-81: Correct lsapi_handler value for lsapi virtual hosts
  - AP2NGX-81: Increase timeout during transition from Apache to NGINX to improve reliability


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
  - ZC-11679: Account for circumstance where wwwacct.conf is missing
  - ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
  - EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
  - *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
    Thanks to Nils Bars.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.6
changelog:
  - AP2NGX-221: Reorder redirects to ensure proxy_pass by Apache2Nginx is in effect
  - removed WAFCL patch


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.7
changelog:
  - AP2NGX-226: Include environment variable for extra server identification to PHP scripts
  - AP2NGX-236: Ensure consistent index directive defaults between Apache, PHP-FPM and LSAPI and index_error_code directive


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
  - EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
  - Security: insufficient check in virtual servers handling with TLSv1.3
    SNI allowed to reuse SSL sessions in a different virtual server, to
    bypass client SSL certificates verification (CVE-2025-23419)


author: Cory McIntire <cory.mcintire@webpros.com> - 6.0.24-1
changelog:
  - EA-12681: ea-passenger-src was updated from v6.0.23 to v6.0.24
  - EA-12686: Build against ea-nginx version v1.26.3


author: Dan Muey <dan@cpanel.net> - 16.13.1-2
changelog:
  - ZC-9571: Explicitly conflict w/ `ea-nodejs10` so that DNF does not simply downgrade it to get around the conflict


author: Cory McIntire <cory@cpanel.net> - 16.19.1-1
changelog:
  - EA-11255: Update ea-nodejs16 from v16.19.0 to v16.19.1
  - [CVE-2023-23918) Node.js Permissions policies can be bypassed via process.mainModule (High)
  - [CVE-2023-23919) Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
  - [CVE-2023-23920] Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)


author: Cory McIntire <cory@cpanel.net> - 16.19.1-1
changelog:
  - EA-11255: Update ea-nodejs16 from v16.19.0 to v16.19.1
  - [CVE-2023-23918) Node.js Permissions policies can be bypassed via process.mainModule (High)
  - [CVE-2023-23919) Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
  - [CVE-2023-23920] Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
  - [CVE-2023-23936] Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
  - [CVE-2023-24807] Regular Expression Denial of Service in Headers in Node.js fetch API (Low)


author: Cory McIntire <cory@cpanel.net> - 16.20.2-1
changelog:
  - EA-11604: Update ea-nodejs16 from v16.20.1 to v16.20.2
  	- CVE-2023-32559: Policies can be bypassed via process.binding
  	- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire
  	- CVE-2023-32002:  Policies can be bypassed via Module.\_load
  	- OpenSSL sources upgraded upstream to latest


author: Cory McIntire <cory@cpanel.net> - 18.18.2-1
changelog:
  - EA-11746: Update ea-nodejs18 from v18.18.0 to v18.18.2
  	undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (High) - (CVE-2023-45143)
  	nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)
  	Permission model improperly protects against path traversal (High) - (CVE-2023-39331)
  	Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332)
  	Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552)
  	Code injection via WebAssembly export names (Low) - (CVE-2023-39333)


author: Cory McIntire <cory@cpanel.net> - 18.19.1-1
changelog:
  - EA-11974: Update ea-nodejs18 from v18.19.0 to v18.19.1
  - CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  - CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  - CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  - CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)


author: Cory McIntire <cory@cpanel.net> - 18.20.1-1
changelog:
  - EA-12067: Update ea-nodejs18 from v18.20.0 to v18.20.1
  - CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
  - CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)


author: Cory McIntire <cory@cpanel.net> - 18.20.2-1
changelog:
  - EA-12082: Update ea-nodejs18 from v18.20.1 to v18.20.2
  - Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) - (HIGH)


author: Cory McIntire <cory@cpanel.net> - 18.20.4-1
changelog:
  - EA-12274: Update ea-nodejs18 from v18.20.3 to v18.20.4
  	- CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
  	- CVE-2024-22020 - Bypass network import restriction via data URL (Medium)


author: Cory McIntire <cory@cpanel.net> - 18.20.6-1
changelog:
  - EA-12662: Update ea-nodejs18 from v18.20.5 to v18.20.6
  	- GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
  	- Path traversal by drive name in Windows environment (CVE-2025-23084) - (medium)


author: Cory McIntire <cory@cpanel.net> - 20.8.0-1
changelog:
  - EA-11715: Update ea-nodejs20 from v20.7.0 to v20.8.0
      undici - Cookie headers are not cleared in cross-domain redirect in undici-fetch (High) - (CVE-2023-45143)
      nghttp2 - HTTP/2 Rapid Reset (High) - (CVE-2023-44487)
      Permission model improperly protects against path traversal (High) - (CVE-2023-39331)
      Path traversal through path stored in Uint8Array (High) - (CVE-2023-39332)
      Integrity checks according to policies can be circumvented (Medium) - (CVE-2023-38552)
      Code injection via WebAssembly export names (Low) - (CVE-2023-39333)


author: Cory McIntire <cory@cpanel.net> - 20.11.1-1
changelog:
  - EA-11975: Update ea-nodejs20 from v20.11.0 to v20.11.1
  - CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
  - CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
  - CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
  - CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
  - CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
  - CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
  - CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
  - CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)


author: Cory McIntire <cory@cpanel.net> - 20.12.1-1
changelog:
  - EA-12068: Update ea-nodejs20 from v20.12.0 to v20.12.1
  - CVE-2024-27983 - Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash- (High)
  - CVE-2024-27982 - HTTP Request Smuggling via Content Length Obfuscation - (Medium)


author: Cory McIntire <cory@cpanel.net> - 20.12.2-1
changelog:
  - EA-12083: Update ea-nodejs20 from v20.12.1 to v20.12.2
  - Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) - (HIGH)


author: Cory McIntire <cory@cpanel.net> - 20.15.1-1
changelog:
  - EA-12264: Update ea-nodejs20 from v20.15.0 to v20.15.1
  	- CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
  	- CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
  	- CVE-2024-22018 - fs.lstat bypasses permission model (Low)
  	- CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
  	- CVE-2024-37372 - Permission model improperly processes UNC paths (Low)


author: Cory McIntire <cory@cpanel.net> - 20.18.2-1
changelog:
  - EA-12663: Update ea-nodejs20 from v20.18.1 to v20.18.2
  	- Worker permission bypass via InternalWorker leak in diagnostics (CVE-2025-23083) - (high)
  	- GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
  	- Path traversal by drive name in Windows environment (CVE-2025-23084) - (medium)


author: Cory McIntire <cory@cpanel.net> - 22.4.1-1
changelog:
  - EA-12265: Update ea-nodejs22 from v22.3.0 to v22.4.1
  	- CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
  	- CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
  	- CVE-2024-22018 - fs.lstat bypasses permission model (Low)
   	- CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
  	- CVE-2024-37372 - Permission model improperly processes UNC paths (Low)


author: Cory McIntire <cory@cpanel.net> - 22.13.1-1
changelog:
  - EA-12664: Update ea-nodejs22 from v22.13.0 to v22.13.1
  	- Worker permission bypass via InternalWorker leak in diagnostics (CVE-2025-23083) - (high)
  	- GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
  	- Path traversal by drive name in Windows environment (CVE-2025-23084) - (medium)


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0.2o-2
changelog:
  - EA-7382: Ensure we build shared objects with versioned symbols.
  - Applied patch for CVE-2018-0737: Cache timing vulnerability in RSA Key Generation


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0.2o-3
changelog:
  - EA-7468: Ensure dependency resolution picks /usr/bin/perl instead
    of /bin/perl. This helps downstream users of our RPMs as their
    build environments can be simplified.


author: Cory McIntire <cory@cpanel.net> - 1.0.2q-1
changelog:
  - EA-8030: Update to 1.0.2q
    CVE-2018-5407 Microarchitecture timing vulnerability in ECC scalar multiplication
    CVE-2018-0734 Timing vulnerability in DSA signature generation


author: Cory McIntire <cory@cpanel.net> - 1.1.1j-1
changelog:
  - EA-9590: Update ea-openssl11 from v1.1.1i to v1.1.1j
    Null pointer deref in X509_issuer_and_serial_hash() (CVE-2021-23841)
    Incorrect SSLv2 rollback protection (CVE-2021-23839)
    Integer overflow in CipherUpdate (CVE-2021-23840)


author: Cory McIntire <cory@cpanel.net> - 1.1.1n-1
changelog:
  - EA-10564: Update ea-openssl11 from v1.1.1m to v1.1.1n
  - Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)


author: Cory McIntire <cory@cpanel.net> - 1.1.1p-1
changelog:
  - EA-10773: Update ea-openssl11 from v1.1.1o to v1.1.1p
  - The c_rehash script allows command injection (CVE-2022-2068)


author: Cory McIntire <cory@cpanel.net> - 1.1.1t-1
changelog:
  - EA-11213: Update ea-openssl11 from v1.1.1s to v1.1.1t
  - X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)
  - Timing Oracle in RSA Decryption (CVE-2022-4304)
  - Use-after-free following BIO_new_NDEF (CVE-2023-0215)
  - Double free after calling PEM_read_bio_ex (CVE-2022-4450)


author: Cory McIntire <cory@cpanel.net> - 1.1.1u-1
changelog:
  - EA-11449: Update ea-openssl11 from v1.1.1t to v1.1.1u
      - Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)


author: Cory McIntire <cory@cpanel.net> - 1.1.1v-1
changelog:
  - EA-11578: Update ea-openssl11 from v1.1.1u to v1.1.1v
  	- Fix excessive time spent checking DH q parameter value (CVE-2023-3817)
  	- Fix DH_check() excessive time with over sized modulus (CVE-2023-3446)


author: Cory McIntire <cory@cpanel.net> - 1.1.1w-1
changelog:
  - EA-11665: Update ea-openssl11 from v1.1.1v to v1.1.1w
  	- Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807)


author: Dan Muey <dan@cpanel.net> - 1.0-2
changelog:
  - ZC-9259: Have setting script do defaults (so it can be done at will); use helper script instead of /dev/null for missing binaries


author: Cory McIntire <cory.mcintire@webpros.com> - 6.0.26-1
changelog:
  - EA-12725: Update ea-passenger-src from v6.0.25 to v6.0.26
    * [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-3
changelog:
  - EA-6958: Ensure ownership of _licensedir if it is set
  - ZC-3247: Add support for the allowed-php list to WHM’s Feature Lists


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.16
changelog:
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.18
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.19
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 5.1.6-24.cloudlinux.20
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - Update litespeed to 7.7 version


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.21
changelog:
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.23
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.1.6-24.cloudlinux.26
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - Fix build with ea-brotli-1.0.9


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.1.6-24.cloudlinux.31
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.32
changelog:
  - Fix for hardened PHP
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.33
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.1.6-24.cloudlinux.36
changelog:
  - Fix for hardened PHP
  - CVE-2022-31629: use stack instead of heap, check correct one var
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.1.6-24.cloudlinux.39
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: S. Kurt Newman <kurt.newman@cpanel.net> - 4.7.5-5
changelog:
  - Added scl_package_override macro to regain access to global
    PHP macros that contain location and verison information.


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.26
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.27
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.29
changelog:
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.2.17-27.cloudlinux.41
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-27.cloudlinux.44
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.2.17-27.cloudlinux.46
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.50
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.25
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.3.29-29.cloudlinux.28
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory
  - Fix build with ea-brotli-1.0.9


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-29.cloudlinux.35
changelog:
  - CVE-2021-21703: fix error in php fpm shared memory organization leading to privilage escalation
  - CVE-2021-21707: fix handling of paths with percent encoded NULL byte


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-29.cloudlinux.40
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-29.cloudlinux.50
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.51
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Dan Muey <dan@cpanel.net> - 3.3-7
changelog:
  - EA-5028 via EA-5900: reinstate opcache conflict
  - (the obsoletes is problematic and there is a
  -   proper way to address the problem it was intended to solve)


author: Cory McIntire <cory@cpanel.net> - 1.10.13-1
changelog:
  - EA-11201: Update PEAR and its dependencies
  - Update PEAR from 1.10.12 to 1.10.13
  - Update Archive_Tar from 1.4.9 to 1.4.14
  - Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949)
  - Symlink out-of-path write vulnerability (CVE-2020-36193)
  - Properly fix symbolic link path traversal (CVE-2021-32610)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.10.16-3
changelog:
  - ZC-12614: Rolling “ea-scl-php-pear” back to “9bf382bf95619afb4023c729d76a50e1d98ac429”: merged accidentally


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.4.45-76.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-62.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-22.cloudlinux.6
changelog:
  - Add MySQL 8 charset's support
  - Backport native api for MySQL 8 compatibility
  - Fix tests charsets processing


author: Tim Mullin <tim@cpanel.net> - 7.0.33-26
changelog:
  - EA-11821: Patch to build with the latest ea-libxml2
  - ZC-10950: Add debug_package nil back w/ second directive (3rd item will be ZC-10951)
  - ZC-10936: Clean up Makefile and remove debug-package-nil


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-26.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-26.cloudlinux.6
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Jack Hayhurst <jack@deleteos.com> - 0.2
changelog:
  - added ea-php71-php-memcahe branched off of php54

  - Fixed package name, entire RPM is now working.


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.2.32-2.cloudlinux.1
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached


author: Daniil Leonov <dleonov@cloudlinux.com> - 7.2.34-3.cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77423: FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked
  - Fix Bug #80411: References to null-serialized object break serialize()


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.4
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-9.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74267: fix segfault with streams and invalid datas
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


author: Cory McIntire <cory@cpanel.net> - 0.5.0-3
changelog:
  - ZC-5409: Rolling “scl-snuffleupagus” back to “63cd813641f9dd7df4ad40df37c66af353df6378”
  - Testing EA4-tool rollback procedures


author: Tim Mullin <tim@cpanel.net> - 0.5.0-5
changelog:
  - EA-8865: Add php-cli as a dependency
  - Added autotools-latest-autoconf to build with PHP73 & Cent6


author: Eduard Abdullin <eabdullin@cloudlinux.con> - 8.0.0-2.cloudlinux.1
changelog:
  - Fix patch 0007 with cloudlinux-php-fpm patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory


author: Cory McIntire <cory@cpanel.net> - 8.0.25-1
changelog:
  - EA-11020: Update ea-php80 from v8.0.24 to v8.0.25
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.0.27-1
changelog:
  - EA-11137: Update ea-php80 from v8.0.26 to v8.0.27
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.0.28-1
changelog:
  - EA-11227: Update ea-php80 from v8.0.27 to v8.0.28
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.0.29-1
changelog:
  - EA-11475: Update ea-php80 from v8.0.28 to v8.0.29
      - Fixed bug GHSA-76gg-c692-v2mw
          (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 8.0.3-2.cloudlinux.1
changelog:
  - remove 0005-Ensure-that-php.d-is-not-scanned-when-PHPRC-is-set.patch for EA4D-265
  - Update litespeed log patch for litespeed-7.9


author: Cory McIntire <cory@cpanel.net> - 8.0.30-1
changelog:
  - EA-11590: Update ea-php80 from v8.0.29 to v8.0.30
  	- Libxml:
  		Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  	- Phar:
  		Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 8.0.30-4.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug
    causing password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-8.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-8929: fix various heap buffer over-reads for mysqlnd
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Cory McIntire <cory@cpanel.net> - 8.1.31-1
changelog:
  - EA-12576: Update ea-php81 from v8.1.30 to v8.1.31
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.1.8-1
changelog:
  - EA-10821: Update ea-php81 from v8.1.7 to v8.1.8
  - (Heap buffer overflow in finfo_buffer). (CVE-2022-31627)


author: Cory McIntire <cory@cpanel.net> - 8.1.12-1
changelog:
  - EA-11021: Update ea-php81 from v8.1.11 to v8.1.12
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.1.14-1
changelog:
  - EA-11133: Update ea-php81 from v8.1.13 to v8.1.14
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.1.16-1
changelog:
  - EA-11244: Update ea-php81 from v8.1.15 to v8.1.16
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.1.20-1
changelog:
  - EA-11477: Update ea-php81 from v8.1.19 to v8.1.20
      - Fixed bug GHSA-76gg-c692-v2mw
          - (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Cory McIntire <cory@cpanel.net> - 8.1.22-1
changelog:
  - EA-11589: Update ea-php81 from v8.1.21 to v8.1.22
  	- Libxml:
  		Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  	- Phar:
  		Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Cory McIntire <cory@cpanel.net> - 8.1.28-1
changelog:
  - EA-12087: Update ea-php81 from v8.1.27 to v8.1.28
  - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
  - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
  - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)


author: Cory McIntire <cory@cpanel.net> - 8.1.29-1
changelog:
  - EA-12192: Update ea-php81 from v8.1.28 to v8.1.29
  - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.1.30-1
changelog:
  - EA-12428: Update ea-php81 from v8.1.29 to v8.1.30
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.32-1
changelog:
  - EA-12766: Update ea-php81 from v8.1.31 to v8.1.32
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 14.4.0-1
changelog:
  - EA-12675: Update ea-ioncube14 from v14.0.0 to v14.4.0
  - Full release of PHP 8.4 loaders that will run encoded files produced by the PHP 8.3 & 8.2 Encoders.


author: Cory McIntire <cory@cpanel.net> - 8.2.26-1
changelog:
  - EA-12577: Update ea-php82 from v8.2.25 to v8.2.26
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.2.1-1
changelog:
  - EA-11136: Update ea-php82 from v8.2.0 to v8.2.1
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.2.7-1
changelog:
  - EA-11478: Update ea-php82 from v8.2.6 to v8.2.7
      - Fixed bug GHSA-76gg-c692-v2mw
          - (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Cory McIntire <cory@cpanel.net> - 8.2.9-1
changelog:
  - EA-11619: Update ea-php82 from v8.2.8 to v8.2.9
      - Libxml:
          Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
      - Phar:
          Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Cory McIntire <cory@cpanel.net> - 8.2.18-1
changelog:
  - EA-12085: Update ea-php82 from v8.2.17 to v8.2.18
  - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
  - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
  - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)


author: Cory McIntire <cory@cpanel.net> - 8.2.20-1
changelog:
  - EA-12194: Update ea-php82 from v8.2.19 to v8.2.20
  - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.2.24-1
changelog:
  - EA-12423: Update ea-php82 from v8.2.23 to v8.2.24
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.28-1
changelog:
  - EA-12772: Update ea-php82 from v8.2.27 to v8.2.28
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory@cpanel.net> - 8.2.3-1
changelog:
  - EA-11226: Update ea-php82 from v8.2.2 to v8.2.3
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.3.14-1
changelog:
  - EA-12578: Update ea-php83 from v8.3.13 to v8.3.14
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.3.6-1
changelog:
  - EA-12086: Update ea-php83 from v8.3.4 to v8.3.6
  - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
  - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
  - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
  - Fixed bug GHSA-fjp9-9hwx-59fq (mb_encode_mimeheader runs endlessly for some inputs). (CVE-2024-2757)


author: Cory McIntire <cory@cpanel.net> - 8.3.8-1
changelog:
  - EA-12193: Update ea-php83 from v8.3.7 to v8.3.8
  - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.3.12-1
changelog:
  - EA-12410: Update ea-php83 from v8.3.11 to v8.3.12
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.3.19-1
changelog:
  - EA-12769: Update ea-php83 from v8.3.17 to v8.3.19
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.4.5-1
changelog:
  - EA-12768: Update ea-php84 from v8.4.4 to v8.4.5
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Dan Muey <dan@cpanel.net> - 1.0-5
changelog:
  - ZC-9925: cleanup /opt/cpanel/ea-podman/bin/ea-podman on all systems, not just apt based ones
  - ZC-9916: Do not rely on perlcc symlink since it can be missing
  - ZC-9917: if users can see each others' processes give advice about how to address that
  - ZC-9917: make ~/ea-podman.d and ~/ea-podman.d/<CONTAINER-DIR> inaccessible to other users


author: Julian Brown <julian.brown@cpanel.net> - 1.0-6
changelog:
  - ZC-9877: Add backup/restore sub commands, and manage backup exclude file
  - ZC-9909: Add /scripts/removeacct Hook


author: Cory McIntire <cory@cpanel.net> - 1.0-8
changelog:
  - EA-10834: Rolling “ea-podman” back to “547d2ef67731ef65145dd384c32ade79018f8180”: accidental merge to production


author: Julian Brown <julian.brown@cpanel.net> - 1.0-14
changelog:
  - ZC-10612: Add container name to output, and add better messaging when ea-podman package is not installed


author: Dan Muey <dan@cpanel.net> - 1.0-67
changelog:
  - ZC-11494: Rolling “ea-profiles-cpanel” back to “562229d”: scriptlets seem to be happening out of order on a9


author: Cory McIntire <cory@cpanel.net> - 6.2.14-1
changelog:
  - EA-11922: Update ea-redis62 from v6.2.8 to v6.2.14
  - CVE-2023-45145 ( Bypass permissions on socket on startups )
  - CVE-2022-24834 ( RCE )
  - CVE-2023-28856 ( Users can crash redis with invalid data )
  - CVE-2023-25155 ( Integer overflow can cause redis to terminate )
  - CVE-2022-36021 ( DoS - can cause redis to hang and consume 100% CPU time )
  - CVE-2022-35977, CVE-2023-22458 ( integer overflow issues / oom panic fixes )


author: Cory McIntire <cory@cpanel.net> - 6.2.16-1
changelog:
  - EA-12449: Update ea-redis62 from v6.2.14 to v6.2.16
  - (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.
  - (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.


author: Cory McIntire <cory@cpanel.net> - 6.2.17-1
changelog:
  - EA-12624: Update ea-redis62 from v6.2.16 to v6.2.17
  - (CVE-2024-46981) Lua script commands may lead to remote code execution


author: Travis Holloway <t.holloway@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Install racc and irb and require ruby-devel for update to 2.7.2
    Adjusted release to -6 in order to match ea-ruby27 package


author: Cory McIntire <cory@cpanel.net> - 2.7.8-1
changelog:
  - EA-11327: Update ea-ruby27 from v2.7.7 to v2.7.8
    CVE-2023-28755: ReDoS vulnerability in URI
    CVE-2023-28756: ReDoS vulnerability in Time


author: Cory McIntire <cory@cpanel.net> - 1.48.0-1
changelog:
  - EA-11958: Update ea-ruby27-libuv from v1.47.0 to v1.48.0
  - CVE-2024-24806: Improper Domain Lookup that potentially leads to SSRF attacks


author: Cory McIntire <cory@cpanel.net> - 1.49.0-2
changelog:
  - EA-12450: Rolling “ea-ruby27-libuv” back to “757c822adb9bc99291dfd5219b5afa32e63e1fd4”: upstream issue causing upload limit problems
  - Actual version is 1.48.0-3


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
    Adjusted release to -6 due to OBS build issues of the gems


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.12-1
changelog:
  - EA-12745: Update ea-ruby27-rubygem-rack from v2.2.11 to v2.2.12
      * CVE-2025-27111 Possible Log Injection in Rack::Sendfile.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.12-1
changelog:
  - EA-12745: Update ea-ruby27-rubygem-rack from v2.2.11 to v2.2.12
  - CVE-2025-27111 Possible Log Injection in Rack::Sendfile.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.13-1
changelog:
  - EA-12755: Update ea-ruby27-rubygem-rack from v2.2.12 to v2.2.13
  - CVE-2025-27610 Local file inclusion in Rack::Static.


author: Cory McIntire <cory@cpanel.net> - 10.1.33-1
changelog:
  - EA-12555: Update ea-tomcat101 from v10.1.30 to v10.1.33
  - CVE-2024-52316: Apache Tomcat: Authentication bypass when using Jakarta Authentication API
  - CVE-2024-52317: Apache Tomcat: Request/response mix-up with HTTP/2
  - CVE-2024-52318: Apache Tomcat: Incorrect JSP tag recycling leads to XSS


author: Cory McIntire <cory@cpanel.net> - 10.1.34-1
changelog:
  - EA-12606: Update ea-tomcat101 from v10.1.33 to v10.1.34
  - CVE-2024-54677: Apache Tomcat: DoS in examples web application
  - CVE-2024-50379: Apache Tomcat: RCE due to TOCTOU issue in JSP compilation


author: Cory McIntire <cory.mcintire@webpros.com> - 10.1.35-1
changelog:
  - EA-12693: Update ea-tomcat101 from v10.1.34 to v10.1.35
  - Add a check to ensure that, if one or more web applications are potentially vulnerable to CVE-2024-56337, the JVM has been configured to protect against the vulnerability and to configure the JVM correctly if not. Where one or more web applications are potentially vulnerable to CVE-2004-56337 and the JVM cannot be correctly configured or it cannot be confirmed that the JVM has been correctly configured, prevent the impacted web applications from starting.


author: Cory McIntire <cory.mcintire@webpros.com> - 10.1.39-1
changelog:
  - EA-12756: Update ea-tomcat101 from v10.1.36 to v10.1.39
  - Improve the checks for exposure to and protection against CVE-2024-56337 so that reflection is not used unless required.


author: Tim Mullin <tim@cpanel.net> - 8.5.51-2
changelog:
  - EA-8885: Updated our setup script to handle changes to the 8.5.51 server.xml file
  - EA-8886: Set secretRequired to false for the AJP connector


author: Cory McIntire <cory@cpanel.net> - 8.5.88-1
changelog:
  - EA-11369: Update ea-tomcat85 from v8.5.87 to v8.5.88
  - Apache Tomcat denial of service CVE-2023-28709


author: Cory McIntire <cory@cpanel.net> - 8.5.94-1
changelog:
  - EA-11728: Update ea-tomcat85 from v8.5.93 to v8.5.94
  - Request smuggling CVE-2023-45648
  - Denial of Service CVE-2023-44487
  - Information Disclosure CVE-2023-42795
  - Denial of Service CVE-2023-42794


author: Tom Lane <tgl@redhat.com> 1:5.1.17-5
changelog:
  - Switch to noarch (non-GCJ) build
  Resolves: #688937, #819139
  - Fix mysql-connector-java-jdbc-4.1.patch to cover both driver classes
  Related: #816696


author: Darren Mobley <darren@cpanel.net> - 0.1-9
changelog:
  - HB-1952: Added support for sending an argument of --pkglist=/path/to/file
    that has a line by line list of each rpm package being handled by the
    current operation to the wildcard scripts


