# changelog

author: Pavel Raiskup <praiskup@redhat.com> - 1-7
changelog:
  - the fix for 'filelist' (#1079203) is not needed, according to
    https://fedorahosted.org/SoftwareCollections/ticket/18


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-3
changelog:
  - EA-7802: Restore mod_ratelimit back to the 2.3.34 version. Apply
  upstream fixes for it from trunk.


author: Cory McIntire <cory@cpanel.net> - 2.4.35-1
changelog:
  - EA-7871: Update to v2.4.35, drop v2.4.34
    Remove Patch500: 0017-Apply-mod_ratelimit-fix-from-trunk.patch as it
    was implemented upstream.


author: Cory McIntire <cory@cpanel.net> - 2.4.39-1
changelog:
  - EA-8307: Update to 2.4.39, drop 2.4.38
    CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts
    CVE-2019-0196: mod_http2, read-after-free on a string compare
    CVE-2019-0197: mod_http2, possible crash on late upgrade
    CVE-2019-0215: mod_ssl access control bypass
    CVE-2019-0217: mod_auth_digest access control bypass
    CVE-2019-0220: URL normalization inconsistincies


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-2
changelog:
  - EA-7715: Revert mod_ratelimit back to the 2.3.33 version.
    This is to ensure that it emits proper chunks, as there are several
    issues with the 2.3.34 version.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.39-3
changelog:
  - CPANEL-27056: Fix bug in condition that allowed for non-user files
    to be served in certain situations when SymlinkProtection was
    enabled.


author: Daniel Muey <dan@cpanel.net> - 2.4.41-5
changelog:
  - ZC-4361: bump release prefix past 4 so these will be newest (4 was added and disappeared due to a faulty revert)


author: Cory McIntire <cory@cpanel.net> - 2.4.46-5
changelog:
  - EA-9463: Resolve Apache startup race conditions
             Enable mod_systemd for further startup enhancements


author: Travis Holloway <t.holloway@cpanel.net> - 2.4.49-2
changelog:
  - EA-10123: Patch apache 2.4.49: Correctly decrement active_daemons also in the case that the child process decides on its own to die because of MaxRequestsPerChild.


author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
  - EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
  	- CVE-2023-31122: mod_macro buffer over-read
  	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
  	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
  - EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
  	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
  	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
  	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
  - EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
  	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
  	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
  	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
  	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
  	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
  	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
  	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
  	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
  - EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
  	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.26-21
changelog:
  - Rebase upon passenger-5.0.26
  - Added support for DirectAdmin
  - More robust alt-mod-passenger installation routine for CPanel servers
  - Deploy pre-built binaries for non CPanel servers
    (thus no custom httpd-devel, alt-mod-passenger depends on)
  - Use pre-built ruby native support library for all CloudLinux alt-ruby versions,
    so that the library is not built on-fly per user app first invokation


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.29-22
changelog:
  - Rebase upon passenger-5.0.29
  - Return back to Passenger 4.0 tmp/restart.txt behavour (minimal lag
    between touching app/tmp/restart.txt and app restart)
  - Fixup installation script for non-panel server


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-26
changelog:
  - Support httpd, httpd24 and EA4 apache with same passenger
  - New passenger version 5.0.29
  - Small bug fixes


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 4.0.58-14
changelog:
  - Rebase upon passenger-4.0.58
  - Disable Node.js handler, which has had no official support
  - Move away from noarch: Rework .spec to build passenger


author: Daniel Muey <dan@cpanel.net> - 1.0-157
changelog:
  - ZC-5669: Add undocumented & unsupported touchfile to disable 009-phpconf.pl's user setting validation


author: Daniel Muey <dan@cpanel.net> - 1.0-175
changelog:
  - ZC-9061: Detect and inform admin of non-existent home directory
  - ZC-9058: Have nobody check set primary group to nobody


author: Dan Muey <dan@cpanel.net> - 1.0-178
changelog:
  - ZC-9109: Do ensure-nobody script pre transaction so post transaction script can relay on it being there


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-4
changelog:
  - Install Passenger into separate version folders
  - Tune simlinks to point to proper Passenger version
  - Fix permissions of PassengerInstanceRegistryDir to 755


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.6-1
changelog:
  - ALMODP-77: Make /var/passenger less worldwide accessible
  - ALMODP-60: Use `PASSENGER_INSTANCE_REGISTRY_DIR` instead `PASSENGER_TEMP_DIR`
  - ALMODP-81: Add conflict for package ea-ruby24-mod_passenger


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.11-1
changelog:
  - ALMODP-91: Arbitrary file read vulnerability in passenger
  - ALMODP-89: Made graceful reload Apache instead of restart when alt-mod-passenger install/update
  - Remove dependency from old package which obsoletes ea-apache24-alt_mod_passenger
  - ALMODP-86: Add Node.js language support for alt-mod-passenger


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.92-1.cloudlinux
changelog:
  - Epoch bumped to 1
  - Removed Vendor tags
  - 491_mod_bw.conf and setbwlimit files added to the sources list


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.4-4
changelog:
  - Change bwlimited.conf to 0644 so that normal users can load modules
    the same as Apache while testing their configuration with 'httpd -t'
  - Also renamed configuration to 490_mod_bwlimited.conf to match the
    naming scheme of our other files.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-1
changelog:
  - EA-7191: Initial implementation of mod_cpanel:
      * Handle requests to suspended users in apache without requiring
        an include file to be generated on the product side.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.4-1
changelog:
  - EA-7821: Don't strip symbools from the debug package.
  - EA-7822: Handle edge cases where request_rec->filename == NULL.
      * Some modules that hook into the map_to_storage process (eg. mod_pagespeed),
        can alter the request_rec in an unexpected manner, that resulted
        result in a segfault.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
  - General cleanup (EA-5395)
  - Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
  - Switch to rpm macros


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-25
changelog:
  - MODLS-494: implement ~/mod_lsapi_reset_me flag for removing all CRUI images for all domains of user
  - dependency from alt-libxml2 removed from ea-apache24-mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Kees Monshouwer <km|monshouwer_com> 0.9.8-1
changelog:
  - Address reported security bug in chroot mode. Thanks to the
    "cPanel Security Team" for the discovery of this bug.
  - Improve chroot behavior in drop capability mode.


author: Jacob Perkins <jacob.perkins@cpanel.net> - 2.9.2-1
changelog:
  - EA-6312: Update ModSec to 2.9.2
  - Removed RuleProcessingFailedExpand patch as it was fixed upstream


author: Tim Mullin <tim@cpanel.net> - 2.9.3-18
changelog:
  - EA-10239: Increase compiler optimization level to help mitigate performance loss from large rulesets


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.7.2-12.3.cloudlinux
changelog:
  - suphp-0.7.1-cagefs.patch replaced with suphp-0.7.2-cagefs.am.patch
  - Dependencies adjusted to use ea-* packages from CloudLinux OS
  - Epoch bumped to 1
  - Vendor removed
  - dist macro added to Release


author: Tim Mullin <tim@cpanel.net> - 0.7.2-25
changelog:
  - EA-7525: Fixed 0008-Support-phprc_paths-section-in-suphp.conf.patch, targetMode used before initialized


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 0.7.2-25.cloudlinux.1
changelog:
  - EA4D-97: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea- and alt-php


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.7.2-30.cloudlinux.1
changelog:
  - EA4D-323: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea-php* and alt-php*


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.5.2-9.1.cloudlinux
changelog:
  - Epoch bumped to 1
  - dist macro added to Release
  - Dependencies adjusted to use ea-apr from CloudLinux OS


author: Tim Mullin <tim@cpanel.net> - 1.6.3-1
changelog:
  - EA-11199: Update apr-util from v1.6.1 to v1.6.3
  - CVE-2022-25147
      Integer Overflow or Wraparound vulnerability in apr_base64 functions
      of Apache Portable Runtime Utility (APR-util) allows an attacker to
      write beyond bounds of a buffer.


author: Dan Muey <dan@cpanel.net> - 1.0-17
changelog:
  - EA-6344: ea_convert_php_ini fixups: add missing require, allow it to parse suphp conf handlers, add usage comment to package


author: Tim Mullin <tim@cpanel.net> - 1.0-19
changelog:
  - EA-7549: If the php config file is a symlink, and the force option is used, remove the symlink so the file can be written.


author: Daniel Muey <dan@cpanel.net> - 1.0-30
changelog:
  - ZC-4935: Add recommendation for -php-cli and -php-common removal
  - ZC-6604: Add recommendations for PHP 7.2, 7.3, 7.4


author: Daniel Muey <dan@cpanel.net> - 1.0-37
changelog:
  - ZC-7307: Specify default directory index and PHP FPM’s `security_limit_extensions` that so they can be updated without requiring a ULC updated/backport


author: Dan Muey <dan@cpanel.net> - 1.0-48
changelog:
  - ZC-9307: Rolling “ea-cpanel-tools” back to “0a3c415”: ea-apache24-mod-passenger shows up under Apache modules so additional packages was not necessary


author: Dan Muey <dan@cpanel.net> - 1.0-54
changelog:
  - ZC-9758: Add ea-nginx-brotli to additional packages list && do http2-like toggle off recommendations
  - ZC-9759: add `container_based_packages` list to ea4-metainfo.json


author: Julian Brown <julian.brown@cpanel.net> - 1.0-56
changelog:
  - ZC-9849: Add pkg_manifest.json and add target to ea_current_to_profile
  - ZC-9854: Add ea-nginx-njs to additional packages and recommendations.


author: Dan Muey <dan@cpanel.net> - 1.0-57
changelog:
  - ZC-9886: Add meta info to target-os profile && update EA4-production manifest when updating EA4 manifest
  - EA-10600: Add PHP 7.3 to EOL recommendations


author: Dan Muey <dan@cpanel.net> - 1.0-65
changelog:
  - ZC-10447: update manifest for A9 and PHP 8.2, make PHP 8.1 the default for EA4
  - ZC-10581: update ea4 recommendations to match the PHP reality


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.0-71
changelog:
  - ZC-10474: Add ea-nginx-headers-more to `additional_packages`
  - ZC-10320: Add Ubuntu 22 to manifest


author: Dan Muey <dan@cpanel.net> - 1.0-72
changelog:
  - ZC-10955: Update manifest for post reset of OBS flags (Makefile disables only; no manual disables)


author: Dan Muey <dan@cpanel.net> - 1.0-78
changelog:
  - ZC-11033: Add support for packages w/out an `ea-` prefix in EA4 profiles
  - ZC-11135: Add ea-nodejs18 and ea-nodejs20 to additional packages list
  - ZC-11149: Add touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited to readme


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.0-86.cloudlinux.1
changelog:
  - add strong requires for ea-profiles-cloudlinux >= 4:1.0-68.2
  - EA4D-244: Update EOL ea-php versions


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.91-1.cloudlinux
changelog:
  - Bumped Epoch to 1
  - Removed Vendor tag
  - Disabled automatic Provides generation to avoid conflicts with EPEL package


author: Eugene Zamriy <eugene@zamriy.info> - 1.00.27-2
changelog:
  - Disabled automatic Provides / Requires generation to avoid conflicts with EPEL package
  - Removed duplicate BuildRoot definition


author: Rishwanth Yeddula <rish@cpanel.net> - 7.59.0-2
changelog:
  - EA-7382: Update dependency on ea-openssl to require the latest version with versioned symbols.
  - ZC-3626: Re-enable SFTP support via libssh2.


author: Cory McIntire <cory@cpanel.net> - 7.60.0-1
changelog:
  - ZC-3769: Update cURL from 7.59.0 to 7.60.0
  - CVE-2018-1000300 https://curl.haxx.se/docs/adv_2018-82c2.html


author: Rishwanth Yeddula <rish@cpanel.net> - 7.61.0-1
changelog:
  - EA-7654: Update cURL from 7.60.0 to 7.61.0
  - CVE-2018-0500 https://curl.haxx.se/docs/adv_2018-70a2.html


author: Cory McIntire <cory@cpanel.net> - 7.61.1-1
changelog:
  - EA-7819: Update cURL from 7.61.0 to 7.61.1
  - CVE-2018-14618 https://curl.haxx.se/docs/CVE-2018-14618.html
  - Low priority CVE, 32 bit systems only


author: Cory McIntire <cory@cpanel.net> - 7.62.0-1
changelog:
  - EA-7978: Update cURL from 7.61.1 to 7.62.0 for CVEs
    https://curl.haxx.se/docs/CVE-2018-16839.html
    https://curl.haxx.se/docs/CVE-2018-16840.html
    https://curl.haxx.se/docs/CVE-2018-16842.html


author: Cory McIntire <cory@cpanel.net> - 7.64.0-1
changelog:
  - EA-8204: Update cURL from 7.63.0 to 7.64.0
    https://curl.haxx.se/docs/CVE-2018-16890.html
    https://curl.haxx.se/docs/CVE-2019-3822.html
    https://curl.haxx.se/docs/CVE-2019-3823.html


author: Cory McIntire <cory@cpanel.net> - 7.84.0-1
changelog:
  - EA-10790: Update libcurl from v7.83.1 to v7.84.0
  - CVE-2022-32208: FTP-KRB bad message verification
  - CVE-2022-32207: Unpreserved file permissions
  - CVE-2022-32206: HTTP compression denial of service
  - CVE-2022-32205: Set-Cookie denial of service


author: Cory McIntire <cory@cpanel.net> - 7.86.0-1
changelog:
  - EA-11016: Update libcurl from v7.85.0 to v7.86.0
  - CVE-2022-32221: POST following PUT confusion
  - CVE-2022-35260: .netrc parser out-of-bounds access
  - CVE-2022-42915: HTTP proxy double-free
  - CVE-2022-42916: HSTS bypass via IDN


author: Cory McIntire <cory@cpanel.net> - 7.87.0-1
changelog:
  - EA-11118: Update libcurl from v7.86.0 to v7.87.0
  - CVE-2022-43551: Another HSTS bypass via IDN
  - CVE-2022-43552: HTTP Proxy deny use-after-free


author: Cory McIntire <cory@cpanel.net> - 7.88.0-1
changelog:
  - EA-11241: Update libcurl from v7.87.0 to v7.88.0
  - CVE-2023-23916: HTTP multi-header compression denial of service
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23914: HSTS ignored on multiple requests


author: Cory McIntire <cory@cpanel.net> - 8.0.1-1
changelog:
  - EA-11303: Update libcurl from v7.88.1 to v8.0.1
  - CVE-2023-27538: SSH connection too eager reuse still
  - CVE-2023-27537: HSTS double-free
  = CVE-2023-27536: GSS delegation too eager connection re-use
  = CVE-2023-27535: FTP too eager connection reuse
  - CVE-2023-27534: SFTP path ~ resolving discrepancy


author: Cory McIntire <cory@cpanel.net> - 8.4.0-1
changelog:
  - EA-11731: Update libcurl from v8.3.0 to v8.4.0
  - CVE-2023-38545 - SOCKS5 heap buffer overflow
  - CVE-2023-38546 - cookie injection with none file


author: Cory McIntire <cory@cpanel.net> - 8.5.0-1
changelog:
  - EA-11857: Update libcurl from v8.4.0 to v8.5.0
  - CVE-2023-46219 - HSTS long file name clears contents
  - CVE-2023-46218 - cookie mixed case PSL bypass


author: Cory McIntire <cory@cpanel.net> - 8.6.0-1
changelog:
  - EA-11948: Update libcurl from v8.5.0 to v8.6.0
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse


author: Cory McIntire <cory@cpanel.net> - 8.7.1-1
changelog:
  - EA-12051: Update libcurl from v8.6.0 to v8.7.1
  - CVE-2024-2466: TLS certificate check bypass with mbedTLS
  - CVE-2024-2398: HTTP/2 push headers memory-leak
  - CVE-2024-2379: QUIC certificate check bypass with wolfSSL
  - CVE-2024-2004: Usage of disabled protocol


author: Cory McIntire <cory@cpanel.net> - 8.11.0-1
changelog:
  - EA-12523: Update libcurl from v8.10.1 to v8.11.0
  - CVE-2024-9681: HSTS subdomain overwrites parent cache entry


author: Cory McIntire <cory@cpanel.net> - 8.11.1-1
changelog:
  - EA-12607: Update ea-libcurl from v8.11.0 to v8.11.1
  - CVE-2024-11053: netrc and redirect credential leak


author: Cory McIntire <cory.mcintire@webpros.com> - 8.12.0-1
changelog:
  - EA-12678: Update ea-libcurl from v8.11.1 to v8.12.0
  - CVE-2025-0167 / CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  - CVE-2025-0665 / CWE-1341: Multiple Releases of Same Resource or Handle
  - CVE-2025-0725 / CWE-680: Integer Overflow to Buffer Overflow


author: Cory McIntire <cory@cpanel.net> - 8.1.1-1
changelog:
  - EA-11432: Update libcurl from v8.0.1 to v8.1.1
     - CVE-2023-28322: more POST-after-PUT confusion
     - CVE-2023-28321: IDN wildcard match
     - CVE-2023-28320: siglongjmp race condition
     - CVE-2023-28319: UAF in SSH sha256 fingerprint check


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Dan Muey <dan@cpanel.net> - 2.9.7-1
changelog:
  - EA-7043: Update from v2.9.4 to v2.9.7
  - fixed %setup so that we do not need to modify tarball (EA-6094)
  - remove unreferenced 2.9.4-remove-pyverify_fd patch


author: Cory McIntire <cory@cpanel.net> - 1.10-2
changelog:
  - EA-12397: Rolling “ea-libzip” back to “a55dc085a3c6d8ccc95613a7f6acf4589fe405c2”: Version issues in happening in PHP compliations with this update


author: Jack Hayhurst <jakdept@gmail.com> - 1.4.35-4
changelog:
  - Change config install location in spec file to match init files
  - modified from github PR #1, also fixed changelog versions


author: Dan Muey <dan@cpanel.net> - 1.20.0-4
changelog:
  - EA-6638: bump release prefix to make the EA4 one newer than the typo'd-release-prefix in EA4-experimental


author: Cory McIntire <cory@cpanel.net> - 1.57.0-1
changelog:
  - EA-11729: Update ea-nghttp2 from v1.56.0 to v1.57.0
  - CVE-2023-44487 - The HTTP/2 protocol allows a denial of service (server resource consumption)


author: Dan Muey <dan@cpanel.net> - 1.21.4-6
changelog:
  - ZC-9343: Change worker_processes to auto
  - ZC-9343: Allow setting `worker_processes` via /etc/nginx/ea-nginx/settings.json
  - ZC-9343: When writing settings.json make it human readable
  - ZC-7303: Support IP based requests (ZC-9586: only use an IP once)
  - ZC-9384: Use mycpanel.pem if its there


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.5-2
changelog:
  - EA-10283: Only perform regex check for WordPress login for domains that have at least one WordPress site installed


author: Dan Muey <dan@cpanel.net> - 1.21.5-5
changelog:
  - ZC-9700: Do not use predictable cPanel-localhost header
  - ZC-9700: ensure random value is regenerated if missing or older than 30 minutes; ensure users can not see the value
  - EA-10464: Avoid redirect to https for service subdomain DCV validation


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-2
changelog:
  - EA-10503: Update standalone config to ensure 404 for non-existent php files
  - EA-10285: Have 'ea-nginx config --all' update user configs in parallel


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-5
changelog:
  - EA-10493: The server_name directive needs the public/external IP on systems configured to use a NAT


author: Dan Muey <dan@cpanel.net> - 1.21.6-11
changelog:
  - ZC-9698: Proxy robots.txt (and favicon) since it can be dynamic (e.g. wordpress + .htaccess)
  - ZC-9844: Add flag file to use micro caching as the cache defaults


author: Dan Muey <dan@cpanel.net> - 1.21.6-13
changelog:
  - ZC-9931: Ensure that a pre-existing cache.json/settings.json is respected when ea-nginx is installed
  - ZC-9371: enable keepalive support
  - ZC-9939: optimize proxy sub-domain configuration
  - ZC-9952: Allow setting `worker_shutdown_timeout` via /etc/nginx/ea-nginx/settings.json
  - EA-10673: Increase `proxy_headers_hash_bucket_size` to 128 in cpanel-proxy-xt.conf


author: Dan Muey <dan@cpanel.net> - 1.22.0-2
changelog:
  - ZC-9940: Change worker_processes default back to 1
  - ZC-9940: Have worker_shutdown_timeout default to 10 seconds


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-3
changelog:
  - EA-10892: Avoid configuring shared IPs in multiple server blocks when configuring nginx asynchronously


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-4
changelog:
  - EA-10671: Calculate 'server_names_hash_bucket_size' and 'server_names_hash_max_size' at config time
  - EA-10913: Update ea-nginx.conf when adding/updating a config file for a single user


author: Tim Mullin <tim@cpanel.net> - 1.23.2-2
changelog:
  - EA-10999: Update logic to check if service is listening on ports 80 or 443
  - EA-10985: Drop logrotate configuration for domain logs since cpanellogd handles the rotation


author: Tim Mullin <tim@cpanel.net> - 1.23.2-4
changelog:
  - EA-11004: Fix Passenger restart failures after reboot
  - EA-10670: Add better guards against bad userdata to configuration script


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-5
changelog:
  - EA-10769: Allow custom config files to be moved across partitions when ea-nginx is installed
  - EA-11025: If user generated config is detected as bad after configuration, remove the config file to avoid taking all sites down


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-7
changelog:
  - EA-11048: Move '/var/log/nginx' to a backup location during uninstall
  - EA-11069: Increase open files limit for master and worker processes
  - EA-10574: Remove deprecated configure option --with-ipv6
  - EA-10874: Remove fallback logic in scripts::ea_nginx::_get_application_paths()


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-8
changelog:
  - EA-11078: Fix uninitialized value warning for non-user requests when the USER_ID touch file exists
  - EA-11093: Increase nginx buffer when calculating server_names_hash_bucket_size
  - EA-10891: Refactor logging initialization to be its own sub


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.23.3-3
changelog:
  - ZC-10317: Update ngx_http_pipelog_module to v1.0.3
  - ZC-10484: Remove SIGKILL from various nginx files
  - ZC-10517: Address Ubuntu creating addiotional splitlog processes
  - ZC-10593: Close out fd's during reload/shutdown
  - EA-11088: Account for mail subdomains of addon and parked domains when configuring the server_name directive
  - EA-11121: Add ipv6 subdomain to server_name directive when account has an ipv6 address assigned
  - EA-10890: Refactor _render_and_append() to use more data from global config data


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.3-7
changelog:
  - EA-11269: Reduce frequency of nginx restarts during cpanellogd's domain log processing when piped logging is enabled


author: 2023 Danila Vershinin <dvershinin@cloudlinux.com> - 1:1.23.4-2.cloudlinux.1
changelog:
  - AP2NGX-4 updated patch allowing more contexts for a number of NGINX directives
  - AP2NGX-14 added patch that allows customizing root locations in server blocks


author: Travis Holloway <t.holloway@cpanel.net> - 1.24.0-2
changelog:
  - EA-11131: Ensure userdata reflects apache port changes when ea-nginx is removed
  - EA-11132: Ensure '/var/log/nginx.uninstall' does not exist before moving active log files there


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.25.1-1.cloudlinux.1
changelog:
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Cory McIntire <cory@cpanel.net> - 1.25.1-1
changelog:
  - EA-11496: Update ea-nginx from v1.25.0 to v1.25.1
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Dan Muey <dan@cpanel.net> - 1.25.1-4
changelog:
  - ZC-11149: support touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.25.3-1.cloudlinux.1
changelog:
  - AP2NGX-70: Add support of lsapi Virtual Hosts to ea-nginx
  - AP2NGX-77: Fixed invalid number of arguments in the "client_max_body_size" directive


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.25.4-1.cloudlinux.1
changelog:
  - AP2NGX-81: Fix regression issus introduced by AP2NGX-70
  - AP2NGX-81: Correct lsapi_handler value for lsapi virtual hosts
  - AP2NGX-81: Increase timeout during transition from Apache to NGINX to improve reliability


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
  - ZC-11679: Account for circumstance where wwwacct.conf is missing
  - ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
  - EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
  - *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
    Thanks to Nils Bars.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.6
changelog:
  - AP2NGX-221: Reorder redirects to ensure proxy_pass by Apache2Nginx is in effect
  - removed WAFCL patch


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.7
changelog:
  - AP2NGX-226: Include environment variable for extra server identification to PHP scripts
  - AP2NGX-236: Ensure consistent index directive defaults between Apache, PHP-FPM and LSAPI and index_error_code directive


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
  - EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
  - Security: insufficient check in virtual servers handling with TLSv1.3
    SNI allowed to reuse SSL sessions in a different virtual server, to
    bypass client SSL certificates verification (CVE-2025-23419)


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0.2o-2
changelog:
  - EA-7382: Ensure we build shared objects with versioned symbols.
  - Applied patch for CVE-2018-0737: Cache timing vulnerability in RSA Key Generation


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0.2o-3
changelog:
  - EA-7468: Ensure dependency resolution picks /usr/bin/perl instead
    of /bin/perl. This helps downstream users of our RPMs as their
    build environments can be simplified.


author: Cory McIntire <cory@cpanel.net> - 1.0.2q-1
changelog:
  - EA-8030: Update to 1.0.2q
    CVE-2018-5407 Microarchitecture timing vulnerability in ECC scalar multiplication
    CVE-2018-0734 Timing vulnerability in DSA signature generation


author: Cory McIntire <cory@cpanel.net> - 1.1.1j-1
changelog:
  - EA-9590: Update ea-openssl11 from v1.1.1i to v1.1.1j
    Null pointer deref in X509_issuer_and_serial_hash() (CVE-2021-23841)
    Incorrect SSLv2 rollback protection (CVE-2021-23839)
    Integer overflow in CipherUpdate (CVE-2021-23840)


author: Cory McIntire <cory@cpanel.net> - 1.1.1n-1
changelog:
  - EA-10564: Update ea-openssl11 from v1.1.1m to v1.1.1n
  - Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)


author: Cory McIntire <cory@cpanel.net> - 1.1.1p-1
changelog:
  - EA-10773: Update ea-openssl11 from v1.1.1o to v1.1.1p
  - The c_rehash script allows command injection (CVE-2022-2068)


author: Cory McIntire <cory@cpanel.net> - 1.1.1t-1
changelog:
  - EA-11213: Update ea-openssl11 from v1.1.1s to v1.1.1t
  - X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)
  - Timing Oracle in RSA Decryption (CVE-2022-4304)
  - Use-after-free following BIO_new_NDEF (CVE-2023-0215)
  - Double free after calling PEM_read_bio_ex (CVE-2022-4450)


author: Cory McIntire <cory@cpanel.net> - 1.1.1u-1
changelog:
  - EA-11449: Update ea-openssl11 from v1.1.1t to v1.1.1u
      - Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)


author: Cory McIntire <cory@cpanel.net> - 1.1.1v-1
changelog:
  - EA-11578: Update ea-openssl11 from v1.1.1u to v1.1.1v
  	- Fix excessive time spent checking DH q parameter value (CVE-2023-3817)
  	- Fix DH_check() excessive time with over sized modulus (CVE-2023-3446)


author: Cory McIntire <cory@cpanel.net> - 1.1.1w-1
changelog:
  - EA-11665: Update ea-openssl11 from v1.1.1v to v1.1.1w
  	- Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-2.tuxcare.els2
changelog:
  - CVE-2024-0727: properly accounting PKCS12 struct fields to prevent DoS
  - Extend modulus checking for parameters in existed patch for CVE-2023-5678


author: Alexey Berezhok <aberezhok@cloudlinux.com> - 1:0.2.0-1.cloudlinux.2
changelog:
  - Make lsphp empty for backward compatibility
  - Added fix to cPanel's tests. It is incorrect to use local structures uninitialized


author: Edwin Buck <e.buck@cpanel.net> - 0.1.0-1
changelog:
  - EA-5110: Add /usr/local/bin/php targets to php-cli
  - Change /usr/bin/php targets to php-cgi
             Change /usr/bin/php targets to php-cgi


author: Dan Muey <dan@cpanel.net> - 0.2.0-5
changelog:
  - EA-6569: fix `-ea_php NN` handling to set package name
  - EA-6542: Ignore commented out MIME Types
  - EA-6543: ignore .htaccess 'mime type packages' that does not contain '-php'


author: Daniel Muey <dan@cpanel.net> - 1.0.0-1
changelog:
  - ZC-4400: rewrite to make it easier to work with and fix all the bugs
  - ZC-4425: deprecate -ea_php flag


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-3
changelog:
  - EA-6958: Ensure ownership of _licensedir if it is set
  - ZC-3247: Add support for the allowed-php list to WHM’s Feature Lists


author: Rishwanth Yeddula <rish@cpanel.net> - 2007f-11
changelog:
  - EA-7182: Build against ea-openssl to ensure that any IMAP ssl
    calls made via PHP are functional.


author: Cory McIntire <cory@cpanel.net> - 2007f-12
changelog:
  - ZC-3552: Added versioning to ea-openssl requirements.
  - ZC-3552: Linked to shared openssl .so's.
  - ZC-3552: Whitespace clean up.


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.5
changelog:
  - Fix #77973: Uninitialized read in gdImageCreateFromXbm
  - Fix bug #77988 - heap-buffer-overflow on php_jpg_get16


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.8
changelog:
  - Fix bug #77124
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.13
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.16
changelog:
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.18
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.19
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 5.1.6-24.cloudlinux.20
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - Update litespeed to 7.7 version


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.21
changelog:
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.23
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.1.6-24.cloudlinux.26
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - Fix build with ea-brotli-1.0.9


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.1.6-24.cloudlinux.31
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.32
changelog:
  - Fix for hardened PHP
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.33
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.1.6-24.cloudlinux.36
changelog:
  - Fix for hardened PHP
  - CVE-2022-31629: use stack instead of heap, check correct one var
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.1.6-24.cloudlinux.39
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.16
changelog:
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.20
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.23
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.26
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.27
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.29
changelog:
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.2.17-27.cloudlinux.41
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-27.cloudlinux.44
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.2.17-27.cloudlinux.46
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.50
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.25
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.3.29-29.cloudlinux.28
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory
  - Fix build with ea-brotli-1.0.9


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-29.cloudlinux.35
changelog:
  - CVE-2021-21703: fix error in php fpm shared memory organization leading to privilage escalation
  - CVE-2021-21707: fix handling of paths with percent encoded NULL byte


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-29.cloudlinux.40
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-29.cloudlinux.50
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.51
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Remi Collet <rcollet@redhat.com> 1.1-4
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php54.7 man page #1061454
  - add scldevel subpackage #1063356


author: Cory McIntire <cory@cpanel.net> - 1.10.13-1
changelog:
  - EA-11201: Update PEAR and its dependencies
  - Update PEAR from 1.10.12 to 1.10.13
  - Update Archive_Tar from 1.4.9 to 1.4.14
  - Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949)
  - Symlink out-of-path write vulnerability (CVE-2020-36193)
  - Properly fix symbolic link path traversal (CVE-2021-32610)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.10.16-3
changelog:
  - ZC-12614: Rolling “ea-scl-php-pear” back to “9bf382bf95619afb4023c729d76a50e1d98ac429”: merged accidentally


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.4.45-10
changelog:
  - Added imap extension for all CentOS versions.  It now depends on
    our internal SCL libc-client package.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.4.45-11
changelog:
  - mod_php adjusted to conflict with other mod_php versions, and
    not itself.  this lets the user reinstall the package without
    conflict. (ZC-1459)


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.4.45-76.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: S. Kurt Newman <kurt.newman@cpanel.net> - 4.7.5-5
changelog:
  - Added scl_package_override macro to regain access to global
    PHP macros that contain location and verison information.


author: Dan Muey <dan@cpanel.net> - 3.3-7
changelog:
  - EA-5028 via EA-5900: reinstate opcache conflict
  - (the obsoletes is problematic and there is a
  -   proper way to address the problem it was intended to solve)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-62.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-22.cloudlinux.6
changelog:
  - Add MySQL 8 charset's support
  - Backport native api for MySQL 8 compatibility
  - Fix tests charsets processing


author: Tim Mullin <tim@cpanel.net> - 7.0.33-26
changelog:
  - EA-11821: Patch to build with the latest ea-libxml2
  - ZC-10950: Add debug_package nil back w/ second directive (3rd item will be ZC-10951)
  - ZC-10936: Clean up Makefile and remove debug-package-nil


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-26.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-26.cloudlinux.6
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Jack Hayhurst <jack@deleteos.com> - 0.2
changelog:
  - added ea-php71-php-memcahe branched off of php54

  - Fixed package name, entire RPM is now working.


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.33-2.cloudlinux.1
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Fixed bug #78863 (DirectoryIterator class silently truncates after a nullbyte). (CVE-2019-11045)
  - Fixed bug #78862 (link() silently truncates after a null byte on Windows). (CVE-2019-11044)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.33-4.cloudlinux.2
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar` (CVE-2020-7060)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)
  - Fix bug #79091: heap use-after-free in session_create_id()
  - Fix bug #79221: Null Pointer Dereference in PHP Session Upload Progress (CVE-2020-7062)


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.33-4.cloudlinux.3
changelog:
  - Fix bug #77569: Write Access Violation in DomImplementation
  - Fix bug #79078: Hypothetical use-after-free in curl_multi_add_handle
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.2.32-2.cloudlinux.1
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached


author: Daniil Leonov <dleonov@cloudlinux.com> - 7.2.34-3.cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77423: FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked
  - Fix Bug #80411: References to null-serialized object break serialize()


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.4
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-9.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74267: fix segfault with streams and invalid datas
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.5-1.cloudlinux.1
changelog:
  - Apply mod_lsapi_mode patch
  - Update userini_homedir.patch, log.patch, use_reject.patch to latest versions


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


author: Cory McIntire <cory@cpanel.net> - 0.5.0-3
changelog:
  - ZC-5409: Rolling “scl-snuffleupagus” back to “63cd813641f9dd7df4ad40df37c66af353df6378”
  - Testing EA4-tool rollback procedures


author: Tim Mullin <tim@cpanel.net> - 0.5.0-5
changelog:
  - EA-8865: Add php-cli as a dependency
  - Added autotools-latest-autoconf to build with PHP73 & Cent6


author: Dan Muey <dan@cpanel.net> - 1.0-67
changelog:
  - ZC-11494: Rolling “ea-profiles-cpanel” back to “562229d”: scriptlets seem to be happening out of order on a9


author: Rishwanth Yeddula <rish@cpanel.net> 2.4.1-3
changelog:
  - CPANEL-15622: Update rubygems to 2.6.13 to address:
    CVE-2017-0902
    CVE-2017-0899
    CVE-2017-0900
    CVE-2017-0901


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.5-13
changelog:
  - EA-8124: Ensure that the test certificates are updated prior to test runs
    to avoid failures due to expired certificates.


author: Rishwanth Yeddula <rish@cpanel.net> 2.4.2-5
changelog:
  - PIG-3585: Refactored patches into a git format-patch patchset
    to make maintenance easier.
  - Patch the tests to ensure that multicast tests are skipped
    on systems where multicast is not available.


author: Rishwanth Yeddula <rish@cpanel.net> - 5.1.8-2
changelog:
  - SEC-312: Stop reading the 'REVISION' file. This addresses an
    arbitrary file read vulnerability in passenger.


author: Daniel Muey <dan@cpanel.net> - 5.3.5-3
changelog:
  - ZC-4661: Make nodejs a requirement so that if they get one they get all of them, that way Application Manager has all the bells


author: Daniel Muey <dan@cpanel.net> - 6.0.7-2
changelog:
  - ZC-7655: Provide/Conflict `apache24-passenger`
  - ZC-7897: Add version/package specific template file (and support userdata paths like nginx)


author: Cory McIntire <cory@cpanel.net> - 8.5.94-1
changelog:
  - EA-11728: Update ea-tomcat85 from v8.5.93 to v8.5.94
  - Request smuggling CVE-2023-45648
  - Denial of Service CVE-2023-44487
  - Information Disclosure CVE-2023-42795
  - Denial of Service CVE-2023-42794


author: Daniel Muey <dan@cpanel.net> - 8.5.32-8
changelog:
  - ZC-4142: Change RPM to not run tomcat by default
  - ZC-3874: avoid spurious `cat: /var/run/catalina.pid: No such file or directory`
  - ZC-4081: do not remove tomcat user
  - ZC-4082: change %files so tomcat does not have write access to things it shouldn't


author: Daniel Muey <dan@cpanel.net> - 8.5.32-9
changelog:
  - ZC-4252: Adjust for private instance in jailshell
  - ZC-4198: stop/restart private instances on update/uninstall as appropriate (ZC-4202/ZC-4203)
  - ZC-4198: Make private instance default configuration more secure (ZC-4205)


author: Daniel Muey <dan@cpanel.net> - 8.5.32-10
changelog:
  - ZC-4319: Minor security improvements
  - ZC-4318: do not suppress errors from code run under dropped privileges
  - ZC-4303: do not load external DTDs or external entities in tomcat’s XML files
  - ZC-4299: set umask when doing things as the user for better permissions
  - ZC-4300: remove pointless redirectPort that is in the default setup


author: Daniel Muey <dan@cpanel.net> - 8.5.32-13
changelog:
  - ZC-4427: Fix cosmetic USER issue caused by Cpanel::AccessIds lack of setting ENV
  - Fix stop/restart scriptlet ordering


author: Tim Mullin <tim@cpanel.net> - 8.5.51-2
changelog:
  - EA-8885: Updated our setup script to handle changes to the 8.5.51 server.xml file
  - EA-8886: Set secretRequired to false for the AJP connector


author: Cory McIntire <cory@cpanel.net> - 8.5.88-1
changelog:
  - EA-11369: Update ea-tomcat85 from v8.5.87 to v8.5.88
  - Apache Tomcat denial of service CVE-2023-28709


author: Darren Mobley <darren@cpanel.net> - 0.1-9
changelog:
  - HB-1952: Added support for sending an argument of --pkglist=/path/to/file
    that has a line by line list of each rpm package being handled by the
    current operation to the wildcard scripts


author: Igor Seletsky <iseletsk@cloudlinux.com> 1.1.7-1.1
changelog:
  - Added initial fastestmirror support
  - Added automated attempt to re-register system via clnreg if system is not licensed


