[CLSA-2026:1789783760] alt-php81: Fix of CVE-2022-31627
Type:
security
Severity:
Critical
Release date:
2026-09-19 02:09:38 UTC
Description:
- ALTPHP-2571: restore the sticky-writable mode on /opt/alt/php81/var/lib/php/session from the Debian/Ubuntu postinst - dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root user could write session data - ALTEAPLN-3: drop the hard Requires on alt-php81-fpm from alt-php81-cli, so the FPM package can be removed on servers that only use PHP Selector via lsapi. The alt-php group still installs it by default - ALTEAPLN-15: stop shipping the empty /opt/cpanel/alt-php81/root/etc/php-fpm.d/_.conf placeholder as a packaged file. cPanel reads any *.conf there as an enabled FPM pool and kept restarting alt-php81-fpm on servers that never use FPM. It is now a ghost entry that the post-install scriptlet creates only when cPanel is absent, where it still silences php-fpm's include-glob warning. Creating it instead of shipping-then-deleting also keeps package verification clean: the old approach left every cPanel server reporting the file as missing. The placeholder now belongs to alt-php81-php-fpm rather than alt-php81-common, since it exists only to silence a php-fpm warning, and on Debian the new -php-fpm postrm deletes it on package removal, which dpkg cannot do for a file no package owns. The ghost entry now carries an explicit 0644 mode, and both post-install scriptlets create the file with exactly that mode, because rpm verifies the mode of a ghost file even though it skips the existence and digest checks. The recorded user and group are left as this version already had them The default www pool is removed on cPanel hosts too, the same way as _.conf. cPanel writes its own per-domain pool under /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its API - verified serving a request with SAPI fpm-fcgi from that pool alone - so the shipped default pool was only letting the service run on hosts that never use FPM. It is still shipped and used off cPanel - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied to alt-php73 and alt-php82-85 but missed on this version, so on el8 pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli) and configure failed with "Package 'libbrotlidec', required by 'libcurl', not found". - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no rotate directive, so logrotate applied its default of 0 and deleted the previous log on every rotation, leaving no error-log history at all. Found while adding this config to php53-55, which had none
CVEs fixed:
Updated packages:
  • alt-php81-8.1.34-28.el9.x86_64.rpm
    sha:db650a867c56a39fbd11ba1f15afb21b93b1ac8fce16b266385e15c180c3c853
  • alt-php81-bcmath-8.1.34-28.el9.x86_64.rpm
    sha:adcaf37e57263c09cdb4fd571f976fa4dd75eece9322edf3fcd0715cbfe0d54e
  • alt-php81-cli-8.1.34-28.el9.x86_64.rpm
    sha:9952b4718131331f065909a7b75ef59c6f2a97da687026ff4684d7698a4aeb13
  • alt-php81-common-8.1.34-28.el9.x86_64.rpm
    sha:8132ced4a23e5dbc738ab96f6824799b153dc57f312227f8b050c4c577a670b4
  • alt-php81-dba-8.1.34-28.el9.x86_64.rpm
    sha:7cb430569a1133f3d291c25656101888d54f3158f91a79b68a9762319b583aed
  • alt-php81-devel-8.1.34-28.el9.x86_64.rpm
    sha:dbf255be69e0362e84b111bbb15eb6fe99a4789fd89255ba7c5d41b72359eef7
  • alt-php81-enchant-8.1.34-28.el9.x86_64.rpm
    sha:975ed2ce21873033593c13a397b18cc95c1d5df24589d2499a175d367c98f9a3
  • alt-php81-firebird-8.1.34-28.el9.x86_64.rpm
    sha:00dfc852ee4455f91438312cbd66e1432ff37ecb088420b2b1f5c0af52e48e48
  • alt-php81-gd-8.1.34-28.el9.x86_64.rpm
    sha:e6dec460d90a22c6d35ff0e44036ee406bc643a637b68e558d4ca4be3c5e67b9
  • alt-php81-gmp-8.1.34-28.el9.x86_64.rpm
    sha:644d7ab8d50dc5e266d49a7f7e86226875be791ac36ddb3c907b653872152dc9
  • alt-php81-imap-8.1.34-28.el9.x86_64.rpm
    sha:7f17ab60fa748929d78711a173046b05fa026cf50d8b3b7321e3e0d187fd6725
  • alt-php81-intl-8.1.34-28.el9.x86_64.rpm
    sha:a9f5fd021d001d802011cadd222e49aee2458477e5aab5e527f779fe2e0c336f
  • alt-php81-ldap-8.1.34-28.el9.x86_64.rpm
    sha:7a2876d6ca27fa0c9bd053d297104573cb749a7790c8d9cfa6b8f908b8b7cf9a
  • alt-php81-mbstring-8.1.34-28.el9.x86_64.rpm
    sha:e1e9f5c068104d933db2755f84d94cd11d92a31b393aa2ed00738eaf1d681218
  • alt-php81-mysqlnd-8.1.34-28.el9.x86_64.rpm
    sha:16e093b7f99720e1b124deadba307b89f0c924d5b28f1e3d821833d906a10018
  • alt-php81-odbc-8.1.34-28.el9.x86_64.rpm
    sha:be658f5b3c1ec6dd4364c26353408eca328bca6873c0ed0f61bd1b01f4b54116
  • alt-php81-opcache-8.1.34-28.el9.x86_64.rpm
    sha:1aab2e91e4d7f728b392d3e44131f00c2a212fd2726bd0b189f8fa83bb33c054
  • alt-php81-pdo-8.1.34-28.el9.x86_64.rpm
    sha:4a2ff18483b8ca2b337e8f42a4935d83afb800bb175b41123d9cd23105fb2067
  • alt-php81-pgsql-8.1.34-28.el9.x86_64.rpm
    sha:d9887dc35c79f24c9b3c77402e01c484fea76128cc89bea4b1cb597d121a7e0a
  • alt-php81-php-fpm-8.1.34-28.el9.x86_64.rpm
    sha:a02a7968c5f01b335ae3ac9deafbd556d5d4a405d902e787b01128d7f950a82a
  • alt-php81-process-8.1.34-28.el9.x86_64.rpm
    sha:f2ab7c8fdf69d9cee8148dfa608343f824356d5d17d47a130e3cafa117fe240a
  • alt-php81-pspell-8.1.34-28.el9.x86_64.rpm
    sha:4cf7535438f7e60e98186731fe28aeb4c6eb1cd29c2ff22ff0c2ae94d6064a04
  • alt-php81-snmp-8.1.34-28.el9.x86_64.rpm
    sha:a5dc281c5f9a5dc4f9ae3649dce99cc38d7954e4396267d1970b59d8eb455647
  • alt-php81-soap-8.1.34-28.el9.x86_64.rpm
    sha:cc22cdedb3a3cf92056a0ee36daa9f270c4fff057486e09dec05319ec276d19e
  • alt-php81-sodium-8.1.34-28.el9.x86_64.rpm
    sha:cbda50ec3cea1bbd573f6e5e3263ff11814d31b3caad49643cbd514c632e033f
  • alt-php81-tidy-8.1.34-28.el9.x86_64.rpm
    sha:8c55fd83ff60ee615e512d350516a37e5461e17062687c0eb72be29167b9ee54
  • alt-php81-xml-8.1.34-28.el9.x86_64.rpm
    sha:e9ced46e1ec3002788bb2c3a9559db8b5e0dc4b285d2569c558bd092bb3d69b9
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.