[CLSA-2026:1788347703] Fix CVE(s): CVE-2024-11235
Type:
security
Severity:
Important
Release date:
2026-09-02 11:15:21 UTC
Description:
* ALTEAPLN-3: no change to the Debian packaging - alt-php82-cli has never depended on the FPM package here. Recorded for parity with the RPM side, where a hard Requires was dropped so the FPM package can be removed on servers that only use PHP Selector via lsapi * ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php82/root/etc/php-fpm.d/_.conf placeholder in the package. cPanel counts any *.conf in that directory as an enabled FPM pool and kept restarting alt-php82-fpm through chkservd on servers that never use FPM, even with the unit disabled. The alt-php82-php-fpm post-install script now creates the file with mode 0644 only when cPanel is absent - the only case where it is wanted, to silence php-fpm's include-glob warning - and deletes it when cPanel is present. Since no package owns the file any more, a new -php-fpm postrm removes it on remove and purge, so a stray *.conf cannot be left behind to re-trigger this bug if cPanel is installed later The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel * ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
CVEs fixed:
Updated packages:
  • alt-php82_8.2.33-2_amd64.deb
    sha:cbbb1f004950d26eab787a165a647363bbd429f7
  • alt-php82-bcmath_8.2.33-2_amd64.deb
    sha:7e76f964f0bf061c281c5c0f10a9f2c91a04da2a
  • alt-php82-cli_8.2.33-2_amd64.deb
    sha:c6af025ab85dfb3eb85370b9556e65df750377a9
  • alt-php82-common_8.2.33-2_amd64.deb
    sha:d27e858bfc427d7c94d610f554d9aa357f8af719
  • alt-php82-dba_8.2.33-2_amd64.deb
    sha:f73d10f5e6baf3475a11077e937fcaf68d451d13
  • alt-php82-dev_8.2.33-2_amd64.deb
    sha:ac30706f0c14a0685ec7dec914b8ae3b078e628d
  • alt-php82-enchant_8.2.33-2_amd64.deb
    sha:b7c402375e8584db2dcd6a44e9f56741d0a91e70
  • alt-php82-firebird_8.2.33-2_amd64.deb
    sha:628351d8458b100cb881ef934f94c20fac11a888
  • alt-php82-gd_8.2.33-2_amd64.deb
    sha:5881e1f7ff215d3388bc62181c1c428ec58f89c0
  • alt-php82-imap_8.2.33-2_amd64.deb
    sha:9759ce035067ffda49e347fffe096dbc76a9e793
  • alt-php82-intl_8.2.33-2_amd64.deb
    sha:20f3c4644bfd1440405b0151f8456f6b3b91167f
  • alt-php82-ldap_8.2.33-2_amd64.deb
    sha:adc9fdb676aa55b8fdfceffb1c870955e380ff5c
  • alt-php82-mbstring_8.2.33-2_amd64.deb
    sha:8e0b1328d13055c007dc8b618340faea406f92e2
  • alt-php82-mysqlnd_8.2.33-2_amd64.deb
    sha:f0d14ae6e9448348119a843a0eaf17b3cab39f93
  • alt-php82-odbc_8.2.33-2_amd64.deb
    sha:2f1adf1a1e7f2b10933fe6c24a259f8deef4eadf
  • alt-php82-opcache_8.2.33-2_amd64.deb
    sha:b7d2101e8dccfc4cef2ec3e60fde879f9614d7a9
  • alt-php82-pdo_8.2.33-2_amd64.deb
    sha:1d3d8bd2da87f445fb89f5d77ed44ff05bd0b25c
  • alt-php82-pgsql_8.2.33-2_amd64.deb
    sha:ef76cbb6ee6f46e28a28ba419933fdcbe33d2814
  • alt-php82-php-fpm_8.2.33-2_amd64.deb
    sha:2332e9588a781830d61ff556dd171dfcf7b92fdd
  • alt-php82-process_8.2.33-2_amd64.deb
    sha:5f989f583bc24dac5d2bd2b21dee0191b1cfc292
  • alt-php82-pspell_8.2.33-2_amd64.deb
    sha:74666039577832d538c0c5e27c1b76c2d919b1ac
  • alt-php82-snmp_8.2.33-2_amd64.deb
    sha:90125072b7377816f77a06e57c58f05af729603a
  • alt-php82-soap_8.2.33-2_amd64.deb
    sha:08d3c61a1d669acd4be4fe5133257917e30fc49c
  • alt-php82-sodium_8.2.33-2_amd64.deb
    sha:5ae43efd77de536d097419856510cd2ab9d95e90
  • alt-php82-tidy_8.2.33-2_amd64.deb
    sha:bea686b570d26b6b094752b1256cba1dbc024761
  • alt-php82-xml_8.2.33-2_amd64.deb
    sha:99f59952d463740161e716f47667d6c080db8c77
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.