# changelog

author: Java SIG <java-devel@lists.fedoraproject.org> - 1.0.12-2
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Cory McIntire <cory@cpanel.net> - 2.4.46-5
changelog:
  - EA-9463: Resolve Apache startup race conditions
             Enable mod_systemd for further startup enhancements


author: Travis Holloway <t.holloway@cpanel.net> - 2.4.49-2
changelog:
  - EA-10123: Patch apache 2.4.49: Correctly decrement active_daemons also in the case that the child process decides on its own to die because of MaxRequestsPerChild.


author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
  - EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
  	- CVE-2023-31122: mod_macro buffer over-read
  	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
  	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
  - EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
  	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
  	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
  	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
  - EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
  	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
  	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
  	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
  	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
  	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
  	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
  	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
  	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
  - EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
  	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author: Tim Mullin <tim@cpanel.net> - 2.9.3-18
changelog:
  - EA-10239: Increase compiler optimization level to help mitigate performance loss from large rulesets


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.7.2-30.cloudlinux.1
changelog:
  - EA4D-323: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea-php* and alt-php*


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Tim Mullin <tim@cpanel.net> - 1.6.3-1
changelog:
  - EA-11199: Update apr-util from v1.6.1 to v1.6.3
  - CVE-2022-25147
      Integer Overflow or Wraparound vulnerability in apr_base64 functions
      of Apache Portable Runtime Utility (APR-util) allows an attacker to
      write beyond bounds of a buffer.


author: Cory McIntire <cory@cpanel.net> - 1.57.0-1
changelog:
  - EA-11729: Update ea-nghttp2 from v1.56.0 to v1.57.0
  - CVE-2023-44487 - The HTTP/2 protocol allows a denial of service (server resource consumption)


author: Cory McIntire <cory@cpanel.net> - 1.61.0-1
changelog:
  - EA-12069: Update ea-nghttp2 from v1.60.0 to v1.61.0
  - CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Dan Muey <dan@cpanel.net> - 2.9.7-1
changelog:
  - EA-7043: Update from v2.9.4 to v2.9.7
  - fixed %setup so that we do not need to modify tarball (EA-6094)
  - remove unreferenced 2.9.4-remove-pyverify_fd patch


author: Cory McIntire <cory@cpanel.net> - 2.10.3-1
changelog:
  - EA-11205: Update ea-libxml2 from v2.9.7 to v2.10.3
  - [CVE-2022-23308] Use-after-free of ID and IDREF attributes
  - [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
  - [CVE-2022-2309] Reset nsNr in xmlCtxtReset
  - [CVE-2022-40304] Fix dict corruption caused by entity reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE


author: Cory McIntire <cory@cpanel.net> - 2.10.4-1
changelog:
  - EA-11352: Update ea-libxml2 from v2.10.3 to v2.10.4
  - [CVE-2023-29469] Hashing of empty dict strings isn't deterministic
  - [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType


author: Cory McIntire <cory@cpanel.net> - 2.11.1-1
changelog:
  - EA-11388: Update ea-libxml2 from v2.10.4 to v2.11.1
      - Security Fixes
      - Fix use-after-free in xmlParseContentInternal() (David Kilzer)
      - xmllint: Fix use-after-free with --maxmem
      - parser: Fix OOB read when formatting error message
      - entities: Rework entity amplification checks


author: Cory McIntire <cory@cpanel.net> - 2.11.5-2
changelog:
  - EA-11822: Rolling “ea-libxml2” back to “04c4b9a40fbd4c0f07e1b66ab71f24a66aa7f90d”: libxml2 upstream updated to 2.12 and changed a lot of .h files, apache/php need patches


author: Cory McIntire <cory@cpanel.net> - 2.12.6-1
changelog:
  - EA-12022: Update ea-libxml2 from v2.12.4 to v2.12.6
  - [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking


author: Cory McIntire <cory@cpanel.net> - 2.12.6-2
changelog:
  - EA-12252: Rolling “ea-libxml2” back to “0e1f4ea2052c4cb2643ebd9d51394223643c6fc2”: breaks scl-phps


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
  - EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.6-1
changelog:
  - EA-12713: Update ea-libxml2 from v2.13.5 to v2.13.6
    - [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements
    - [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd


author: Cory McIntire <cory@cpanel.net> - 1.10-2
changelog:
  - EA-12397: Rolling “ea-libzip” back to “a55dc085a3c6d8ccc95613a7f6acf4589fe405c2”: Version issues in happening in PHP compliations with this update


author: Jack Hayhurst <jakdept@gmail.com> - 1.4.35-4
changelog:
  - Change config install location in spec file to match init files
  - modified from github PR #1, also fixed changelog versions


author: Andy Baugh <thomas.baugh@cpanel.net> - 1.5.12-2
changelog:
  - CPANEL-26786: Add "provides" entry for memcached, as we actually conflict
    with the base package due to installing to the same place (but it is the
    same software package ultimately, so may as well have it act as an
    alternative instead of conflicting).


author: Dan Muey <dan@cpanel.net> - 1.0.3-2
changelog:
  - ZC-10395: Build/manage `modules/ngx_http_modsecurity_module.so` and nginx modsec hooks in this pkg


author: Daniel Muey <dan@cpanel.net> - 1.0.1-4
changelog:
  - ZC-7769: factor in that `active_configs` still has the vendor info even if the vendor is disabled per `active_configs`


author: Dan Muey <dan@cpanel.net> - 1.21.4-6
changelog:
  - ZC-9343: Change worker_processes to auto
  - ZC-9343: Allow setting `worker_processes` via /etc/nginx/ea-nginx/settings.json
  - ZC-9343: When writing settings.json make it human readable
  - ZC-7303: Support IP based requests (ZC-9586: only use an IP once)
  - ZC-9384: Use mycpanel.pem if its there


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.5-2
changelog:
  - EA-10283: Only perform regex check for WordPress login for domains that have at least one WordPress site installed


author: Dan Muey <dan@cpanel.net> - 1.21.5-5
changelog:
  - ZC-9700: Do not use predictable cPanel-localhost header
  - ZC-9700: ensure random value is regenerated if missing or older than 30 minutes; ensure users can not see the value
  - EA-10464: Avoid redirect to https for service subdomain DCV validation


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-2
changelog:
  - EA-10503: Update standalone config to ensure 404 for non-existent php files
  - EA-10285: Have 'ea-nginx config --all' update user configs in parallel


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-5
changelog:
  - EA-10493: The server_name directive needs the public/external IP on systems configured to use a NAT


author: Dan Muey <dan@cpanel.net> - 1.21.6-11
changelog:
  - ZC-9698: Proxy robots.txt (and favicon) since it can be dynamic (e.g. wordpress + .htaccess)
  - ZC-9844: Add flag file to use micro caching as the cache defaults


author: Dan Muey <dan@cpanel.net> - 1.21.6-13
changelog:
  - ZC-9931: Ensure that a pre-existing cache.json/settings.json is respected when ea-nginx is installed
  - ZC-9371: enable keepalive support
  - ZC-9939: optimize proxy sub-domain configuration
  - ZC-9952: Allow setting `worker_shutdown_timeout` via /etc/nginx/ea-nginx/settings.json
  - EA-10673: Increase `proxy_headers_hash_bucket_size` to 128 in cpanel-proxy-xt.conf


author: Dan Muey <dan@cpanel.net> - 1.22.0-2
changelog:
  - ZC-9940: Change worker_processes default back to 1
  - ZC-9940: Have worker_shutdown_timeout default to 10 seconds


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-3
changelog:
  - EA-10892: Avoid configuring shared IPs in multiple server blocks when configuring nginx asynchronously


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-4
changelog:
  - EA-10671: Calculate 'server_names_hash_bucket_size' and 'server_names_hash_max_size' at config time
  - EA-10913: Update ea-nginx.conf when adding/updating a config file for a single user


author: Tim Mullin <tim@cpanel.net> - 1.23.2-2
changelog:
  - EA-10999: Update logic to check if service is listening on ports 80 or 443
  - EA-10985: Drop logrotate configuration for domain logs since cpanellogd handles the rotation


author: Tim Mullin <tim@cpanel.net> - 1.23.2-4
changelog:
  - EA-11004: Fix Passenger restart failures after reboot
  - EA-10670: Add better guards against bad userdata to configuration script


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-5
changelog:
  - EA-10769: Allow custom config files to be moved across partitions when ea-nginx is installed
  - EA-11025: If user generated config is detected as bad after configuration, remove the config file to avoid taking all sites down


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-7
changelog:
  - EA-11048: Move '/var/log/nginx' to a backup location during uninstall
  - EA-11069: Increase open files limit for master and worker processes
  - EA-10574: Remove deprecated configure option --with-ipv6
  - EA-10874: Remove fallback logic in scripts::ea_nginx::_get_application_paths()


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-8
changelog:
  - EA-11078: Fix uninitialized value warning for non-user requests when the USER_ID touch file exists
  - EA-11093: Increase nginx buffer when calculating server_names_hash_bucket_size
  - EA-10891: Refactor logging initialization to be its own sub


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.23.3-3
changelog:
  - ZC-10317: Update ngx_http_pipelog_module to v1.0.3
  - ZC-10484: Remove SIGKILL from various nginx files
  - ZC-10517: Address Ubuntu creating addiotional splitlog processes
  - ZC-10593: Close out fd's during reload/shutdown
  - EA-11088: Account for mail subdomains of addon and parked domains when configuring the server_name directive
  - EA-11121: Add ipv6 subdomain to server_name directive when account has an ipv6 address assigned
  - EA-10890: Refactor _render_and_append() to use more data from global config data


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.3-7
changelog:
  - EA-11269: Reduce frequency of nginx restarts during cpanellogd's domain log processing when piped logging is enabled


author: 2023 Danila Vershinin <dvershinin@cloudlinux.com> - 1:1.23.4-2.cloudlinux.1
changelog:
  - AP2NGX-4 updated patch allowing more contexts for a number of NGINX directives
  - AP2NGX-14 added patch that allows customizing root locations in server blocks


author: Travis Holloway <t.holloway@cpanel.net> - 1.24.0-2
changelog:
  - EA-11131: Ensure userdata reflects apache port changes when ea-nginx is removed
  - EA-11132: Ensure '/var/log/nginx.uninstall' does not exist before moving active log files there


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.25.1-1.cloudlinux.1
changelog:
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Cory McIntire <cory@cpanel.net> - 1.25.1-1
changelog:
  - EA-11496: Update ea-nginx from v1.25.0 to v1.25.1
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Dan Muey <dan@cpanel.net> - 1.25.1-4
changelog:
  - ZC-11149: support touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.25.3-1.cloudlinux.1
changelog:
  - AP2NGX-70: Add support of lsapi Virtual Hosts to ea-nginx
  - AP2NGX-77: Fixed invalid number of arguments in the "client_max_body_size" directive


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.25.4-1.cloudlinux.1
changelog:
  - AP2NGX-81: Fix regression issus introduced by AP2NGX-70
  - AP2NGX-81: Correct lsapi_handler value for lsapi virtual hosts
  - AP2NGX-81: Increase timeout during transition from Apache to NGINX to improve reliability


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
  - ZC-11679: Account for circumstance where wwwacct.conf is missing
  - ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
  - EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
  - *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
    Thanks to Nils Bars.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.6
changelog:
  - AP2NGX-221: Reorder redirects to ensure proxy_pass by Apache2Nginx is in effect
  - removed WAFCL patch


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.7
changelog:
  - AP2NGX-226: Include environment variable for extra server identification to PHP scripts
  - AP2NGX-236: Ensure consistent index directive defaults between Apache, PHP-FPM and LSAPI and index_error_code directive


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
  - EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
  - Security: insufficient check in virtual servers handling with TLSv1.3
    SNI allowed to reuse SSL sessions in a different virtual server, to
    bypass client SSL certificates verification (CVE-2025-23419)


author: Jack Hayhurst <jack@deleteos.com> - 0.2
changelog:
  - added ea-php71-php-memcahe branched off of php54

  - Fixed package name, entire RPM is now working.


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.20-2.cloudlinux.1
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-5.cloudlinux.1
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-10.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-4.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.2
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.2
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-9.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


author: Eduard Abdullin <eabdullin@cloudlinux.con> - 8.0.0-2.cloudlinux.1
changelog:
  - Fix patch 0007 with cloudlinux-php-fpm patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory


author: Cory McIntire <cory@cpanel.net> - 8.0.25-1
changelog:
  - EA-11020: Update ea-php80 from v8.0.24 to v8.0.25
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.0.27-1
changelog:
  - EA-11137: Update ea-php80 from v8.0.26 to v8.0.27
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.0.28-1
changelog:
  - EA-11227: Update ea-php80 from v8.0.27 to v8.0.28
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 8.0.3-2.cloudlinux.1
changelog:
  - remove 0005-Ensure-that-php.d-is-not-scanned-when-PHPRC-is-set.patch for EA4D-265
  - Update litespeed log patch for litespeed-7.9


author: Cory McIntire <cory@cpanel.net> - 8.1.8-1
changelog:
  - EA-10821: Update ea-php81 from v8.1.7 to v8.1.8
  - (Heap buffer overflow in finfo_buffer). (CVE-2022-31627)


author: Cory McIntire <cory@cpanel.net> - 8.1.12-1
changelog:
  - EA-11021: Update ea-php81 from v8.1.11 to v8.1.12
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.1.14-1
changelog:
  - EA-11133: Update ea-php81 from v8.1.13 to v8.1.14
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.1.16-1
changelog:
  - EA-11244: Update ea-php81 from v8.1.15 to v8.1.16
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.2.1-1
changelog:
  - EA-11136: Update ea-php82 from v8.2.0 to v8.2.1
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.2.3-1
changelog:
  - EA-11226: Update ea-php82 from v8.2.2 to v8.2.3
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
  - EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
    Adjusted release to -6 due to OBS build issues of the gems


author: Cory McIntire <cory@cpanel.net> - 2.7.8-1
changelog:
  - EA-11327: Update ea-ruby27 from v2.7.7 to v2.7.8
    CVE-2023-28755: ReDoS vulnerability in URI
    CVE-2023-28756: ReDoS vulnerability in Time


