# changelog

author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
- EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
	- CVE-2023-31122: mod_macro buffer over-read
	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
- EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
- EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
- EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
- EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
- Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Cory McIntire <cory@cpanel.net> - 1.10.13-1
changelog:
- EA-11201: Update PEAR and its dependencies
- Update PEAR from 1.10.12 to 1.10.13
- Update Archive_Tar from 1.4.9 to 1.4.14
- Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949)
- Symlink out-of-path write vulnerability (CVE-2020-36193)
- Properly fix symbolic link path traversal (CVE-2021-32610)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.10.16-3
changelog:
- ZC-12614: Rolling “ea-scl-php-pear” back to “9bf382bf95619afb4023c729d76a50e1d98ac429”: merged accidentally


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.5-13
changelog:
- EA-8124: Ensure that the test certificates are updated prior to test runs
  to avoid failures due to expired certificates.


author: Daniel Muey <dan@cpanel.net> - 6.0.7-2
changelog:
- ZC-7655: Provide/Conflict `apache24-passenger`
- ZC-7897: Add version/package specific template file (and support userdata paths like nginx)


author: Cory McIntire <cory@cpanel.net> - 2.7.2-6
changelog:
- EA-9609: Update ea-ruby27 from v2.7.1 to v2.7.2
  Adjusted release to -6 due to OBS build issues of the gems


author: Cory McIntire <cory@cpanel.net> - 2.7.8-1
changelog:
- EA-11327: Update ea-ruby27 from v2.7.7 to v2.7.8
  CVE-2023-28755: ReDoS vulnerability in URI
  CVE-2023-28756: ReDoS vulnerability in Time


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.12-1
changelog:
- EA-12745: Update ea-ruby27-rubygem-rack from v2.2.11 to v2.2.12
    * CVE-2025-27111 Possible Log Injection in Rack::Sendfile.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.12-1
changelog:
- EA-12745: Update ea-ruby27-rubygem-rack from v2.2.11 to v2.2.12
- CVE-2025-27111 Possible Log Injection in Rack::Sendfile.


author: Cory McIntire <cory.mcintire@webpros.com> - 2.2.13-1
changelog:
- EA-12755: Update ea-ruby27-rubygem-rack from v2.2.12 to v2.2.13
- CVE-2025-27610 Local file inclusion in Rack::Static.


author: Pavel Raiskup <praiskup@redhat.com> - 1-7
changelog:
- the fix for 'filelist' (#1079203) is not needed, according to
  https://fedorahosted.org/SoftwareCollections/ticket/18


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.4-4
changelog:
- Change bwlimited.conf to 0644 so that normal users can load modules
  the same as Apache while testing their configuration with 'httpd -t'
- Also renamed configuration to 490_mod_bwlimited.conf to match the
  naming scheme of our other files.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-1
changelog:
- EA-7191: Initial implementation of mod_cpanel:
    * Handle requests to suspended users in apache without requiring
      an include file to be generated on the product side.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.4-1
changelog:
- EA-7821: Don't strip symbools from the debug package.
- EA-7822: Handle edge cases where request_rec->filename == NULL.
    * Some modules that hook into the map_to_storage process (eg. mod_pagespeed),
      can alter the request_rec in an unexpected manner, that resulted
      result in a segfault.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
- General cleanup (EA-5395)
- Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
- Switch to rpm macros


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
- MODLS-952: Fixed the bug added when solving MODLS-935
- CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
- MODLS-946: lsapi_backend_use_own_log option context fixed
- MODLS-956: liblsapi dependency made strict for mod_lsapi packages
- MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
- MODLS-963: ea-php82 handler added
- MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
- CLOS-2334: Minor mod_lsapi scripts corrections
- CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-75
changelog:
- CLOS-2832: AlmaLinux support added
- CLOS-2818: Changed requirement from alt-php56 to alt-php81
- CLOS-2860: Added lsapi_get_status_line declaration


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-77
changelog:
- CLOS-2951: Add support of alt-php 5.2-5.5 for Alma
- CLOS-2904: Ignore errors in blacklisted config files


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-78
changelog:
- CLOS-3055: Restore CRIU support in mod_lsapi DA tarballs
- CLOS-3007: Add PHP 8.4 support as well as support of future PHP versions
- CLOS-3007: Add heuristic to resolve unlisted PHP handlers
- CLOS-3043: Add support of Ubuntu 22


author: Cory McIntire <cory@cpanel.net> - 1.14.36.1-1
changelog:
- EA-9563: Update ea-apache24-mod_pagespeed from vstable to v1.14.36.1
           Remove 32 bit logic and RPM


author: Cory McIntire <cory@cpanel.net> - 1.14.36.1-1
changelog:
- EA-9560: Update ea-apache24-mod_pagespeed from vstable to v1.14.36.1
           Remove 32 bit logic and RPM


author: Tim Mullin <tim@cpanel.net> - 2.9.3-18
changelog:
- EA-10239: Increase compiler optimization level to help mitigate performance loss from large rulesets


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
- EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
- Security impacting issues
    Fix: FILES_TMP_CONTENT may sometimes lack complete content
    [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Tim Mullin <tim@cpanel.net> - 0.7.2-25
changelog:
- EA-7525: Fixed 0008-Support-phprc_paths-section-in-suphp.conf.patch, targetMode used before initialized


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
- EA-11198: Update apr from v1.7.0 to v1.7.2
- CVE-2022-24963
    Integer Overflow or Wraparound vulnerability in apr_encode functions of
    Apache Portable Runtime (APR) allows an attacker to write beyond bounds
    of a buffer.
- CVE-2021-35940
    Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
    (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
    later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
- EA-12350: Update apr from v1.7.4 to v1.7.5
- SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
     Unexpected lax shared memory permissions (cve.mitre.org)
     Lax permissions set by the Apache Portable Runtime library on
     Unix platforms would allow local users read access to named
     shared memory segments, potentially revealing sensitive
     application data.
     This issue does not affect non-Unix platforms, or builds with
     APR_USE_SHMEM_SHMGET=1 (apr.h)
     Users are recommended to upgrade to APR version 1.7.5, which
     fixes this issue.
     Credits: Thomas Stangner


author: Tim Mullin <tim@cpanel.net> - 1.6.3-1
changelog:
- EA-11199: Update apr-util from v1.6.1 to v1.6.3
- CVE-2022-25147
    Integer Overflow or Wraparound vulnerability in apr_base64 functions
    of Apache Portable Runtime Utility (APR-util) allows an attacker to
    write beyond bounds of a buffer.


author: Cory McIntire <cory@cpanel.net> - 8.5.0-1
changelog:
- EA-11857: Update libcurl from v8.4.0 to v8.5.0
- CVE-2023-46219 - HSTS long file name clears contents
- CVE-2023-46218 - cookie mixed case PSL bypass


author: Cory McIntire <cory@cpanel.net> - 8.6.0-1
changelog:
- EA-11948: Update libcurl from v8.5.0 to v8.6.0
- CVE-2024-0853: OCSP verification bypass with TLS session reuse


author: Cory McIntire <cory@cpanel.net> - 8.7.1-1
changelog:
- EA-12051: Update libcurl from v8.6.0 to v8.7.1
- CVE-2024-2466: TLS certificate check bypass with mbedTLS
- CVE-2024-2398: HTTP/2 push headers memory-leak
- CVE-2024-2379: QUIC certificate check bypass with wolfSSL
- CVE-2024-2004: Usage of disabled protocol


author: Cory McIntire <cory@cpanel.net> - 8.11.0-1
changelog:
- EA-12523: Update libcurl from v8.10.1 to v8.11.0
- CVE-2024-9681: HSTS subdomain overwrites parent cache entry


author: Cory McIntire <cory@cpanel.net> - 8.11.1-1
changelog:
- EA-12607: Update ea-libcurl from v8.11.0 to v8.11.1
- CVE-2024-11053: netrc and redirect credential leak


author: Cory McIntire <cory.mcintire@webpros.com> - 8.12.0-1
changelog:
- EA-12678: Update ea-libcurl from v8.11.1 to v8.12.0
- CVE-2025-0167 / CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2025-0665 / CWE-1341: Multiple Releases of Same Resource or Handle
- CVE-2025-0725 / CWE-680: Integer Overflow to Buffer Overflow


author: Brian Aker <brian@tangent.org> - 1.0.8
changelog:
* Fri Jan  8 2010 Brian Aker <brian@tangent.org> - 0.37
- Modified to be explicit in install include files.


author: Cory McIntire <cory@cpanel.net> - 2.12.6-1
changelog:
- EA-12022: Update ea-libxml2 from v2.12.4 to v2.12.6
- [CVE-2024-25062] xmlreader: Don't expand XIncludes when backtracking


author: Cory McIntire <cory@cpanel.net> - 2.12.6-2
changelog:
- EA-12252: Rolling “ea-libxml2” back to “0e1f4ea2052c4cb2643ebd9d51394223643c6fc2”: breaks scl-phps


author: Cory McIntire <cory@cpanel.net> - 2.13.3-2
changelog:
- EA-12336: Rolling “ea-libxml2” back to “f77d3db2ad0957accee0eda34f1bb8bc66a9bb5c”: breaks older php-pears


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.6-1
changelog:
- EA-12713: Update ea-libxml2 from v2.13.5 to v2.13.6
  - [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements
  - [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd


author: Cory McIntire <cory.mcintire@webpros.com> - 2.13.8-1
changelog:
- EA-12821: Update ea-libxml2 from v2.13.6 to v2.13.8
- [CVE-2025-32415] schemas: Fix heap buffer overflow in xmlSchemaIDCFillNodeTables
- [CVE-2025-32414] python: Read at most len/4 characters. (Maks Verver)


author: Cory McIntire <cory@cpanel.net> - 1.10-2
changelog:
- EA-12397: Rolling “ea-libzip” back to “a55dc085a3c6d8ccc95613a7f6acf4589fe405c2”: Version issues in happening in PHP compliations with this update


author: Cory McIntire <cory@cpanel.net> - 1.57.0-1
changelog:
- EA-11729: Update ea-nghttp2 from v1.56.0 to v1.57.0
- CVE-2023-44487 - The HTTP/2 protocol allows a denial of service (server resource consumption)


author: Cory McIntire <cory@cpanel.net> - 1.61.0-1
changelog:
- EA-12069: Update ea-nghttp2 from v1.60.0 to v1.61.0
- CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
- ZC-11679: Account for circumstance where wwwacct.conf is missing
- ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
- EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
- *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
  Thanks to Nils Bars.


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
- EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
- Security: insufficient check in virtual servers handling with TLSv1.3
  SNI allowed to reuse SSL sessions in a different virtual server, to
  bypass client SSL certificates verification (CVE-2025-23419)


author: Cory McIntire <cory@cpanel.net> - 16.19.1-1
changelog:
- EA-11255: Update ea-nodejs16 from v16.19.0 to v16.19.1
- [CVE-2023-23918) Node.js Permissions policies can be bypassed via process.mainModule (High)
- [CVE-2023-23919) Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
- [CVE-2023-23920] Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)
- [CVE-2023-23936] Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
- [CVE-2023-24807] Regular Expression Denial of Service in Headers in Node.js fetch API (Low)


author: Cory McIntire <cory@cpanel.net> - 16.20.2-1
changelog:
- EA-11604: Update ea-nodejs16 from v16.20.1 to v16.20.2
	- CVE-2023-32559: Policies can be bypassed via process.binding
	- CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire
	- CVE-2023-32002:  Policies can be bypassed via Module.\_load
	- OpenSSL sources upgraded upstream to latest


author: Dan Muey <dan@cpanel.net> - 1.0-2
changelog:
- ZC-9259: Have setting script do defaults (so it can be done at will); use helper script instead of /dev/null for missing binaries


author: Cory McIntire <cory.mcintire@webpros.com> - 6.0.26-1
changelog:
- EA-12725: Update ea-passenger-src from v6.0.25 to v6.0.26
  * [CVE-2025-26803] The http parser (from Passenger 6.0.21-6.0.25) was susceptible to a denial of service attack when parsing a request with an invalid HTTP method.


author: Daniel Muey <dan@cpanel.net> - 1.0.0-1
changelog:
- ZC-4400: rewrite to make it easier to work with and fix all the bugs
- ZC-4425: deprecate -ea_php flag


author: S. Kurt Newman <kurt.newman@cpanel.net> - 4.7.5-5
changelog:
- Added scl_package_override macro to regain access to global
  PHP macros that contain location and verison information.


author: Dan Muey <dan@cpanel.net> - 3.3-7
changelog:
- EA-5028 via EA-5900: reinstate opcache conflict
- (the obsoletes is problematic and there is a
-   proper way to address the problem it was intended to solve)


author: Jack Hayhurst <jack@deleteos.com> - 0.2
changelog:
- added ea-php71-php-memcahe branched off of php54

- Fixed package name, entire RPM is now working.


author: Cory McIntire <cory@cpanel.net> - 8.0.29-1
changelog:
- EA-11475: Update ea-php80 from v8.0.28 to v8.0.29
    - Fixed bug GHSA-76gg-c692-v2mw
        (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP).


author: Cory McIntire <cory@cpanel.net> - 8.0.30-1
changelog:
- EA-11590: Update ea-php80 from v8.0.29 to v8.0.30
	- Libxml:
		Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
	- Phar:
		Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)


author: Cory McIntire <cory@cpanel.net> - 8.1.31-1
changelog:
- EA-12576: Update ea-php81 from v8.1.30 to v8.1.31
- (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
- (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
- (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
- (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
- (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
- (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.1.28-1
changelog:
- EA-12087: Update ea-php81 from v8.1.27 to v8.1.28
- Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874)
- Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756)
- Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096)


author: Cory McIntire <cory@cpanel.net> - 8.1.29-1
changelog:
- EA-12192: Update ea-php81 from v8.1.28 to v8.1.29
- Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
- Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
- Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
- The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.1.30-1
changelog:
- EA-12428: Update ea-php81 from v8.1.29 to v8.1.30
- Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
- Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
- Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
- Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.1.32-1
changelog:
- EA-12766: Update ea-php81 from v8.1.31 to v8.1.32
    - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
    - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
    - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory@cpanel.net> - 8.2.26-1
changelog:
- EA-12577: Update ea-php82 from v8.2.25 to v8.2.26
- (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
- (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
- (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
- (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
- (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
- (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.2.20-1
changelog:
- EA-12194: Update ea-php82 from v8.2.19 to v8.2.20
- Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
- Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
- Fixed bug GHSA-9fcc-425m-g385 (Bypass of CVE-2024-1874). (CVE-2024-5585)
- The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack


author: Cory McIntire <cory@cpanel.net> - 8.2.24-1
changelog:
- EA-12423: Update ea-php82 from v8.2.23 to v8.2.24
- Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
- Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
- Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
- Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.2.28-1
changelog:
- EA-12772: Update ea-php82 from v8.2.27 to v8.2.28
    - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
    - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
    - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Cory McIntire <cory@cpanel.net> - 8.3.14-1
changelog:
- EA-12578: Update ea-php83 from v8.3.13 to v8.3.14
- (Single byte overread with convert.quoted-printable-decode filter). (CVE-2024-11233)
- (Configuring a proxy in a stream context might allow for CRLF injection in URIs). (CVE-2024-11234)
- (Integer overflow in the dblib quoter causing OOB writes). (CVE-2024-11236)
- (Integer overflow in the firebird quoter causing OOB writes). (CVE-2024-11236)
- (Leak partial content of the heap through heap buffer over-read). (CVE-2024-8929)
- (OOB access in ldap_escape). (CVE-2024-8932)


author: Cory McIntire <cory@cpanel.net> - 8.3.12-1
changelog:
- EA-12410: Update ea-php83 from v8.3.11 to v8.3.12
- Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
- Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
- Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
- Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)


author: Cory McIntire <cory.mcintire@webpros.com> - 8.3.19-1
changelog:
- EA-12769: Update ea-php83 from v8.3.17 to v8.3.19
    - Fixed GHSA-hgf54-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
    - Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
    - Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
    - Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers). (CVE-2025-1217)
    - Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a redirected resource). (CVE-2025-1219)
    - Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)


author: Dan Muey <dan@cpanel.net> - 1.0-67
changelog:
- ZC-11494: Rolling “ea-profiles-cpanel” back to “562229d”: scriptlets seem to be happening out of order on a9


author: Cory McIntire <cory@cpanel.net> - 6.2.14-1
changelog:
- EA-11922: Update ea-redis62 from v6.2.8 to v6.2.14
- CVE-2023-45145 ( Bypass permissions on socket on startups )
- CVE-2022-24834 ( RCE )
- CVE-2023-28856 ( Users can crash redis with invalid data )
- CVE-2023-25155 ( Integer overflow can cause redis to terminate )
- CVE-2022-36021 ( DoS - can cause redis to hang and consume 100% CPU time )
- CVE-2022-35977, CVE-2023-22458 ( integer overflow issues / oom panic fixes )


author: Cory McIntire <cory@cpanel.net> - 6.2.16-1
changelog:
- EA-12449: Update ea-redis62 from v6.2.14 to v6.2.16
- (CVE-2024-31449) Lua library commands may lead to stack overflow and potential RCE.
- (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern matching.


author: Cory McIntire <cory@cpanel.net> - 6.2.17-1
changelog:
- EA-12624: Update ea-redis62 from v6.2.16 to v6.2.17
- (CVE-2024-46981) Lua script commands may lead to remote code execution


author: Travis Holloway <t.holloway@cpanel.net> - 2.7.2-6
changelog:
- EA-9609: Install racc and irb and require ruby-devel for update to 2.7.2
  Adjusted release to -6 in order to match ea-ruby27 package


author: Cory McIntire <cory@cpanel.net> - 1.48.0-1
changelog:
- EA-11958: Update ea-ruby27-libuv from v1.47.0 to v1.48.0
- CVE-2024-24806: Improper Domain Lookup that potentially leads to SSRF attacks


author: Cory McIntire <cory@cpanel.net> - 1.49.0-2
changelog:
- EA-12450: Rolling “ea-ruby27-libuv” back to “757c822adb9bc99291dfd5219b5afa32e63e1fd4”: upstream issue causing upload limit problems
- Actual version is 1.48.0-3


author: Cory McIntire <cory@cpanel.net> - 8.5.94-1
changelog:
- EA-11728: Update ea-tomcat85 from v8.5.93 to v8.5.94
- Request smuggling CVE-2023-45648
- Denial of Service CVE-2023-44487
- Information Disclosure CVE-2023-42795
- Denial of Service CVE-2023-42794


author: Dan Muey <dan@cpanel.net> - 0.1-3
changelog:
- ZC-10895: Add support for multiple Ubuntus as well as 22.04 && make `From repo` have OS info akin to `APT-Sources`


author: Jindrich Novy <jnovy@redhat.com> 0.1-11
changelog:
- avoid redefinition of %_root* macros by multiple
  occurence of %stack_package
- make the Stack root path configurable


author: Jindrich Novy <jnovy@redhat.com> 0.1-14
changelog:
- define %_defaultdocdir to properly relocate docs into
  a stack
- document a way how to pass command to stack via stdin


author: Jindrich Novy <jnovy@redhat.com> 20120209-1
changelog:
- fix minor bugs (#788194)
  - clear temp files
  - handle commands from stdin properly
  - run command even if ran as "scl enable SCL command" from already
    enabled SCL


author: Jindrich Novy <jnovy@redhat.com> 20120229-1
changelog:
- do not prepend scl_* prefix to package names
- unify package naming to <SCL>-package-version
- add scl --list functionality to list available SCLs


author: Darren Mobley <darren@cpanel.net> - 0.1-9
changelog:
- HB-1952: Added support for sending an argument of --pkglist=/path/to/file
  that has a line by line list of each rpm package being handled by the 
  current operation to the wildcard scripts


author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
- EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
  CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
  CVE-2022-28330: Read beyond bounds in mod_isapi
  CVE-2022-28614: Read beyond bounds via ap_rwrite()
  CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
  CVE-2022-29404: Denial of service in mod_lua r:parsebody
  CVE-2022-30522: mod_sed: Denial of service
  CVE-2022-30556: Information Disclosure in mod_lua with websockets
  CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
- EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
- CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
- CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
- CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
- EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
- CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
- CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


changelog: - switch_mod_lsapi --stat option added - MODLS-560: Installation of mod_lsapi package on DA added
author:
Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
- MODLS-574: Started logics improvement
- MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
- MODLS-565: lsapi_poll_timeout default-value 300


author:
Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
- MODLS-590: Fixed stack overflow lscapi_do_request
- MODLS-582: Update Copyright for mod_lsapi project
- MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
- MODLS-584: semtimedwait improvement
- MODLS-580: stat support added for DA without mod_lsapi rpm
- MODLS-481: fix stuck when bodyLen is wrong
- MODLS-579: Remove LVE support from cpanel mod_lsapi
- Fix exception in case if there are no liblsapi installed
- MODLS-576: added absolute path for service util


author:
Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
- MODLS-608: removed non-ascii symbol in copyright
- MODLS-606: Fix lsapi_poll_timeout functionality
- MODLS-600: fix mod_lsapi removal sets handler to none
- MODLS-571: add support for httpd24-mod_lsapi usage statistics
- MODLS-598: Fix permissions on config files
- MODLS-587, MODLS-594: selector usage statistics added
- MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daniel Muey <dan@cpanel.net> - 1.1-36
changelog:
- ZC-4779: Add ea-php73 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Daniel Muey <dan@cpanel.net> - 1.1-37
changelog:
- ZC-6114: Add ea-php74 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Daniel Muey <dan@cpanel.net> - 1.1-41
changelog:
- ZC-7213: Add ea-php80 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of
- bump release prefix to get back in sync w/ ea-liblsapi.spec
- Add missing 7.3 and 7.4 entries for application/x-httpd-ea-php*-lsphp rpm/switch_lsapi


author: Daniel Muey <dan@cpanel.net> - 1.1-42
changelog:
- ZC-9484: Add ea-php81 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Dan Muey <dan@cpanel.net> - 1.1-43
changelog:
- ZC-10388: Add ea-php82 to hardcoded list that rpm/switch_lsapi builds /etc/container/php.handler out of


author: Eugene Zamriy <eugene@zamriy.info> - 1.00.27-2
changelog:
- Disabled automatic Provides / Requires generation to avoid conflicts with EPEL package
- Removed duplicate BuildRoot definition


author: Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-33
changelog:
- MODLS-579: Remove LVE support from cpanel mod_lsapi
- Fix exception in case if there are no liblsapi installed
- MODLS-576: added absolute path for service util


changelog:
- MODLS-590: Fixed stack overflow lscapi_do_request
- MODLS-582: Update Copyright for mod_lsapi project
- MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
- MODLS-584: semtimedwait improvement
- MODLS-580: stat support added for DA without mod_lsapi rpm
- MODLS-481: fix stuck when bodyLen is wrong


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
- Update to 2.9.4.
- Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Dan Muey <dan@cpanel.net> - 2.9.7-1
changelog:
- EA-7043: Update from v2.9.4 to v2.9.7
- fixed %setup so that we do not need to modify tarball (EA-6094)
- remove unreferenced 2.9.4-remove-pyverify_fd patch
- Add Provides of libxml2


author: Cory McIntire <cory@cpanel.net> - 2.10.3-1
changelog:
- EA-11205: Update ea-libxml2 from v2.9.7 to v2.10.3
- [CVE-2022-23308] Use-after-free of ID and IDREF attributes
- [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
- [CVE-2022-2309] Reset nsNr in xmlCtxtReset
- [CVE-2022-40304] Fix dict corruption caused by entity reference cycles
- [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE


author: Cory McIntire <cory@cpanel.net> - 2.10.4-1
changelog:
- EA-11352: Update ea-libxml2 from v2.10.3 to v2.10.4
- [CVE-2023-29469] Hashing of empty dict strings isn't deterministic
- [CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType


author: Cory McIntire <cory@cpanel.net> - 2.11.1-1
changelog:
- EA-11388: Update ea-libxml2 from v2.10.4 to v2.11.1
    - Security Fixes
    - Fix use-after-free in xmlParseContentInternal() (David Kilzer)
    - xmllint: Fix use-after-free with --maxmem
    - parser: Fix OOB read when formatting error message
    - entities: Rework entity amplification checks


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.23.3-3
changelog:
- ZC-10317: Update ngx_http_pipelog_module to v1.0.3
- ZC-10484: Remove SIGKILL from various nginx files
- ZC-10517: Address Ubuntu creating addiotional splitlog processes
- ZC-10593: Close out fd's during reload/shutdown
- EA-11088: Account for mail subdomains of addon and parked domains when configuring the server_name directive
- EA-11121: Add ipv6 subdomain to server_name directive when account has an ipv6 address assigned
- EA-10890: Refactor _render_and_append() to use more data from global config data


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.3-7
changelog:
- EA-11269: Reduce frequency of nginx restarts during cpanellogd's domain log processing when piped logging is enabled


author: Travis Holloway <t.holloway@cpanel.net> - 1.24.0-2
changelog:
- EA-11131: Ensure userdata reflects apache port changes when ea-nginx is removed
- EA-11132: Ensure '/var/log/nginx.uninstall' does not exist before moving active log files there


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0.2o-2
changelog:
- EA-7382: Ensure we build shared objects with versioned symbols.
- Applied patch for CVE-2018-0737: Cache timing vulnerability in RSA Key Generation


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0.2o-3
changelog:
- EA-7468: Ensure dependency resolution picks /usr/bin/perl instead
  of /bin/perl. This helps downstream users of our RPMs as their
  build environments can be simplified.


author: Cory McIntire <cory@cpanel.net> - 1.0.2q-1
changelog:
- EA-8030: Update to 1.0.2q
  CVE-2018-5407 Microarchitecture timing vulnerability in ECC scalar multiplication
  CVE-2018-0734 Timing vulnerability in DSA signature generation


author: Cory McIntire <cory@cpanel.net> - 1.1.1p-1
changelog:
- EA-10773: Update ea-openssl11 from v1.1.1o to v1.1.1p
- The c_rehash script allows command injection (CVE-2022-2068)


author: Cory McIntire <cory@cpanel.net> - 1.1.1t-1
changelog:
- EA-11213: Update ea-openssl11 from v1.1.1s to v1.1.1t
- X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)
- Timing Oracle in RSA Decryption (CVE-2022-4304)
- Use-after-free following BIO_new_NDEF (CVE-2023-0215)
- Double free after calling PEM_read_bio_ex (CVE-2022-4450)


author: Cory McIntire <cory@cpanel.net> - 1.1.1u-1
changelog:
- EA-11449: Update ea-openssl11 from v1.1.1t to v1.1.1u
    - Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)


author: Cory McIntire <cory@cpanel.net> - 1.1.1v-1
changelog:
- EA-11578: Update ea-openssl11 from v1.1.1u to v1.1.1v
	- Fix excessive time spent checking DH q parameter value (CVE-2023-3817)
	- Fix DH_check() excessive time with over sized modulus (CVE-2023-3446)


author: Cory McIntire <cory@cpanel.net> - 1.1.1w-1
changelog:
- EA-11665: Update ea-openssl11 from v1.1.1v to v1.1.1w
	- Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807)


author: Cory McIntire <cory@cpanel.net> - 1.1.1j-1
changelog:
- EA-9590: Update ea-openssl11 from v1.1.1i to v1.1.1j
  Null pointer deref in X509_issuer_and_serial_hash() (CVE-2021-23841)
  Incorrect SSLv2 rollback protection (CVE-2021-23839)
  Integer overflow in CipherUpdate (CVE-2021-23840)


author: Cory McIntire <cory@cpanel.net> - 1.1.1n-1
changelog:
- EA-10564: Update ea-openssl11 from v1.1.1m to v1.1.1n
- Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)


author: Cory McIntire <cory@cpanel.net> - 8.0.25-1
changelog:
- EA-11020: Update ea-php80 from v8.0.24 to v8.0.25
- GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
- Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.0.27-1
changelog:
- EA-11137: Update ea-php80 from v8.0.26 to v8.0.27
- PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.0.28-1
changelog:
- EA-11227: Update ea-php80 from v8.0.27 to v8.0.28
- Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
- Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
- Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.1.12-1
changelog:
- EA-11021: Update ea-php81 from v8.1.11 to v8.1.12
- GD: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
- Hash: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)


author: Cory McIntire <cory@cpanel.net> - 8.1.14-1
changelog:
- EA-11133: Update ea-php81 from v8.1.13 to v8.1.14
- PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.1.16-1
changelog:
- EA-11244: Update ea-php81 from v8.1.15 to v8.1.16
- Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
- Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
- Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


author: Cory McIntire <cory@cpanel.net> - 8.2.1-1
changelog:
- EA-11136: Update ea-php82 from v8.2.0 to v8.2.1
- PDO::quote() may return unquoted string). (CVE-2022-31631)


author: Cory McIntire <cory@cpanel.net> - 8.2.3-1
changelog:
- EA-11226: Update ea-php82 from v8.2.2 to v8.2.3
- Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567)
- Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568)
- Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)


