Critical PHP updates

Hi everyone, I'm running CentOS 7 with DirectAdmin v1.668 (bca79c43d780533cba222b06b8210ccc3357cf70), and my PHP 8.3 installation is stuck on version 8.3.21. I'm unable to update DirectAdmin or upgrade PHP to the latest patched version. Is there any way to apply the recent security patches while staying on this setup?

I'm planning to upgrade the OS as soon as possible, but I need to keep the server secure until then. What would be the safest approach to mitigate these vulnerabilities on my current setup?
 
fln said:
The versions with * symbol means PHP version is the same, but we added new patches for that particular PHP release.

Note: we have noticed PHP 8.1 does not build cleanly on some systems with the latest patch.
Click to expand...
copy that. there is an inconsistency with the Zend installation on almalinux 10. not sure about 9 yet.
 
I was wondering if anyone can help me with the following. As many others, I'm currently in the process of updating alle versions of PHP within DirectAdmin. I am however running into an issue with the patch for PHP 8.1, which is the following:

Code: 
download_cached: downloading 'https://www.php.net/distributions/php-8.1.25.tar.gz' to '/usr/local/directadmin/custombuild/cache/php-8.1.25.tar.gz'
Patching PHP 8.1 ...
patching file ext/xml/compat.c
Hunk #1 FAILED at 376.
1 out of 1 hunk FAILED -- saving rejects to file ext/xml/compat.c.rej
patching file ext/xml/tests/gh14834.phpt
patch_dir_apply: failed to apply '/usr/local/directadmin/custombuild/patches/php-8.1/001-libxml2-with-pear-compat.patch' patch
install_php: failed to compile '/usr/local/directadmin/custombuild/cache/php-8.1.25.tar.gz' inside '/usr/local/directadmin/custombuild/tmp/tmp.CirSjjm2DO.php-8.1.25.tar.gz'

As far as I understand, 'Hunk #1 FAILED' has something to do with the patchfile itself, so I'm not quite sure if I would be able to sort this out myself.
 
onurs said:
Hi everyone, I'm running CentOS 7 with DirectAdmin v1.668 (bca79c43d780533cba222b06b8210ccc3357cf70), and my PHP 8.3 installation is stuck on version 8.3.21. I'm unable to update DirectAdmin or upgrade PHP to the latest patched version. Is there any way to apply the recent security patches while staying on this setup?

I'm planning to upgrade the OS as soon as possible, but I need to keep the server secure until then. What would be the safest approach to mitigate these vulnerabilities on my current setup?
Click to expand...
You can try:
Code: 
echo "php83:8.3.36:" >> /usr/local/directadmin/custombuild/custom_versions.txt
da build php 8.3
if it finishes OK, then it should be updated to the one with the fix. If no, then only OS update or migration of DA users to the server with newer OS.

UPDATE: I think it will not help, at least on my CentOS 7.9:
Code: 
520 |     EXPAND_IPV6_ADDRESS(ipbuffer, ASN1_STRING_get0_data(san->d.iPAddress));
      |     ^~~~~~~~~~~~~~~~~~~
make: *** [Makefile:898: ext/openssl/xp_ssl.lo] Error 1
make: *** Waiting for unfinished jobs....
install_php: failed to compile '/usr/local/directadmin/custombuild/cache/php-8.3.36.tar.gz' inside '/usr/local/directadmin/custombuild/tmp/tmp.lXpjD7P9dL.php-8.3.36.tar.gz'
[root@server ~]#
 
I have this with build versions:

Code: 
Latest version of PHP 7.4: 7.4.33
Installed version of PHP 7.4: 7.4.33

Is this patched? of should i must see a star like this?:

Installed version of PHP 7.4: 7.4.33*
 
Aar said:
I have this with build versions:

Code: 
Latest version of PHP 7.4: 7.4.33
Installed version of PHP 7.4: 7.4.33

Is this patched? of should i must see a star like this?:

Installed version of PHP 7.4: 7.4.33*
Click to expand...
Check : custombuild/patches/php-7.4/143-php-7.4-cve-2026-109618.patch
 
romans said:
You can try:
Code: 
echo "php83:8.3.36:" >> /usr/local/directadmin/custombuild/custom_versions.txt
da build php 8.3
if it finishes OK, then it should be updated to the one with the fix. If no, then only OS update or migration of DA users to the server with newer OS.

UPDATE: I think it will not help, at least on my CentOS 7.9:
Code: 
520 |     EXPAND_IPV6_ADDRESS(ipbuffer, ASN1_STRING_get0_data(san->d.iPAddress));
      |     ^~~~~~~~~~~~~~~~~~~
make: *** [Makefile:898: ext/openssl/xp_ssl.lo] Error 1
make: *** Waiting for unfinished jobs....
install_php: failed to compile '/usr/local/directadmin/custombuild/cache/php-8.3.36.tar.gz' inside '/usr/local/directadmin/custombuild/tmp/tmp.lXpjD7P9dL.php-8.3.36.tar.gz'
[root@server ~]#
Click to expand...
We seem to manage one server for our customers that's not been updated because they couldn't. What's the alternative that's not migrating all customers off in a hurry?
 
Aar said:
I have this with build versions:

Code: 
Latest version of PHP 7.4: 7.4.33
Installed version of PHP 7.4: 7.4.33

Is this patched? of should i must see a star like this?:

Installed version of PHP 7.4: 7.4.33*
Click to expand...
I believe it's actually the reverse. If you have an asterisk on the installed version it means there is an update (with the same version number) that needs to be installed. Once the update completes there is no longer an asterisk.
 
onurs said:
Hi everyone, I'm running CentOS 7 with DirectAdmin v1.668 (bca79c43d780533cba222b06b8210ccc3357cf70), and my PHP 8.3 installation is stuck on version 8.3.21. I'm unable to update DirectAdmin or upgrade PHP to the latest patched version. Is there any way to apply the recent security patches while staying on this setup?

I'm planning to upgrade the OS as soon as possible, but I need to keep the server secure until then. What would be the safest approach to mitigate these vulnerabilities on my current setup?
Click to expand...
Same situation here. I'm also running CentOS 7 with DirectAdmin 1.668, PHP 8.3.21 and PHP 7.4.33.

Is there any way to manually apply the security patches or compile the latest patched PHP versions using CustomBuild without upgrading the OS immediately?

Any temporary workaround would be greatly appreciated. Thanks!
 
Imunify360 is already blocking attempts to exploit... Lets hope they update CloudLinux packages quickly.
 
No update for 5.6, not sure if its ok but i get advise to add in php,ini:
session.upload_progress.enabled = Off
session.use_strict_mode = 1
 
fln said:
PHP versions 7.3 - 5.6 does not yet have a patch, we wanted to release what we have as soon as possible. Once we have patches for older PHP we will release them.
Click to expand...


I can imagine you're all quite busy right now, and we appreciate the work. It would be helpful if you could post an update when patches for 7.3 - 5.6 become available, so we know when we (I?) can start patching our legacy systems (PHP < 8.1 == bad; yes, yes, I know...)
 
Last edited:
You must log in or register to reply here.
Back
Top