{"id":56337,"date":"2024-04-18T01:54:59","date_gmt":"2024-04-17T21:54:59","guid":{"rendered":"https:\/\/news.cpanel.com\/?p=62917"},"modified":"2024-04-18T01:54:59","modified_gmt":"2024-04-17T21:54:59","slug":"easyapache4-2024-04-17-maintenance-and-security-release","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/easyapache4-2024-04-17-maintenance-and-security-release\/","title":{"rendered":"EasyApache4 2024-04-17 Maintenance and Security Release"},"content":{"rendered":"<p>cPanel, L.L.C. has released an update for&nbsp;<a href=\"https:\/\/docs.cpanel.net\/ea4\/basics\/introduction-to-easyapache-4\/\" target=\"_blank\" rel=\"noopener\">EasyApache 4!<\/a>&nbsp; Take a look at some highlights below, and then join us on&nbsp;the&nbsp;<a href=\"https:\/\/forums.cpanel.net\/forums\/cpanel-announcements.133\/\" target=\"_blank\" rel=\"noopener\">cPanel Community Forums<\/a>,&nbsp;<a href=\"https:\/\/go.cpanel.net\/discord\" target=\"_blank\" rel=\"noopener\">Discord<\/a>,&nbsp;or&nbsp;<a href=\"https:\/\/reddit.com\/r\/cpanel\/\" target=\"_blank\" rel=\"noopener\">Reddit<\/a>&nbsp;to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.<\/p>\n<ul>\n<li><strong>ea-libzip<\/strong>\n<ul>\n<li>EA-12064: Update ea-libzip from v1.9.2 to v1.10.1<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-php81<\/strong><\/li>\n<li><strong>ea-php81-meta<\/strong>\n<ul>\n<li>ZC-11730: Add GD support for AVIF format on Ubuntu 22 and higher<\/li>\n<li>EA-12087: Update ea-php81 from v8.1.27 to v8.1.28\n<ul>\n<li>Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)<\/li>\n<li>Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-\/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)<\/li>\n<li>Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-php82<\/strong><\/li>\n<li><strong>ea-php82-meta<\/strong>\n<ul>\n<li>ZC-11730: Add GD support for AVIF format on Ubuntu 22 and higher\n<ul>\n<li>EA-12085: Update ea-php82 from v8.2.17 to v8.2.18\n<ul>\n<li>Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)<\/li>\n<li>Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-\/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)<\/li>\n<li>Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-php83<\/strong><\/li>\n<li><strong>ea-php83-meta<\/strong>\n<ul>\n<li>ZC-11730: Add GD support for AVIF format on Ubuntu 22 and higher<\/li>\n<li>EA-12086: Update ea-php83 from v8.3.4 to v8.3.6\n<ul>\n<li>Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)<\/li>\n<li>Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-\/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)<\/li>\n<li>Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)<\/li>\n<li>Fixed bug GHSA-fjp9-9hwx-59fq (mb_encode_mimeheader runs endlessly for some inputs). (CVE-2024-2757)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-cpanel-tools<\/strong>\n<ul>\n<li>ZC-11698: Update manifest for new ea-noop-u20 pkg and recent repo cleanups<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-tomcat101<\/strong>\n<ul>\n<li>EA-12081: Update ea-tomcat101 from v10.1.10 to v10.1.20<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-openssl11<\/strong>\n<ul>\n<li>EA-12071: Update ea-openssl11 for CVE-2023-5678 (additional patch) and CVE-2024-0727<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-libcurl<\/strong>\n<ul>\n<li>EA-12080: patch update that caused issues with CURLOPT_ACCEPT_ENCODING<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>SUMMARY<\/strong><\/p>\n<p>cPanel, L.L.C. has updated packages for EasyApache 4 with OpenSSL version 1.1.1 (patched) and PHP versions 8.1.28, 8.2.18, and 8.3.6. This release addresses vulnerabilities related to CVE-2024-1874, CVE-2024-2756, CVE-2024-3096, CVE-2024-2757, CVE-2023-5678, and CVE-2024-0727. We strongly encourage all OpenSSL users to upgrade to the patched version of OpenSSL 1.1.1 and all PHP users to update to versions 8.1.28, 8.2.18, and 8.3.6.<\/p>\n<p><strong>AFFECTED VERSIONS<br \/><\/strong>All versions of OpenSSL through 1.1.1.<br \/>All versions of PHP 8.1 through 8.1.27.<br \/>All versions of PHP 8.2 through 8.2.17.<br \/>All versions of PHP 8.3 through 8.3.4.<\/p>\n<p><strong>SECURITY RATING<br \/><\/strong>The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:<\/p>\n<p>CVE-2024-1874 \u2013 MEDIUM<br \/>PHP 8.1.28<br \/>Fixed vulnerability related to CVE-2024-1874.<\/p>\n<p>PHP 8.2.18<br \/>Fixed vulnerability related to CVE-2024-1874.<\/p>\n<p>PHP 8.3.6<br \/>Fixed vulnerability related to CVE-2024-1874.<\/p>\n<p>CVE-2024-2756 \u2013 MEDIUM<br \/>PHP 8.1.28<br \/>Fixed vulnerability related to CVE-2024-2756.<\/p>\n<p>PHP 8.2.18<br \/>Fixed vulnerability related to CVE-2024-2756.<\/p>\n<p>PHP 8.3.6<br \/>Fixed vulnerability related to CVE-2024-2756.<\/p>\n<p>CVE-2024-3096 \u2013 MEDIUM<br \/>PHP 8.1.28<br \/>Fixed vulnerability related to CVE-2024-3096.<\/p>\n<p>PHP 8.2.18<br \/>Fixed vulnerability related to CVE-2024-3096.<\/p>\n<p>PHP 8.3.6<br \/>Fixed vulnerability related to CVE-2024-3096.<\/p>\n<p>CVE-2024-2757 \u2013 MEDIUM<br \/>PHP 8.3.6<br \/>Fixed vulnerability related to CVE-2024-2757.<\/p>\n<p>CVE-2023-5678 \u2013 MEDIUM<br \/>OpenSSL 1.1.1<br \/>Patched for vulnerability related to CVE-2023-5678.<\/p>\n<p>CVE-2024-0727 \u2013 MEDIUM<br \/>OpenSSL 1.1.1<br \/>Patched for vulnerability related to CVE-2024-0727.<\/p>\n<p><strong>SOLUTION<br \/><\/strong>cPanel, L.L.C. has released updated packages for EasyApache 4 on April 17, 2024, with a patched version of OpenSSL 1.1.1 and PHP versions 8.1.28, 8.2.18, and 8.3.6. Unless you have enabled automatic package updates in your cron, update your system with either your package manager or WHM\u2019s Run System Update interface.<\/p>\n<p><strong>REFERENCES<\/strong><br \/><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-1874 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-1874<br \/><\/a><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2756 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2756<br \/><\/a><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-3096 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-3096<br \/><\/a><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2757 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-2757<br \/><\/a><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-5678 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2023-5678<br \/><\/a><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-0727 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-0727<br \/><\/a><a href=\"https:\/\/www.php.net\/ChangeLog-8.php#8.3.6 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/ChangeLog-8.php#8.3.6<br \/><\/a><a href=\"https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_2 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_2<br \/><\/a><a href=\"https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_1\" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_1<\/a><\/p>\n<p><a href=\"https:\/\/news.cpanel.com\/wp-content\/uploads\/2024\/04\/EA4-2024-4-17-CVE.signed.txt\" target=\"_blank\" rel=\"noopener\">https:\/\/news.cpanel.com\/wp-content\/uploads\/2024\/04\/EA4-2024-4-17-CVE.signed.txt<\/a><\/p>\n<p>Information about all releases this year can be found in the&nbsp;<a href=\"https:\/\/docs.cpanel.net\/changelogs\/easyapache-4-change-log-2024\/\" target=\"_blank\" rel=\"noopener\">2024 EasyApache 4 Changelog&nbsp;<\/a>and&nbsp;the&nbsp;<a href=\"https:\/\/docs.cpanel.net\/ea4\/information\/easyapache-4-release-notes\/\" target=\"_blank\" rel=\"noopener\">EasyApache 4 Release Notes<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>cPanel, L.L.C. has released an update for&nbsp;EasyApache 4!&nbsp; Take a look at some highlights below, and then join us on&nbsp;the&nbsp;cPanel Community Forums,&nbsp;Discord,&nbsp;or&nbsp;Reddit&nbsp;to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels. ea-libzip EA-12064: Update ea-libzip from v1.9.2 to v1.10.1 ea-php81 ea-php81-meta &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"class_list":["post-56337","post","type-post","status-publish","format-standard","hentry","category-cpanel-news"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56337"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56337\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}