EasyApache June 15 Release

We are happy to announce that cPanel, L.L.C. has released an update for cPanel Community Forums, Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

• ea-apache24
  • EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
  • CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
  • CVE-2022-28330: Read beyond bounds in mod_isapi
  • CVE-2022-28614: Read beyond bounds via ap_rwrite()
  • CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
  • CVE-2022-29404: Denial of service in mod_lua r:parsebody
  • CVE-2022-30522: mod_sed: Denial of service
  • CVE-2022-30556: Information Disclosure in mod_lua with websockets
  • CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism
• ea-nodejs16
  • EA-10748: Update ea-nodejs16 from v16.15.0 to v16.15.1
• ea-tomcat85
  • EA-10761: Update ea-tomcat85 from v8.5.79 to v8.5.81
• ea-php74
• ea-php74-meta
  • EA-10757: Update ea-php74 from v7.4.29 to v7.4.30
    • mysqlnd:
      • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    • pgsql:
      • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
• ea-php80
• ea-php80-meta
  • EA-10760: Update ea-php80 from v8.0.19 to v8.0.20
    • mysqlnd:
      • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    • pgsql:
      • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
• ea-php81
• ea-php81-meta
  • EA-10758: Update ea-php81 from v8.1.6 to v8.1.7
    • mysqlnd:
      • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    • pgsql:
      • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
• ea-podman
  • ZC-9993: Add script for dev/QA/smold4r to be able to test against internal docker hub
• ea-podman-repo
  • ZC-10010: enable powertools on Rocky 8
• ea-nginx
  • ZC-9940: Change worker_processes default back to 1
  • ZC-9940: Have worker_shutdown_timeout default to 10 seconds

SUMMARY cPanel, L.L.C. has updated packages for EasyApache 4 with PHP versions 7.4.30, 8.0.20, and 8.1.7 and Apache version 2.4.54. This release addresses vulnerabilities related to CVE-2022-26377, CVE-2022-28330, CVE-2022-28614, CVE-2022-28615, CVE-2022-29404, CVE-2022-30522, CVE-2022-30556, CVE-2022-31813, CVE-2022-31626, and CVE-2022-31625. We strongly encourage all PHP 7.4 users to update to version 7.4.30, all PHP 8.0 users to update to version 8.0.20, all PHP 8.1 users to update to version 8.1.7, and all Apache users to update to version 2.4.54. AFFECTED VERSIONS All versions of PHP 7.4 through 7.4.29. All versions of PHP 8.0 through 8.0.19. All versions of PHP 8.1 through 8.1.6. All versions of Apache through 2.4.53. SECURITY RATING The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs: CVE-2022-26377 " MEDIUM Apache 2.4.54 Fixed vulnerability in the mod_proxy_ajp module related to CVE-2022-26377. CVE-2022-28330 " MEDIUM Apache 2.4.54 Fixed vulnerability in the mod_isapi module related to CVE-2022-28330. CVE-2022-28614 " MEDIUM Apache 2.4.54 Fixed vulnerability related to CVE-2022-28614. CVE-2022-28615 " MEDIUM Apache 2.4.54 Fixed vulnerability related to CVE-2022-28615. CVE-2022-29404 " MEDIUM Apache 2.4.54 Fixed vulnerability in the mod_lua module related to CVE-2022-29404. CVE-2022-30522 " MEDIUM Apache 2.4.54 Fixed vulnerability in the mod_sed module related to CVE-2022-30522. CVE-2022-30556 " MEDIUM Apache 2.4.54 Fixed vulnerability in the mod_lua module related to CVE-2022-30556. CVE-2022-31813 " MEDIUM Apache 2.4.54 Fixed vulnerability in the mod_proxy module related to CVE-2022-31813. CVE-2022-31626 " MEDIUM PHP 7.4.30 2022 EasyApache 4 Changelog and the EasyApache Development and