# changelog

author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
  - EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
  	- CVE-2023-31122: mod_macro buffer over-read
  	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
  	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
  - EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
  	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
  	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
  	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
  - EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
  	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
  	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
  	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
  	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
  	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
  	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
  	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
  	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
  - EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
  	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Dan Muey <dan@cpanel.net> - 6.0.17-3
changelog:
  - ZC-10938: Remove i586 cruft && DISABLE_DEBUGINFO from Makefile, remove debug_package && fix spec date that breaks build


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
  - CLOS-2832: AlmaLinux support added
  - CLOS-2818: Changed requirement from alt-php56 to alt-php81
  - CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
  - CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
  - CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
  - CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
  - CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
  - CLOS-3007: Add heuristic to resolve unlisted PHP handlers
  - CLOS-3043: Add support of Ubuntu 22


author: Timur Averianov <taverianov@cloudlinux.com> 1.1-81
changelog:
  - CLOS-3184: Fix installation error on CL7+Plesk, leading to Apache service not starting; improve future upgrade reliability for other configurations


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.7.2-30.cloudlinux.1
changelog:
  - EA4D-323: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea-php* and alt-php*


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Dan Muey <dan@cpanel.net> - 1.0-65
changelog:
  - ZC-10447: update manifest for A9 and PHP 8.2, make PHP 8.1 the default for EA4
  - ZC-10581: update ea4 recommendations to match the PHP reality


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.0-71
changelog:
  - ZC-10474: Add ea-nginx-headers-more to `additional_packages`
  - ZC-10320: Add Ubuntu 22 to manifest


author: Dan Muey <dan@cpanel.net> - 1.0-72
changelog:
  - ZC-10955: Update manifest for post reset of OBS flags (Makefile disables only; no manual disables)


author: Dan Muey <dan@cpanel.net> - 1.0-78
changelog:
  - ZC-11033: Add support for packages w/out an `ea-` prefix in EA4 profiles
  - ZC-11135: Add ea-nodejs18 and ea-nodejs20 to additional packages list
  - ZC-11149: Add touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited to readme


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.0-86.cloudlinux.1
changelog:
  - add strong requires for ea-profiles-cloudlinux >= 4:1.0-68.2
  - EA4D-244: Update EOL ea-php versions


author: Dan Muey <dan@cpanel.net> - 1.25.1-4
changelog:
  - ZC-11149: support touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.25.3-1.cloudlinux.1
changelog:
  - AP2NGX-70: Add support of lsapi Virtual Hosts to ea-nginx
  - AP2NGX-77: Fixed invalid number of arguments in the "client_max_body_size" directive


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.25.4-1.cloudlinux.1
changelog:
  - AP2NGX-81: Fix regression issus introduced by AP2NGX-70
  - AP2NGX-81: Correct lsapi_handler value for lsapi virtual hosts
  - AP2NGX-81: Increase timeout during transition from Apache to NGINX to improve reliability


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
  - ZC-11679: Account for circumstance where wwwacct.conf is missing
  - ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
  - EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
  - *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
    Thanks to Nils Bars.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.6
changelog:
  - AP2NGX-221: Reorder redirects to ensure proxy_pass by Apache2Nginx is in effect
  - removed WAFCL patch


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.7
changelog:
  - AP2NGX-226: Include environment variable for extra server identification to PHP scripts
  - AP2NGX-236: Ensure consistent index directive defaults between Apache, PHP-FPM and LSAPI and index_error_code directive


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
  - EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
  - Security: insufficient check in virtual servers handling with TLSv1.3
    SNI allowed to reuse SSL sessions in a different virtual server, to
    bypass client SSL certificates verification (CVE-2025-23419)


author: Cory McIntire <cory@cpanel.net> - 1.10.13-1
changelog:
  - EA-11201: Update PEAR and its dependencies
  - Update PEAR from 1.10.12 to 1.10.13
  - Update Archive_Tar from 1.4.9 to 1.4.14
  - Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949)
  - Symlink out-of-path write vulnerability (CVE-2020-36193)
  - Properly fix symbolic link path traversal (CVE-2021-32610)


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.6.40-22.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.6.40-22.cloudlinux.3
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.6.40-22.cloudlinux.4
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.6.40-22.cloudlinux.5
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-22.cloudlinux.6
changelog:
  - Add MySQL 8 charset's support
  - Backport native api for MySQL 8 compatibility
  - Fix tests charsets processing


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.6.40-22.cloudlinux.7
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-22.1.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.6.40-22.1.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.6.40-22.1.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.6.40-19.cloudlinux.3
changelog:
  - CVE-2021-21703: fix error in php fpm shared memory organization leading to privilage escalation
  - CVE-2021-21707: fix handling of paths with percent encoded NULL byte


author: Tim Mullin <tim@cpanel.net> - 7.0.33-26
changelog:
  - EA-11821: Patch to build with the latest ea-libxml2
  - ZC-10950: Add debug_package nil back w/ second directive (3rd item will be ZC-10951)
  - ZC-10936: Clean up Makefile and remove debug-package-nil


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-26.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-26.cloudlinux.6
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.4
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-9.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74267: fix segfault with streams and invalid datas
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


author: Cory McIntire <cory@cpanel.net> - 8.0.25-1
changelog:
  - EA-11020: Update ea-php80 from v8.0.24 to v8.0.25
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.0.27-1
changelog:
  - EA-11137: Update ea-php80 from v8.0.26 to v8.0.27
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.0.28-1
changelog:
  - EA-11227: Update ea-php80 from v8.0.27 to v8.0.28
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.0.29-1
changelog:
  - EA-11475: Update ea-php80 from v8.0.28 to v8.0.29
      - Fixed bug GHSA-76gg-c692-v2mw
          (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Cory McIntire <cory@cpanel.net> - 8.0.30-1
changelog:
  - EA-11590: Update ea-php80 from v8.0.29 to v8.0.30
  	- Libxml:
  		Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  	- Phar:
  		Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 8.0.30-4.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug
    causing password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-8.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-8929: fix various heap buffer over-reads for mysqlnd
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Cory McIntire <cory@cpanel.net> - 8.1.31-1
changelog:
  - EA-12576: Update ea-php81 from v8.1.30 to v8.1.31
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.1.12-1
changelog:
  - EA-11021: Update ea-php81 from v8.1.11 to v8.1.12
  - GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  - Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.1.14-1
changelog:
  - EA-11133: Update ea-php81 from v8.1.13 to v8.1.14
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.1.16-1
changelog:
  - EA-11244: Update ea-php81 from v8.1.15 to v8.1.16
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.1.20-1
changelog:
  - EA-11477: Update ea-php81 from v8.1.19 to v8.1.20
      - Fixed bug GHSA-76gg-c692-v2mw
          - (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Cory McIntire <cory@cpanel.net> - 8.1.22-1
changelog:
  - EA-11589: Update ea-php81 from v8.1.21 to v8.1.22
  	- Libxml:
  		Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  	- Phar:
  		Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Cory McIntire <cory@cpanel.net> - 8.1.28-1
changelog:
  - EA-12087: Update ea-php81 from v8.1.27 to v8.1.28
  - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
  - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
  - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)


author: Cory McIntire <cory@cpanel.net> - 8.1.29-1
changelog:
  - EA-12192: Update ea-php81 from v8.1.28 to v8.1.29
  - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.1.30-1
changelog:
  - EA-12428: Update ea-php81 from v8.1.29 to v8.1.30
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.32-1
changelog:
  - EA-12766: Update ea-php81 from v8.1.31 to v8.1.32
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory@cpanel.net> - 8.2.26-1
changelog:
  - EA-12577: Update ea-php82 from v8.2.25 to v8.2.26
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.2.7-1
changelog:
  - EA-11478: Update ea-php82 from v8.2.6 to v8.2.7
      - Fixed bug GHSA-76gg-c692-v2mw
          - (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Cory McIntire <cory@cpanel.net> - 8.2.9-1
changelog:
  - EA-11619: Update ea-php82 from v8.2.8 to v8.2.9
      - Libxml:
          Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
      - Phar:
          Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Cory McIntire <cory@cpanel.net> - 8.2.18-1
changelog:
  - EA-12085: Update ea-php82 from v8.2.17 to v8.2.18
  - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
  - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
  - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)


author: Cory McIntire <cory@cpanel.net> - 8.2.20-1
changelog:
  - EA-12194: Update ea-php82 from v8.2.19 to v8.2.20
  - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.2.24-1
changelog:
  - EA-12423: Update ea-php82 from v8.2.23 to v8.2.24
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.28-1
changelog:
  - EA-12772: Update ea-php82 from v8.2.27 to v8.2.28
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory@cpanel.net> - 8.2.1-1
changelog:
  - EA-11136: Update ea-php82 from v8.2.0 to v8.2.1
  - PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.2.3-1
changelog:
  - EA-11226: Update ea-php82 from v8.2.2 to v8.2.3
  - Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
  - Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
  - Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.3.14-1
changelog:
  - EA-12578: Update ea-php83 from v8.3.13 to v8.3.14
  - (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
  - (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
  - (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
  - (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
  - (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
  - (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.3.6-1
changelog:
  - EA-12086: Update ea-php83 from v8.3.4 to v8.3.6
  - Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
  - Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
  - Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
  - Fixed bug GHSA-fjp9-9hwx-59fq (mb_encode_mimeheader runs endlessly for some inputs). (CVE-2024-2757)


author: Cory McIntire <cory@cpanel.net> - 8.3.8-1
changelog:
  - EA-12193: Update ea-php83 from v8.3.7 to v8.3.8
  - Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  - Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  - Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  - The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.3.12-1
changelog:
  - EA-12410: Update ea-php83 from v8.3.11 to v8.3.12
  - Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
  - Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
  - Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  - Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.3.19-1
changelog:
  - EA-12769: Update ea-php83 from v8.3.17 to v8.3.19
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.4.5-1
changelog:
  - EA-12768: Update ea-php84 from v8.4.4 to v8.4.5
      - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
      - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
      - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
      - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
      - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
      - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Dan Muey <dan@cpanel.net> - 1.0-67
changelog:
  - ZC-11494: Rolling “ea-profiles-cpanel” back to “562229d”: scriptlets seem to be happening out of order on a9


