cPanel has released new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. These builds are currently available to all customers via the standard update system.

SEC-650

Summary

cPanel Visitors UI does not always display direct apache access

Security Rating

cPanel has assigned this vulnerability a CVSSv3.1 score of 5.3 CVSS:3.1AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

If nginx is installed, then the cPanel Visitors UI does not display direct hits to the apache webserver.
This could prevent a cPanel user from seeing malicious requests to their website.

Credits

This issue was discovered by John Lightsey

Solution

This issue is resolved in the following builds:
11.107.9999.94
11.106.0.9
11.102.0.24

SEC-651

Summary

Nginx stops logging all requests after log rotation via cpanellogd

Security Rating

cPanel has assigned this vulnerability a CVSSv3.1 score of 5.3 CVSS:3.1AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

If nginx is installed, and piped logging (splitlogs) are disabled, then nginx will stop logging all requests after the logs are
rotated via cpanellogd.

Credits

This issue was discovered by John Lightsey.

Solution

This issue is resolved in the following package:

ea-nginx-1.23.1-9