# changelog

author: Pavel Raiskup <praiskup@redhat.com> - 1-2
changelog:
  - oh well, the EPEL7 workaround causes problem now on EPEL7, giving up and not
    trying to observe what really happens


author: Pavel Raiskup <praiskup@redhat.com> - 1-7
changelog:
  - the fix for 'filelist' (#1079203) is not needed, according to
    https://fedorahosted.org/SoftwareCollections/ticket/18


author: Joe Orton <jorton@redhat.com> - 2.2.15-3
changelog:
  - default config tweaks:
   * harden httpd.conf w.r.t. .htaccess restriction (#591293)
   * load mod_substitute, mod_version by default
   * drop proxy_ajp.conf, load mod_proxy_ajp in httpd.conf
   * add commented list of shipped-but-unloaded modules
   * bump up worker defaults a little
   * drop KeepAliveTimeout to 5 secs per upstream
  - fix LSB compliance in init script (#522074)
  - bundle NOTICE in -tools
  - use init script in logrotate postrotate to pick up PIDFILE
  - drop some old Obsoletes/Conflicts


author: Joe Orton <jorton@redhat.com> - 2.2.17-7
changelog:
  - generate dummy mod_ssl cert with CA:FALSE constraint (#667841)
  - add man page stubs for httpd.event, httpd.worker
  - drop distcache support
  - add STOP_TIMEOUT support to init script


author: Joe Orton <jorton@redhat.com> - 2.2.21-6
changelog:
  - complete conversion to systemd, drop init script (#770311)
  - fix comments in /etc/sysconfig/httpd (#771024)
  - enable PrivateTmp in service file (#781440)
  - set LANG=C in /etc/sysconfig/httpd


author: Joe Orton <jorton@redhat.com> - 2.4.1-1
changelog:
  - update to 2.4.1
  - adopt upstream default httpd.conf (almost verbatim)
  - split all LoadModules to conf.modules.d/*.conf
  - include conf.d/*.conf at end of httpd.conf
  - trim %changelog


author: Joe Orton <jorton@redhat.com> - 2.4.1-2
changelog:
  - clean docroot better
  - ship proxy, ssl directories within /var/cache/httpd
  - default config:
   * unrestricted access to (only) /var/www
   * remove (commented) Mutex, MaxRanges, ScriptSock
   * split autoindex config to conf.d/autoindex.conf
  - ship additional example configs in docdir


author: Joe Orton <jorton@redhat.com> - 2.4.1-3
changelog:
  - add mod_proxy_html subpackage (w/mod_proxy_html + mod_xml2enc)
  - move mod_ldap, mod_authnz_ldap to mod_ldap subpackage


author: Joe Orton <jorton@redhat.com> - 2.4.2-4
changelog:
  - pull from upstream:
    * use TLS close_notify alert for dummy_connection (r1326980+)
    * cleanup symbol exports (r1327036+)


author: Joe Orton <jorton@redhat.com> - 2.4.2-15
changelog:
  - move tmpfiles.d fragment into /usr/lib per new guidelines
  - package /run/httpd not /var/run/httpd
  - set runtimedir to /run/httpd likewise


author: Joe Orton <jorton@redhat.com> - 2.4.2-18
changelog:
  - avoid use of "core" GIF for a "core" directory (#168776)
  - drop use of "syslog.target" in systemd unit file


author: Joe Orton <jorton@redhat.com> - 2.4.3-7
changelog:
  - use systemd scriptlets if available (#850149)
  - don't run posttrans restart if /etc/sysconfig/httpd-disable-posttrans exists


author: Joe Orton <jorton@redhat.com> - 2.4.3-13
changelog:
  - filter mod_*.so auto-provides (thanks to rcollet)
  - pull in syslog logging fix from upstream (r1344712)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-5
changelog:
  - execute systemctl reload as result of apachectl graceful
  - mod_ssl: ignore SNI hints unless required by config
  - mod_cache: forward-port CacheMaxExpire "hard" option
  - mod_ssl: fall back on another module's proxy hook if mod_ssl proxy
    is not configured.


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-6
changelog:
  - htpasswd/htdbm: fix hash generation bug (#956344)
  - do not dump vhosts twice in httpd -S output (#928761)
  - mod_cache: fix potential crash caused by uninitialized variable (#954109)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.4-12
changelog:
  - mod_unique_id: replace use of hostname + pid with PRNG output (#976666)
  - apxs: mention -p option in manpage


author: Joe Orton <jorton@redhat.com> - 2.4.6-13
changelog:
  - mod_ssl: sanity-check use of "SSLCompression" (#1036666)
  - mod_proxy_http: fix brigade memory usage (#1040447)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-17
changelog:
  - mod_dav: add security fix for CVE-2013-6438 (#1077907)
  - mod_log_config: add security fix for CVE-2014-0098 (#1077907)


author: Jim Perrin <jperrin@centos.org> - 2.4.6-17.el7.centos.1
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - update welcome.conf with proper aliases
  - change symlink for poweredby.png


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-17.el6.cpanel.1
changelog:
  - Added cPanel-specific patches
  - Removed apache user creation, configured to run as nobody
  - Repaired incorrect run directories


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-20.el6.cpanel.1
changelog:
  - Each module now has its own conf.modules.d file
  - conf.modules.d files are created programmatically
  - Simplified ssl, proxy_html, ldap, and session package file lists


author: Trinity Quirk <trinity.quirk@cpanel.net> - 2.4.6-21.el6.cpanel.1
changelog:
  - Split the MPMs into their own packages
  - mod_heartbeat needs to be loaded after mod_status and mod_watchdog


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.12-10
changelog:
  - Fixed mpm conflicts
  - Removed itk conflict since apache shouldn't be concerned with that..
    only itk should be
  - Removed unused cloudlinux cagefs patch


author: Julian Brown <julian.brown@cpanel.net> - 2.4.16-2
changelog:
  - Added requirements for ea-apache24-mod_proxy and mod_proxy_http
  - so we can support proxy subdomains


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.16-5
changelog:
  - Added /etc/apache2/bin directory for apache-specific utility scripts
  - Added additional macros to /etc/rpm/macros.apache2 so other rpms
    can make use of those paths


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.18-2
changelog:
  - Applied fix for Apache Bug #58854.  This patch should be removed
    once it has made into upstream.


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:2.4.18-2.1.cloudlinux
changelog:
  - httpd2-cagefs_jail.patch and httpd-2.4-suexec-safe.patch applied
  - Epoch bumped to 1
  - dist macro added to Release
  - Dependencies adjusted to use ea-* packages from CloudLinux OS


author: David Nielson <david.nielson@cpanel.net> 2.4.18-3
changelog:
  - Remove conflict on 'webserver' and add conflict on 'httpd-mmn' so
    Nginx can be installed from EPEL.


author: Edwin Buck <e.buck@cpanel.net> - 2.4.23-1
changelog:
  - EA-4872: Updated to verison 2.4.23
  - Added mod_proxy_hcheck (side effect of upstream 2.5 backport into 2.4.23)


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.23-2
changelog:
  - mod_lua can be installed, but is off by default (EA-4825)
  - fixed a few rpmlint warnings complaining about lack of attr macros


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.4.23-7
changelog:
  - Update apachectl with ulimit calls modifying the open file
    descriptor limit so that Apache will start up (EA-5662)


author: Dan Muey <dan@cpanel.net> - 2.4.23-9
changelog:
  - EA-5557: turn off icon directives by default since the icons are broken under symlink protect
  -          and are used by HTMLTable even when fancy indexinf is off


author: Jacob Perkins <jacob.perkins@cpanel.net> - 2.4.29-1
changelog:
  - Updated to version 2.4.29 via update_pkg.pl (ZC-2981)
  - Removed mod_unique_id patch as it was patched upstream.


author: Cory McIntire <cory@cpanel.net> - 2.4.29-2
changelog:
  - EA-6020: Restarting Apache while using splitlogs can result in "Broken pipe" errors
  - Applying patch provided by Gary Stanley (gary@cpanel.net)


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.29-5
changelog:
  - EA-7127: Ensure the mod_proxy_html and mod_xml2enc modules
    build against ea-libxml2. Additionally, updated the build
    process to avoid modifying the LDFLAGS - as it caused the
    libxml2 dependency to be carried to extensions compiled
    separately.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.29-7
changelog:
  - EA-7159: Use 'elinks' instead of 'links' as a dependency
    to ensure that EA4 does not pull any packages from
    the EPEL repos.


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 2.4.33-5.cloudlinux.3
changelog:
  - EA4D-66: Remove %triggerin for ea-apache24-mod_security2 package to avoid apache
    downtime during the update


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 2.4.33-5.cloudlinux.5
changelog:
  - Reverted "EA4D-26: Add patch for extending mod_remoteip to support Host/Port/Protocol mangling natively"


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.33-6
changelog:
  - EA-7468: Ensure dependency resolution picks /usr/bin/perl instead
    of /bin/perl. This helps downstream users of our RPMs as their
    build environments can be simplified.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-2
changelog:
  - EA-7715: Revert mod_ratelimit back to the 2.3.33 version.
    This is to ensure that it emits proper chunks, as there are several
    issues with the 2.3.34 version.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.34-3
changelog:
  - EA-7802: Restore mod_ratelimit back to the 2.3.34 version. Apply
  upstream fixes for it from trunk.


author: Cory McIntire <cory@cpanel.net> - 2.4.35-1
changelog:
  - EA-7871: Update to v2.4.35, drop v2.4.34
    Remove Patch500: 0017-Apply-mod_ratelimit-fix-from-trunk.patch as it
    was implemented upstream.


author: Cory McIntire <cory@cpanel.net> - 2.4.39-1
changelog:
  - EA-8307: Update to 2.4.39, drop 2.4.38
    CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts
    CVE-2019-0196: mod_http2, read-after-free on a string compare
    CVE-2019-0197: mod_http2, possible crash on late upgrade
    CVE-2019-0215: mod_ssl access control bypass
    CVE-2019-0217: mod_auth_digest access control bypass
    CVE-2019-0220: URL normalization inconsistincies


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.39-3
changelog:
  - CPANEL-27056: Fix bug in condition that allowed for non-user files
    to be served in certain situations when SymlinkProtection was
    enabled.


author: Daniel Muey <dan@cpanel.net> - 2.4.41-5
changelog:
  - ZC-4361: bump release prefix past 4 so these will be newest (4 was added and disappeared due to a faulty revert)


author: Cory McIntire <cory@cpanel.net> - 2.4.46-5
changelog:
  - EA-9463: Resolve Apache startup race conditions
             Enable mod_systemd for further startup enhancements


author: Travis Holloway <t.holloway@cpanel.net> - 2.4.49-2
changelog:
  - EA-10123: Patch apache 2.4.49: Correctly decrement active_daemons also in the case that the child process decides on its own to die because of MaxRequestsPerChild.


author: Tim Mullin <tim@cpanel.net> - 2.4.54-1
changelog:
  - EA-10756: Update ea-apache2 from v2.4.53 to v2.4.54
    CVE-2022-26377: mod_proxy_ajp: Possible request smuggling
    CVE-2022-28330: Read beyond bounds in mod_isapi
    CVE-2022-28614: Read beyond bounds via ap_rwrite()
    CVE-2022-28615: Read beyond bounds in ap_strcmp_match()
    CVE-2022-29404: Denial of service in mod_lua r:parsebody
    CVE-2022-30522: mod_sed: Denial of service
    CVE-2022-30556: Information Disclosure in mod_lua with websockets
    CVE-2022-31813: mod_proxy X-Forwarded-For dropped by hop-by-hop mechanism


author: Cory McIntire <cory@cpanel.net> - 2.4.55-1
changelog:
  - EA-11157: Update ea-apache2 from v2.4.54 to v2.4.55
  - CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting
  - CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling
  - CVE-2006-20001: Apache HTTP Server: mod_dav out of  bounds read, or write of zero byte


author: Tim Mullin <tim@cpanel.net> - 2.4.56-1
changelog:
  - EA-11284: Update ea-apache2 from v2.4.55 to v2.4.56
  - CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
  - CVE-2023-25690: HTTP request splitting with mod_rewrite and mod_proxy


author: Cory McIntire <cory@cpanel.net> - 2.4.58-1
changelog:
  - EA-11758: Update ea-apache2 from v2.4.57 to v2.4.58
  	- CVE-2023-31122: mod_macro buffer over-read
  	- CVE-2023-43622: Apache HTTP Server: DoS in HTTP/2 with initial windows size 0
  	- CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST


author: Cory McIntire <cory@cpanel.net> - 2.4.59-1
changelog:
  - EA-12070: Update ea-apache2 from v2.4.58 to v2.4.59
  	- low: Apache HTTP Server: HTTP Response Splitting in multiple modules (CVE-2024-24795)
  	- moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (CVE-2024-27316)
  	- moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)


author: Cory McIntire <cory@cpanel.net> - 2.4.61-1
changelog:
  - EA-12261: Update ea-apache2 from v2.4.59 to v2.4.61
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-39884)
  	- low: Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (CVE-2024-36387)
  	- important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
  	- moderate: Apache HTTP Server proxy encoding problem (CVE-2024-38473)
  	- important: Apache HTTP Server weakness with encoded question marks in backreferences (CVE-2024-38474)
  	- important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)
  	- important: Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (CVE-2024-38476)
  	- important: Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (CVE-2024-38477)
  	- moderate: Apache HTTP Server: mod_rewrite proxy handler substitution (CVE-2024-39573)


author: Cory McIntire <cory@cpanel.net> - 2.4.62-1
changelog:
  - EA-12288: Update ea-apache2 from v2.4.61 to v2.4.62
  	- important: Apache HTTP Server: source code disclosure with handlers configured via AddType (CVE-2024-40725)
  	- important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)


author: Cory McIntire <cory.mcintire@webpros.com> - 2.4.63-1
changelog:
  - EA-12665: Update ea-apache24 from v2.4.62 to v2.4.63
  - Remove Proxy FCGI patch (upstream patched in v2.5.63)


author: Igor Savenko <bliss@cloudlinux.com> 4.0.50-5
changelog:
  - Fixed spec file (added /opt/passenger to %files section)
  - Added pre-creating dir for apache conf files in handle_module.py


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.26-21
changelog:
  - Rebase upon passenger-5.0.26
  - Added support for DirectAdmin
  - More robust alt-mod-passenger installation routine for CPanel servers
  - Deploy pre-built binaries for non CPanel servers
    (thus no custom httpd-devel, alt-mod-passenger depends on)
  - Use pre-built ruby native support library for all CloudLinux alt-ruby versions,
    so that the library is not built on-fly per user app first invokation


author: Oleksiy Shchukin <oshchukin@cloudlinux.com> 5.0.29-22
changelog:
  - Rebase upon passenger-5.0.29
  - Return back to Passenger 4.0 tmp/restart.txt behavour (minimal lag
    between touching app/tmp/restart.txt and app restart)
  - Fixup installation script for non-panel server


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-26
changelog:
  - Support httpd, httpd24 and EA4 apache with same passenger
  - New passenger version 5.0.29
  - Small bug fixes


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.29-27
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs


author: Vladimir Prokofev <vprokofev@cloudlinux.com> - 5.0.29-27.2
changelog:
  - Improve checking of the building passenger native libs.
  - Bug fix usage of have_ functions to build native libs
  - Provides ea-apache24-alt_mod_passenger package name


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-3
changelog:
  - Check configs to migrate from 4.x to 5.x Passenger
  - Restart Passenger (via httpd) to reload fresh liblve


author: Vladimir Prokofev <vprokofev@cloudlinux.com> 5.0.30-4
changelog:
  - Install Passenger into separate version folders
  - Tune simlinks to point to proper Passenger version
  - Fix permissions of PassengerInstanceRegistryDir to 755


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.6-1
changelog:
  - ALMODP-77: Make /var/passenger less worldwide accessible
  - ALMODP-60: Use `PASSENGER_INSTANCE_REGISTRY_DIR` instead `PASSENGER_TEMP_DIR`
  - ALMODP-81: Add conflict for package ea-ruby24-mod_passenger


author: Serhii Kokhan <skokhan@cloudlinux.com> - 5.1.11-1
changelog:
  - ALMODP-91: Arbitrary file read vulnerability in passenger
  - ALMODP-89: Made graceful reload Apache instead of restart when alt-mod-passenger install/update
  - Remove dependency from old package which obsoletes ea-apache24-alt_mod_passenger
  - ALMODP-86: Add Node.js language support for alt-mod-passenger


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-2
changelog:
  - ALMODP-112: disable nodejs handler by default
  - ALMODP-111: allow PassengerFriendlyErrorPages PassengerAppEnv passenger directives in htaccess


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Dan Muey <dan@cpanel.net> - 1.0-5
changelog:
  - changed indicator file from conf_dir/ea4_built to /var/cpanel/conf/is_ea4
  - bump version for release


author: Tim Mullin <tim@cpanel.net> 1.0-9
changelog:
  - Stopped autogenerating "requires" for httpd-runtime
  - Invoking restartsrv_http via a script rather than a symlink


author: Dan Muey <dan@cpanel.net> - 1.0-13
changelog:
  - Fixed 060 to not symlink conf dir (specific content already symlinked)
  - consolidated 060's mkdirs and fixed bug w/ error variable


author: Darren Mobley <darren@cpanel.net> 1.0-24
changelog:
  - Renamed 040-restartsrv_httpd.sh to 500-restartsrv_httpd.sh to fix chicken/egg problem during migration


author: Dan Muey <dan@cpanel.net> 1.0-28
changelog:
  - have PHP config hook script account for a zero PHP state: ignore needless object constructor death and remove its files


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.0.42
changelog:
  - Fixed virtual host definition ordering httpd.conf so users
    can override cpanel & whm proxy subdomains (EA-3865)


author: Darren Mobley <darren@cpanel.net> - 1.0-68
changelog:
  - HB-1952: Add posttrans script to clean upand reset to default the PHP
    configurations for users using FPM when the packages are removed.


author: Dan Muey <dan@cpanel.net> - 1.0-86
changelog:
  - EA-5864: Do not call restartsrv_apache_php_fpm on systems that do not have restartsrv_apache_php_fpm


author: J. Nick Koston <nick@cpanel.net> - 1.0-93
changelog:
  - EA-6122: Ensure new style proxy subs are disabled if mod_proxy is not installed or proxy subdomains disabled


author: Dan Muey <dan@cpanel.net> 1.0-98
changelog:
  - EA-6246: ensure modescurity2's secdatadir/users dir cagefs entry (add % to 'lines matching' check)


author: Rishwanth Yeddula <rish@cpanel.net> 1.0-104
changelog:
  - PIG-3244: Set the proper PassengerUser and PassengerGroup per vhost to
    ensure that Passenger runs the applications as the right user.


author: Dan Muey <dan@cpanel.net> - 1.0-120
changelog:
  - EA-6910: move extension directives from php.ini to php.d/02-pecl.ini so it loads after 01-ioncube.ini


author: J. Nick Koston <nick@cpanel.net> - 1.0-122
changelog:
  - EA-6962: Move global rewrite option 'inherit' definition before includes so that Global DCV rewrite isn't overridden by includes.


author: J. Nick Koston <nick@cpanel.net> - 1.0-123
changelog:
  - EA-6986: Add global rewrite exclude to allow DCV when .well-known dirs are behind htaccess based password protection.


author: Cory McIntire <cory@cpanel.net> - 1.0-124
changelog:
  - EA-6668: Update ea4_main.default to handle hostname SSL
  - Update IPs list to only be a wildcard for hostname SSL


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-125
changelog:
  - ZC-3249: Ensure the "default SSL" vhost is properly bound to all of the
    shared IPs on the server. Additionally, fixed up the whitespace oddities
    in the generated vhost.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-133
changelog:
  - EA-7777: Ensure that log entries for the hostname, and the shared IPs are
    logged in the main access_log instead of individual domlogs.


author: Daniel Muey <dan@cpanel.net> - 1.0-157
changelog:
  - ZC-5669: Add undocumented & unsupported touchfile to disable 009-phpconf.pl's user setting validation


author: Daniel Muey <dan@cpanel.net> - 1.0-175
changelog:
  - ZC-9061: Detect and inform admin of non-existent home directory
  - ZC-9058: Have nobody check set primary group to nobody


author: Dan Muey <dan@cpanel.net> - 1.0-178
changelog:
  - ZC-9109: Do ensure-nobody script pre transaction so post transaction script can relay on it being there


author: Dan Muey <daniel.muey@webpros.com> - 1.0-201
changelog:
  - ZC-12882: Re-order traffic log IPs format to match actual use
  - ZC-12882: switch domlogs from `%h` to `%a` to take advantage of real-ip


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.92-1.cloudlinux
changelog:
  - Epoch bumped to 1
  - Removed Vendor tags
  - 491_mod_bw.conf and setbwlimit files added to the sources list


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.4-4
changelog:
  - Change bwlimited.conf to 0644 so that normal users can load modules
    the same as Apache while testing their configuration with 'httpd -t'
  - Also renamed configuration to 490_mod_bwlimited.conf to match the
    naming scheme of our other files.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0-1
changelog:
  - EA-7191: Initial implementation of mod_cpanel:
      * Handle requests to suspended users in apache without requiring
        an include file to be generated on the product side.


author: Rishwanth Yeddula <rish@cpanel.net> - 1.4-1
changelog:
  - EA-7821: Don't strip symbools from the debug package.
  - EA-7822: Handle edge cases where request_rec->filename == NULL.
      * Some modules that hook into the map_to_storage process (eg. mod_pagespeed),
        can alter the request_rec in an unexpected manner, that resulted
        result in a segfault.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.3.9-7
changelog:
  - General cleanup (EA-5395)
  - Cleans up run/mod_fcgid directory when package is uninstalled (EA-5594)
  - Switch to rpm macros


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Ability to provide which handlers to treat as suexec, and which to treat regularly <commit: 37ad6a8d6dafd9486217f60e369c530c17510ac6>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Fixed issue when mod_hostinglimits intercepts request already in lve (when php is done via cgi) <commit: abccd6a8276eefca2e50dcf03cfb0519fe3b6f26>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - add mode -m 644 to spec file and add php-script to modhostinglimits.conf <commit: 6bf688d72a68442b2886926fba8cb19ba6a10fc7>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Added directories/confgis to make sure mod_hostinglimits compiles under directadmin <commit: 242e320b83b167435f2b2dccb7c4d3ca045e3a42>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - fix spec file's string with liblve to lve-devel. liblve - for future releases <commit: fb10d65ba6364b6ce78e70e3decbf8200b8a0be2>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - moved p_cookie to be taken from request_config, making module MPM Worker safe <commit: fdab876e8fb52f0f3a21f9fa836cc411b9d4a392>


author: Igor Seletskiy <iseletsk@piter.seletskiy.com>
changelog:
  - Merge branch 'master' of gitosis@pylesos.interdon.net:mod_hostinglimits <commit: f3b7c8df2280fa81b54c33dc53bf6d46f7cf4caa>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug when p_cookie is not installed process was fall down <commit: 44668ecf8599ee39ab8f21ae632d0e4514f67192>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Add private thread variable p-cookie instead mutex <commit: a3d7f50a59f2f94b463edfdf76f67c4a5235cfd8>


author: Alexey Berezhok <alexey_com@ukr.net>
changelog:
  - Fix bug with User and Group params. I can get it bu using server record <commit: 54be580ac5db55913a32a5cf8fb01981a671ef84>


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-1
changelog:
  - [#Feature 189] AllowedHandlers and DenyHandlers directives regex support is added
    - [#Feature 191] DenyHandlers directive support is added
    - Allow to serve content on LVE re-entry(apache 1.3)


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-1
changelog:
  - Add new spec file 3 rpm in 1 spec file
    - Add fix in *.cmake file for building under H-Sphere 3.1


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-2
changelog:
  - Added support for new LVEErrorCode directive
    - Default LVEErrorCode is changed from 503 to 508, default error 508 page is added in module source
    - Bug fix: checking whether we are already in LVE (errno should be EPERM, not -EALREADY)
    - Bug fix: logging "already in LVE" error in module for Apache 1.3


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-8
changelog:
  - Restored leave hendler                                                                                                                                    
  - Removed request pool data storing                                                                                                                         
  - Disable empty host debugging
  - Added new directive LVESitesDebug                                                                                                                         
  - Re-entry procedure restored                                                                                                                               
  - Optimized leave handler                                                                                                                                   
  - Optimized work with child pools
  - Reset errno on module initializtion
  - Repaired lve available check
  - Added support mod_ruid2                                                                                                                                   
  - Added new derctive LVEUser                                                                                                   
  - Added support of apache-mpm-itk


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-15
changelog:
  - Added support new apr                                                                                                                                     
  - Removed h-sphere support. No more need


author: Alexey Berezhok <alexey_com@ukr.net> 0.8-1
changelog:
  - Added LVERetryAfter: send RetryAfter header
  - Added LVEParseMode: there are three modes of working(CONF, PATH, OWNER)
  - Added LVEPathRegexp: regexp expression for username extracting from path(PATH mode)
  - Added LVEHeaderName: not supported yet
  - Added URL with error description in log


author: Alexey Berezhok <alexey_com@ukr.net> 1.0-5
changelog:
  - Added LVEUids debug
  - Fixed bug with mod_userdir + mod_hostinglimits
  - Renew lve api for apache 1.3


author: Stefan Mortensen <stefan.mortensen@atomia.com>, Mikhail Zhbankov <mzhbankov@cloudlinux.com> 1.0-26
changelog:
  - Fixed issue where cfg->path_regex was never being set when setting a custom path with LVEPathRegexp causing the default to always be used
  - AAP-57: mod_hostinglimits not increases EP in cgi mode (but process is in LVE)


author: Eugen Vodilov <evodilov@cloudlinux.com> - 1.0-30
changelog:
  - AAP-142: avoid lve_leave using filters
  - AAP-151: add EP limit hiting when EP is reached max value


author: Alexey Berezhok <alexey_com@ukr.net> 0.7-8
changelog:
  - Restored leave hendler
  - Removed request pool data storing
  - Disable empty host debugging
  - Added new directive LVESitesDebug
  - Re-entry procedure restored
  - Optimized leave handler
  - Optimized work with child pools
  - Reset errno on module initializtion
  - Repaired lve available check
  - Added support mod_ruid2
  - Added new derctive LVEUser
  - Added support of apache-mpm-itk


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.0-37.1
changelog:
  - AAP-273: expand the range of LVEErrorCodes
  - AAP-253: spec and cmake redesigned for new httpd24 build
  - AAP-241: Update Copyright for mod_hostinglimits project
  - AAP-244: Fix cmakefiles for httpd24-mod_hostinglimits


author: Anton Volkov <avolkov@cloudlinux.com> 0.7-1
changelog:
  - Add new CMakeList and *.cmake files for RPM building
    - [#Feature 189] AllowedHandlers and DenyHandlers directives regex support is added
    - [#Feature 191] DenyHandlers directive support is added
    - Allow to serve content on LVE re-entry(apache 1.3)


author: Aleksandr Demeshko <ademeshko@cloudlinux.com> Nikolay Petukhov <npetukhvov@cloulinux.com> - 1.0-40
changelog:
  - AAP-510: log level changed to WARN for limited requests
  - AAP-493: Improved log output
  - AAP-508: Allowed AllowedHandlers and DenyHandlers directives inside Directory, Location and Files contexts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-15
changelog:
  - suPHP_UserGroup processing
  - fixed cPanel's install script
  - extended debug_enabled mode fix
  - LVE entering removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-17
changelog:
  - Server config merging
  - Default value of lsapi_pgrp_max_idle is changed
  - Handler to Backend dir is moved into the library


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-39
changelog:
  - Added secret file installation
  - Fixed hook for patching cPanel templates
  - sulsphp signs
  - sulsphp parent check


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-42
changelog:
  - Using Apache or apr random function instead of /dev/random
  - Processing internal redirects
  - Spec fixes
  - Fixed installation scripts


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-51
changelog:
  - Error 404 in the case of script absense
  - Script owner and permission checks
  - Full support for lsapi_phprc


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-53
changelog:
  - Added lsapi_target_perm config parameter
  - Fixed NULL server-var bug
  - Logging backend fatal error log
  - Fixed DA directory name


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-54
changelog:
  - Added lsapi_uid_gid config parameter
  - Added lsapi_use_default_uid config parameter
  - uid/gid params moved to dir config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-58
changelog:
  - Hook removed
  - Defaults for lsapi_backend_connect_timeout and lsapi_backend_connect_tries changed
  - lsapi_user_group added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-68
changelog:
  - Timeout for backend poll added
  - Backend poll redesign
  - PHP ENV modify_type fix
  - lsapi_hostname_on_debug parameter added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-69
changelog:
  - Delayed invoke mode added
  - read/write/poll backend refined
  - Log messages on error conditions added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-71
changelog:
  - TMPDIR, TEMP and TMP added into safe env var list
  - Dump headers always option is added into config
  - Debug data exchange config option added
  - Dealing with REDIRECT_STATUS added (MODLS-11 fix)
  - Fixed DA install script
  - Resending request if lsphp crash or reset connection added (MODLS-12 fix)
  - Send 503 code in the case of lsphp killing (MODLS-13 fix)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-77
changelog:
  - lsapi_mutex_mech option added
  - send_data simplified
  - cagefs mp fix
  - audit fixes
  - 401 redirect fix
  - 503 response when lsphp is killed
  - REDIRECT_STATUS fix
  - TMPDIR, TEMP and TMP added into safe env var list


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-84
changelog:
  - RPM spec fix
  - Added mod_lsapi rebuild into after_apache_make_install hook
  - 302 Moved Temporarily instead of 302 Found
  - Chrome 302 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-90
changelog:
  - lsapi_do_request redesign
  - lsphp response code used
  - PHP error pages displayed
  - Fatal error log processed correctly
  - Fix 500 Internal server error on 200 Ok page


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-91
changelog:
  - lsapi_backend_children changed to 80
  - Starter pid log output added
  - sulsphp_log location for DA changed
  - selfstarter mode always enabled
  - Log request_rec on send_request error
  - Some advices to error log added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.1-98
changelog:
  - Default value for lsapi_use_default_uid changed to On
  - nobody and apache added as exception to sulsphp


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-1
changelog:
  - Add disabling php_* directives processing
  - sulsphp moved into library
  - ACCEPT_NOTIFY mode implemented
  - Deprecated methods removed
  - Connection pool mode implemented
  - lsapi_backend_max_idle and lsapi_backend_max_reqs parameters added
  - Default lsapi_socket_path changed
  - Added build lsphp with custom php sources location
  - Added hook for autobuild lsphp on easyapach rebuild
  - Creation of subdirectories for socket dir added
  - Fix for custom path lsphp build
  - Old mod_lsapi src.rpm generated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-4
changelog:
  - use_suexec option implemented
  - lsapi_check_document_root option implemented
  - Fix mod_lsapi release number in rpm spec
  - Fix path of php source detection on cPanel
  - Fixed php.ini for correct php work on cPanel
  - Precise Requires: tags in rpm specs
  - Fix for compilation flags for sulsphp in CMakeLists


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-12
changelog:
  - lsapi_backend_accept_notify related bug fix
  - mod_lsapi archive for OBS mode added
  - EA4 package scripts added
  - X-Accel-Buffering: no header support added
  - gdb and lsof removed from mod_lsapi rpm deps
  - Default value for lsapi_accept_notify option changed to On


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-15
changelog:
  - MODLS61: Server-Sent Events support added
  - lsapi_paranoid option added
  - MODLS21: Auto value for lsapi_phprc option added
  - MODLS62: lsapi_max_connection option implemented


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-16
changelog:
  - Merging with_connection_pool CRIU branch
  - Fix for OBS
  - MODLS70: X-Powered-By related fix
  - secret file size fix
  - TMP and TEMP env vars added into default config


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-17
changelog:
  - backend_accept_notify fix
  - MODLS73: Custom response code support
  - MODLS71: Simpla authorization fix
  - Fixed restore global mod_lsapi after easyapache rebuilding


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-20
changelog:
  - /dev/urandom used to generate secret file
  - Default value for lsapi_backend_children changed to 120
  - Default socket path changed to /var/run/mod_lsapi
  - Creating default socket path on start
  - Coverity issues small fixes
  - Fixes for EA4
  - Add to file /etc/container/php.handler handlers for EA4


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-21
changelog:
  - 'Requires:' tag changed to liblsapi only
  - Added force update after lsphp rebuild
  - MODLS98: /var/run/mod_lsapi directory creation fix
  - MODLS102: TMPDIR var in default config
  - Removed dependency on CageFS
  - MODLS100: cagefs mount point removed
  - MODLS90: lsapi_backend_use_own_log option added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-22
changelog:
  - MODLS-94: Error in case of setup mod_lsapi on CL5 without any panel
  - MODLS-107: REDIRECT_STATUS message supressed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-24
changelog:
  - MODLS-104 lsapi_resend_if_crashed option added
  - MODLS-108: domain name added into lsphp socket name
  - MODLS-109 Fix POST >100K fails when body length is omitted
  - adaptive_mmap() in lscapi_send_request()
  - MODLS-105 lscapi_send_request() refactoring
  - MODLS-106: Fixup for rare backup connection fails


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-26
changelog:
  - MODLS-125: Do not allow to process .php.disabled extensions
  - MODLS-126: switch_mod_lsapi on 7.2 fix


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-27
changelog:
  - MODLS-130: Full info in sulsphp error messages
  - MODLS-132: Fix wrong processing of lsapi.conf by switch_mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-29
changelog:
  - Fixes for switch utility for EA4
  - MODLS-128: switch_lsapi script fix
  - MODLS-153: Add more log info in case of entering jail error
  - MODLS-151: Dependencies from older alt-php packages removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-32
changelog:
  - Fix in script for CL 7.2 version
  - MODLS-155: default value of mutex mechamism changed to posixmem
  - MODLS-156: LSAPIPath option support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 0.3-33
changelog:
  - MODLS-169: Don't flood /tmp with send_request() buf artifacts
  - MODLS-170: Config option for alternate tmp directory
  - lscapi_reset_internal_error_state definition moved to lscapi.h


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-9
changelog:
  - MODLS-231: Fix HTTPOXY vulnerability
  - MODLS-232: Removing of mod_ruid2 configs added to EA3 rebuilding hook
  - MODLS-230: connection pool mode switched to on by default
  - poll mask changed in lscapi_is_socket_closed


author: Alexey Berezhok <aberezhok@cloudlinux.com> 1.0-10
changelog:
  - MODLS-227: Errors during execute cloudlinux_ea3_to_ea4 with --mod_lsapi 
  - MODLS-226: Lsapi script should have verifying of cagefs install


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-11
changelog:
  - MODLS-234: Fix switch_mod_lsapi for PLESK systems
  - AAP-104: Improve communication between mod_lsapi worker and starter


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-12
changelog:
  - MODLS-240: event mask for poll in waiting output from lsphp changed
  - AAP-110: unnecessary restart of Apache during EA3 build removed
  - MODLS-238: LVE_NO_MAXENTER flag added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-15
changelog:
  - MODLS-252: replacement of native php avoided
  - Filtering of HTTP_AUTHORIZATION and HTTP_PROXY_AUTHORIZATION removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-16
changelog:
  - connection pool mode switched to off by default
  - MODLS-256: fixing of broken lsapi.conf on EA4 added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-17
changelog:
  - MODLS-248: logrotate config for sulsphp_log added
  - MODLS-257: Scriptlet automation --setup and --uninstall added for EA4
  - MODLS-259: Possibility to set PHPRC via SetEnv added
  - MODLS-260: Fix switch_mod_lsapi for CL5


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-18
changelog:
  - MODLS-254: Fix lsphp path in /etc/container/php.handler added
  - MODLS-262: lsapi_per_user option added
  - AAP-106: Fix to standard behavour of PHPRC on EA4 php added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-19
changelog:
  - MODLS-272: Possibility to pass env vars to safe env added
  - MODLS-271: correct /usr/local/bin/lsphp symlink on PLESK
  - MODLS-266: Config option management fixed
  - MODLS-268: rewriting of lsapi config file on EA4 fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-21
changelog:
  - MODLS-261: Dependency from alt-php56 removed from EA4 mod_lsapi rpm
  - MODLS-249: Fix for full logging of backend messages
  - MODLS-276: switch_mod_lsapi bug fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-22
changelog:
  - MODLS-281: Fix crashing Apache on DA servers
  - MODLS-274: user.ini support added to mod_lsapi-1.0
  - MODLS-277: Make sulsphp work with 500+ users in group
  - MODLS-279: mod_lsapi gets disabled after some time post enabling (fcgid mod, cpanel)
  - MODLS-273: Maximum path length for PHPRC increased


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.0-24
changelog:
  - Fix work in backend_accept_notify Off mode with multiple logs from backend
  - MODLS-275: check-php command ported to 1.0 branch


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Ruslan Kuprieiev <rkuprieiev@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-2

changelog:
  - MODLS-269: Make lsphp working with PHP versions selected with MultiPHP on EA4 when SuPHP enabled
  - MODLS-308: LSAPI protocol logging added
  - MODLS-333: Drop criu system service and use something similar internally. CRIU as a system service is not recommended for use
  - MODLS-332: Add some way to trigger images cleanup
  - MODLS-331: Change criu images perms to 0600, as existing 0644 might not be secure enough
  - MODLS-330: Hide all debug and extra messages. Activate them only with specific parameter
  - MODLS-229: Make lsphp wait for dump to end, so it can detect when it's restored from images and cleanup its dead children
  - Added librt for CloudLinux 6


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com>, Alexey Berezhok <alexey.berezhok@cloudlinux.com> 1.1-3

changelog:
  - MODLS-344: Plesk 17.0.17 version does not read /usr/local/psa/admin/conf/templates/custom/domain/domainVirtualHost.php.
  - MODLS-311: CL7 only. First start of lsphp after reboot takes a lot of time(about 7 seconds longer than suphp). Try to make so-lib cache before first usage of lsphp
  - MODLS-339: Make global flag for signaling of removing all images for CRIU(it can bee needed when php will be updated)
  - MODLS-345: Add creation of dump on lsphp stopping
  - MODLS-359: Check if /etc/container/php.handler updates properly
  - MODLS-364: mod_lsapi with criu don't create criu imgs in directory which is set by lsapi_criu_imgs_dir_path option


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-4
changelog:
  - MODLS-347: Remove LSCAPI_CRIU_SYNC_FD from the output of lsphp (phpinfo). Because it is service info
  - MODLS-367: Detect when CRIU is stopped and lsapi_criu is On and write message to apache log: Start CRIU. Service is stopped.
  - MODLS-193: Support custom php.ini added
  - MODLS-370: Add to CRIU, creation images for different virtual host under one user
  - MODLS-366: Improper option scopes fixed
  - MODLS-376: Fix PHP Selector on Plesk + mod_lsapi
  - MODLS-339: Added description of lsapi_reset_criu_on_apache_restart flag to lsapi.conf file
  - MODLS-378: sulsphp_log permissions changed to default Apache ones


author: Alexandr Demeshko <ademeshko@cloudlinux.com>, Serhii Kokhan <skokhan@cloudlinux.com> 1.1-5
changelog:
  - MODLS-388: destroy_lve symbol lookup bug fixed
  - MODLS-389: starter lock mechanism changed to fcntl
  - MODLS-384: Conflict with ea-apache24 added to mod_lsapi spec
  - MODLS-379: /usr/selector and ea-php locations for lsphp added into csf rules
  - MODLS-374: Cache of spawn_info_t structure sent on every lsphp starting for domain" into mod_lsapi-1.0.criu


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-9
changelog:
  - MODLS-394: starter mutex switched to PTHREAD mech to avoid deadlocks on MPM Event
  - MODLS-340: Corrected CRIU functions
  - MODLS-405: DocRoot special value is added to lsapi_phprc option


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-10
changelog:
  - MODLS-368: Add mod_lsapi handler to EA4 PHP handlers
  - MODLS-399: Fetch litespeed sources over https for beta
  - MODLS-408: Add PHP71 handler
  - MODLS-391: Buffer temporary file completely before passing it to backend PHP process


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-11
changelog:
  - MODLS-401: Add dynamic tuning of lsapi_backend_children parameter
  - MODLS-410: Priority of php_value from httpd.conf lowered to PERDIR


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-12
changelog:
  - MODLS-419: Make script for switching lsapi from old mechanism(--enable-global, --enable-domain) to new mechanism(lsapi via web-interface of cPanel)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-13
changelog:
  - MODLS-423: php_value htaccess flag value changed
  - MODLS-422: Add ability to disable lsapi while it is enabled globally EA3
  - MODLS-424: uninstall does not work properly


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-14
changelog:
  - MODLS-430: Add lsphp handlers to users Plesk panel correctly
  - MODLS-431: lsapi_output_buffering option added
  - MODLS-414: env var for lsphp log prefix added
  - MODLS-417: Backend log changed to own file on EA4
  - MODLS-368: Removed suphp detection
  - Changed method of suphp detection


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-15
changelog:
  - MODLS-436: Add force option to switch_mod_lsapi --setup
  - MODLS-429: switch_mod_lsapi --build-native-lsphp is not executed randomly after upcp on EA3
  - MODLS-433: New mechanism lsapi and web-interface of cPanel. Proposed by cPanel team


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-16
changelog:
  - MODLS-403: Check for Cloudlinux added to liblsapi
  - MODLS-434: Handler value was dropped after update
  - MODLS-435: Conflict with mpm_itk added to EA4 mod_lsapi
  - MODLS-433: New mechanism lsapi and web-interface of cPanel
  - Added /opt/cloudlinux as safe path
  - Fix httpd24 CL7 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-17
changelog:
  - MODLS-443: Hotfix: add setup-light command for cleaning all garbage in htaccess wich bring by previous versions
  - MODLS-442: Configure uninstall/update mod_lsapi with Plesk panel
  - MODLS-440: looking for user.ini in home dir
  - MODLS-400: DA script changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-20
changelog:
  - MODLS-445: CRIU messaging changed
  - MODLS-456: Added handlers for php 7.2 for cPanel EA4 and Plesk


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-21
changelog:
  - MODLS-452: Fix destroying of starter mutex on worker and event MPMs
  - MODLS-457: PWD var added into safe environment as cwd of backend process
  - MODLS-464: Max size of response header package fixed
  - MODLS-463: Add application/x-httpd-ea-php72___lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp and application/x-httpd-ea-php72-lsphp /opt/cpanel/ea-php72/root/usr/bin/lsphp
  - MODLS-460: Add ability to set lsapi_backend_children manually


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-22
changelog:
  - MODLS-466: lsapi_backend_semtimedwait option switched on by default
  - MODLS-466: lsapi-cache service improved
  - MODLS-466: lsapi-cache service for CL6 implemented
  - MODLS-468: criu messaging changed
  - MODLS-476: Add corresponding to criu messages into sulsphp_log
  - MODLS-475: Cleanup criu images on dump error
  - AAP-189: ea-apache24-mod_suphp-0.7.2-21 package installation flush php handlers to suphp
  - MODLS-470: Reset all criu images on update criu-lve and alt-phpXY


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-23
changelog:
  - MODLS-479: Make correct output of the totBytesRead and bodyLen values
  - MODLS-478: Prefix lsapi errors with timestamps
  - MODLS-472: unlimit core file size when BACKEND_COREDUMP on


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-24
changelog:
  - MODLS-483: Fix premature mutex destroying on MPM Event
  - MODLS-482: Refactor CRIU patch for PHP
  - MODLS-472: unlimit core file size on CL6


author: Serhii Kokhan <skokhan@cloudlinux.com> 1.1-25
changelog:
  - MODLS-494: implement ~/mod_lsapi_reset_me flag for removing all CRUI images for all domains of user
  - dependency from alt-libxml2 removed from ea-apache24-mod_lsapi


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-29
changelog:
  - MODLS-538: Alignment issue fixed
  - MODLS-531: Added check if criu images exist on restore request
  - MODLS-532: lsapi_disable_reject_mode option is added
  - MODLS-528: reopen sulsphp_log to exclude too big FD number for criu
  - MODLS-520: Added new lsapi_avoid_zombies config
  - MODLS-491: Avoid worker's child to accept the connection
  - MODLS-491: Avoid reading/writing stale data from/to the lsphp socket
  - MODLS-527: starter logic is improved
  - MODLS-525: httpd criu dumper permissions changed
  - MODLS-519: Option to disable PWD var added


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-30

changelog:
  - MODLS-551: statistics for Plesk via API only; structure reinvented for EA4
  - MODLS-549: Added dump configs lsapi_criu, lsapi_with_connection_pool, lsapi_per_user
  - MODLS-549: mod_lsapi stat for EA4 (v.1)
  - MODLS-441: http_keep_http200 option added
  - MODLS-533: Hook for Plesk update added
  - MODLS-548: Suppress unrelevant warning messages on Apache restart


changelog:
  - switch_mod_lsapi --stat option added
  - MODLS-560: Installation of mod_lsapi package on DA added

author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Serhii Kokhan <skokhan@cloudlinux.com> 1.1-31


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-32
changelog:
  - MODLS-574: Started logics improvement
  - MODLS-573: add support alt-php7.3 for mod_lsapi (plesk) and ea-apache24-mod_lsapi
  - MODLS-565: lsapi_poll_timeout default-value 300


author:
  Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-33

changelog:
  - MODLS-590: Fixed stack overflow lscapi_do_request
  - MODLS-582: Update Copyright for mod_lsapi project
  - MODLS-589: fix lsapi_terminate_backends_on_exit and lsapi_reset_criu_on_apache_restart directives
  - MODLS-584: semtimedwait improvement
  - MODLS-580: stat support added for DA without mod_lsapi rpm
  - MODLS-481: fix stuck when bodyLen is wrong
  - MODLS-579: Remove LVE support from cpanel mod_lsapi
  - Fix exception in case if there are no liblsapi installed
  - MODLS-576: added absolute path for service util


author:
  Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-34

changelog:
  - MODLS-608: removed non-ascii symbol in copyright
  - MODLS-606: Fix lsapi_poll_timeout functionality
  - MODLS-600: fix mod_lsapi removal sets handler to none
  - MODLS-571: add support for httpd24-mod_lsapi usage statistics
  - MODLS-598: Fix permissions on config files
  - MODLS-587, MODLS-594: selector usage statistics added
  - MODLS-588: cpanel_mod_lsapi: put all of liblsapi's files into /opt/cpanel/ea-liblsapi/


author: Daria Kavchuk <dkavchuk@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-35
changelog:
  - Fixed statistics exceptions flow
  - MODLS-615: ea-apache24-mod_lsapi epoch bumped
  - MODLS-615: liblsapi confilct with ea-liblsapi added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-36
changelog:
  - MODLS-618: liblsapi vs ea-liblsapi conflict fixed
  - MODLS-619: Requires tag added for python related pkgs


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-37
changelog:
  - MODLS-616: Ensure existence of directory for lsapi sockets in /var/run
  - MODLS-621: Add a configuration option (lsapi_use_req_hostname) that controls how virtualhost name is picked
  - AAP-253: spec and cmake files redesigned for new httpd24 build


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-38
changelog:
  - MODLS-577: Log changed for errors produced by http filter
  - AAP-243: Sentry: create a mechanism to save errors from mod_lsapi
  - MODLS-644: added ea-php73 lsapi handler
  - Added troubleshooting link into log for rejected request


author:
  Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-39

changelog:
  - MODLS-638: Clearing of systemd cgroup for lsphp added
  - MODLS-638: MODLS-481 reverted
  - MODLS-641: Build scripts redesigned
  - MODLS-654: CMakeCache deleted on make clean
  - AAP-243: Disable lsapi_sentry by default
  - MODLS-653: DA spec file added
  - MODLS-655: fix unexpected statistics output


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-40
changelog:
  - MODLS-661: Make possibility criu work on CL7h
  - MODLS-638: During graceful restart lsphp process are killed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Rostyslav Tulchii <rtulchii@cloudlinux.com> 1.1-42
changelog:
  - MODLS-679: fixed race condition is dump req info
  - MODLS-674: liblsapi receive response header interface redesigned
  - MODLS-670: ElasticAPM support redesigned
  - MODLS-665: added sulsphp_log logfile location directive
  - MODLS-656: unifying form of errors for sentry


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author:
  Sergey Kozhekin <skozhekin@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-56

changelog:
  - MODLS-806: Dynamic lsapi_set_env added
  - MODLS-859: Added CRIU support to httpd24-mod_lsapi
  - MODLS-851: CL license updated


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-57
changelog:
  - MODLS-878: Custom control panel integration improved for src.rpm
  - MODLS-877: Added support of alt-php81


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Hasan Aliev <haliev@cloudlinux.com> 1.1-60
changelog:
  - MODLS-905: Add possibility to work with switch_mod_lsapi to control panel integration
  - MODLS-916: Trigger scriptlet creates /usr/local/bin/lsphp as symlink


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-62
changelog:
  - MODLS-935: Fixed malformed http response caused by wrong http header
  - MODLS-940: Added oom score adjustment for lsphp processes


author: Nikolay Petukhov <npetukhov@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-63
changelog:
  - MODLS-952: Fixed the bug added when solving MODLS-935
  - CRIU support disabled on CL9 due to MODLS-955


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-64
changelog:
  - MODLS-946: lsapi_backend_use_own_log option context fixed
  - MODLS-956: liblsapi dependency made strict for mod_lsapi packages
  - MODLS-959: HTTP output filter error processing changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-65
changelog:
  - MODLS-963: ea-php82 handler added
  - MODLS-962: DA installation script modified to be called without parameters


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-73
changelog:
  - CLOS-2334: Minor mod_lsapi scripts corrections
  - CLOS-2348: Execute condition changed in switch_mod_lsapi script


author: Cory McIntire <cory@cpanel.net> - 1.14.36.1-1
changelog:
  - EA-9560: Update ea-apache24-mod_pagespeed from vstable to v1.14.36.1
             Remove 32 bit logic and RPM


author: Kees Monshouwer <km|monshouwer_com> 0.9.8-1
changelog:
  - Address reported security bug in chroot mode. Thanks to the
    "cPanel Security Team" for the discovery of this bug.
  - Improve chroot behavior in drop capability mode.


author: Michael Fleming <mfleming+rpm@enlartenment.com> 1.8.7-4
changelog:
  - Add Requires: httpd-mmn to get the appropriate "module magic" version
    (thanks Ville Skytta)
  - Disabled an overly-agressive rule or two..


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.0-1
changelog:
  - New major release - 2.1.0
  - Fix CVE-2007-1359 with a local rule courtesy of Ivan Ristic
  - Addition of core ruleset
  - (Build)Requires libxml2 and pcre added.


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.0-3
changelog:
  - Automagically configure correct library path for libxml2 library.
  - Add LoadModule for mod_unique_id as the logging wants this at runtime


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.1.1-1
changelog:
  - New upstream release
  - Drop ASCIIZ rule (fixed upstream)
  - Re-enable protocol violation/anomalies rules now that REQUEST_FILENAME
    is fixed upstream.


author: Michael Fleming <mfleming+rpm@enlartenment.com> 2.5.6-1
changelog:
  - Update to upstream 2.5.6
  - Remove references to mlogc, it no longer ships in the main tarball.
  - Link correctly vs. libxml2 and lua (bz# 445839)
  - Remove bogus LoadFile directives as they're no longer needed.


author: Michael Fleming <mfleming+rpm@thatfleminggent.com> - 2.5.12-1
changelog:
  - Update to latest upstream release
  - SECURITY: Fix potential rules bypass and denial of service (bz#563576)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-1
changelog:
  - Update to 2.7.1
  - Remove libxml2 build patch (upstreamed)
  - Update spec since upstream moved to github


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-3
changelog:
  - Add some missing directives RHBZ #569360
  - Fix multipart/invalid part ruleset bypass issue (CVE-2012-4528)
    (RHBZ #867424, #867773, #867774)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.1-5
changelog:
  - Use conditional for loading mod_unique_id (rhbz #879264)
  - Fix syntax errors on httpd 2.4.x by using IncludeOptional (rhbz #879264, comment #2)


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.7.3-2
changelog:
  - Fix NULL pointer dereference (DoS, crash) (CVE-2013-2765) (RHBZ #967615)
  - Fix a possible memory leak.


author: Darren Mobley <darren@cpanel.net> - 2.8.0-1
changelog:
  - Changed name of ea-httpd rpm dependancy to ea-apache2-config
  - Fixed previous changelog entry claiming version was updated to 2.9.0


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.9.0-6
changelog:
  - Added explicit lua and xml2 Requires statements (EA-4433)
  - Remove mpm_itk and mod_ruid2 conflicts (EA-4433)
  - Added more comments to explain portions of spec file (EA-4433)
  - Arrest control of modsec2.conf so we can ensure proper Apache logging type (EA-4433)
  - Arrest control of conf.modules.d/800-mod_security2.conf (EA-4433)
  - RPM now creates logs/modsec_audit dir for concurrent logging (EA-4433)
  - Added comments to configuration files to help guide administrator (EA-4433)
  - Use module name, not file name in configuration file (EA-4654)


author: S. Kurt Newman <kurt.newman@cpanel.net> - 2.9.0-12
changelog:
  - Enforce apr-util dependency (EA-5720)
  - Ensure dependent libraries are the same arch type (EA-5720)


author: Jacob Perkins <jacob.perkins@cpanel.net> - 2.9.2-1
changelog:
  - EA-6312: Update ModSec to 2.9.2
  - Removed RuleProcessingFailedExpand patch as it was fixed upstream


author: Tim Mullin <tim@cpanel.net> - 2.9.3-18
changelog:
  - EA-10239: Increase compiler optimization level to help mitigate performance loss from large rulesets


author: Cory McIntire <cory@cpanel.net> - 2.9.7-1
changelog:
  - EA-11134: Update mod_security2 from v2.9.6 to v2.9.7
  - Security impacting issues
      Fix: FILES_TMP_CONTENT may sometimes lack complete content
      [Issue #2857 - gieltje, @airween, @dune73, @martinhsv]


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.8-1
changelog:
  - EA-12853: Update ea-apache24-mod_security2 from v2.9.7 to v2.9.8
  - Remove 2 patches that were added upstream.
  	- 0003-Import-some-memory-leak-fixes-for-Mod-Security-2.9.x.patch
  	- 0004-Allow-Lua-5.4.patch
  - Add new patch for re.c to allow it to build on Ubuntu
  - Add new patch for tests on Ubuntu 20


author: Dan Muey <daniel.muey@webpros.com> - 2.9.9-1
changelog:
  - EA-12885: Update ea-apache24-mod_security2 from v2.9.8 to v2.9.9
  - Possible DoS vulnerability: CVE-2025-47947


author: Dan Muey <daniel.muey@webpros.com> - 2.9.10-1
changelog:
  - ZC-12886: Update ea-apache24-mod_security2 from v2.9.9 to v2.9.10
  - DoS vulnerability: CVE-2025-48866


author: Cory McIntire <cory.mcintire@webpros.com> - 2.9.11-1
changelog:
  - EA-12994: Update ea-apache24-mod_security2 from v2.9.10 to v2.9.11
  - prevent segmentation fault if the XML node is empty: CVE-2025-52891


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.7.2-12.3.cloudlinux
changelog:
  - suphp-0.7.1-cagefs.patch replaced with suphp-0.7.2-cagefs.am.patch
  - Dependencies adjusted to use ea-* packages from CloudLinux OS
  - Epoch bumped to 1
  - Vendor removed
  - dist macro added to Release


author: Tim Mullin <tim@cpanel.net> - 0.7.2-25
changelog:
  - EA-7525: Fixed 0008-Support-phprc_paths-section-in-suphp.conf.patch, targetMode used before initialized


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 0.7.2-25.cloudlinux.1
changelog:
  - EA4D-97: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea- and alt-php


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:0.7.2-30.cloudlinux.1
changelog:
  - EA4D-323: Reverted changes in 0008-Support-phprc_paths-section-in-suphp.conf.patch due to conflict with CL versions of ea-php* and alt-php*


author: Joe Orton <jorton@redhat.com> 0.9.3-7
changelog:
  - use AI_ADDRCONFIG in getaddrinfo() support (#73350)
  - include a working libtool script rather than relying on
   /usr/bin/libtool (#97695)


author: Joe Orton <jorton@redhat.com> 0.9.4-6
changelog:
  - define apr_off_t as int/long/... to prevent it changing
    with _FILE_OFFSET_BITS on 32-bit platforms


author: Joe Orton <jorton@redhat.com> 0.9.4-10
changelog:
  - fix configure check for mmap of /dev/zero
  - just put -D_GNU_SOURCE in CPPFLAGS not _{BSD,SVID,XOPEN}_SOURCE


author: Joe Orton <jorton@redhat.com> 0.9.4-13
changelog:
  - entirely remove 2Gb file size limit from apr_file_copy();
    fixes "svnadmin hotcopy" on repos with >2Gb strings table
  - work around getnameinfo bugs with v4-mapped addresses
  - fix apr_time_exp_get() for dates in 2038 (Philip Martin)


author: Joe Orton <jorton@redhat.com> 0.9.4-14
changelog:
  - enable posixsem and process-shared pthread mutex support, but
    ensure that sysvsem remains the default mechanism


author: Joe Orton <jorton@redhat.com> 0.9.4-15
changelog:
  - add support for setuid/setgid/sticky bits (André Malo)
  - add apr_threadattr_{guardsize,stacksize}_set() (latter by Jeff Trawick)


author: Joe Orton <jorton@redhat.com> 0.9.4-22
changelog:
  - backport fixes from HEAD:
   * correct implementation of nested mutexes
   * support for POSIX semaphores on LP64 platforms


author: Joe Orton <jorton@redhat.com> 0.9.6-5
changelog:
  - add from 0.9.x branch:
   * fix for apr_{uid,gid}_* error handling (r239592)
   * fix for apr_file_ write flushing (r267192)
  - add backport for use of readdir64_r (r265032, r265681, r265684)


author: Joe Orton <jorton@redhat.com> 0.9.6-6
changelog:
  - don't override CFLAGS at build time
  - allow setting TCP_NODELAY and TCP_CORK concurrently
  - use _exit() not exit() in child if exec*() fails (upstream #30913)


author: Joe Orton <jorton@redhat.com> 1.2.2-2
changelog:
  - avoid linking against -lrt
  - don't print -L${libdir} in --libs output
  - don't export -lcrypt/-luuid in .la file


author: Joe Orton <jorton@redhat.com> 1.2.8-6
changelog:
  - merge review (#225253): drop .a archive; drop use of CC/CXX,
    use BuildRequires; drop old Conflicts; URL reference for Source


author: Bojan Smojver <bojan@rexursive.com> 1.2.12-1
changelog:
  - bump up to 1.2.12
  - add dist
  - remove a comment from apr-1.2.7-psprintfpi.patch (applied upstream)


author: Joe Orton <jorton@redhat.com> - 1.4.2-3
changelog:
  - work around alising issue in ring macros (upstream PR 50190)
  - fix buildconf with newer libtool (#670621)


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.5.2-1.1.cloudlinux
changelog:
  - apr-1.4.2.1_cloudlinux_apr.patch was replaced with apr-1.4.2.2.lve.patch
  - Epoch bumped to 1
  - dist macro added to Release


author: Tim Mullin <tim@cpanel.net> - 1.7.2-1
changelog:
  - EA-11198: Update apr from v1.7.0 to v1.7.2
  - CVE-2022-24963
      Integer Overflow or Wraparound vulnerability in apr_encode functions of
      Apache Portable Runtime (APR) allows an attacker to write beyond bounds
      of a buffer.
  - CVE-2021-35940
      Restore fix for out-of-bounds array dereference in apr_time_exp*() functions.
      (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and
      later 1.6.x releases, but was missing in 1.7.0.)


author: Cory McIntire <cory@cpanel.net> - 1.7.5-1
changelog:
  - EA-12350: Update apr from v1.7.4 to v1.7.5
  - SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
       Unexpected lax shared memory permissions (cve.mitre.org)
       Lax permissions set by the Apache Portable Runtime library on
       Unix platforms would allow local users read access to named
       shared memory segments, potentially revealing sensitive
       application data.
       This issue does not affect non-Unix platforms, or builds with
       APR_USE_SHMEM_SHMGET=1 (apr.h)
       Users are recommended to upgrade to APR version 1.7.5, which
       fixes this issue.
       Credits: Thomas Stangner


author: Joe Orton <jorton@redhat.com> 0.9.3-3
changelog:
  - make devel package conflict with old subversion-devel
  - run the less crufty parts of the test suite


author: Joe Orton <jorton@redhat.com> 0.9.3-5
changelog:
  - fix to try linking against -ldb first (#90917)
  - depend on openldap, gdbm, db4, expat appropriately.


author: Joe Orton <jorton@redhat.com> 1.2.8-3
changelog:
  - build DBD drivers as DSOs (w/Bojan Smojver, #192922)
  - split out pgsql driver into -pgsql subpackage


author: Joe Orton <jorton@redhat.com> 1.2.8-9
changelog:
  - add rewrite of expat autoconf code (upstream r493791)
  - fix build for new glibc open()-as-macro
  - split out sqlite subpackage


author: Bojan Smojver <bojan@rexursive.com> 1.2.10-1
changelog:
  - bump up to 1.2.10
  - pick up newly checked in MySQL DBD driver directly from ASF
  - remove dbdopen patch (fixed upstream)
  - remove xmlns patch (fixed upstream)
  - remove autoexpat patch (fixed upstream)


author: Bojan Smojver <bojan@rexursive.com> - 1.2.12-1
changelog:
  - bump up to 1.2.12
  - drop MySQL DBD driver, shipped upstream
  - adjust various patches to apply
  - rework tests in %check (1.2.x got tests from trunk)


author: Bojan Smojver <bojan@rexursive.com> - 1.3.2-3
changelog:
  - revert build dependencies, change from -2 didn't help
  - add apr-util-1.3.2-pgsql.patch (remove pgsql_LIBS during detection)


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.5.2-9.1.cloudlinux
changelog:
  - Epoch bumped to 1
  - dist macro added to Release
  - Dependencies adjusted to use ea-apr from CloudLinux OS


author: Tim Mullin <tim@cpanel.net> - 1.6.3-1
changelog:
  - EA-11199: Update apr-util from v1.6.1 to v1.6.3
  - CVE-2022-25147
      Integer Overflow or Wraparound vulnerability in apr_base64 functions
      of Apache Portable Runtime Utility (APR-util) allows an attacker to
      write beyond bounds of a buffer.


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:1.0-3.1.cloudlinux
changelog:
  - Epoch bumped to 1
  - ea_current_to_profile and ea_install_profile sources added
  - dist macro added to Release


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.0-6
changelog:
  - Added ea_convert_php_ini script (EA-4772)
  - Updated rpm spec file to conform to standard macros
  - Fixed several rpmlint errors


author: Dan Muey <dan@cpanel.net> - 1.0-17
changelog:
  - EA-6344: ea_convert_php_ini fixups: add missing require, allow it to parse suphp conf handlers, add usage comment to package


author: Tim Mullin <tim@cpanel.net> - 1.0-19
changelog:
  - EA-7549: If the php config file is a symlink, and the force option is used, remove the symlink so the file can be written.


author: Daniel Muey <dan@cpanel.net> - 1.0-37
changelog:
  - ZC-7307: Specify default directory index and PHP FPM’s `security_limit_extensions` that so they can be updated without requiring a ULC updated/backport


author: Dan Muey <dan@cpanel.net> - 1.0-48
changelog:
  - ZC-9307: Rolling “ea-cpanel-tools” back to “0a3c415”: ea-apache24-mod-passenger shows up under Apache modules so additional packages was not necessary


author: Dan Muey <dan@cpanel.net> - 1.0-54
changelog:
  - ZC-9758: Add ea-nginx-brotli to additional packages list && do http2-like toggle off recommendations
  - ZC-9759: add `container_based_packages` list to ea4-metainfo.json


author: Julian Brown <julian.brown@cpanel.net> - 1.0-56
changelog:
  - ZC-9849: Add pkg_manifest.json and add target to ea_current_to_profile
  - ZC-9854: Add ea-nginx-njs to additional packages and recommendations.


author: Dan Muey <dan@cpanel.net> - 1.0-57
changelog:
  - ZC-9886: Add meta info to target-os profile && update EA4-production manifest when updating EA4 manifest
  - EA-10600: Add PHP 7.3 to EOL recommendations


author: Dan Muey <dan@cpanel.net> - 1.0-65
changelog:
  - ZC-10447: update manifest for A9 and PHP 8.2, make PHP 8.1 the default for EA4
  - ZC-10581: update ea4 recommendations to match the PHP reality


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.0-71
changelog:
  - ZC-10474: Add ea-nginx-headers-more to `additional_packages`
  - ZC-10320: Add Ubuntu 22 to manifest


author: Dan Muey <dan@cpanel.net> - 1.0-72
changelog:
  - ZC-10955: Update manifest for post reset of OBS flags (Makefile disables only; no manual disables)


author: Dan Muey <dan@cpanel.net> - 1.0-78
changelog:
  - ZC-11033: Add support for packages w/out an `ea-` prefix in EA4 profiles
  - ZC-11135: Add ea-nodejs18 and ea-nodejs20 to additional packages list
  - ZC-11149: Add touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited to readme


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.0-86.cloudlinux.1
changelog:
  - add strong requires for ea-profiles-cloudlinux >= 4:1.0-68.2
  - EA4D-244: Update EOL ea-php versions


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:0.91-1.cloudlinux
changelog:
  - Bumped Epoch to 1
  - Removed Vendor tag
  - Disabled automatic Provides generation to avoid conflicts with EPEL package


author: Eugene Zamriy <eugene@zamriy.info> - 1.00.27-2
changelog:
  - Disabled automatic Provides / Requires generation to avoid conflicts with EPEL package
  - Removed duplicate BuildRoot definition


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.53.1-1.cloudlinux
changelog:
  - Removed unnecessary ea-libcurl and ea-libcurl-devel Provides
  - Removed wrong valgrind and perl* Provides
  - Epoch bumped to 1
  - Vendor tag removed


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.53.1-1.cloudlinux.2
changelog:
  - Disable automatic Requires generation to avoid broken dependencies
  - Added libssh2, openldap, krb5-libs requirements
  - Added krb5-devel build requirement


author: Cory McIntire <cory@cpanel.net> - 7.53.1-2
changelog:
  - Updated the package with changes suggested by @ezamriy (Eugene Zamriy)
  - https://github.com/CpanelInc/libcurl/pull/1
  - Removed unnecessary ea-libcurl and ea-libcurl-devel Provides
  - Removed incorrect valgrind and perl* Provides workaround
  - Disable automatic Requires generation to avoid broken dependencies
  - Disable automatic Provides generation to avoid conflicts with system curl
  - Added libssh2, openldap, krb5-libs requirements
  - Added krb5-devel build requirement


author: Rishwanth Yeddula <rish@cpanel.net> - 7.58.0-2
changelog:
  - EA-7219: Build curl against the ea-nghttp2 that is installed
    in /opt/cpanel/nghttp2 to ensure that http2 can still be utilized.


author: Rishwanth Yeddula <rish@cpanel.net> - 7.58.0-3
changelog:
  - EA-7233: Require the newer version of ea-nghttp2 to ensure that
    the packages are updated as a set.


author: Rishwanth Yeddula <rish@cpanel.net> - 7.58.0-5
changelog:
  - ZC-3552: Ensure curl is linked again ea-openssl, and ea-nghttp2
    Additionally, added support for brotli.
    Added versioning to ea-openssl and nghttp2 requirements for easier
    maintenance.


author: Rishwanth Yeddula <rish@cpanel.net> - 7.59.0-2
changelog:
  - EA-7382: Update dependency on ea-openssl to require the latest version with versioned symbols.
  - ZC-3626: Re-enable SFTP support via libssh2.


author: Cory McIntire <cory@cpanel.net> - 7.60.0-1
changelog:
  - ZC-3769: Update cURL from 7.59.0 to 7.60.0
  - CVE-2018-1000300 https://curl.haxx.se/docs/adv_2018-82c2.html


author: Rishwanth Yeddula <rish@cpanel.net> - 7.61.0-1
changelog:
  - EA-7654: Update cURL from 7.60.0 to 7.61.0
  - CVE-2018-0500 https://curl.haxx.se/docs/adv_2018-70a2.html


author: Cory McIntire <cory@cpanel.net> - 7.61.1-1
changelog:
  - EA-7819: Update cURL from 7.61.0 to 7.61.1
  - CVE-2018-14618 https://curl.haxx.se/docs/CVE-2018-14618.html
  - Low priority CVE, 32 bit systems only


author: Cory McIntire <cory@cpanel.net> - 7.62.0-1
changelog:
  - EA-7978: Update cURL from 7.61.1 to 7.62.0 for CVEs
    https://curl.haxx.se/docs/CVE-2018-16839.html
    https://curl.haxx.se/docs/CVE-2018-16840.html
    https://curl.haxx.se/docs/CVE-2018-16842.html


author: Cory McIntire <cory@cpanel.net> - 7.64.0-1
changelog:
  - EA-8204: Update cURL from 7.63.0 to 7.64.0
    https://curl.haxx.se/docs/CVE-2018-16890.html
    https://curl.haxx.se/docs/CVE-2019-3822.html
    https://curl.haxx.se/docs/CVE-2019-3823.html


author: Cory McIntire <cory@cpanel.net> - 7.84.0-1
changelog:
  - EA-10790: Update libcurl from v7.83.1 to v7.84.0
  - CVE-2022-32208: FTP-KRB bad message verification
  - CVE-2022-32207: Unpreserved file permissions
  - CVE-2022-32206: HTTP compression denial of service
  - CVE-2022-32205: Set-Cookie denial of service


author: Cory McIntire <cory@cpanel.net> - 7.86.0-1
changelog:
  - EA-11016: Update libcurl from v7.85.0 to v7.86.0
  - CVE-2022-32221: POST following PUT confusion
  - CVE-2022-35260: .netrc parser out-of-bounds access
  - CVE-2022-42915: HTTP proxy double-free
  - CVE-2022-42916: HSTS bypass via IDN


author: Cory McIntire <cory@cpanel.net> - 7.87.0-1
changelog:
  - EA-11118: Update libcurl from v7.86.0 to v7.87.0
  - CVE-2022-43551: Another HSTS bypass via IDN
  - CVE-2022-43552: HTTP Proxy deny use-after-free


author: Cory McIntire <cory@cpanel.net> - 7.88.0-1
changelog:
  - EA-11241: Update libcurl from v7.87.0 to v7.88.0
  - CVE-2023-23916: HTTP multi-header compression denial of service
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23914: HSTS ignored on multiple requests


author: Cory McIntire <cory@cpanel.net> - 8.0.1-1
changelog:
  - EA-11303: Update libcurl from v7.88.1 to v8.0.1
  - CVE-2023-27538: SSH connection too eager reuse still
  - CVE-2023-27537: HSTS double-free
  = CVE-2023-27536: GSS delegation too eager connection re-use
  = CVE-2023-27535: FTP too eager connection reuse
  - CVE-2023-27534: SFTP path ~ resolving discrepancy


author: Cory McIntire <cory@cpanel.net> - 8.1.1-1
changelog:
  - EA-11432: Update libcurl from v8.0.1 to v8.1.1
     - CVE-2023-28322: more POST-after-PUT confusion
     - CVE-2023-28321: IDN wildcard match
     - CVE-2023-28320: siglongjmp race condition
     - CVE-2023-28319: UAF in SSH sha256 fingerprint check


author: Cory McIntire <cory@cpanel.net> - 8.4.0-1
changelog:
  - EA-11731: Update libcurl from v8.3.0 to v8.4.0
  - CVE-2023-38545 - SOCKS5 heap buffer overflow
  - CVE-2023-38546 - cookie injection with none file


author: Cory McIntire <cory@cpanel.net> - 8.5.0-1
changelog:
  - EA-11857: Update libcurl from v8.4.0 to v8.5.0
  - CVE-2023-46219 - HSTS long file name clears contents
  - CVE-2023-46218 - cookie mixed case PSL bypass


author: Cory McIntire <cory@cpanel.net> - 8.6.0-1
changelog:
  - EA-11948: Update libcurl from v8.5.0 to v8.6.0
  - CVE-2024-0853: OCSP verification bypass with TLS session reuse


author: Cory McIntire <cory@cpanel.net> - 8.7.1-1
changelog:
  - EA-12051: Update libcurl from v8.6.0 to v8.7.1
  - CVE-2024-2466: TLS certificate check bypass with mbedTLS
  - CVE-2024-2398: HTTP/2 push headers memory-leak
  - CVE-2024-2379: QUIC certificate check bypass with wolfSSL
  - CVE-2024-2004: Usage of disabled protocol


author: Cory McIntire <cory@cpanel.net> - 8.11.0-1
changelog:
  - EA-12523: Update libcurl from v8.10.1 to v8.11.0
  - CVE-2024-9681: HSTS subdomain overwrites parent cache entry


author: Cory McIntire <cory@cpanel.net> - 8.11.1-1
changelog:
  - EA-12607: Update ea-libcurl from v8.11.0 to v8.11.1
  - CVE-2024-11053: netrc and redirect credential leak


author: Cory McIntire <cory.mcintire@webpros.com> - 8.12.0-1
changelog:
  - EA-12678: Update ea-libcurl from v8.11.1 to v8.12.0
  - CVE-2025-0167 / CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  - CVE-2025-0665 / CWE-1341: Multiple Releases of Same Resource or Handle
  - CVE-2025-0725 / CWE-680: Integer Overflow to Buffer Overflow


author: Dan Muey <dan@cpanel.net> - 1.20.0-4
changelog:
  - EA-6638: bump release prefix to make the EA4 one newer than the typo'd-release-prefix in EA4-experimental


author: Cory McIntire <cory@cpanel.net> - 1.57.0-1
changelog:
  - EA-11729: Update ea-nghttp2 from v1.56.0 to v1.57.0
  - CVE-2023-44487 - The HTTP/2 protocol allows a denial of service (server resource consumption)


author: Rex Dieter <rdieter@fedoraproject.org> - 0.99.0-20.20091203
changelog:
  - 20091203 snapshot
  - spec housecleaning
  - Tidy erroniously removes whitespace, causing mangled text (#481350)


author: Daniel Veillard <veillard@redhat.com> 2.6.27-1
changelog:
  - upstream release 2.6.27 see http://xmlsoft.org/news.html
  - very large amount of bug fixes reported upstream


author: Daniel Veillard <veillard@redhat.com> 2.7.0-1.fc10
changelog:
  - upstream release of 2.7.0
  - switch to XML 1.0 5th edition
  - switch to RFC 3986 for URI parsing
  - better entity handling
  - option to remove hardcoded limitations in the parser
  - more testing
  - a new API to allocate entity nodes
  - and lot of fixes and clanups


author: Daniel Veillard <veillard@redhat.com> 2.7.2-1.fc10
changelog:
  - new release 2.7.2
  - Fixes the known problems in 2.7.1
  - increase the set of options when saving documents


author: Daniel Veillard <veillard@redhat.com> - 2.7.3-1
changelog:
  - new release 2.7.3
  - limit default max size of text nodes
  - special parser mode for PHP
  - bug fixes and more compiler checks


author: Daniel Veillard <veillard@redhat.com> - 2.7.4-1
changelog:
  - upstream release 2.7.4
  - symbol versioning of libxml2 shared libs
  - very large number of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.7-1
changelog:
  - Upstream release of 2.7.7
  - fix serious trouble with zlib >= 1.2.4
  - xmllint new option --xpath
  - various HTML parser improvements
  - includes a number of nug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.8-1
changelog:
  - Upstream release of 2.7.8
  - various bug fixes, including potential crashes
  - new non-destructive formatting option
  - date parsing updated to RFC 5646


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-0rc1
changelog:
  - upstream release candidate 1 of 2.9.0
  - introduce a small API change, but ABI compatible, see
    https://mail.gnome.org/archives/xml/2012-August/msg00005.html
    patches for php, gcc/libjava and evolution-data-connector are upstream
    Grab me in cases of problems veillard@redhat.com
  - many bug fixes including security aspects and small improvements


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-1
changelog:
  - upstream release of 2.9.0
  - A few new API entry points
  - More resilient push parser mode
  - A lot of portability improvement
  - Faster XPath evaluation
  - a lot of bug fixes and smaller improvement


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-2
changelog:
  - remaining cleanups from merge bug rhbz#226079
  - do not put the docs in the main package, only in -devel rhbz#864731


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Till Maas <opensource@till.name> - 2.9.2-4
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.9.2-8
changelog:
  - Remove executable permissions from documentation.  Complies with packaging
    guidelines and solves issue of libxml2-python3 package depending on python2


author: Daniel Veillard <veillard@redhat.com> - 2.9.2-1
changelog:
  - upstream release of 2.9.3
  - Fixes for CVE-2015-8035, CVE-2015-7942, CVE-2015-7941, CVE-2015-1819
    CVE-2015-7497, CVE-2015-7498, CVE-2015-5312, CVE-2015-7499, CVE-2015-7500
    and CVE-2015-8242
  - many other bug fixes


author: Kevin Fenzi <kevin@scrye.com> - 2.9.4-1
changelog:
  - Update to 2.9.4.
  - Apply very hacky patch that removes the no longer in python-3.6 PyVerify_fd symbol.


author: Dan Muey <dan@cpanel.net> - 2.9.7-1
changelog:
  - EA-7043: Update from v2.9.4 to v2.9.7
  - fixed %setup so that we do not need to modify tarball (EA-6094)
  - remove unreferenced 2.9.4-remove-pyverify_fd patch


author: Cory McIntire <cory@cpanel.net> - 1.10-2
changelog:
  - EA-12397: Rolling “ea-libzip” back to “a55dc085a3c6d8ccc95613a7f6acf4589fe405c2”: Version issues in happening in PHP compliations with this update


author: Jack Hayhurst <jakdept@gmail.com> - 1.4.35-4
changelog:
  - Change config install location in spec file to match init files
  - modified from github PR #1, also fixed changelog versions


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - spec file cleanup (thanks to Yury V. Zaytsev)
  - log dir permitions fixed
  - logrotate creates new logfiles with nginx owner
  - "upgrade" argument to init-script added (based on fedora one)


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - 1.0.11
  - init script enhancements (thanks to Gena Makhomed)
  - one second sleep during upgrade replaced with 0.1 sec usleep


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - 1.5.12
  - spec cleanup
  - openssl version dependence added
  - upgrade() function in the init script improved
  - warning added when binary upgrade returns non-zero exit code


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - common configure args are now in macros
  - xslt, image-filter and geoip dynamic modules added
  - 1.9.12


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.9.13
  - Added perl and njs dynamic modules
  - Fixed Requires section for dynamic modules on CentOS7/RHEL7


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.3.
  - njs updated to 0.1.0.
  - njs stream dynamic module added to nginx-module-njs package.
  - geoip stream dynamic module added to nginx-module-geoip package.


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.9
  - Extended hardening build flags.
  - Added check-reload target to init script / systemd service.


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.13
  - CentOS7/RHEL7: made upgrade loops/timeouts configurable via
    /etc/sysconfig/nginx.
  - Bumped upgrade defaults to five loops one second each.


author: Dan Muey <dan@cpanel.net> - 1.15.9-2
changelog:
  - ZC-4868: Add cPanel specific configurations
  - ZC-4867: start nginx (specfile already stops it if needed)
  -          fix hard coded `nginx` user in log ownership
  -          Add `Provides` and `Conflicts` for upstream
  - ZC-4867: Move Apache to alternate port and back again
  - ZC-4869: Add support for proxying to apache,
  -          add mailman and DCV (.well-known) proxies
  - ZC-4870/ZC-4871: tie into chkservd and restartsrv system
  - ZC-4897: Account for current apache port settings that are above the root-only range
  - ZC-4898: Do not move apache if it is already configured for nonstandard ports
  - ZC-4869: do `proxy_set_header` for `Host` and `X-Real-IP` anywhere we `proxy_pass`
  - ZC-4869: alias img-sys for mailman images


author: Daniel Muey <dan@cpanel.net> - 1.16.0-2
changelog:
  - ZC-5014: Add cPanel Password Protected Directory support
  - ZC-5151: Add CGI and Server-Parsed support via proxy


author: Daniel Muey <dan@cpanel.net> - 1.17.3-6
changelog:
  - ZC-5574: Ensure ngx_http_pipelog_module processes are cleaned up
  -   Work around https://github.com/pandax381/ngx_http_pipelog_module/issues/7


author: Dan Muey <dan@cpanel.net> - 1.19.1-3
changelog:
  - ZC-6985: fix `undefined status from Cpanel::ServiceManager::Services::Nginx for Server Status`
  -    probably other issues as well


author: Daniel Muey <dan@cpanel.net> - 1.19.3-2
changelog:
  - ZC-7669: Add universal hook to hard restart nginx for any transaction involving any nginc related package


author: Julian Brown <julian.brown@cpanel.net> - 1.19.7-3
changelog:
  - ZC-8436: Hooks for suspend/unsuspend acct, changing ip, and refactor clear-cache for API
  - ZC-8433: handle localhost/127.0.0.1/machines's hostname consistently
  - ZC-8194: Add cloudflare config
  - ZC-8510: do bandwidth notices and exceeding


author: Travis Holloway <t.holloway@cpanel.net> - 1.19.8-5
changelog:
  - EA-9672: Decrease delay to rebuild config when creating new domains
  - EA-9673: Honor proxysubdomains tweak setting when rebuilding config


author: Travis Holloway <t.holloway@cpanel.net> - 1.19.9-1
changelog:
  - EA-9683: Update ea-nginx from v1.19.8 to v1.19.9
  - EA-9682: Create hook to rebuild config for tweak settings changes in WHM


author: Cory McIntire <cory@cpanel.net> - 1.21.0-1
changelog:
  - EA-9798: Update ea-nginx from v1.20.0 to v1.21.0
  - EA-9791: Add alarm to request to determine if a domain is using CloudFlare


author: Travis Holloway <t.holloway@cpanel.net> = 1.21.0-8
changelog:
  - EA-9879: Make timeout on request to determine if a domain is using CloudFlare threadsafe
  - EA-9880: Move Accounts::Modify and Accounts::Remove from rebuild_user action to rebuild_all action


author: Daniel Muey <dan@cpanel.net> - 1.21.0-12
changelog:
  - ZC-9005: Do not hide Upgrade header when proxying websockets under main service subdomains
  - ZC-9018: rebuild all users; reporting any issues at the end
  - ZC-9020: Add cache related methods to adminbin


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.0-15
changelog:
  - EA-9944: Remove noreplace from nginx.conf and ea-nginx.conf
  - EA-9945: Ensure clean '/etc/nginx' directory on new installs


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.0-16
changelog:
  - EA-9946: Add syntax validation check to configuration script
  - EA-9967: Ensure 'modsec_vendor_configs' is left in place on new installs


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.1-5
changelog:
  - EA-9954: Add logic for server_names_hash_max_size and server_names_hash_bucket_size to syntax checker


author: Dan Muey <dan@cpanel.net> - 1.21.3-2
changelog:
  - ZC-9260: Move standalone includes to seperate folder && bring in server includes on reverse proxy and standalone
  - ZC-9261: Allow include to prefix `proxy_cache_key` based on any criteria


author: Dan Muey <dan@cpanel.net> - 1.21.4-6
changelog:
  - ZC-9343: Change worker_processes to auto
  - ZC-9343: Allow setting `worker_processes` via /etc/nginx/ea-nginx/settings.json
  - ZC-9343: When writing settings.json make it human readable
  - ZC-7303: Support IP based requests (ZC-9586: only use an IP once)
  - ZC-9384: Use mycpanel.pem if its there


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.5-2
changelog:
  - EA-10283: Only perform regex check for WordPress login for domains that have at least one WordPress site installed


author: Dan Muey <dan@cpanel.net> - 1.21.5-5
changelog:
  - ZC-9700: Do not use predictable cPanel-localhost header
  - ZC-9700: ensure random value is regenerated if missing or older than 30 minutes; ensure users can not see the value
  - EA-10464: Avoid redirect to https for service subdomain DCV validation


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-2
changelog:
  - EA-10503: Update standalone config to ensure 404 for non-existent php files
  - EA-10285: Have 'ea-nginx config --all' update user configs in parallel


author: Travis Holloway <t.holloway@cpanel.net> - 1.21.6-5
changelog:
  - EA-10493: The server_name directive needs the public/external IP on systems configured to use a NAT


author: Dan Muey <dan@cpanel.net> - 1.21.6-11
changelog:
  - ZC-9698: Proxy robots.txt (and favicon) since it can be dynamic (e.g. wordpress + .htaccess)
  - ZC-9844: Add flag file to use micro caching as the cache defaults


author: Dan Muey <dan@cpanel.net> - 1.21.6-13
changelog:
  - ZC-9931: Ensure that a pre-existing cache.json/settings.json is respected when ea-nginx is installed
  - ZC-9371: enable keepalive support
  - ZC-9939: optimize proxy sub-domain configuration
  - ZC-9952: Allow setting `worker_shutdown_timeout` via /etc/nginx/ea-nginx/settings.json
  - EA-10673: Increase `proxy_headers_hash_bucket_size` to 128 in cpanel-proxy-xt.conf


author: Dan Muey <dan@cpanel.net> - 1.22.0-2
changelog:
  - ZC-9940: Change worker_processes default back to 1
  - ZC-9940: Have worker_shutdown_timeout default to 10 seconds


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-3
changelog:
  - EA-10892: Avoid configuring shared IPs in multiple server blocks when configuring nginx asynchronously


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.1-4
changelog:
  - EA-10671: Calculate 'server_names_hash_bucket_size' and 'server_names_hash_max_size' at config time
  - EA-10913: Update ea-nginx.conf when adding/updating a config file for a single user


author: Tim Mullin <tim@cpanel.net> - 1.23.2-2
changelog:
  - EA-10999: Update logic to check if service is listening on ports 80 or 443
  - EA-10985: Drop logrotate configuration for domain logs since cpanellogd handles the rotation


author: Tim Mullin <tim@cpanel.net> - 1.23.2-4
changelog:
  - EA-11004: Fix Passenger restart failures after reboot
  - EA-10670: Add better guards against bad userdata to configuration script


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-5
changelog:
  - EA-10769: Allow custom config files to be moved across partitions when ea-nginx is installed
  - EA-11025: If user generated config is detected as bad after configuration, remove the config file to avoid taking all sites down


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-7
changelog:
  - EA-11048: Move '/var/log/nginx' to a backup location during uninstall
  - EA-11069: Increase open files limit for master and worker processes
  - EA-10574: Remove deprecated configure option --with-ipv6
  - EA-10874: Remove fallback logic in scripts::ea_nginx::_get_application_paths()


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.2-8
changelog:
  - EA-11078: Fix uninitialized value warning for non-user requests when the USER_ID touch file exists
  - EA-11093: Increase nginx buffer when calculating server_names_hash_bucket_size
  - EA-10891: Refactor logging initialization to be its own sub


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.23.3-3
changelog:
  - ZC-10317: Update ngx_http_pipelog_module to v1.0.3
  - ZC-10484: Remove SIGKILL from various nginx files
  - ZC-10517: Address Ubuntu creating addiotional splitlog processes
  - ZC-10593: Close out fd's during reload/shutdown
  - EA-11088: Account for mail subdomains of addon and parked domains when configuring the server_name directive
  - EA-11121: Add ipv6 subdomain to server_name directive when account has an ipv6 address assigned
  - EA-10890: Refactor _render_and_append() to use more data from global config data


author: Travis Holloway <t.holloway@cpanel.net> - 1.23.3-7
changelog:
  - EA-11269: Reduce frequency of nginx restarts during cpanellogd's domain log processing when piped logging is enabled


author: 2023 Danila Vershinin <dvershinin@cloudlinux.com> - 1:1.23.4-2.cloudlinux.1
changelog:
  - AP2NGX-4 updated patch allowing more contexts for a number of NGINX directives
  - AP2NGX-14 added patch that allows customizing root locations in server blocks


author: Travis Holloway <t.holloway@cpanel.net> - 1.24.0-2
changelog:
  - EA-11131: Ensure userdata reflects apache port changes when ea-nginx is removed
  - EA-11132: Ensure '/var/log/nginx.uninstall' does not exist before moving active log files there


author: Cory McIntire <cory@cpanel.net> - 1.25.1-1
changelog:
  - EA-11496: Update ea-nginx from v1.25.0 to v1.25.1
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Sergey Fokin <sfokin@cloudlinux.com> - 1:1.25.1-1.cloudlinux.1
changelog:
  - EA-11512: Update config script to use new http2 directive instead of deprecated http2 on listen directive


author: Dan Muey <dan@cpanel.net> - 1.25.1-4
changelog:
  - ZC-11149: support touchfile for nginx cpwrap that will ignore memory limits and set it to unlimited


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.25.3-1.cloudlinux.1
changelog:
  - AP2NGX-70: Add support of lsapi Virtual Hosts to ea-nginx
  - AP2NGX-77: Fixed invalid number of arguments in the "client_max_body_size" directive


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.25.4-1.cloudlinux.1
changelog:
  - AP2NGX-81: Fix regression issus introduced by AP2NGX-70
  - AP2NGX-81: Correct lsapi_handler value for lsapi virtual hosts
  - AP2NGX-81: Increase timeout during transition from Apache to NGINX to improve reliability


author: Dan Muey <dan@cpanel.net> - 1.25.4-2
changelog:
  - ZC-11679: Account for circumstance where wwwacct.conf is missing
  - ZC-11680: clear cache after lookup for pre-install /var override


author: Cory McIntire <cory@cpanel.net> - 1.26.2-1
changelog:
  - EA-12337: Update ea-nginx from v1.26.1 to v1.26.2
  - *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347).
    Thanks to Nils Bars.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.6
changelog:
  - AP2NGX-221: Reorder redirects to ensure proxy_pass by Apache2Nginx is in effect
  - removed WAFCL patch


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.2-1.cloudlinux.7
changelog:
  - AP2NGX-226: Include environment variable for extra server identification to PHP scripts
  - AP2NGX-236: Ensure consistent index directive defaults between Apache, PHP-FPM and LSAPI and index_error_code directive


author: Cory McIntire <cory.mcintire@webpros.com> - 1.26.3-1
changelog:
  - EA-12703: Update ea-nginx from v1.26.2 to v1.26.3
  - Security: insufficient check in virtual servers handling with TLSv1.3
    SNI allowed to reuse SSL sessions in a different virtual server, to
    bypass client SSL certificates verification (CVE-2025-23419)


author: Danila Vershinin <dvershinin@cloudlinux.com> - 3:1.26.3-2.cloudlinux.3
changelog:
  - MAXWS-180: Update nginx mod-lsapi configuration directives and set lsapi_check_script off for better performance


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-2.cloudlinux.4
changelog:
  - MAXWS-267: Add autoindex_ignore configuration directive
  - MAXWS-419: Prevent unnecessary reloads and .htaccess conversion for MAx Web Server


author:
  Danila Vershinin <dvershinin@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 3:1.26.3-4.cloudlinux.2

changelog:
  - MAXWS-410: File listing is enabled by MAx Web Server converter by default
  - MAXWS-502: Add support for autoindex_ignore_reset configuration directive


author: Rishwanth Yeddula <rish@cpanel.net> - 1.0.2o-2
changelog:
  - EA-7382: Ensure we build shared objects with versioned symbols.
  - Applied patch for CVE-2018-0737: Cache timing vulnerability in RSA Key Generation


author: Cory McIntire <cory@cpanel.net> - 1.0.2q-1
changelog:
  - EA-8030: Update to 1.0.2q
    CVE-2018-5407 Microarchitecture timing vulnerability in ECC scalar multiplication
    CVE-2018-0734 Timing vulnerability in DSA signature generation


author: Cory McIntire <cory@cpanel.net> - 1.1.1j-1
changelog:
  - EA-9590: Update ea-openssl11 from v1.1.1i to v1.1.1j
    Null pointer deref in X509_issuer_and_serial_hash() (CVE-2021-23841)
    Incorrect SSLv2 rollback protection (CVE-2021-23839)
    Integer overflow in CipherUpdate (CVE-2021-23840)


author: Cory McIntire <cory@cpanel.net> - 1.1.1n-1
changelog:
  - EA-10564: Update ea-openssl11 from v1.1.1m to v1.1.1n
  - Infinite loop in BN_mod_sqrt() reachable when parsing certificates (CVE-2022-0778)


author: Cory McIntire <cory@cpanel.net> - 1.1.1p-1
changelog:
  - EA-10773: Update ea-openssl11 from v1.1.1o to v1.1.1p
  - The c_rehash script allows command injection (CVE-2022-2068)


author: Cory McIntire <cory@cpanel.net> - 1.1.1t-1
changelog:
  - EA-11213: Update ea-openssl11 from v1.1.1s to v1.1.1t
  - X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)
  - Timing Oracle in RSA Decryption (CVE-2022-4304)
  - Use-after-free following BIO_new_NDEF (CVE-2023-0215)
  - Double free after calling PEM_read_bio_ex (CVE-2022-4450)


author: Cory McIntire <cory@cpanel.net> - 1.1.1u-1
changelog:
  - EA-11449: Update ea-openssl11 from v1.1.1t to v1.1.1u
      - Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)


author: Cory McIntire <cory@cpanel.net> - 1.1.1v-1
changelog:
  - EA-11578: Update ea-openssl11 from v1.1.1u to v1.1.1v
  	- Fix excessive time spent checking DH q parameter value (CVE-2023-3817)
  	- Fix DH_check() excessive time with over sized modulus (CVE-2023-3446)


author: Cory McIntire <cory@cpanel.net> - 1.1.1w-1
changelog:
  - EA-11665: Update ea-openssl11 from v1.1.1v to v1.1.1w
  	- Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 1.1.1w-2.tuxcare.els2
changelog:
  - CVE-2024-0727: properly accounting PKCS12 struct fields to prevent DoS
  - Extend modulus checking for parameters in existed patch for CVE-2023-5678


author: Edwin Buck <e.buck@cpanel.net> - 0.1.0-1
changelog:
  - EA-5110: Add /usr/local/bin/php targets to php-cli
             Change /usr/bin/php targets to php-cgi


author: Dan Muey <dan@cpanel.net> - 0.2.0-5
changelog:
  - EA-6569: fix `-ea_php NN` handling to set package name
  - EA-6542: Ignore commented out MIME Types
  - EA-6543: ignore .htaccess 'mime type packages' that does not contain '-php'


author: Daniel Muey <dan@cpanel.net> - 1.0.0-1
changelog:
  - ZC-4400: rewrite to make it easier to work with and fix all the bugs
  - ZC-4425: deprecate -ea_php flag


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-3
changelog:
  - EA-6958: Ensure ownership of _licensedir if it is set
  - ZC-3247: Add support for the allowed-php list to WHM’s Feature Lists


author: Kaj J. Niemi <kajtzu@fi.basen.net> 0:2002e-0.1
changelog:
  - c-client 2002e is based on imap-2002d
  - Build shared version, build logic is copied from FreeBSD net/cclient


author: Joe Orton <jorton@redhat.com> 2002e-3
changelog:
  - install .so with permissions 0755
  - make auth_md5.c functions static to avoid symbol conflicts
  - remove Epoch: 0


author: Kaj J. Niemi <kajtzu@fi.basen.net> 2002e-4
changelog:
  - Use CFLAGS (and RPM_OPT_FLAGS) during the compilation
  - Build the .so through gcc instead of directly calling ld


author: Rex Dieter <rexdieter at sf.net> 2004-0.fdr.1
changelog:
  - imap-2004
  - use mlock, if available.
  - Since libc-client is an attrocious name choice, we'll trump it,
    and provide imap, imap-libs, imap-devel instead (redhat bug #120873)


author: Rex Dieter <rexdieter at sf.net> 1:2004-0.fdr.6.a
changelog:
  - remove Obsoletes/Provides: libc-client (they can, in fact, co-xist)
  - -devel: remove O/P: libc-client-devel -> Conflicts: libc-client-devel


author: Rex Dieter <rexdieter[AT]users.sf.net> 1:2004-0.fdr.9.c
changelog:
  - imap2004c
  - -utils: dmail,mailutil,tmail
  - -libs: include mlock (so it's available for other imap clients, like pine)
  - remove extraneous patches
  - %_sysconfigdir/c-client.cf: use to set MailDir (but don't if upgrading from
    an older version (ie, if folks don't want/expect a change in behavior)


author: Rex Dieter <rexdieter[AT]users.sf.net> 1:2004-0.fdr.11.c1
changelog:
  - change default driver from mbox to mbx
  - comply with RFC 3501 security: Unencrypted plaintext passwords are prohibited


author: Rex Dieter <rexdieter[AT]users.sf.net> 1:2004d-1
changelog:
  - 2004d
  - imap-libs -> lib%{soname}%{version} (ie, libc-client2004d), so we can
    have multiple versions (shared-lib only) installed
  - move mlock to -utils.
  - revert RFC2301, locks out too many folks where SSL is unavailable


author: Rex Dieter <rexdieter[AT]users.sf.net> 2004e-1
changelog:
  - imap-2004e
  - rename: imap -> uw-imap (yay, we get to drop the Epoch)
  - sslcerts=%{_sysconfdir}/pki/tls/certs if exists, else /usr/share/ssl/certs


author: Rex Dieter <rdieter@fedoraproject.org> 2007-2
changelog:
  - Obsoletes: libc-client2006 (#429796)
  - drop libc-client hacks for parallel-installability, fun while it lasted


author: Rex Dieter <rdieter@fedoraproject.org> 2007e-13
changelog:
  - _with_system_libc_client option (el6+)
  - tight deps via %?_isa
  - drop extraneous Requires(post,postun): xinetd


author: Rishwanth Yeddula <rish@cpanel.net> - 2007f-11
changelog:
  - EA-7182: Build against ea-openssl to ensure that any IMAP ssl
    calls made via PHP are functional.


author: Cory McIntire <cory@cpanel.net> - 2007f-12
changelog:
  - ZC-3552: Added versioning to ea-openssl requirements.
  - ZC-3552: Linked to shared openssl .so's.
  - ZC-3552: Whitespace clean up.


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-2
changelog:
  - add HaredenedPHP patches:
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-4
changelog:
  - add HaredenedPHP patches:
  -   Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   Improve check for :memory: pseudo-filename in SQlite (CVE-2012-3365)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - EA-5807: enable php-tidy on rhel 6 and above
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-5
changelog:
  - EA-2422: use ea-libcurl instead of system curl package
  - Disabled automatic Requires generation for curl subpackage


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-10.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php51 symlinks to /usr/bin and /usr/local/bin


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.1.6-11.cloudlinux
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug70436: Use After Free Vulnerability in unserialize()
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.1.6-19.cloudlinux
changelog:
  - ZC-3551: Added versioning to ea-openssl and libcurl requirements.
  - ZC-3475: Update for ea-openssl shared object


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-23.cloudlinux.3
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.2
changelog:
  - Fix bug #77390 (feof might hang on TLS streams in case of fragmented TLS records)
  - Fix #77431 SplFileInfo::__construct() accepts NUL bytes
  - Fixed bug #77494 (Disabling class causes segfault on member access)
  - Fix bug #77540 - Invalid Read on exif_process_SOFn
  - Fix #77546 iptcembed broken function
  - Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
  - Fix bug #77630 - safer rename() procedure
  - LSAPI sem_timedwait synchronization fixed


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.4
changelog:
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77742
  - Fixed bug #77765
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.5
changelog:
  - Fix #77973: Uninitialized read in gdImageCreateFromXbm
  - Fix bug #77988 - heap-buffer-overflow on php_jpg_get16


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.8
changelog:
  - Fix bug #77124
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.13
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.1.6-24.cloudlinux.16
changelog:
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.18
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.19
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned. (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 5.1.6-24.cloudlinux.20
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - Update litespeed to 7.7 version


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.21
changelog:
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.1.6-24.cloudlinux.23
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.1.6-24.cloudlinux.26
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - Fix build with ea-brotli-1.0.9


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.1.6-24.cloudlinux.31
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.32
changelog:
  - Fix for hardened PHP
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.1.6-24.cloudlinux.33
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.1.6-24.cloudlinux.36
changelog:
  - Fix for hardened PHP
  - CVE-2022-31629: use stack instead of heap, check correct one var
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.1.6-24.cloudlinux.39
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.1.6-24.cloudlinux.40
changelog:
  - Security fixes
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-2
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: Fixed bug 71465: PHAR doesn't know about litespeed


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-6
changelog:
  - add HaredenedPHP patches:
  -   bug 73764: Crash while loading hostile phar archive (CVE-2016-10159)
  -   bug 73768: Memory corruption when loading hostile phar (CVE-2016-10160)
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 68447: grapheme_extract take an extra trailing character
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73773: Seg fault when loading hostile phar
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 1:5.2.17-8
changelog:
  - add HaredenedPHP patches:
  -   Improve check for :memory: pseudo-filename in SQlite (CVE-2012-3365)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   Added check that soap.wsdl_cache_dir conforms to open_basedir (CVE-2013-1635)
  -   bug 70350: ZipArchive::extractTo allows for directory traversal when creating directories (CVE-2014-9767)
  -   Disabled external entities loading (CVE-2013-1643, CVE-2013-1824)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - EA-5807: enable php-tidy on rhel 6 and above
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.2.17-14.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php52 symlinks to /usr/bin and /usr/local/bin


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.2.17-19.cloudlinux
changelog:
  - bug 75571: Potential infinite loop in gdImageCreateFromGifCtx
  - bug 74782: Reflected XSS in .phar 404 page


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.2.17-22.cloudlinux
changelog:
  - ZC-3552: Added versioning to ea-openssl and libcurl requirements.
  - ZC-3475: Update for ea-openssl shared object


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-26.cloudlinux.3
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.5
changelog:
  - Fix bug #77390 (feof might hang on TLS streams in case of fragmented TLS records)
  - Fix bug #77396 - Null Pointer Dereference in phar_create_or_parse_filename
  - Fix #77431 SplFileInfo::__construct() accepts NUL bytes
  - Fixed bug #77494 (Disabling class causes segfault on member access)
  - Fix bug #77540 - Invalid Read on exif_process_SOFn
  - Fix #77546 iptcembed broken function
  - Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
  - Fix bug #77586 - phar_tar_writeheaders_int() buffer overflow
  - Fix bug #77630 - safer rename() procedure
  - LSAPI sem_timedwait synchronization fixed


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.10
changelog:
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77742
  - Fixed bug #77765
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.16
changelog:
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.20
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.2.17-27.cloudlinux.23
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.26
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.27
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.2.17-27.cloudlinux.29
changelog:
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 5.2.17-27.cloudlinux.41
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-27.cloudlinux.44
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.2.17-27.cloudlinux.46
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.50
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.52
changelog:
  - Security fixes
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-27.cloudlinux.53
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    Injection


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-27.cloudlinux.54
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-27.cloudlinux.55
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-3
changelog:
  - add HardenedPHP patches:
  -   CVE-2016-7412: Heap overflow in mysqlnd related to BIT fields
  -   CVE-2016-7413: wddx_deserialize use-after-free
  -   CVE-2016-7414: Out of bound when verify signature of zip phar in phar_parse_zipfile
  -   CVE-2016-7416: SEH buffer overflow msgfmt_format_message
  -   CVE-2016-7417: Missing type check when unserializing SplArray
  -   CVE-2016-7418: Out-Of-Bounds Read in php_wddx_push_element of wddx.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-4
changelog:
  - add HardenedPHP patches
  -   security bug 73189: Memcpy negative size parameter php_resolve_path
  -   security bug 73150: missing NULL check in dom_document_save_html
  -   security bug 73284: heap overflow in php_ereg_replace function
  -   security bug 73218: stack-buffer-overflow through "ResourceBundle" methods
  -   security bug 73208: integer overflow in imap_8bit caused heap corruption
  -   security bug 73082: string length overflow in mb_encode_* function
  -   security bug 73174: heap overflow in php_pcre_replace_impl
  -   security bug 73276: crash in openssl_random_pseudo_bytes function
  -   security bug 73275: crash in openssl_encrypt function
  -   security bug 73017: memory corruption in wordwrap function
  -   security bug 73240: Write out of bounds at number_format
  -   security bug 73073: CachingIterator null dereference when convert to string
  -   security bug 73293: NULL pointer dereference in SimpleXMLElement::asXML()
  - Force users on jailshell and noshell to be chrooted when using php-fpm
  - remove Type=notify from ea-php53-php-frm.service file


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-5
changelog:
  - ALTPHP-238: litespeed-php updated to 6.10
  - AL-1865: Back to ea-php "Ensure that php.d is not scanned when PHPRC is set" patch with mod_lsapi mode support


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-6
changelog:
  - add HardenedPHP patches:
  -   security bug 73356: crash in bzcompress function
  -   CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf
  -   security bug 72482: Illegal write/read access caused by gdImageAALine overflow
  -   security bug 72696: imagefilltoborder stackoverflow on truecolor images
  -   security bug 73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
  -   security bug 73144: Use-after-free in ArrayObject Deserialization
  -   security bug 73192: parse_url return wrong hostname
  -   security bug 73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-7
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: Fixed bug 71465: PHAR doesn't know about litespeed
  - Fixed bug 67587: Redirection loop on nginx with FPM


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-10
changelog:
  - add HaredenedPHP patches:
  -   bug 70014: openssl_random_pseudo_bytes() is not cryptographically secure (CVE-2015-8867)
  -   bug 70081: SoapClient info leak / null pointer dereference via multiple type confusions (CVE-2015-8835)
  -   bug 70121: unserialize() could lead to unexpected methods execution / NULL pointer deref (CVE-2015-8876)
  -   bug 70350: ZipArchive::extractTo allows for directory traversal when creating directories (CVE-2014-9767)
  -   bug 71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut (CVE-2016-4073)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess
  - EA-5807: enable php-tidy on rhel 6 and above


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-14.cloudlinux
changelog:
  - add require for ea-libnghttp2
  - EA-6484: Clarify Summary and Description for DSO
  - EA-6232: Build -curl with HTTP/2 support
  - Added ea-php53 symlinks to /usr/bin and /usr/local/bin
  - EA-3685: do not create apache user/group since we use nobody


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-16.cloudlinux
changelog:
  - ALTPHP-364: Added сorrect exit from lve if the nproc limit is reached
  - EA-6574: Make permissions on FPM socket dir more secure


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.3.29-18.cloudlinux
changelog:
  - HB-2873: Added network-online.target to "After" in the service file
  - EA-6819: Patch to support libtidy 5.4.0


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.3.29-19.cloudlinux
changelog:
  - bug 75055 Out-Of-Bounds Read in timelib_meridian()
  - bug 72535 arcfour encryption stream filter crashes php


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.3.29-23.cloudlinux
changelog:
  - HB-3287: Increase open file limit for php-fpm by default
  - Filter libxml2.so from requires
  - HB-3263: Ensure securetmp is done before starting FPM
  - EA-7044: Adjust PHPs to use ea-libxml2
  - HB-3061: Fix epoll bug.


author: Ivan Danilov <idanilov@cloudlinux.com> 5.3.29-23.cloudlinux.3
changelog:
  - ALTPHP-482: Fix for bug 75605 Dumpable FPM child processes allow bypassing opcache access controls


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.2
changelog:
  - Fix bug #51068 (glob:// do not support current path relative)
  - Fix bug #77390 (feof might hang on TLS streams in case of fragmented TLS records)
  - Fix bug #77396 - Null Pointer Dereference in phar_create_or_parse_filename
  - Fix #77431 SplFileInfo::__construct() accepts NUL bytes
  - Fixed bug #77494 (Disabling class causes segfault on member access)
  - Fix bug #77540 - Invalid Read on exif_process_SOFn
  - Fix #77546 iptcembed broken function
  - Fix bug #77563 - Uninitialized read in exif_process_IFD_in_MAKERNOTE
  - Fix bug #77586 - phar_tar_writeheaders_int() buffer overflow
  - Fix bug #77630 - safer rename() procedure
  - LSAPI sem_timedwait synchronization fixed


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.4
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77742
  - Fixed bug #77765
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.5
changelog:
  - Fix bug #77967 - Bypassing open_basedir restrictions via file uris
  - Fix #77973: Uninitialized read in gdImageCreateFromXbm
  - Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
  - Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow
  - AAP-272: fix error with uid comparison


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.9
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.14
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter
  - Fix #78579: mb_decode_numericentity: args number inconsistency
  - Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.15
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Fixed bug #78863 (DirectoryIterator class silently truncates after a nullbyte). (CVE-2019-11045)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.3.29-29.cloudlinux.18
changelog:
  - Fix bug #79078: Hypothetical use-after-free in curl_multi_add_handle
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.21
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79514: Memory leaks while including unexistent file
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.23
changelog:
  - Fix bug #62890: default_socket_timeout=-1 causes connection to timeout
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.3.29-29.cloudlinux.25
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing


author: Eduard Abdullin <eabdullin@cloudlinux.com> - 5.3.29-29.cloudlinux.28
changelog:
  - ALTPHP-1053: Update move_override_ini patch
  - ALTPHP-1038: Update litespeed log patch
  - AAP-178: Added disable killing of PHP-FPM parent process in LVE when not enough of memory
  - Fix build with ea-brotli-1.0.9


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-29.cloudlinux.35
changelog:
  - CVE-2021-21703: fix error in php fpm shared memory organization leading to privilage escalation
  - CVE-2021-21707: fix handling of paths with percent encoded NULL byte


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.3.29-29.cloudlinux.40
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-29.cloudlinux.50
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.51
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-29.cloudlinux.53
changelog:
  - Security fixes
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.54
changelog:
  - Security fixes
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-29.cloudlinux.55
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    injection


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-29.cloudlinux.56
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-29.cloudlinux.57
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Remi Collet <rcollet@redhat.com> 1.1-4
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php54.7 man page #1061454
  - add scldevel subpackage #1063356


author: Cory McIntire <cory@cpanel.net> - 1.10.13-1
changelog:
  - EA-11201: Update PEAR and its dependencies
  - Update PEAR from 1.10.12 to 1.10.13
  - Update Archive_Tar from 1.4.9 to 1.4.14
  - Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949)
  - Symlink out-of-path write vulnerability (CVE-2020-36193)
  - Properly fix symbolic link path traversal (CVE-2021-32610)


author: Cory McIntire <cory.mcintire@webpros.com> - 1.10.16-3
changelog:
  - ZC-12614: Rolling “ea-scl-php-pear” back to “9bf382bf95619afb4023c729d76a50e1d98ac429”: merged accidentally


author: Tom Callaway <tcallawa@redhat.com>
changelog:
  - bump to 5.0.0
  - add patch to prevent clobbering struct re_registers from regex.h
  - remove domxml references, replaced with dom now built-in
  - fix php.ini to refer to php5 not php4


author: Joe Orton <jorton@redhat.com> 5.0.1-1
changelog:
  - update to 5.0.1
  - only build shared modules once
  - put dom extension in php-dom subpackage again
  - move extension modules into %{_libdir}/php/modules
  - don't use --with-regex=system, it's ignored for the apache* SAPIs


author: Joe Orton <jorton@redhat.com> 5.0.2-4
changelog:
  - update to 5.0.2 (#127980)
  - build against mysqlclient10-devel
  - use new RTLD_DEEPBIND to load extension modules
  - drop explicit requirement for elfutils-devel
  - use AddHandler in default conf.d/php.conf (#135664)
  - "fix" round() fudging for recent gcc on x86
  - disable sqlite pending audit of warnings and subpackage split


author: Joe Orton <jorton@redhat.com> 5.0.2-5
changelog:
  - fix phpize installation for lib64 platforms
  - add fix for segfault in variable parsing introduced in 5.0.2


author: Joe Orton <jorton@redhat.com> 5.0.2-7
changelog:
  - truncate changelog at 4.3.1-1
  - merge from 4.3.x package:
   - enable mime_magic extension and Require: file (#130276)


author: Joe Orton <jorton@redhat.com> 5.0.3-1
changelog:
  - update to 5.0.3 (thanks to Robert Scheck et al, #143101)
  - enable xsl extension (#142174)
  - package both the xsl and dom extensions in php-xml
  - enable soap extension, shared (php-soap package) (#142901)
  - add patches from upstream 5.0 branch:
   * Zend_strtod.c compile fixes
   * correct php_sprintf return value usage


author: Joe Orton <jorton@redhat.com> 5.0.3-2
changelog:
  - install the ext/gd headers (#145891)
  - enable pcntl extension in /usr/bin/php (#142903)
  - add libmbfl array arithmetic fix (dcb314@hotmail.com, #143795)
  - add BuildRequire for recent pcre-devel (#147448)


author: Joe Orton <jorton@redhat.com> 5.0.3-4
changelog:
  - package mysqli extension in php-mysql
  - really enable pcntl (#142903)
  - don't build with --enable-safe-mode (#148969)
  - use "Instant Client" libraries for oci8 module (Kai Bolay, #149873)


author: Joe Orton <jorton@redhat.com> 5.0.3-5
changelog:
  - BuildRequire mysql-devel >= 4.1
  - don't mark php.ini as noreplace to make upgrades work (#152171)
  - fix subpackage descriptions (#152628)
  - fix memset(,,0) in Zend (thanks to Dave Jones)
  - fix various compiler warnings in Zend


author: Joe Orton <jorton@redhat.com> 5.0.4-1
changelog:
  - update to 5.0.4 (#153068)
  - add .phps AddType to php.conf (#152973)
  - better gcc4 fix for libxmlrpc


author: Joe Orton <jorton@redhat.com> 5.0.4-4
changelog:
  - bundle from PEAR: HTTP, Mail, XML_Parser, Net_Socket, Net_SMTP
  - snmp: disable MSHUTDOWN function to prevent error_log noise (#153988)
  - mysqli: add fix for crash on x86_64 (Georg Richter, upstream #32282)


author: Joe Orton <jorton@redhat.com> 5.0.4-6
changelog:
  - build /usr/bin/php with the CLI SAPI, and add /usr/bin/php-cgi,
    built with the CGI SAPI (thanks to Edward Rudd, #137704)
  - add php(1) man page for CLI
  - fix more test cases to use -n when invoking php


author: Joe Orton <jorton@redhat.com> 5.0.4-7
changelog:
  - split out dba and bcmath extensions into subpackages
  - BuildRequire gcc-c++ to avoid AC_PROG_CXX{,CPP} failure (#155221)
  - pear: update to DB-1.7.6
  - enable FastCGI support in /usr/bin/php-cgi (#149596)


author: Joe Orton <jorton@redhat.com> 5.0.4-9
changelog:
  - build simplexml_import_dom even with shared dom (#156434)
  - prevent truncation of copied files to ~2Mb (#155916)
  - install /usr/bin/php from CLI build alongside CGI
  - enable sysvmsg extension (#142988)


author: Joe Orton <jorton@redhat.com> 5.0.5-3
changelog:
  - update to 5.0.5
  - add fix for upstream #34435
  - devel: require autoconf, automake (#159283)
  - pear: update to HTTP-1.3.6, Mail-1.1.8, Net_SMTP-1.2.7, XML_RPC-1.4.1
  - fix imagettftext et al (upstream, #161001)


author: Joe Orton <jorton@redhat.com> 5.1.1-2
changelog:
  - update to 5.1.1
  - remove pear subpackage
  - enable pdo extensions (php-pdo subpackage)
  - remove non-standard conditional module builds
  - enable xmlreader extension


author: Joe Orton <jorton@redhat.com> 5.1.2-5
changelog:
  - provide php-api (#183227)
  - add provides for all builtin modules (Tim Jackson, #173804)
  - own %{_libdir}/php/pear for PEAR packages (per #176733)
  - add obsoletes to allow upgrade from FE4 PDO packages (#181863)


author: Joe Orton <jorton@redhat.com> 5.1.4-5
changelog:
  - provide mod_php (#187891)
  - provide php-cli (#192196)
  - use correct LDAP fix (#181518)
  - define _GNU_SOURCE in php_config.h and leave it defined
  - drop (circular) dependency on php-pear


author: Joe Orton <jorton@redhat.com> 5.1.4-8
changelog:
  - Provide php-posix (#194583)
  - only provide php-pcntl from -cli subpackage
  - add missing defattr's (thanks to Matthias Saou)


author: Joe Orton <jorton@redhat.com> 5.2.0-3
changelog:
  - update to 5.2.0 (#213837)
  - php-xml provides php-domxml (#215656)
  - fix php-pdo-abi provide (#214281)


author: Joe Orton <jorton@redhat.com> 5.2.0-4
changelog:
  - provide php-zend-abi (#212804)
  - add /etc/rpm/macros.php exporting interface versions
  - synch with upstream recommended php.ini


author: Joe Orton <jorton@redhat.com> 5.2.0-5
changelog:
  - build json and zip shared, in -common (Remi Collet, #215966)
  - obsolete php-json and php-pecl-zip
  - build readline extension into /usr/bin/php* (#210585)
  - change module subpackages to require php-common not php (#177821)


author: Joe Orton <jorton@redhat.com> 5.2.0-9
changelog:
  - add php(api), php(zend-abi) provides (#221302)
  - package /usr/share/php and append to default include_path (#225434)


author: Joe Orton <jorton@redhat.com> 5.2.0-10
changelog:
  - bump default memory_limit to 32M (#220821)
  - mark config files noreplace again (#174251)
  - drop trailing dots from Summary fields
  - use standard BuildRoot
  - drop libtool15 patch (#226294)


author: Joe Orton <jorton@redhat.com> 5.2.3-3
changelog:
  - add mcrypt, mhash, tidy, mssql subpackages (Dmitry Butskoy)
  - enable dbase extension and package in -common


author: Joe Orton <jorton@redhat.com> 5.2.6-3
changelog:
  - update to 5.2.6
  - sync default php.ini with upstream
  - drop extension_dir from default php.ini, rely on hard-coded
    default, to make php-common multilib-safe (#455091)
  - update to r3 of systzdata patch


author: Joe Orton <jorton@redhat.com> 5.2.6-6
changelog:
  - move gd_README to php-gd
  - update to r4 of systzdata patch; introduces a default timezone
    name of "System/Localtime", which uses /etc/localtime (#469532)


author: Joe Orton <jorton@redhat.com> 5.2.8-4
changelog:
  - move wddx to php-xml, build curl shared in -common
  - remove BR for expat-devel, bogus configure option


author: Joe Orton <jorton@redhat.com> 5.2.8-9
changelog:
  - add recode support, -recode subpackage (#106755)
  - add -zts subpackage with ZTS-enabled build of httpd SAPI
  - adjust php.conf to use -zts SAPI build for worker MPM


author: Remi Collet <Fedora@famillecollet.com> 5.3.0-1
changelog:
  - update to 5.3.0
  - remove ncurses, dbase, mhash extensions
  - add enchant, sqlite3, intl, phar, fileinfo extensions
  - raise sqlite version to 3.6.0 (for sqlite3, build with --enable-load-extension)
  - sync with upstream "production" php.ini


author: Joe Orton <jorton@redhat.com> 5.3.0-2
changelog:
  - update to v5 of systzdata patch; parses zone.tab and extracts
    timezone->{country-code,long/lat,comment} mapping table


author: Remi Collet <Fedora@famillecollet.com> 5.3.1-1
changelog:
  - update to 5.3.1
  - remove openssl patch (merged upstream)
  - add provides for php-pecl-json
  - add prod/devel php.ini in doc


author: Remi Collet <Fedora@famillecollet.com> 5.3.2-1
changelog:
  - PHP 5.3.2 Released!
  - remove mime_magic option (now provided by fileinfo, by emu)
  - add patch for http://bugs.php.net/50578
  - remove patch for libedit (upstream)
  - add runselftest option to allow build without test suite


author: Remi Collet <remi@fedoraproject.org> 5.3.8-2
changelog:
  - add mysqlnd sub-package
  - drop patch4, use --libdir to use /usr/lib*/php/build
  - add patch to redirect mysql.sock (in mysqlnd)


author: Remi Collet <remi@fedoraproject.org> 5.3.8-3
changelog:
  - revert is_a() to php <= 5.3.6 behavior (from upstream)
    with new option (allow_string) for new behavior


author: Remi Collet <remi@fedoraproject.org> 5.4.0-0.3.RC7
changelog:
  - update to PHP 5.4.0RC7
  - provides env file for php-fpm (#784770)
  - add patch to use system libzip (thanks to spot)
  - don't provide INSTALL file


author: Remi Collet <remi@fedoraproject.org> 5.4.0-5
changelog:
  - fix Loadmodule with MPM event (use ZTS if not MPM worker)
  - split conf.d/php.conf + conf.modules.d/10-php.conf with httpd 2.4


author: Remi Collet <remi@fedoraproject.org> 5.4.4-1
changelog:
  - update to 5.4.4 (CVE-2012-2143, CVE-2012-2386)
  - use /usr/lib/tmpfiles.d instead of /etc/tmpfiles.d
  - use /run/php-fpm instead of /var/run/php-fpm


author: Remi Collet <rcollet@redhat.com> 5.4.7-8
changelog:
  - systemd integration, https://bugs.php.net/63085
  - no odbc call during timeout, https://bugs.php.net/63171
  - check sqlite3_column_table_name, https://bugs.php.net/63149


author: Remi Collet <remi@fedoraproject.org> 5.4.7-9
changelog:
  - php-fpm: enable PrivateTmp
  - php-fpm: new systemd macros (#850268)
  - php-fpm: add upstream patch for startup issue (#846858)


author: Remi Collet <rcollet@redhat.com> 5.4.7-2
changelog:
  - missing requires on scl-runtime
  - relocate /var/lib/session
  - fix php-devel requires
  - rename, but don't relocate macros.php


author: Remi Collet <rcollet@redhat.com> 5.4.7-3
changelog:
  - add configtest option to init script
  - test configuration before service reload
  - fix php-fpm service relocation
  - fix php-fpm config relocation
  - drop embdded subpackage for scl


author: Remi Collet <rcollet@redhat.com> 5.4.8-1
changelog:
  - update to 5.4.8
  - define both session.save_handler and session.save_path
  - fix possible segfault in libxml (#828526)
  - use SKIP_ONLINE_TEST during make test
  - php-devel requires pcre-devel and php-cli (instead of php)
  - provides php-phar
  - update systzdata patch to v10, timezone are case insensitive


author: Remi Collet <rcollet@redhat.com> 5.4.8-1.2
changelog:
  - minor macro fixes for RHEL-5 build
  - update autotools workaround for RHEL-5
  - use readline when libedit not available (RHEL-5)


author: Remi Collet <rcollet@redhat.com> 5.4.8-2.1
changelog:
  - make php-enchant optionnal, not available on RHEL-5
  - make php-recode optionnal, not available on RHEL-5
  - disable t1lib on RHEL-5


author: Remi Collet <rcollet@redhat.com> 5.4.8-6
changelog:
  - clarify Licenses
  - missing provides xmlreader and xmlwriter
  - change php embedded library soname version to 5.4


author: Remi Collet <rcollet@redhat.com> 5.4.8-6
changelog:
  - filter private shared in _httpd_modir
  - improve system libzip patch to use pkg-config
  - use _httpd_contentdir macro and fix php.gif path
  - switch back to upstream generated scanner/parser
  - use system pcre only when recent enough


author: Remi Collet <rcollet@redhat.com> 5.4.10-1
changelog:
  - update to 5.4.10
  - remove patches merged upstream
  - drop "Configure Command" from phpinfo output
  - prevent php_config.h changes across (otherwise identical)
    rebuilds


author: Remi Collet <rcollet@redhat.com> 5.4.13-1
changelog:
  - update to 5.4.13
  - security fixes for CVE-2013-1635 and CVE-2013-1643
  - make php-mysql package optional (and disabled)
  - make ZTS build optional (and disabled)
  - always try to load mod_php (apache warning is usefull)
  - Hardened build (links with -z now option)
  - Remove %config from /etc/rpm/macros.php


author: Remi Collet <rcollet@redhat.com> 5.4.14-2
changelog:
  - rebuild for libjpeg (instead of libjpeg_turbo)
  - fix unowned dir %{_datadir}/fpm and %{_libdir}/httpd (#956221)


author: Remi Collet <rcollet@redhat.com> 5.4.16-1
changelog:
  - rebase to 5.4.16
  - fix hang in FindTishriMolad(), #965144
  - patch for upstream Bug #64915 error_log ignored when daemonize=0
  - patch for upstream Bug #64949 Buffer overflow in _pdo_pgsql_error, #969103
  - patch for upstream bug #64960 Segfault in gc_zval_possible_root


author: Remi Collet <rcollet@redhat.com> 5.4.16-4
changelog:
  - improve mod_php, pgsql and ldap description
  - add missing man pages (phar, php-cgi)
  - add provides php(pdo-abi) for consistency with php(api) and php(zend-abi)
  - use %__isa_bits instead of %__isa in ABI suffix #985350


author: Remi Collet <rcollet@redhat.com> 5.4.16-8
changelog:
  - relocate RPM macro #1008483
  - remove ZTS conditional stuf for ligibility
  - add mod_php for httpd24 collection


author: Remi Collet <rcollet@redhat.com> - 5.4.16-18
changelog:
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515
  - fileinfo: fix infinite recursion. CVE-2014-1943
  - fileinfo: fix out-of-bounds memory access. CVE-2014-2270
  - fileinfo: fix extensive backtracking CVE-2013-7345
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587


author: Remi Collet <rcollet@redhat.com> - 5.4.16-20
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.4.45-10
changelog:
  - Added imap extension for all CentOS versions.  It now depends on
    our internal SCL libc-client package.


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.4.45-11
changelog:
  - mod_php adjusted to conflict with other mod_php versions, and
    not itself.  this lets the user reinstall the package without
    conflict. (ZC-1459)


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 5.4.45-21.cloudlinux.2
changelog:
  - add HardenedPHP patches:
  -   CVE-2016-7412: Heap overflow in mysqlnd related to BIT fields
  -   CVE-2016-7413: wddx_deserialize use-after-free
  -   CVE-2016-7414: Out of bound when verify signature of zip phar in phar_parse_zipfile
  -   CVE-2016-7416: SEH buffer overflow msgfmt_format_message
  -   CVE-2016-7417: Missing type check when unserializing SplArray
  -   CVE-2016-7418: Out-Of-Bounds Read in php_wddx_push_element of wddx.c
  -   security bug #72837: integer overflow in bzdecompress caused heap corruption (bz2)
      http://bugs.php.net/72837
  -   security bug #70436: Use After Free Vulnerability in unserialize() (core)
      http://bugs.php.net/70436
  -   security bug #72633: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization (core)
      http://bugs.php.net/72663
  -   security bug #72681: PHP Session Data Injection Vulnerability (core)
      http://bugs.php.net/72681
  -   security bug #72807: integer overflow in curl_escape caused heap corruption (curl)
      http://bugs.php.net/72807
  -   security bug #72838: Integer overflow lead to heap corruption in sql_regcase (ereg)
      http://bugs.php.net/72838
  -   security bug #72697: select_colors write out-  of-   bounds (gd)
      http://bugs.php.net/7- 2697
  -   security bug #72730: imagegammacorrect allows arbitrary write access (gd)
      http://bugs.php.net/72730
  -   security bug #72708: php_snmp_parse_oid integer overflow in memory allocation (snmp)
      http://bugs.php.net/72708
  -   security bug #72836: integer overflow in base64_decode caused heap corruption (standard)
      http://bugs.php.net/72836
  -   security bug #72848: integer overflow in quoted_printable_encode caused heap corruption (standard)
      http://bugs.php.net/72848
  -   security bug #72849: integer overflow in urlencode caused heap corruption (standard)
      http://bugs.php.net/72849
  -   security bug #72850: integer overflow in php_uuencode caused heap corruption (standard)
      http://bugs.php.net/72850
  -   security bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack (streams)
      http://bugs.php.net/72771
  -   security bug #72749: wddx_deserialize allows illegal memory access (wddx)
      http://bugs.php.net/72749
  -   security bug #72750: wddx_deserialize null dereference (wddx)
      http://bugs.php.net/72750
  -   security bug #72790: wddx_deserialize null dereference with invalid xml (wddx)
      http://bugs.php.net/72790
  -   security bug #72799: wddx_deserialize null dereference in php_wddx_pop_element (wddx)
      http://bugs.php.net/72799
  -   CVE-2016-5399: Inadequate error handling in bzread()
      http://bugs.php.net/72613
  -   CVE-2016-6288: php_url_parse_ex() buffer overflow read
      http://bugs.php.net/70480
  -   CVE-2016-6289: Stack-based buffer overflow vulnerability in virtual_file_ex
      http://bugs.php.net/72513
  -   CVE-2016-6290: Use After Free in unserialize() with Unexpected Session Deserialization
      http://bugs.php.net/72562
  -   CVE-2016-6291: Out of bound read in exif_process_IFD_in_MAKERNOTE
      http://bugs.php.net/72603
  -   CVE-2016-6292: NULL Pointer Dereference in exif_process_user_comment
      http://bugs.php.net/72618
  -   CVE-2016-6294: locale_accept_from_http out-of-bounds access
      http://bugs.php.net/72533
  -   CVE-2015-8879: PHP segfaults when accessing nvarchar(max) defined columns
      http://bugs.php.net/69975
  -   CVE-2016-6295: Use After Free Vulnerability in SNMP with GC and unserialize()
      http://bugs.php.net/72479
  -   CVE-2016-6296: heap-buffer-overflow (write) simplestring_addn simplestring.c
      http://bugs.php.net/72606
  -   CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener
      http://bugs.php.net/72520
  -   CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow
      https://bugs.php.net/bug.php?id=72339
  -   CVE-2016-5768: _php_mb_regex_ereg_replace_exec - double free
      https://bugs.php.net/bug.php?id=72402
  -   CVE-2016-5771: Use After Free Vulnerability in PHP's GC algorithm and unserialize
      https://bugs.php.net/bug.php?id=72433
  -   CVE-2016-5772: Double Free Corruption in wddx_deserialize
      https://bugs.php.net/bug.php?id=72340
  -   CVE-2016-5773: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize
      https://bugs.php.net/bug.php?id=72434
  -   CVE-2015-8874: Stack overflow with imagefilltoborder
      https://bugs.php.net/bug.php?id=66387
  -   CVE-2016-4343: (phar) uninitialized pointer in phar_make_dirstream()
      https://bugs.php.net/71331
  -   CVE-2016-5093: (intl) get_icu_value_internal out-of-bounds read
      https://bugs.php.net/72241
  -   CVE-2016-5094: (core) integer overflow in php_html_entities
      https://bugs.php.net/72135
  -   CVE-2016-5096: (core) integer underflow / arbitrary null write in fread/gzread
      https://bugs.php.net/72114
  -   security bug 72099: xml_parse_into_struct segmentation fault (CVE-2016-4539)
      https://bugs.php.net/bug.php?id=72099
  -   security bug 72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset (CVE-2016-4540, CVE-2016-4541)
      https://bugs.php.net/bug.php?id=72061
  -   security bug 71912: libgd: signedness vulnerability (CVE-2016-3074)
      https://bugs.php.net/bug.php?id=71912
  -   security bug 72094: Out of bounds heap read access in exif header processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
      https://bugs.php.net/bug.php?id=72094
  -   security bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition (CVE-2016-4537, CVE-2016-4538)
      https://bugs.php.net/bug.php?id=72093
  -   security bug 72099: xml_parse_into_struct segmentation fault (CVE-2016-4539)
      https://bugs.php.net/bug.php?id=72099
  -   security bug 72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset (CVE-2016-4540, CVE-2016-4541)
      https://bugs.php.net/bug.php?id=72061
  -   security bug 71912: libgd: signedness vulnerability (CVE-2016-3074)
      https://bugs.php.net/bug.php?id=71912
  -   security bug 72094: Out of bounds heap read access in exif header processing (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
      https://bugs.php.net/bug.php?id=72094
  -   security bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition (CVE-2016-4537, CVE-2016-4538)
      https://bugs.php.net/bug.php?id=72093
  -   security bug 71860: Invalid memory write in phar on filename with \0 in name
      https://bugs.php.net/bug.php?id=71860
  -   security bug 71704: php_snmp_error() Format String Vulnerability
      https://bugs.php.net/bug.php?id=71704
  -   security bug 71798: Integer Overflow in php_raw_url_encode
      https://bugs.php.net/bug.php?id=71798
  -   security bug 71860: Invalid memory write in phar on filename with \0 in name
      https://bugs.php.net/bug.php?id=71860
  -   security bug 71704: php_snmp_error() Format String Vulnerability
      https://bugs.php.net/bug.php?id=71704
  -   security bug 71798: Integer Overflow in php_raw_url_encode
      https://bugs.php.net/bug.php?id=71798
  -   security bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
      https://bugs.php.net/bug.php?id=71587
  -   security bug #71498: Out-of-Bound Read in phar_parse_zipfile()
      https://bugs.php.net/bug.php?id=71498
  -   security bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
      https://bugs.php.net/bug.php?id=71587
  -   security bug #71498: Out-of-Bound Read in phar_parse_zipfile()
      https://bugs.php.net/bug.php?id=71498
  -   bug 64343: PharData::extractTo fails for tarball created by BSD tar
  -   security bug #71039: exec functions ignore length but look for NULL termination
  -   security bug #71323: Output of stream_get_meta_data can be falsified by its input
  -   security bug #71354: Heap corruption in tar/zip/phar parser.
  -   security bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
  -   security bug #71459: Integer overflow in iptcembed()
  -   security bug #71488: Stack overflow when decompressing tar archives
  -   bug 64343: PharData::extractTo fails for tarball created by BSD tar
  -   security bug #71039: exec functions ignore length but look for NULL termination
  -   security bug #71323: Output of stream_get_meta_data can be falsified by its input
  -   security bug #71354: Heap corruption in tar/zip/phar parser.
  -   security bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
  -   security bug #71459: Integer overflow in iptcembed()
  -   security bug #71488: Stack overflow when decompressing tar archives
  -   bug70661: Use After Free Vulnerability in WDDX Packet Deserialization
  -   bug70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
  -   bug70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
  -   bug70755: fpm_log.c memory leak and buffer overflow
  -   add patches for bugs 69720 (https://bugs.php.net/bug.php?id=69720) and 70433 (https://bugs.php.net/bug.php?id=70433)


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-22.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  -   security bug 73189: memcpy negative size parameter php_resolve_path
  -   security bug 73190: memcpy negative parameter _bc_new_num_ex
  -   security bug 73150: missing NULL check in dom_document_save_html
  -   security bug 73284: heap overflow in php_ereg_replace function
  -   security bug 73218: stack-buffer-overflow through "ResourceBundle" methods
  -   security bug 73208: integer overflow in imap_8bit caused heap corruption
  -   security bug 73082: string length overflow in mb_encode_* function
  -   security bug 73174: heap overflow in php_pcre_replace_impl
  -   security bug 73276: crash in openssl_random_pseudo_bytes function
  -   security bug 73275: crash in openssl_encrypt function
  -   security bug 73017: memory corruption in wordwrap function
  -   security bug 73240: Write out of bounds at number_format
  -   security bug 73073: CachingIterator null dereference when convert to string
  -   security bug 73293: NULL pointer dereference in SimpleXMLElement::asXML()


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.4.45-25.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  -   security bug 73452: Segfault (Regression for #69152)
  -   security bug 73631: Invalid read when wddx decodes empty boolean element
  - ALTPHP-271: bug 71465: PHAR doesn't know about litespeed


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.4.45-25.cloudlinux.2
changelog:
  - add HaredenedPHP patches:
  -   bug 73764: Crash while loading hostile phar archive (CVE-2016-10159)
  -   bug 73768: Memory corruption when loading hostile phar (CVE-2016-10160)
  -   bug 73825: Heap out of bounds read on unserialize in finish_nested_data() (CVE-2016-10161)
  -   bug 68447: grapheme_extract take an extra trailing character
  -   bug 70213: Unserialize context shared on double class lookup
  -   bug 73549: Use after free when stream is passed to imagepng
  -   bug 73737: FPE when parsing a tag format (CVE-2016-10158)
  -   bug 73773: Seg fault when loading hostile phar
  -   bug 73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
  -   bug 73869: Signed Integer Overflow gd_io.c


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-28.cloudlinux.1
changelog:
  - add HaredenedPHP patches:
  -   bug 71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut (CVE-2016-4073)
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.4.45-38.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug70436: Use After Free Vulnerability in unserialize()
  - bug74087: Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Cory McIntire <cory@cpanel.net> - 5.4.45-52
changelog:
  * Mon Mar 20 2018 Cory McIntire <cory@cpanel.net> - 5.4.45-52
  - ZC-3552: Added versioning to ea-openssl and libcurl requirements.


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-56.cloudlinux.4
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code
  - Fix bug #77418: Heap overflow in utf32be_mbc_to_code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-60.cloudlinux.1
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77722
  - Fixed bug #77742
  - Fixed bug #77765
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-63.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.4.45-66.cloudlinux.3
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar` (CVE-2020-7060)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)
  - Fix bug #79221: Null Pointer Dereference in PHP Session Upload Progress (CVE-2020-7062)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.4.45-69.cloudlinux.1
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #75673: SplStack::unserialize() behavior
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 5.4.45-70.cloudlinux.1
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached


author: Daniil Leonov <dleonov@cloudlinux.com> - 5.4.45-72.cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.4.45-76.cloudlinux.1
changelog:
  - ELS-189: Fix for Harden PHP
  - CVE-2022-31625: Fix freeing of uninitialized memory leading to RCE
  - CVE-2022-31626: Fix buffer overflow in mysqlnd driver leading to RCE


author: S. Kurt Newman <kurt.newman@cpanel.net> - 4.7.5-5
changelog:
  - Added scl_package_override macro to regain access to global
    PHP macros that contain location and verison information.


author: Dan Muey <dan@cpanel.net> - 3.3-7
changelog:
  - EA-5028 via EA-5900: reinstate opcache conflict
  - (the obsoletes is problematic and there is a
  -   proper way to address the problem it was intended to solve)


author: Remi Collet <rcollet@redhat.com> 1.1-5
changelog:
  - avoid empty debuginfo subpackage
  - add LICENSE, README and php55.7 man page #1061455
  - add scldevel subpackage #1063357


author: Remi Collet <rcollet@redhat.com> 5.5.4-1
changelog:
  - update to PHP 5.5.4
  - improve security, use specific soap.wsdl_cache_dir
    use /var/lib/php/wsdlcache for mod_php and php-fpm
  - sync short_tag comments in php.ini with upstream
  - relocate RPM macro


author: Remi Collet <rcollet@redhat.com> - 5.5.6-8
changelog:
  - fix patch name
  - fix memory leak introduce in patch for CVE-2014-1943
  - fix heap-based buffer over-read in DateInterval CVE-2013-6712


author: Remi Collet <rcollet@redhat.com> - 5.5.6-9
changelog:
  - gd: fix NULL deref in imagecrop CVE-2013-7327
  - gd: drop vpx support, fix huge memory consumption #1075201


author: Remi Collet <rcollet@redhat.com> - 5.5.6-10
changelog:
  - fileinfo: fix out-of-bounds memory access CVE-2014-2270
  - fileinfo: fix extensive backtracking CVE-2013-7345


author: Remi Collet <rcollet@redhat.com> - 5.5.6-11
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
    CVE-2014-2497
  - gd: fix NUL byte injection in file names. CVE-2014-5120
  - core: fix heap-based buffer overflow in DNS TXT record
    parsing. CVE-2014-4049
  - network: fix segfault in dns_get_record
    (incomplete fix for CVE-2014-4049). CVE-2014-3597
  - core: unserialize() SPL ArrayObject / SPLObjectStorage
    type confusion flaw. CVE-2014-3515
  - core: type confusion issue in phpinfo(). CVE-2014-4721
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
  - fileinfo: cdf_unpack_summary_info() excessive looping
    DoS. CVE-2014-0237
  - fileinfo: CDF property info parsing nelements infinite
    loop. CVE-2014-0238
  - fileinfo: cdf_read_short_sector insufficient boundary
    check. CVE-2014-0207
  - fileinfo: fix extensive backtracking in regular expression
    (incomplete fix for CVE-2013-7345). CVE-2014-3538
  - fileinfo: cdf_check_stream_offset insufficient boundary
    check. CVE-2014-3479
  - fileinfo: cdf_count_chain insufficient boundary check
    CVE-2014-3480
  - fileinfo: fix mconvert incorrect handling of truncated
    pascal string size. CVE-2014-3478
  - fileinfo: cdf_read_property_info insufficient boundary
    check. CVE-2014-3487
  - fileinfo: fix cdf_read_property_info
    (incomplete fix for CVE-2012-1571). CVE-2014-3587


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.5.22-1
changelog:
  - Set imap and recode to be incompatible
  - developer version of opcache.ini is distributed instead of auto-gen


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:5.5.31-1.2.cloudlinux
changelog:
  - php-fpm.5.dl.patch applied
  - build with LSAPI 6.9
  - added explicit declaration for debuginfo package
  - Epoch bumped to 1
  - Vendor removed
  - dist macro added to Release


author: Anatholy Scryabin <ascryabin@cloudlinux.com> - 5.5.38-4.cloudlinux
changelog:
  - add HardenedPHP patches:
  -   CVE-2016-7411: Memory Corruption in During Deserialized-object Destruction
  -   CVE-2016-7412: Heap overflow in mysqlnd related to BIT fields
  -   CVE-2016-7413: wddx_deserialize use-after-free
  -   CVE-2016-7414: Out of bound when verify signature of zip phar in phar_parse_zipfile
  -   CVE-2016-7416: SEH buffer overflow msgfmt_format_message
  -   CVE-2016-7417: Missing type check when unserializing SplArray
  -   CVE-2016-7418: Out-Of-Bounds Read in php_wddx_push_element of wddx.c
  -   security bug #72837: integer overflow in bzdecompress caused heap corruption (bz2)
      http://bugs.php.net/72837
  -   security bug #70436: Use After Free Vulnerability in unserialize() (core)
      http://bugs.php.net/70436
  -   bug #72024: microtime() leaks memory (core)
      http://bugs.php.net/72024
  -   security bug #72633: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization (core)
      http://bugs.php.net/72663
  -   security bug #72681: PHP Session Data Injection Vulnerability (core)
      http://bugs.php.net/72681
  -   security bug #72807: integer overflow in curl_escape caused heap corruption (curl)
      http://bugs.php.net/72807
  -   security bug #72838: Integer overflow lead to heap corruption in sql_regcase (ereg)
      http://bugs.php.net/72838
  -   security bug #72697: select_colors write out-of-bounds (gd)
      http://bugs.php.net/72697
  -   security bug #72730: imagegammacorrect allows arbitrary write access (gd)
      http://bugs.php.net/72730
  -   security bug #72708: php_snmp_parse_oid integer overflow in memory allocation (snmp)
      http://bugs.php.net/72708
  -   security bug #72836: integer overflow in base64_decode caused heap corruption (standard)
      http://bugs.php.net/72836
  -   security bug #72848: integer overflow in quoted_printable_encode caused heap corruption (standard)
      http://bugs.php.net/72848
  -   security bug #72849: integer overflow in urlencode caused heap corruption (standard)
      http://bugs.php.net/72849
  -   security bug #72850: integer overflow in php_uuencode caused heap corruption (standard)
      http://bugs.php.net/72850
  -   security bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack (streams)
      http://bugs.php.net/72771
  -   security bug #72749: wddx_deserialize allows illegal memory access (wddx)
      http://bugs.php.net/72749
  -   security bug #72750: wddx_deserialize null dereference (wddx)
      http://bugs.php.net/72750
  -   security bug #72790: wddx_deserialize null dereference with invalid xml (wddx)
      http://bugs.php.net/72790
  -   security bug #72799: wddx_deserialize null dereference in php_wddx_pop_element (wddx)
      http://bugs.php.net/72799


author: Dmitry Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-4.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  -   security bug 73189: Memcpy negative size parameter php_resolve_path
  -   security bug 73147: Use After Free in unserialize()
  -   security bug 73190: memcpy negative parameter _bc_new_num_ex
  -   security bug 73150: missing NULL check in dom_document_save_html
  -   security bug 73284: heap overflow in php_ereg_replace function
  -   CVE-2016-7568: Integer Overflow in gdImageWebpCtx of gd_webp.c
  -   security bug 73218: stack-buffer-overflow through "ResourceBundle" methods
  -   security bug 73208: integer overflow in imap_8bit caused heap corruption
  -   security bug 73082: string length overflow in mb_encode_* function
  -   security bug 73174: heap overflow in php_pcre_replace_impl
  -   security bug 73276: crash in openssl_random_pseudo_bytes function
  -   security bug 73275: crash in openssl_encrypt function
  -   security bug 73017: memory corruption in wordwrap function
  -   security bug 73240: Write out of bounds at number_format
  -   security bug 73073: CachingIterator null dereference when convert to string
  -   security bug 73293: NULL pointer dereference in SimpleXMLElement::asXML()


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-11.cloudlinux.1
changelog:
  - add HaredenedPHP patches:
  -   bug 72627: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)
  - ALTPHP-313: Add to lsphp support for custom php.ini defined via .htaccess


author: Dmtriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-11.cloudlinux.3
changelog:
  - ALTPHP-318: bug 69090: opcache: add prefix/xor to cache keys/check permissions or separate caches
  - ALTPHP-323: LSPHP: CRIU support added


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 5.5.38-22.cloudlinux.1
changelog:
  - add HardenedPHP patches:
  - CVE-2017-11143: wddx parsing empty boolean tag leads to SIGSEGV
  - CVE-2017-11144: negative-size-param (-1) in memcpy in zif_openssl_seal()
  - CVE-2017-11145: wddx_deserialize() heap out-of-bound read via php_parse_date()
  - CVE-2017-11146: wddx_deserialize() heap out-of-bound read via php_parse_date() (caused by CVE-2017-11145)
  - CVE-2017-7890: Buffer over-read into uninitialized memory
  - CVE-2017-9224: Buffer Overflow in match_at() (Oniguruma issue)
  - CVE-2017-9226: Heap corruption in next_state_val() in 15 encodings (Oniguruma issue)
  - CVE-2017-9227: Bug in mbc_enc_len() (Oniguruma issue)
  - CVE-2017-9228: Heap corruption in next_state_val() due to uninitialized local variable (Oniguruma issue)
  - CVE-2017-9229: SIGSEGV in left_adjust_char_head() due to bad dereference (Oniguruma issue)
  - bug74087: Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)
  - bug74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
  -
  - add LSAPI patches:
  - update Litespeed SAPI to 6.11
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Cory McIntire <cory@cpanel.net> - 5.5.38-35
changelog:
  * Mon Mar 20 2018 Cory McIntire <cory@cpanel.net> - 5.5.38-35
  - ZC-3552: Added versioning to ea-openssl and ea-libcurl requirements.


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.5.38-39.cloudlinux.4
changelog:
  - Fix bug #77242: heap out of bounds read in xmlrpc_decode()
  - Fix bug #77247: heap buffer overflow in phar_detect_phar_fname_ext
  - Fix bug #77269: Potential unsigned underflow in gdImageScale
  - Fix bug #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77371: heap buffer overflow in mb regex functions - compile_string_node
  - Fix bug #77380: Global out of bounds read in xmlrpc base64 code
  - Fix bug #77418: Heap overflow in utf32be_mbc_to_code


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.5.38-46.cloudlinux.1
changelog:
  - Fix bug #77124
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  - Fixed bug #78279
  - Fixed bug #78297


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.5.38-46.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast
  - Fix #78342: Bus error in configure test for iconv //IGNORE


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 5.5.38-52.cloudlinux.2
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79497: stream_socket_client() throws an unknown error sometimes with <1s timeout
  - Fix bug #79514: Memory leaks while including unexistent file
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-62.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.5.38-62.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.5.38-62.cloudlinux.11
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: S. Kurt Newman <kurt.newman@cpanel.net> - 5.6.6-1
changelog:
  - Set imap and recode to be incompatible
  - Added libzip compile flags, but set to incompatible with all
    current versions of CentOS (e.g. <= 7).  RHEL patches PHP to
    be compatible with the version of libzip that's supplied by
    them.
  - developer version of opcache.ini is distributed instead of auto-gen


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:5.6.30-1.cloudlinux.2
changelog:
  - ALTPHP-306: LSPHP: Return response code and response status line in cgi/fcgi manner
  - Update CRIU patch to version 7
  - Supress warnings about deprecated $HTTP_RAW_POST_DATA


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> 5.6.31-1.cloudlinux.1
changelog:
  - ALTPHP-351: make lsphp error messaqges more informative
  - ALTPHP-354: SIGCHILD handler fix after CRIU restoring


author: Cory McIntire <cory@cpanel.net> - 5.6.34-3
changelog:
  * Mon Mar 20 2018 Cory McIntire <cory@cpanel.net> - 5.6.34-3
  - ZC-3552: Added versioning to ea-openssl and ea-libcurl requirements.


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-5.cloudlinux.1
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77597
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77722
  - Fixed bug #77742
  - Fixed bug #77765
  - Fix #77767: phpdbg break command help message shows incorrect aliases
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-5.cloudlinux.2
changelog:
  - Fix bug #77967 - Bypassing open_basedir restrictions via file uris
  - Fix #77973: Uninitialized read in gdImageCreateFromXbm
  - Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
  - Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-8.cloudlinux.1
changelog:
  - Fix bug #77124
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78202: Opcache stats for cache hits are capped at 32bit NUM
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  - Fixed bug #78279
  - Fixed bug #78297


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-8.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast
  - Fix #78342: Bus error in configure test for iconv //IGNORE
  - Fix #78379: (Cast to object confuses GC, causes crash)


author: Ivan Danilov <idanilov@cloudlinux.com> - 5.6.40-9.cloudlinux.3
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter
  - Fix #78413: php-fpm request_terminate_timeout does not take effect after fastcgi_finish_request
  - Fix #78579: mb_decode_numericentity: args number inconsistency
  - Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-22.cloudlinux.6
changelog:
  - Add MySQL 8 charset's support
  - Backport native api for MySQL 8 compatibility
  - Fix tests charsets processing


author: Remi Collet <rcollet@redhat.com> - 5.6.0-0.1.RC4
changelog:
  - initial spec for PHP 5.6 as Software Collection
  - adapted from php 5.6 spec file from remi repository
  - adapted from php 5.5 spec file from rhscl 1.1


author: Remi Collet <remi@fedoraproject.org> 5.6.1-1
changelog:
  - Update to PHP 5.6.1
    http://php.net/releases/5_6_1.php
  - use default system cipher list by Fedora policy
    http://fedoraproject.org/wiki/Changes/CryptoPolicy
  - add system php library to default include_path


author: Remi Collet <remi@fedoraproject.org> 5.6.3-0.1.RC1
changelog:
  - update to 5.6.3RC1
  - new version of systzdata patch, fix case sensitivity
  - ignore Factory in date tests
  - disable opcache.fast_shutdown in default config
  - add php56-cgi command in base system


author: Remi Collet <remi@fedoraproject.org> 5.6.3-2
changelog:
  - FPM: add upstream patch for https://bugs.php.net/68421
    access.format=R doesn't log ipv6 address
  - FPM: add upstream patch for https://bugs.php.net/68420
    listen=9000 listens to ipv6 localhost instead of all addresses
  - FPM: add upstream patch for https://bugs.php.net/68423
    will no longer load all pools


author: Remi Collet <remi@fedoraproject.org> 5.6.4-2
changelog:
  - Update to 5.6.4
    http://www.php.net/releases/5_6_4.php
  - add sybase_ct extension (in mssql sub-package)
  - xmlrpc requires xml


author: Remi Collet <remi@fedoraproject.org> 5.6.5-0.1.RC1
changelog:
  - update to 5.6.5RC1
  - add base system path in default include path
  - FPM: enable ACL for Unix Domain Socket


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.1.20150325git23336d7
changelog:
  - update for php 7.0.0
  - ereg, mssql, mysql and sybase_ct extensions are removed
  - add pdo-dblib subpackage (instead of php-mssql)
  - disable oci8 extension, not yet adapted for 7.0
  - add php-zip subpackage
  - add php-json subpackage


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.15.RC2
changelog:
  - Update to 7.0.0RC2
  - enable oci8 and pdo_oci extensions
  - sync php.ini with upstream php.ini-production


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.19.RC5
changelog:
  - Update to 7.0.0RC5
  - update php-fpm.d/www.conf comments
  - API and Zend API are now set to 20151012


author: Remi Collet <remi@fedoraproject.org> 7.0.0-0.26.RC8
changelog:
  - set opcache.huge_code_pages=0 on EL-6
    see  https://bugs.php.net/70973 and https://bugs.php.net/70977


author: S. Kurt Newman <kurt.newman@cpanel.net> - 7.0.0-4
changelog:
  - Update spec to reflect how cpanel deploys its other php packages.
  - Disable file-based opcaching for cpanel because it introduces
    security concerns and incompatibilities on multi-user systems.


author: Daniel Muey <dan@cpanel.net> - 7.0.8-1
changelog:
  - Updated to version 7.0.8 via update_pkg.pl (EA-4738)
  - Remove opcache check since it was removed in d41920c (EA-4755)


author: S. Kurt Newman <kurt.newman@cpanel.net> - 7.0.9-2
changelog:
  - Removed reference to unused patches.
  - Used prior choon.net mail-header patch as a basis for updating
    it with PHP 7 compatibility (EA-4199).


author: Dmitriy Kasyanov <dkasyanov@cloudlinux.com> - 1:7.0.15-1.cloudlinux.2
changelog:
  - ALTPHP-306: LSPHP: Return response code and response status line in cgi/fcgi manner
  - Update CRIU patch to version 7


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-2.cloudlinux2.1
changelog:
  - Fix #77269: Potential unsigned underflow in gdImageScale
  - Fix #77270: imagecolormatch Out Of Bounds Write on Heap
  - Fix bug #77370 - check that we do not read past buffer end when parsing multibytes
  - Fix bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
  - Fix bug #77418 - Heap overflow in utf32be_mbc_to_code
  - Fix bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext)
  - Fix bug #77242 (heap out of bounds read in xmlrpc_decode())
  - Fix bug #77380  (Global out of bounds read in xmlrpc base64 code)


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-6.cloudlinux.1
changelog:
  - Fixed bug #50020 (DateInterval:createDateFromString() silently fails)
  - Fixed bug #75113: Added DatePeriod::getRecurrences() method.
  - Fixed bug #75186
  - Fixed bug #76717
  - Fix #77024: SplFileObject::__toString() may return array
  - Fixed bug #77597
  - fail on 7.2, but I'm fixing this here anyway as the code is clearly
  - Fixed bug #77652
  - Fixed bug #77660 (Segmentation fault on break 2147483648)
  - Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper)
  - Fix bug #77677: WCOREDUMP not available on all systems
  - Fixed bug #77697 (Crash on Big_Endian platform)
  - Fix #77700: Writing truecolor images as GIF ignores interlace flag
  - Fixed bug #77722
  - Fixed bug #77738 (Nullptr deref in zend_compile_expr)
  - Fixed bug #77742
  - Fixed bug #77765
  - Fixed bug #75186
  - Fixed bug #76717
  - Fix #77767: phpdbg break command help message shows incorrect aliases
  - Fixed bug #77843
  - Fix #77921: static.php.net doesn't work anymore
  - Fix bug #77934 (php-fpm kill -USR2 not working)
  - Fix #77943: imageantialias($image, false); does not work
  - Fix #77944: Wrong meta pdo_type for bigint on LLP64
  - Fixed bug #77945


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-9.cloudlinux.1
changelog:
  - Fix bug #77124
  - Fix #77919: Potential UAF in Phar RSHUTDOWN
  - Fix #78173: XML-RPC mutates immutable objects during encoding
  - Fix bug #78192 PDO SQLite SegFault when reuse statement after schema has changed
  - Fix #78202: Opcache stats for cache hits are capped at 32bit NUM
  - Fix #78212: Segfault in built-in webserver
  - Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
  - Fix #78241: touch() does not handle dates after 2038 in PHP 64-bit
  - Fix bug #78256 (heap-buffer-overflow on exif_process_user_comment)
  - Fixed bug #78279
  - Fix bug #78291 Missing opcache directives
  - Fixed bug #78297


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-9.cloudlinux.2
changelog:
  - Fix #69100: Bus error from stream_copy_to_stream
  - Fix #75457: heap-use-after-free
  - Fix #77946: Bad cURL resources returned by curl_multi_info_read
  - Fix #78282: atime and mtime mismatch
  - Fix #78326: improper memory deallocation on stream_get_contents
  - Fix #78333: Exif crash (bus error) due to wrong alignment and invalid cast
  - Fix #78342: Bus error in configure test for iconv //IGNORE
  - Fix #78379: (Cast to object confuses GC, causes crash)


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-10.cloudlinux.3
changelog:
  - Fix #76342: file_get_contents waits twice specified timeout
  - Fix #76859 stream_get_line skips data if used with data-generating filter
  - Fix #78413: php-fpm request_terminate_timeout does not take effect after fastcgi_finish_request
  - Fix #78535: auto_detect_line_endings value not parsed as bool
  - Fix #78579: mb_decode_numericentity: args number inconsistency
  - Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)
  - Fixed bug #78612
  - Fix #78620: Out of memory error
  - Fix #78641: addGlob can modify given remove_path value


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-11.cloudlinux.1
changelog:
  - Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer)
  - Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
  - Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047)
  - Fixed bug #78863 (DirectoryIterator class silently truncates after a nullbyte). (CVE-2019-11045)
  - Fixed bug #78862 (link() silently truncates after a null byte on Windows). (CVE-2019-11044)
  - Updated Litespeed SAPI to 7.6


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.0.33-12.cloudlinux.3
changelog:
  - Fix bug #77569: Write Access Violation in DomImplementation
  - Fix bug #79078: Hypothetical use-after-free in curl_multi_add_handle
  - Fix bug #79282: Use-of-uninitialized-value in exif (CVE-2020-7064)
  - Fix bug #79329: get_headers silently truncates after a null byte (CVE-2020-7066)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-15.cloudlinux.1
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #75673: SplStack::unserialize() behavior
  - Fix bug #79199: curl_copy_handle() memory leak
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79393: Null coalescing operator failing with SplFixedArray
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)
  - Fix bug #79468: SIGSEGV when closing stream handle with a stream filter appended


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-15.cloudlinux.2
changelog:
  - Fix bug #78221: DOMNode::normalize() doesn't remove empty text nodes
  - Fix bug #78875: Long variables cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #78876: Long variables in multipart/form-data cause OOM and temp files are not cleaned (CVE-2019-11048)
  - Fix bug #79497: stream_socket_client() throws an unknown error sometimes with <1s timeout
  - Fix bug #79503: Memory leak on duplicate metadata
  - Fix bug #79514: Memory leaks while including unexistent file
  - Fix bug #79528: Different object of the same xml between 7.4.5 and 7.4.4


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-16.cloudlinux.2
changelog:
  - Fix bug #62890: default_socket_timeout=-1 causes connection to timeout
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79783: Segfault in php_str_replace_common
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79797: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)
  - Fix bug #79877: getimagesize function silently truncates after a null byte


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.0.33-16.cloudlinux.4
changelog:
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #79825: opcache.file_cache causes SIGSEGV when custom opcode handlers changed
  - Fix bug #79986: str_ireplace bug with diacritics characters
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing
  - Fix bug #80049: Memleak when coercing integers to string via variadic argument


author: Daniil Leonov <dleonov@cloudlinux.com> - 7.0.33-19.cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked
  - Fix Bug #80411: References to null-serialized object break serialize()


author: Tim Mullin <tim@cpanel.net> - 7.0.33-26
changelog:
  - EA-11821: Patch to build with the latest ea-libxml2
  - ZC-10950: Add debug_package nil back w/ second directive (3rd item will be ZC-10951)
  - ZC-10936: Clean up Makefile and remove debug-package-nil


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-26.cloudlinux.3
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-26.cloudlinux.6
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-26.cloudlinux.8
changelog:
  - Security fixes
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-26.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-26.cloudlinux.10
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()
  - CVE-2019-9022: fix DNS response parsing


author: Jack Hayhurst <jack@deleteos.com> - 0.2
changelog:
  - added ea-php71-php-memcahe branched off of php54

  - Fixed package name, entire RPM is now working.


author: Jacob Perkins <jacob.perkins@cpanel.net> - 7.1.0-alpha3
changelog:
  * Mon Jun 27 2016 Daniel Muey <dan@cpanel.net> - 7.0.8-1
  - Updated to version 7.0.8 via update_pkg.pl (EA-4738)
  - Remove opcache check since it was removed in d41920c (EA-4755)


author: Edwin Buck <e.buck@cpanel.net> - 7.1.0-2.beta1
changelog:
  - Updated to PHP 7.1 (beta) sources
  - Added php imap support
  - Applied fpm and updated mail header patches


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 1:7.1.0-4.beta3.cloudlinux
changelog:
  - epoch bumped to 1
  - cPanel vendor removed
  - php-7.0.x-ea4-ini.patch disabled because it breaks mod_lsapi in some cases
  - php-fpm.7.1.dl.v2.patch patch applied
  - php-5.6.10-litespeed-sa_mask.patch patch applied
  - lsapi-6.9-wink_server_is_ready.patch patch applied
  - php-litespeed69-max_idle_timeout.patch patch applied


author: Eugene Zamriy <ezamriy@cloudlinux.com> - 7.1.2-1.cloudlinux.1
changelog:
  - EA-5946: force requirement of ea-libtidy instead of .so from BuildRequires ea-libtidy-devel
  - EA-5839: Add opcache.validate_permission to opcache ini
  - EA-5807: enable php-tidy on rhel 6 and above


author: Ivan Danilov <idanilov@cloudlinux.com> - 7.1.33-4.cloudlinux.2
changelog:
  - Fix bug #79099: OOB read in php_strip_tags_ex (CVE-2020-7059)
  - Fix bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar` (CVE-2020-7060)
  - Fix bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions (CVE-2020-7063)
  - Fix bug #79091: heap use-after-free in session_create_id()
  - Fix bug #79221: Null Pointer Dereference in PHP Session Upload Progress (CVE-2020-7062)


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-6.cloudlinux.1
changelog:
  - Fix bug #61597: SXE properties may lack attributes and content
  - Fix bug #74940: DateTimeZone loose comparison always true
  - Fix bug #75673: SplStack::unserialize() behavior
  - Fix bug #79199: curl_copy_handle() memory leak
  - Fix bug #79200: Some iconv functions cut Windows-1258
  - Fix bug #79296: ZipArchive::open fails on empty file (libzip 1.6.0)
  - Fix bug #79330: shell_exec() silently truncates after a null byte
  - Fix bug #79364: When copy empty array, next key is unspecified
  - Fix bug #79393: Null coalescing operator failing with SplFixedArray
  - Fix bug #79396: setting Date/Time during a forward DST transition
  - Fix bug #79410: system() swallows last chunk if it is exactly 4095 bytes without newline
  - Fix bug #79413: session_create_id() fails for active sessions
  - Fix bug #79424: php_zip_glob uses gl_pathc after call to globfree
  - Fix bug #79465: OOB Read in urldecode() (CVE-2020-7067)
  - Fix bug #79468: SIGSEGV when closing stream handle with a stream filter appended


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-7.cloudlinux.2
changelog:
  - Fix bug #79787: mb_strimwidth does not trim string
  - Fix bug #79797: Use of freed hash key in the phar_parse_zipfile function (CVE-2020-7068)
  - Fix bug #70362: Can't copy() large 'data://' with open_basedir
  - Fix bug #73527: Invalid memory access in php_filter_strip
  - Fix bug #74267: segfault with streams and invalid data
  - Fix bug #79783: Segfault in php_str_replace_common
  - Fix bug #79877: getimagesize function silently truncates after a null byte
  - Fix bug #62890: default_socket_timeout=-1 causes connection to timeout


author: Nikolai Mikhno <nmikhno@cloudlinux.com> - 7.1.33-7.cloudlinux.4
changelog:
  - Fix bug #79601: Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVE-2020-7069)
  - Fix bug #79699: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent (CVE-2020-7070)
  - Fix bug #79825: opcache.file_cache causes SIGSEGV when custom opcode handlers changed
  - Fix bug #79986: str_ireplace bug with diacritics characters
  - Fix bug #80007: Potential type confusion in unixtojd() parameter parsing
  - Fix bug #80049: Memleak when coercing integers to string via variadic argument


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-17.cloudlinux.8
changelog:
  - Security fixes
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-17.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.1.33-17.cloudlinux.10
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: <dan@cpanel.net> - 7.2.0-3.RC1
changelog:
  - EA-6757: Update 7.2.0 from beta3 to RC1
  - fix version specific symlinks
  - remove TZ patch for now (EA-6764 may re-add a version of it)
  - Add patch to fix RC1 bug  https://bugs.php.net/bug.php?id=75149 until the next version


author: Daniil Leonov <dleonov@cloudlinux.com> - 7.2.34-3.cloudlinux.2
changelog:
  - Fix Bug #73809: Phar Zip parse crash - mmap fail
  - Fix Bug #77322: PharData::addEmptyDir('/') Possible integer overflow
  - Fix Bug #77423: FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  - Fix Bug #77961: Slow reqursive functions with MySQL
  - Fix Bug #80366: Potential issue in ext/standard/iptc.c: Return Value Not Checked
  - Fix Bug #80411: References to null-serialized object break serialize()


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.3
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-7.cloudlinux.4
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-9.cloudlinux.5
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74267: fix segfault with streams and invalid datas
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.2.34-9.cloudlinux.7
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9120: integer overflow in mysqli_real_escape_string()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.2.34-9.cloudlinux.9
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Cory McIntire <cory@cpanel.net> - 7.3.3-1
changelog:
  - Updated to version 7.3.3 via update_pkg.pl (EA-8275)
  - Added patch for phpize to handle autotools on C6


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.3.5-2.cloudlinux.1
changelog:
  - Apply mod_lsapi_mode patch
  - Update userini_homedir.patch, log.patch, use_reject.patch to latest versions


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-10.cloudlinux.1
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-13.cloudlinux.2
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - Bug #74960: fix heap buffer overflow via str_repeat
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-13.cloudlinux.4
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.4.33-8.cloudlinux.1
changelog:
  - CVE-2022-4900: Prevent potential buffer overflow for php_cli_server_workers_max
  - EA4D-470: build intl with system icu for RHEL >= 9


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-12.cloudlinux.1
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Remi Collet <remi@fedoraproject.org> - 2.2.5-3
changelog:
  - add numerical prefix to extension configuration file (php 5.6)
  - add comment about session configuration


author: Remi Collet <remi@fedoraproject.org> - 3.1.0-1
changelog:
  - update to 3.1.0
  - open https://github.com/phpredis/phpredis/issues/1052 max version
  - open https://github.com/phpredis/phpredis/issues/1053 segfault
  - open https://github.com/phpredis/phpredis/issues/1054 warnings
  - open https://github.com/phpredis/phpredis/issues/1055 reflection
  - open https://github.com/phpredis/phpredis/issues/1056 32bits tests


author: Remi Collet <remi@fedoraproject.org> - 3.1.0-2
changelog:
  - test build for open upcoming 3.1.1
  - open https://github.com/phpredis/phpredis/issues/1060 broken impl
    with https://github.com/phpredis/phpredis/pull/1064
  - reed https://github.com/phpredis/phpredis/issues/1062 session php 7.1
    with https://github.com/phpredis/phpredis/pull/1063


author: Remi Collet <remi@remirepo.net> - 3.1.4~RC2-1
changelog:
  - update to 3.1.4RC2 (beta)
  - open https://github.com/phpredis/phpredis/issues/1236
    unwanted noise (warning) not even using the extension


author: Remi Collet <remi@remirepo.net> - 4.0.0~RC1-1
changelog:
  - update to 4.0.0RC1
  - rename to php-pecl-redis4
  - enable lzf support
  - update configuration for new options


author: Remi Collet <remi@remirepo.net> - 4.0.0~RC1-3
changelog:
  - add patch to skip online test from
    https://github.com/phpredis/phpredis/pull/1304
  - exclude s390x arch reported as
    https://github.com/phpredis/phpredis/issues/1305


author: Remi Collet <remi@remirepo.net> - 4.1.0~RC1-1
changelog:
  - update to 4.1.0RC1 (alpha)
  - open https://github.com/phpredis/phpredis/pull/1365
    use PHP_BINARY instead of php and allow override
  - report https://github.com/phpredis/phpredis/issues/1364
    missing files in pecl archive
  - add new redis.session.lock* options in provided configuration


author: Remi Collet <remi@remirepo.net> - 4.1.0~RC1-2
changelog:
  - test build with 7.3
  - open https://github.com/phpredis/phpredis/pull/1366
    Fix: Warning: time() expects exactly 0 parameters, 1 given ...


author: Remi Collet <remi@remirepo.net> - 4.2.0~RC2-1
changelog:
  - update to 4.2.0RC2 (beta)
  - open https://github.com/phpredis/phpredis/issues/1437 32-bit failed test


author: Remi Collet <remi@remirepo.net> - 4.3.0~RC1-1
changelog:
  - update to 4.3.0RC1 (alpha)
    no change sincy 4.2.1RC1, only version change according to semver
    see https://github.com/phpredis/phpredis/issues/1517


author: Remi Collet <remi@remirepo.net> - 5.0.0~RC1-1
changelog:
  - update to 5.0.0RC1
  - rename to php-pecl-redis5
  - raise dependency on PHP 7
  - enable msgpack support
  - enable json support
  - update configuration for new options
  - open https://github.com/phpredis/phpredis/pull/1578
    fix extension dependencies and report about json serializer


author: Remi Collet <remi@remirepo.net> - 5.1.0~RC1-1
changelog:
  - update to 5.1.0RC1
  - enable ZSTD compression support
  - open https://github.com/phpredis/phpredis/pull/1648


author: Remi Collet <remi@remirepo.net> - 5.3.0~RC1-1
changelog:
  - update to 5.3.0RC1
  - enable lz4 compression support
  - drop patch merged upstream
  - add upstream patch to fix lz4 library name
  - add new option in provided configuration file


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


author: Cory McIntire <cory@cpanel.net> - 0.5.0-3
changelog:
  - ZC-5409: Rolling “scl-snuffleupagus” back to “63cd813641f9dd7df4ad40df37c66af353df6378”
  - Testing EA4-tool rollback procedures


author: Tim Mullin <tim@cpanel.net> - 0.5.0-5
changelog:
  - EA-8865: Add php-cli as a dependency
  - Added autotools-latest-autoconf to build with PHP73 & Cent6


author: Trinity Quirk <trinity.quirk@cpanel.net> - 1.0-9
changelog:
  - Updated all profiles to approximately match those provided by EA3
  - Added new mcrypt extension to all profiles


author: Darren Mobley <darren@cpanel.net> - 1.0-12
changelog:
  * Sun May 15 2016 Darren Mobley <darren@cpanel.net> - 1.0-12
  - Removed PHP 5.4 from profiles with PHP
  - Adding PHP 7.0 to profiles with PHP
  - Added PHP-FPM to all profiles that have PHP
  - Moved the previous default profile to a "worker" profile
  - Created a new default profile from the old ruid2 profile that uses mpm_prefork, ruid2


author: S. Kurt Newman <kurt.newman@cpanel.net> - 1.0-14
changelog:
  - Added mod_security2 apache module to default and itk profiles (EA-4655)
  - Spec file cleanup (EA-4655)


author: Sricharan Angara <charan@cpanel.net> - 1.0-15
changelog:
  - Removed duplicate PHP FPM packages for PHP 5.5, PHP 5.6 and PHP 7.0 respectively from allphp.json and allphp-opcache.json profiles. (ZC-1956)


author: Julian Brown <julian.brown@cpanel.net> - 1.0-46
changelog:
  - ZC-6297: Add PHP 7.4 to all and all opcache
  - ZC-6283: order allphp* tags lowest to highest like the rest


author: Travis Holloway <t.holloway@cpanel.net> - 1.0-55
changelog:
  - EA-10325: Update “mpm_itk worker” profile(s):  add “ea-php74”
  - EA-10325: Update “allphp allphp-opcache default mpm_itk worker” profile(s):  remove “ea-php73”


author: Brian Mendoza <brian.mendoza@cpanel.net> - 1.0-63
changelog:
  - ZC-11253: Update EA4 profiles - Add ea-php82, Remove ea-php80
  - EA4D-444: remove ea-php74-php-snuffleupagus from profiles


author: Dan Muey <dan@cpanel.net> - 1.0-67
changelog:
  - ZC-11494: Rolling “ea-profiles-cpanel” back to “562229d”: scriptlets seem to be happening out of order on a9


author: Darren Mobley <darren@cpanel.net> - 1.0-12
changelog:
  - Removed PHP 5.4 from profiles with PHP
  - Adding PHP 7.0 to profiles with PHP
  - Added PHP-FPM to all profiles that have PHP
  - Moved the previous default profile to a "worker" profile
  - Created a new default profile from the old ruid2 profile that uses mpm_prefork, ruid2


author: Rishwanth Yeddula <rish@cpanel.net> - 5.1.8-2
changelog:
  - SEC-312: Stop reading the 'REVISION' file. This addresses an
    arbitrary file read vulnerability in passenger.


author: Daniel Muey <dan@cpanel.net> - 5.3.5-3
changelog:
  - ZC-4661: Make nodejs a requirement so that if they get one they get all of them, that way Application Manager has all the bells


author: Daniel Muey <dan@cpanel.net> - 6.0.7-2
changelog:
  - ZC-7655: Provide/Conflict `apache24-passenger`
  - ZC-7897: Add version/package specific template file (and support userdata paths like nginx)


author: Rishwanth Yeddula <rish@cpanel.net> 2.4.1-3
changelog:
  - CPANEL-15622: Update rubygems to 2.6.13 to address:
    CVE-2017-0902
    CVE-2017-0899
    CVE-2017-0900
    CVE-2017-0901


author: Rishwanth Yeddula <rish@cpanel.net> 2.4.2-5
changelog:
  - PIG-3585: Refactored patches into a git format-patch patchset
    to make maintenance easier.
  - Patch the tests to ensure that multicast tests are skipped
    on systems where multicast is not available.


author: Rishwanth Yeddula <rish@cpanel.net> - 2.4.5-13
changelog:
  - EA-8124: Ensure that the test certificates are updated prior to test runs
    to avoid failures due to expired certificates.


author: Daniel Muey <dan@cpanel.net> - 8.5.24-7
changelog:
  - EA-7489: General UX Improvements
      RPM:

      - add Requires for mysql-connector-java
      - add Requires for jakarta-commons-daemon and jakarta-commons-daemon-jsvc

      cpanel script:

      - Have its Include match `/servlets?/` in subdirectories
      - Add `refresh` subcommand
      - Add --verbose support to `status` sub command
      - Add support for custom server.xml `<Host>` entry
      - Add support for custom httpd Include
      - cleanup domain’s `work/` and `conf/` files


author: Cory McIntire <cory@cpanel.net> - 8.5.32-1
changelog:
  - EA-7691: Update to 8.5.32 to handle CVEs
    CVE-2018-1304 Security constraints mapped to context root are ignored
    CVE-2018-1305 Security constraint annotations applied too late
    CVE-2018-1336 A bug in the UTF-8 decoder can lead to DoS
    CVE-2018-8014 CORS filter has insecure defaults
    CVE-2018-8034 host name verification missing in WebSocket client
    CVE-2018-8037 Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up


author: Daniel Muey <dan@cpanel.net> - 8.5.32-8
changelog:
  - ZC-4142: Change RPM to not run tomcat by default
  - ZC-3874: avoid spurious `cat: /var/run/catalina.pid: No such file or directory`
  - ZC-4081: do not remove tomcat user
  - ZC-4082: change %files so tomcat does not have write access to things it shouldn't


author: Daniel Muey <dan@cpanel.net> - 8.5.32-9
changelog:
  - ZC-4252: Adjust for private instance in jailshell
  - ZC-4198: stop/restart private instances on update/uninstall as appropriate (ZC-4202/ZC-4203)
  - ZC-4198: Make private instance default configuration more secure (ZC-4205)


author: Daniel Muey <dan@cpanel.net> - 8.5.32-10
changelog:
  - ZC-4319: Minor security improvements
  - ZC-4318: do not suppress errors from code run under dropped privileges
  - ZC-4303: do not load external DTDs or external entities in tomcat’s XML files
  - ZC-4299: set umask when doing things as the user for better permissions
  - ZC-4300: remove pointless redirectPort that is in the default setup


author: Daniel Muey <dan@cpanel.net> - 8.5.32-13
changelog:
  - ZC-4427: Fix cosmetic USER issue caused by Cpanel::AccessIds lack of setting ENV
  - Fix stop/restart scriptlet ordering


author: Tim Mullin <tim@cpanel.net> - 8.5.51-2
changelog:
  - EA-8885: Updated our setup script to handle changes to the 8.5.51 server.xml file
  - EA-8886: Set secretRequired to false for the AJP connector


author: Cory McIntire <cory@cpanel.net> - 8.5.82-1
changelog:
  - EA-10878: Update ea-tomcat85 from v8.5.81 to v8.5.82
  - Apache Tomcat XSS in examples web application CVE-2022-34305


author: Cory McIntire <cory@cpanel.net> - 8.5.83-1
changelog:
  - EA-10980: Update ea-tomcat85 from v8.5.82 to v8.5.83
  - Apache Tomcat request smuggling CVE-2022-42252


author: Cory McIntire <cory@cpanel.net> - 8.5.84-1
changelog:
  - EA-11072: Update ea-tomcat85 from v8.5.83 to v8.5.84
  - Apache Tomcat JsonErrorReportValve injection CVE-2022-45143


author: Cory McIntire <cory@cpanel.net> - 8.5.85-1
changelog:
  - EA-11177: Update ea-tomcat85 from v8.5.84 to v8.5.85
  - Apache Tomcat denial of service CVE-2023-24998


author: Cory McIntire <cory@cpanel.net> - 8.5.86-1
changelog:
  - EA-11270: Update ea-tomcat85 from v8.5.85 to v8.5.86
  - Apache Tomcat information disclosure CVE-2023-28708


author: Cory McIntire <cory@cpanel.net> - 8.5.88-1
changelog:
  - EA-11369: Update ea-tomcat85 from v8.5.87 to v8.5.88
  - Apache Tomcat denial of service CVE-2023-28709


author: Cory McIntire <cory@cpanel.net> - 8.5.94-1
changelog:
  - EA-11728: Update ea-tomcat85 from v8.5.93 to v8.5.94
  - Request smuggling CVE-2023-45648
  - Denial of Service CVE-2023-44487
  - Information Disclosure CVE-2023-42795
  - Denial of Service CVE-2023-42794


author: Darren Mobley <darren@cpanel.net> - 0.1-9
changelog:
  - HB-1952: Added support for sending an argument of --pkglist=/path/to/file
    that has a line by line list of each rpm package being handled by the
    current operation to the wildcard scripts


author: James Bowes <jbowes@redhat.com> - 0.1.8-1
changelog:
  - Require a version of rhn-client-tools that doesn't provide up2date.
  - package the translation files.


author: Pradeep Kilambi <pkilambi@redhat.com> - 0.5.3-3
changelog:
  - Resolves: #222327, #226151, #245013, #248385, #251915, #324141 
  - Resolves: #331001, #332011, #378911


author: Pradeep Kilambi <pkilambi@redhat.com> - 0.5.3-26.el6
changelog:
  - Resolves: #431082 #436043 #436804 #441265 #448012 #448044 #449726
  - Resolves: #450241 #453690 #455759 #455760 #456540 #457191  #462499


author: jesus m. rodriguez <jesusr@redhat.com> 0.5.5-1
changelog:
  - merging additional spec changes and minor edits from svn (pkilambi@redhat.com)
  - 467866 - catch the BadStatusLine and let use know that the server is
    unavailable temporarily (pkilambi@redhat.com)
  - 489396 - remove limitation of rhn auth refresh for only 401 errors (jmatthew@redhat.com)
  - Throw an InvalidRedirectionError if redirect url does'nt fetch the package
    (pkilambi@redhat.com)
  - updating translations (pkilambi@redhat.com)
  - 465340 - clean up loginAuth.pkl along with rest of the cache while yum clean
    all. This file should get recreated when the clients checks in with RHN
    again. (pkilambi@redhat.com)
  - cleanup imports (pkilambi@redhat.com)
  - 481042 - handle ssl timeout exceptions raised from m2crypto more gracefully (pkilambi@redhat.com)
  - 448245 - adding a single global module level reference to yumAction so
    rhn_check uses this for all package related actions as a single instance
    instead of reloading yum configs each time (pkilambi@redhat.com)
  - 491127 - fixing the package actions to  inspect the error codes and raise
    except (pkilambi@redhat.com)


author: John Matthews <jmatthew@redhat.com> 0.5.6-1
changelog:
  - yum operations are not getting redirected as the GET requested is formed at
    the plugin level and not through rhnlib. (pkilambi@redhat.com)
  - 467866 - Raise a more cleaner message if clients end up getting badStatusLine
    error due to 502 proxy errors (pkilambi@redhat.com)


author: Pradeep Kilambi <pkilambi@redhat.com> 0.6.1-1
changelog:
  - fixing the changelog order causing tito build to fail (pkilambi@redhat.com)
  - fixing date (pkilambi@redhat.com)
  - new build (pkilambi@redhat.com)
  - client tools merge from svn (pkilambi@redhat.com)


author: Miroslav Suchý <msuchy@redhat.com> 0.7.2-1
changelog:
  - Rhpl was removed from rhel client packages
  - use macros in spec file
  - move rhnplugin from /var/lib/yum-plugins to /usr/share/yum-plugins - it is not executable
  - versioned obsolete and provide the obsolete package
  - Fix yum-rhn-plugin requiring a version of m2crypto that doesn't exist.
  - bumping versions to 0.7.0


author: Miroslav Suchý <msuchy@redhat.com> 0.7.7-1
changelog:
  - 527412 - compute delta and write it to logs only if writeChangesToLog is set to 1
  - 527412 - Revert "fixing rhn-plugin to update package profiles through the updatePackageProfile call instead of manually setting up the delta as it causes stale package entries in the ui due to epoch being set to 0 for a no epoch packages"
  - 509342 - explicitly say, that this is example
  - 515575 - require recent rhn-client tools
  - remove no.po as Norwegian translation is for some time in nb.po, which is correct location anyway
  - remove double slash, Mandriva do not likes it
  - fix build under opensuse


author: Miroslav Suchý <msuchy@redhat.com> 0.7.8-1
changelog:
  - 437822 - python dependecy is not picked up automatically
  - 437822 - when persistent enable/disable of rhn repo is requested, do it in rhnplugin.conf
  - 514467 - when we say RHN is disabled, we may actually really disable it


author: Miroslav Suchý <msuchy@redhat.com> 0.8.1-1
changelog:
  - 504295 - retrieve and use debug level from rhncli, pass it to yum
  - 548448 - when we are doing rollback, bypass dependecy resolution


author: Miroslav Suchý <msuchy@redhat.com> 1.1.3-1
changelog:
  - 598323 - yumex do not set version (msuchy@redhat.com)
  - l10n: Updates to Chinese (China) (zh_CN) translation
    (leahliu@fedoraproject.org)
  - l10n: Updates to Spanish (Castilian) (es) translation
    (gguerrer@fedoraproject.org)
  - l10n: Updates to Russian (ru) translation (ypoyarko@fedoraproject.org)
  - cleanup - removing translation file, which does not match any language code
    (msuchy@redhat.com)
  - update po files for yum-rhn-plugin (msuchy@redhat.com)
  - l10n: Updates to German (de) translation (ttrinks@fedoraproject.org)
  - l10n: Updates to Polish (pl) translation (raven@fedoraproject.org)


author: Miroslav Suchý <msuchy@redhat.com> 1.1.4-1
changelog:
  - download scheduled package installation in advance (msuchy@redhat.com)
  - add parameter cache_only to all client actions (msuchy@redhat.com)


author: Igor Seletsky <iseletsk@cloudlinux.com> 1.1.7-1.1
changelog:
  - Added initial fastestmirror support
  - Added automated attempt to re-register system via clnreg if system is not licensed


