EasyApache4 2024-10-02 Maintenance and Security Release

cPanel, L.L.C. has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-php83
• ea-php83-meta
  • EA-12410: Update ea-php83 from v8.3.11 to v8.3.12
    • Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    • Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    • Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    • Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)

• ea-php82
• ea-php82-meta
  • EA-12423: Update ea-php82 from v8.2.23 to v8.2.24
    • Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    • Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    • Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    • Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)

• ea-php81
• ea-php81-meta
  • EA-12428: Update ea-php81 from v8.1.29 to v8.1.30
    • Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
    • Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
    • Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
    • Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)

• ea-valkey72
  • EA-12419: Update ea-valkey72 from v7.2.5 to v7.2.6

• ea-nginx-headers-more
  • EA-12422: Update ea-nginx-headers-more from v0.34 to v0.37

• ea-ruby27-libuv
  • EA-12429: Update ea-ruby27-libuv from v1.48.0 to v1.49.0

SUMMARY

cPanel, L.L.C. has updated packages for EasyApache 4 with PHP versions 8.3.12, 8.2.24, and 8.1.30. This release addresses vulnerabilities related to CVE-2024-9026, CVE-2024-8925, CVE-2024-8926, and CVE-2024-8927. We strongly encourage all PHP 8.1 users update to version 8.1.30, all PHP 8.2 users update to version 8.2.24, and all PHP 8.3 users to update to version 8.3.12.

AFFECTED VERSIONS
All versions of PHP 8.1 through version 8.1.29.
All versions of PHP 8.2 through 8.2.23.
All versions of PHP 8.3 through 8.3.11.

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

CVE-2024-9026 – MEDIUM
PHP 8.1.30
Fixed vulnerability related to CVE-2024-9026

PHP 8.2.24
Fixed vulnerability related to CVE-2024-9026

PHP 8.3.12
Fixed vulnerability related to CVE-2024-9026

CVE-2024-8925 – MEDIUM
PHP 8.1.30
Fixed vulnerability related to CVE-2024-8925

PHP 8.2.24
Fixed vulnerability related to CVE-2024-8925

PHP 8.3.12
Fixed vulnerability related to CVE-2024-8925

CVE-2024-8926 – MEDIUM
PHP 8.1.30
Fixed vulnerability related to CVE-2024-8926

PHP 8.2.24
Fixed vulnerability related to CVE-2024-8926

PHP 8.3.12
Fixed vulnerability related to CVE-2024-8926

CVE-2024-8927 – MEDIUM
PHP 8.1.30
Fixed vulnerability related to CVE-2024-8927

PHP 8.2.24
Fixed vulnerability related to CVE-2024-8927

PHP 8.3.12
Fixed vulnerability related to CVE-2024-8927

SOLUTION
cPanel, L.L.C. has released updated packages for EasyApache 4 on OCTOBER 2, 2024, with PHP versions 8.3.12, 8.2.24, and 8.1.30. Unless you have enabled automatic package updates in your cron, update your system with either your package manager or WHM’s Run System Update interface.

REFERENCES
https://www.cve.org/CVERecord?id=CVE-2024-9026
https://www.cve.org/CVERecord?id=CVE-2024-8925
https://www.cve.org/CVERecord?id=CVE-2024-8926
https://www.cve.org/CVERecord?id=CVE-2024-8927
https://www.php.net/ChangeLog-8.php#8.1.30
https://www.php.net/ChangeLog-8.php#8.2.24
https://www.php.net/ChangeLog-8.php#8.3.12

Information about all releases this year can be found in the 2024 EasyApache 4 Changelog and the EasyApache 4 Release Notes

GPG signed copy of this announcement:

https://news.cpanel.com/wp-content/uploads/2024/10/EA4-2024-10-2-CVE.signed-1.txt