EasyApache4 2024-06-10 Maintenance and Security Release

cPanel, L.L.C. has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-profiles-cpanel
  • ZC-11857: Replace mod_ruid with mod_suexec for WP2 profiles

• ea-php81
• ea-php81-meta
  • Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  • Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  • Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  • The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack

• ea-php82
• ea-php82-meta
  • Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  • Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  • Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  • The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack

• ea-php83
• ea-php83-meta
  • Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
  • Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
  • Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
  • The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack

SUMMARY

cPanel, L.L.C. has updated packages for EasyApache 4 with PHP versions 8.1.29, 8.2.20, and 8.3.8. This release addresses vulnerabilities related to CVE-2024-4577, CVE-2024-5458, and CVE-2024-5585. We strongly encourage all PHP users to update to versions 8.1.29, 8.2.20, and 8.3.8.

AFFECTED VERSIONS
All versions of PHP 8.1 through 8.1.28.
All versions of PHP 8.2 through 8.2.19.
All versions of PHP 8.3 through 8.3.7.

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

CVE-2024-4577 – MEDIUM
PHP 8.1.29
Fixed vulnerability related to CVE-2024-4577.

PHP 8.2.20
Fixed vulnerability related to CVE-2024-4577.

PHP 8.3.8
Fixed vulnerability related to CVE-2024-4577.

CVE-2024-5458 – MEDIUM
PHP 8.1.29
Fixed vulnerability related to CVE-2024-5458.

PHP 8.2.20
Fixed vulnerability related to CVE-2024-5458.

PHP 8.3.8
Fixed vulnerability related to CVE-2024-5458.

CVE-2024-5585 – MEDIUM
PHP 8.1.29
Fixed vulnerability related to CVE-2024-5585.

PHP 8.2.20
Fixed vulnerability related to CVE-2024-5585.

PHP 8.3.8
Fixed vulnerability related to CVE-2024-5585.

SOLUTION
cPanel, L.L.C. has released updated packages for EasyApache 4 on June 10, 2024, with PHP versions 8.1.29, 8.2.20, and 8.3.8. Unless you have enabled automatic package updates in your cron, update your system with either your package manager or WHM’s Run System Update interface.

REFERENCES
https://www.cve.org/CVERecord?id=CVE-2024-4577
https://www.cve.org/CVERecord?id=CVE-2024-5458
https://www.cve.org/CVERecord?id=CVE-2024-5585
https://www.php.net/ChangeLog-8.php#8.3.8
https://www.php.net/ChangeLog-8.php#PHP_8_2
https://www.php.net/ChangeLog-8.php#PHP_8_1

https://news.cpanel.com/wp-content/uploads/2024/06/EA4-2024-6-10-CVE.signed.txt

Information about all releases this year can be found in the 2024 EasyApache 4 Changelog and the EasyApache 4 Release Notes.