Skip to main content

EasyApache September 29 Release

cPanelRhoda
EasyApache September 29 Release We are happy to announce that cPanel, L.L.C. has released an update for cPanel Community Forums, Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.
  • ea-apache24-mod-passenger
    • EA-10945: ea-passenger-src was updated from v6.0.14 to v6.0.15
  • ea-apache2-config
    • EA-10935: Account for IPv6 addresses when setting up mod_remoteip
    • EA-10912: Setup mod_remoteip to work with all the server IPs
  • ea-nginx
    • EA-10751: Leave X-Forwarded-Host blank for service subdomains
    • EA-10671: Calculate 'server_names_hash_bucket_size' and 'server_names_hash_max_size' at config time
    • EA-10913: "no resolver defined" error under a specific circumstance
  • ea-nodejs16
    • EA-10948: Update ea-nodejs16 from v16.17.0 to v16.17.1
      • CVE-2022-32212: DNS rebinding in --inspect on macOS (High)
      • CVE-2022-32213: bypass via obs-fold mechanic (Medium)
      • CVE-2022-35255: Weak randomness in WebCrypto keygen
      • CVE-2022-35256: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
  • ea-passenger-src
    • EA-10945: Update ea-passenger-src from v6.0.14 to v6.0.15
  • ea-php80
    • ZC-10260: Link deb against libcurl 4 explicitly
  • ea-php81
    • ZC-10260: Link deb against libcurl 4 explicitly
  • ea-ruby27-passenger
    • EA-10946: Update ea-ruby27-passenger from v6.0.14 to v6.0.15
This release includes a security patch that has been issued a fix for a CVE (Common Vulnerabilities and Exposures), the details of which are included below. SUMMARY cPanel, L.L.C. has updated packages for EasyApache 4 with NodeJS version 16.17.1. This release addresses vulnerabilities related to CVE-2022-32212, CVE-2022-32213, CVE-2022-35255, and CVE-2022-35256. We strongly encourage all NodeJS users to update to version 16.17.1. AFFECTED VERSIONS All versions of NodeJS through 16.17.0. SECURITY RATING The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs: CVE-2022-32212 - HIGH NodeJS 16.17.1 Fixed vulnerability related to CVE-2022-32212. CVE-2022-32213 - CRITICAL NodeJS 16.17.1 Fixed vulnerability related to CVE-2022-32213. CVE-2022-35255 - MEDIUM NodeJS 16.17.1 Fixed vulnerability related to CVE-2022-35255. CVE-2022-35256 - MEDIUM NodeJS 16.17.1 Fixed vulnerability related to CVE-2022-35256. SOLUTION cPanel, L.L.C. has released updated packages for EasyApache 4 on September 29, 2022, with NODEJS 16.17.1. Unless you have enabled automatic package updates in your cron, update your system with either your package manager or WHM's Run System Update interface. REFERENCES ]https://cve.mitre.org/favicon.ico
CVE - CVE-2022-32213 ]https://cve.mitre.org/favicon.ico
CVE - CVE-2022-35256 More Information Information about all releases this year can be found in the EasyApache 4 Release Notes. You can also sign up for our EasyApache Production mailing lists to see when updates are pushed for our RPMs, letting you know ahead of time what will be updated in each EasyApache release.

Comments

2 comments

Date Votes
  • rbairwell
    Is anyone else getting problems with nginx after this update? We had: -- Unit nginx.service has begun starting up. Sep 29 22:50:54 example.com nginx[4873]: nginx: [emerg] unknown "cpanel_service_subdomain" variable Sep 29 22:50:54 example.com systemd[1]: nginx.service: control process exited, code=exited status=1 Sep 29 22:50:54 example.com systemd[1]: Failed to start nginx - high performance web server. -- Subject: Unit nginx.service has failed
    and 2022/09/29 22:47:55 [emerg] 3970#3970: unknown "cpanel_service_subdomain" variable 2022/09/29 22:49:00 [emerg] 4328#4328: unknown "cpanel_service_subdomain" variable 2022/09/29 22:50:54 [emerg] 4873#4873: unknown "cpanel_service_subdomain" variable 2022/09/29 22:51:57 [emerg] 5198#5198: unknown "cpanel_service_subdomain" variable 2022/09/29 22:53:35 [emerg] 5684#5684: unknown "cpanel_service_subdomain" variable 2022/09/29 22:54:55 [emerg] 6734#6734: invalid number of the map parameters in /etc/nginx/conf.d/ea-nginx.conf:14 2022/09/29 22:55:01 [emerg] 7013#7013: unknown "cpanel_service_subdomain" variable 2022/09/29 22:55:08 [emerg] 7167#7167: unknown "cpanel_service_subdomain" variable 2022/09/29 22:55:09 [emerg] 7290#7290: unknown "cpanel_service_subdomain" variable 2022/09/29 22:55:32 [emerg] 7578#7578: unknown "cpanel_service_subdomain" variable
    I've had to just disable/remove nginx for now (as it's just gone midnight here in the UK).
    0
  • rbairwell
    This is reported fixed in
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post