{"id":57425,"date":"2024-06-10T23:28:24","date_gmt":"2024-06-10T20:28:24","guid":{"rendered":"https:\/\/news.cpanel.com\/?p=63017"},"modified":"2024-06-10T23:28:24","modified_gmt":"2024-06-10T20:28:24","slug":"easyapache4-2024-06-10-maintenance-and-security-release","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/easyapache4-2024-06-10-maintenance-and-security-release\/","title":{"rendered":"EasyApache4 2024-06-10 Maintenance and Security Release"},"content":{"rendered":"<p>cPanel, L.L.C. has released an update for&nbsp;<a href=\"https:\/\/docs.cpanel.net\/ea4\/basics\/introduction-to-easyapache-4\/\" target=\"_blank\" rel=\"noopener\">EasyApache 4!<\/a>&nbsp; Take a look at some highlights below, and then join us on&nbsp;the&nbsp;<a href=\"https:\/\/forums.cpanel.net\/forums\/cpanel-announcements.133\/\" target=\"_blank\" rel=\"noopener\">cPanel Community Forums<\/a>,&nbsp;<a href=\"https:\/\/go.cpanel.net\/discord\" target=\"_blank\" rel=\"noopener\">Discord<\/a>,&nbsp;or&nbsp;<a href=\"https:\/\/reddit.com\/r\/cpanel\/\" target=\"_blank\" rel=\"noopener\">Reddit<\/a>&nbsp;to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.<\/p>\n<ul>\n<li><strong>ea-profiles-cpanel<\/strong>\n<ul>\n<li>ZC-11857: Replace mod_ruid with mod_suexec for WP2 profiles<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-php81<\/strong><\/li>\n<li><strong>ea-php81-meta<\/strong>\n<ul>\n<li>Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)<\/li>\n<\/ul>\n<ul>\n<li>Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)<\/li>\n<li>Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)<\/li>\n<li>The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-php82<\/strong><\/li>\n<li><strong>ea-php82-meta<\/strong>\n<ul>\n<li>Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)<\/li>\n<\/ul>\n<ul>\n<li>Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)<\/li>\n<li>Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)<\/li>\n<li>The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li><strong>ea-php83<\/strong><\/li>\n<li><strong>ea-php83-meta<\/strong>\n<ul>\n<li>Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)<\/li>\n<\/ul>\n<ul>\n<li>Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)<\/li>\n<li>Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)<\/li>\n<li>The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>SUMMARY<\/strong><\/p>\n<p>cPanel, L.L.C. has updated packages for EasyApache 4 with PHP versions 8.1.29, 8.2.20, and 8.3.8. This release addresses vulnerabilities related to CVE-2024-4577, CVE-2024-5458, and CVE-2024-5585. We strongly encourage all PHP users to update to versions 8.1.29, 8.2.20, and 8.3.8.<\/p>\n<p><strong>AFFECTED VERSIONS<br \/><\/strong>All versions of PHP 8.1 through 8.1.28.<br \/>All versions of PHP 8.2 through 8.2.19.<br \/>All versions of PHP 8.3 through 8.3.7.<\/p>\n<p><strong>SECURITY RATING<br \/><\/strong>The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:<\/p>\n<p>CVE-2024-4577 \u2013 MEDIUM<br \/>PHP 8.1.29<br \/>Fixed vulnerability related to CVE-2024-4577.<\/p>\n<p>PHP 8.2.20<br \/>Fixed vulnerability related to CVE-2024-4577.<\/p>\n<p>PHP 8.3.8<br \/>Fixed vulnerability related to CVE-2024-4577.<\/p>\n<p>CVE-2024-5458 \u2013 MEDIUM<br \/>PHP 8.1.29<br \/>Fixed vulnerability related to CVE-2024-5458.<\/p>\n<p>PHP 8.2.20<br \/>Fixed vulnerability related to CVE-2024-5458.<\/p>\n<p>PHP 8.3.8<br \/>Fixed vulnerability related to CVE-2024-5458.<\/p>\n<p>CVE-2024-5585 \u2013 MEDIUM<br \/>PHP 8.1.29<br \/>Fixed vulnerability related to CVE-2024-5585.<\/p>\n<p>PHP 8.2.20<br \/>Fixed vulnerability related to CVE-2024-5585.<\/p>\n<p>PHP 8.3.8<br \/>Fixed vulnerability related to CVE-2024-5585.<\/p>\n<p><strong>SOLUTION<br \/><\/strong>cPanel, L.L.C. has released updated packages for EasyApache 4 on June 10, 2024, with PHP versions 8.1.29, 8.2.20, and 8.3.8. Unless you have enabled automatic package updates in your cron, update your system with either your package manager or WHM\u2019s Run System Update interface.<\/p>\n<p><strong>REFERENCES<\/strong><br \/><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4577 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-4577<br \/><\/a><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5458 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5458<br \/><\/a><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5585 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5585<br \/><\/a><a href=\"https:\/\/www.php.net\/ChangeLog-8.php#8.3.8 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/ChangeLog-8.php#8.3.8<br \/><\/a><a href=\"https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_2 \" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_2<br \/><\/a><a href=\"https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_1\" target=\"_blank\" rel=\"noopener\">https:\/\/www.php.net\/ChangeLog-8.php#PHP_8_1<\/a><\/p>\n<p><a href=\"https:\/\/news.cpanel.com\/wp-content\/uploads\/2024\/06\/EA4-2024-6-10-CVE.signed.txt\" target=\"_blank\" rel=\"noopener\">https:\/\/news.cpanel.com\/wp-content\/uploads\/2024\/06\/EA4-2024-6-10-CVE.signed.txt<\/a><\/p>\n<p>Information about all releases this year can be found in the&nbsp;<a href=\"https:\/\/docs.cpanel.net\/changelogs\/easyapache-4-change-log-2024\/\" target=\"_blank\" rel=\"noopener\">2024 EasyApache 4 Changelog&nbsp;<\/a>and&nbsp;the&nbsp;<a href=\"https:\/\/docs.cpanel.net\/ea4\/information\/easyapache-4-release-notes\/\" target=\"_blank\" rel=\"noopener\">EasyApache 4 Release Notes<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>cPanel, L.L.C. has released an update for&nbsp;EasyApache 4!&nbsp; Take a look at some highlights below, and then join us on&nbsp;the&nbsp;cPanel Community Forums,&nbsp;Discord,&nbsp;or&nbsp;Reddit&nbsp;to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels. ea-profiles-cpanel ZC-11857: Replace mod_ruid with mod_suexec for WP2 profiles ea-php81 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"class_list":["post-57425","post","type-post","status-publish","format-standard","hentry","category-cpanel-news"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57425","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=57425"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/57425\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=57425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=57425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=57425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}