We are happy to announce that cPanel, L.L.C. has released an update for EasyApache 4! Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

2021-10-27

ea-php80

ea-php80-meta

ea-php74

ea-php74-meta

scl-php73

scl-php73-meta

ea-nghttp2

ea-modsec2-rules-owasp-crs

This release includes a security patch that has been issued a fix for a CVE (Common Vulnerabilities and Exposures), the details of which are included below.

SUMMARY
cPanel, L.L.C. has updated packages for EasyApache 4 with PHP versions 8.0.12, 7.4.25, and 7.3.32. This release addresses vulnerabilities related to CVE-2021-21703. We strongly encourage all PHP 8.0 users to upgrade to version 8.0.12, all PHP 7.4 users to upgrade to version 7.4.25, and all PHP 7.3 users to upgrade to version 7.3.32.

AFFECTED VERSIONS
All versions of PHP 8.0 through 8.0.11.
All versions of PHP 7.4 through 7.4.24.
All versions of PHP 7.3 through 7.3.31.

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

We are happy to announce that cPanel, L.L.C. has released an update for EasyApache 4! Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

2021-10-7

ea-apache2

This release includes a security patch that has been issued a fix for a CVE (Common Vulnerabilities and Exposures), the details of which are included below.

SUMMARY
cPanel, L.L.C. has updated packages for EasyApache 4 with Apache 2.4.51. This release addresses vulnerabilities related to CVE-2021-42013. We strongly encourage all Apache users to upgrade to version 2.4.51.

AFFECTED VERSIONS
All versions of Apache through 2.4.50

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

We are happy to announce that cPanel, L.L.C. has released an update for EasyApache 4! Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

2021-10-6

scl-sourceguardian

ea-ruby27-passenger

ea-nghttp2

ea-apache2

This release includes a security patch that has been issued a fix for a CVE (Common Vulnerabilities and Exposures), the details of which are included below.

SUMMARY
cPanel, L.L.C. has updated packages for EasyApache 4 with Apache 2.4.50. This release addresses vulnerabilities related to CVE-2021-41773 and CVE-2021-41524. We strongly encourage all Apache users to upgrade to version 2.4.50.

AFFECTED VERSIONS
All versions of Apache through 2.4.49

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

We are happy to announce that cPanel, L.L.C. has released an update for EasyApache 4! Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

2021-9-29

ea-php74

ea-php74-meta

ea-php80

ea-php80-meta

scl-php73

scl-php73-meta

ea-nginx

ea-apache2-config

ea-cpanel-tools

This release includes a security patch that has been issued a fix for a CVE (Common Vulnerabilities and Exposures), the details of which are included below.

SUMMARY
cPanel, L.L.C. has updated packages for EasyApache 4 with PHP versions 7.3.31, 7.4.24, and 8.0.11.. This release addresses vulnerabilities related to CVE-2021-21706. We strongly encourage all PHP 7.3 users to upgrade to version 7.3.31, all PHP 7.4 users to upgrade to version 7.4.24, and all PHP 8.0 users to upgrade to version 8.0.11.

AFFECTED VERSIONS
All versions of PHP 7.3 through 7.3.30.
All versions of PHP 7.4 through 7.4.23.
All versions of PHP 8.0 through 8.0.10.

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

We are happy to announce that cPanel, L.L.C. has released an update for EasyApache 4! Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

2021-9-22

ea-nginx

libcurl

ea-tomcat85

ea-apache2

mod_security2

This release includes a security patch that has been issued a fix for a CVE (Common Vulnerabilities and Exposures), the details of which are included below.

SUMMARY
cPanel, L.L.C. has updated packages for EasyApache 4 with Apache 2.4.49 and libcurl 7.79.0. This release addresses vulnerabilities related to CVE-2021-22945, CVE-2021-22946, CVE-2021-22947, CVE-2021-40438, CVE-2021-39275, CVE-2021-36160, CVE-2021-34798, and CVE-2021-33193. We strongly encourage all Apache users to upgrade to version 2.4.49 and all libcurl users to upgrade to version 7.79.0.

AFFECTED VERSIONS
All versions of Apache through 2.4.48.
All versions of libcurl through 7.78.0.

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

cPanel has released its Targeted Security Release to address security concerns with the cPanel product. These updates are currently available to all customers via the standard update system.

cPanel has rated this update as having a CVSSv3.1 score of 3.9 to 5.3. For more information on ratings, please visit our documentation.

Is there any action required?

If you have disabled cPanel & WHM automatic updates, please update your cPanel & WHM installations at your earliest convenience.

If you have configured cPanel & WHM servers to automatically update, no action is required. Your servers have automatically been updated.

To avoid service interruptions, please ensure you are on one of the following secure versions:

8 Sept 2021

With Version 98 in STABLE cPanel & WHM Version 96 has reached End of Life. This version will now only be supported by cPanel when upgrading to a supported version.

In accordance with our EOL policy, Version 96 will continue to function on servers where it is already installed. The last release of cPanel & WHM Version 96 will remain on our mirrors indefinitely. However, no further updates, including fixes for known security flaws, will be provided for Version 96. Older releases of cPanel & WHM will be removed from our mirrors.

We recommend that all customers upgrade any existing installations of cPanel & WHM Version 96 to the most recent version of cPanel & WHM Version 98, which you can read about on https://releases.cpanel.net.

If your server setup complicates the process of upgrading to a supported version of cPanel & WHM (review the list of upgrade blockers), cPanel is here to help. Simply open a support ticket and our knowledgeable support team will provide recommendations, upgrade assistance, and more.

We are happy to announce that cPanel, L.L.C. has released an update for EasyApache 4! Take a look at some highlights below, and then join us on the cPanel Community Forums, Discord, or Reddit to talk about this update and much more. If you have additional questions, feel free to reach out on one of our social channels.

2021-9-1

apr

ea-freetds

ea-nginx

ea-openssl11

ea-php74

ea-php74-meta

ea-php80

ea-php80-meta

scl-php73

scl-php73-meta

This release includes a security patch that has been issued a fix for a CVE (Common Vulnerabilities and Exposures), the details of which are included below.

SUMMARY
cPanel, L.L.C. has updated RPMs for EasyApache 4 with OpenSSL 1.1.1l and a patch for APR 1.7.0. This release addresses vulnerabilities related to CVE-2021-35940, CVE-2021-3711, and CVE-2021-3712. We strongly encourage all OpenSSL users to upgrade to version 1.1.1l and all APR users to upgrade to the patched version 1.7.0.

AFFECTED VERSIONS
All versions of OpenSSL through 1.1.1k.
APR version 1.7.0.

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs: