# changelog

author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
  - EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
  	- CVE-2023-31122: mod_macro buffer over-read
  	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
  	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
  - EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
  	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
  	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
  	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
  - EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
  	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
  	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
  	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
  	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
  	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
  	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
  	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
  	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
  - EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
  	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Dan Muey <dan@cpanel.net> - 1.25.1-4
changelog:
  - ZC-11149: support touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.25.3-1.cloudlinux.1
changelog:
  - AP2NGX-70: Add support of lsapi Virtual Hosts to ea-nginx
  - AP2NGX-77: Fixed invalid number of arguments in the "client_max_body_size" directive


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.25.4-1.cloudlinux.1
changelog:
  - AP2NGX-81: Fix regression issus introduced by AP2NGX-70
  - AP2NGX-81: Correct lsapi_handler value for lsapi virtual hosts
  - AP2NGX-81: Increase timeout during transition from Apache to NGINX to improve reliability


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
  - ZC-11679: Account for circumstance where wwwacct.conf is missing
  - ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
  - EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
  - *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
    Thanks to Nils Bars.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.6
changelog:
  - AP2NGX-221: Reorder redirects to ensure proxy_pass by Apache2Nginx is in effect
  - removed WAFCL patch


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.7
changelog:
  - AP2NGX-226: Include environment variable for extra server identification to PHP scripts
  - AP2NGX-236: Ensure consistent index directive defaults between Apache, PHP-FPM and LSAPI and index_error_code directive


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
  - EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
  - Security: insufficient check in virtual servers handling with TLSv1.3
    SNI allowed to reuse SSL sessions in a different virtual server, to
    bypass client SSL certificates verification (CVE-2025-23419)


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.3-2.cloudlinux.3
changelog:
  - MAXWS-180: Update nginx mod-lsapi configuration directives and set lsapi_check_script off for better performance


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-2.cloudlinux.4
changelog:
  - MAXWS-267: Add autoindex_ignore configuration directive
  - MAXWS-419: Prevent unnecessary reloads and .htaccess conversion for MAx Web Server


author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-4.cloudlinux.2

changelog:
  - MAXWS-410: File listing is enabled by MAx Web Server converter by default
  - MAXWS-502: Add support for autoindex_ignore_reset configuration directive


author:
  Sergey Kokhan <skokhan@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-5.cloudlinux.4

changelog:
  - MAXWS-556: Add optional SSL environment variables fpm/lsapi conf files
  - MAXWS-539: Use global file lock before calling apache2nginx in cpanel hooks


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 3:1.26.3-5.cloudlinux.6
changelog:
  - MAXWS-521: Exclude cpanel-password-protected-dirs.tt from the server.conf.tt template when apache2nginx is enabled


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-5.cloudlinux.1
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-5.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-10.cloudlinux.2
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.3.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.3.33-4.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.2
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.3.33-4.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-9.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-13.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


