cPanel, L.L.C. has released an update for EasyApache 4!  Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-libzip
  • EA-12064: Update ea-libzip from v1.9.2 to v1.10.1

• ea-php81
• ea-php81-meta
  • ZC-11730: Add GD support for AVIF format on Ubuntu 22 and higher
  • EA-12087: Update ea-php81 from v8.1.27 to v8.1.28
    • Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
    • Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
    • Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)

• ea-php82
• ea-php82-meta
  • ZC-11730: Add GD support for AVIF format on Ubuntu 22 and higher
    • EA-12085: Update ea-php82 from v8.2.17 to v8.2.18
      • Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
      • Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
      • Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)

• ea-php83
• ea-php83-meta
  • ZC-11730: Add GD support for AVIF format on Ubuntu 22 and higher
  • EA-12086: Update ea-php83 from v8.3.4 to v8.3.6
    • Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
    • Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
    • Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)
    • Fixed bug GHSA-fjp9-9hwx-59fq (mb_encode_mimeheader runs endlessly for some inputs). (CVE-2024-2757)

• ea-cpanel-tools
  • ZC-11698: Update manifest for new ea-noop-u20 pkg and recent repo cleanups

• ea-tomcat101
  • EA-12081: Update ea-tomcat101 from v10.1.10 to v10.1.20

• ea-openssl11
  • EA-12071: Update ea-openssl11 for CVE-2023-5678 (additional patch) and CVE-2024-0727

• ea-libcurl
  • EA-12080: patch update that caused issues with CURLOPT_ACCEPT_ENCODING

SUMMARY

cPanel, L.L.C. has updated packages for EasyApache 4 with OpenSSL version 1.1.1 (patched) and PHP versions 8.1.28, 8.2.18, and 8.3.6. This release addresses vulnerabilities related to CVE-2024-1874, CVE-2024-2756, CVE-2024-3096, CVE-2024-2757, CVE-2023-5678, and CVE-2024-0727. We strongly encourage all OpenSSL users to upgrade to the patched version of OpenSSL 1.1.1 and all PHP users to update to versions 8.1.28, 8.2.18, and 8.3.6.

AFFECTED VERSIONS
All versions of OpenSSL through 1.1.1.
All versions of PHP 8.1 through 8.1.27.
All versions of PHP 8.2 through 8.2.17.
All versions of PHP 8.3 through 8.3.4.

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

CVE-2024-1874 – MEDIUM
PHP 8.1.28
Fixed vulnerability related to CVE-2024-1874.

PHP 8.2.18
Fixed vulnerability related to CVE-2024-1874.

PHP 8.3.6
Fixed vulnerability related to CVE-2024-1874.

CVE-2024-2756 – MEDIUM
PHP 8.1.28
Fixed vulnerability related to CVE-2024-2756.

PHP 8.2.18
Fixed vulnerability related to CVE-2024-2756.

PHP 8.3.6
Fixed vulnerability related to CVE-2024-2756.

CVE-2024-3096 – MEDIUM
PHP 8.1.28
Fixed vulnerability related to CVE-2024-3096.

PHP 8.2.18
Fixed vulnerability related to CVE-2024-3096.

PHP 8.3.6
Fixed vulnerability related to CVE-2024-3096.

CVE-2024-2757 – MEDIUM
PHP 8.3.6
Fixed vulnerability related to CVE-2024-2757.

CVE-2023-5678 – MEDIUM
OpenSSL 1.1.1
Patched for vulnerability related to CVE-2023-5678.

CVE-2024-0727 – MEDIUM
OpenSSL 1.1.1
Patched for vulnerability related to CVE-2024-0727.

SOLUTION
cPanel, L.L.C. has released updated packages for EasyApache 4 on April 17, 2024, with a patched version of OpenSSL 1.1.1 and PHP versions 8.1.28, 8.2.18, and 8.3.6. Unless you have enabled automatic package updates in your cron, update your system with either your package manager or WHM’s Run System Update interface.

REFERENCES
https://www.cve.org/CVERecord?id=CVE-2024-1874
https://www.cve.org/CVERecord?id=CVE-2024-2756
https://www.cve.org/CVERecord?id=CVE-2024-3096
https://www.cve.org/CVERecord?id=CVE-2024-2757
https://www.cve.org/CVERecord?id=CVE-2023-5678
https://www.cve.org/CVERecord?id=CVE-2024-0727
https://www.php.net/ChangeLog-8.php#8.3.6
https://www.php.net/ChangeLog-8.php#PHP_8_2
https://www.php.net/ChangeLog-8.php#PHP_8_1

https://news.cpanel.com/wp-content/uploads/2024/04/EA4-2024-4-17-CVE.signed.txt

Information about all releases this year can be found in the 2024 EasyApache 4 Changelog and the EasyApache 4 Release Notes.