PHP 8.0.11, 7.4.24, 7.3.31 (CVE-2021-21706)
- Thread starter Erulezz
- Start date
CVE-2021-21706 - https://bugs.php.net/bug.php?id=81420
It relates to zip and Windows.
It relates to zip and Windows.
PHP 8 still not installing/updating pear due to popen()
Code:
Installing PEAR environment: /usr/local/php80/lib/php/
PHP Warning: Private methods cannot be final as they are never overridden by other classes in /usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar on line 339
PHP Fatal error: Uncaught Error: Call to undefined function popen() in phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/OS/Guess.php:306
Stack trace:
#0 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/OS/Guess.php(251): OS_Guess->_fromGlibCTest()
#1 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/OS/Guess.php(214): OS_Guess->_readGlibCVersionFromFeaturesHeaderFile()
#2 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/OS/Guess.php(148): OS_Guess->_detectGlibcVersion()
#3 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/OS/Guess.php(107): OS_Guess->parseSignature()
#4 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/PEAR/Dependency2.php(109): OS_Guess->__construct()
#5 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/PEAR/Downloader.php(277): PEAR_Dependency2->__construct()
#6 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/PEAR/Downloader.php(556): PEAR_Downloader->getDependency2Object()
#7 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/PEAR/Installer.php(1065): PEAR_Downloader->analyzeDependencies()
#8 phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/index.php(290): PEAR_Installer->setDownloadedPackages()
#9 /usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar(1284): require_once('...')
#10 {main}
thrown in phar:///usr/local/directadmin/custombuild/php-8.0.11/pear/install-pear-nozlib.phar/OS/Guess.php on line 306
make[1]: *** [Makefile:548: install-pear-installer] Error 255
make: *** [Makefile:553: install-pear] Error 2
Richard G
Verified User
I presume you use php-fpm?
Do you have this file still present?
if yes remove (or rename or backup it to some other place), restart all php-fpm services and try again.
Does that help?
Do you have this file still present?
/usr/local/lib/php.iniif yes remove (or rename or backup it to some other place), restart all php-fpm services and try again.
Does that help?
Don't have a php.ini there. It's a pretty basic install (Debian 10.10) I run test websites on and to test updates before rolling them out to the other servers. Running lsphp.
Just did a bunch more test compiles making adjustments. What has finally worked was changing 'secure_php=no' in custombuild options.conf and commenting out the 'disable_functions' in PHP 8's php.ini file (i probably could have just removed 'popen' from the list).
Now just need to work out how to keep secure_php on and finish the build properly.
Just did a bunch more test compiles making adjustments. What has finally worked was changing 'secure_php=no' in custombuild options.conf and commenting out the 'disable_functions' in PHP 8's php.ini file (i probably could have just removed 'popen' from the list).
Now just need to work out how to keep secure_php on and finish the build properly.
Reading though the make files it should be ignoring the php.ini file during the install, but from testing with custombuild it's reading the file. From testing it looks like everything is working properly with php. When testing with the -n option as the makefile install does in the archive, it does not read php.ini... Now reading though the custombuild script I do see specifically it is removing the -n flag for the pear install, which is what is breaking the install when you have configure the secure_php option. From the description of that section sounds like default memory option was a problem. Would have probably been better to leave the '-n' and append '-d memory_limit=whateverbytes' to solve the issue.
@smtalk
Is there any need to modify the Makefile like this in the current (2755) custom build script? Without it everything compiles fine (no problems with PHP 8 with this line commented out) with secure php enabled. (Test compiled with 7.3.31/7.4.24/8.0.11 on Debian 10.10)
All the current PHP versions (5.6/7.3/7.4/8.0) Makefiles already contain: (I think 5.4 does too)
Now I didn't check any of the really old versions, which may be the reason why that was added.
Is there any need to modify the Makefile like this in the current (2755) custom build script? Without it everything compiles fine (no problems with PHP 8 with this line commented out) with secure php enabled. (Test compiled with 7.3.31/7.4.24/8.0.11 on Debian 10.10)
Code:
(Line 14093+)
#change the pear settings to remove the -n option.
#the default memory limit was messing this up.
/usr/bin/perl -pi -e 's/PEAR_INSTALL_FLAGS = .*/PEAR_INSTALL_FLAGS = -dshort_open_tag=0 -dsafe_mode=0/' MakefileAll the current PHP versions (5.6/7.3/7.4/8.0) Makefiles already contain: (I think 5.4 does too)
Code:
# Skip all php.ini files altogether
PEAR_INSTALL_FLAGS = -n -dshort_open_tag=0 -dopen_basedir= -derror_reporting=1803 -dmemory_limit=-1 -ddetect_unicode=0Now I didn't check any of the really old versions, which may be the reason why that was added.