Contains only PHP and installer/packaging fixes/changes.

Backported PHP CVE fixes:

• PHP version 7.1.33.22, 7.2.34.18, 7.3.33.10 CVE fixes:
  • Standard:
    • Fixed bug GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)
    • Fix bug GHSA-h746-cjrr-wfmr: password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

Known issues

RHEL 8 upgrade may fail with the message:

Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

This problem is related to RHEL rpm package dependency resolving and cannot be fixed in Zend Server packaging. Dependency package libaio from the RHEL repository does not install, for reasons unknown to us. A possible reason is the Oracle library dependency requiring the i686 package instead of the distro default.

Solution: Enter the following command when this error message has been displayed and then retry the upgrade:

sudo yum install libaio-0.3.112-1.el8.i686 liboci8-zend

Fixed

• JobQueue HTTPS requests failure on IBM i
• Change lighttpd configuration for HTTPv.1.1 compatibility
• JobQueue incorrect behavior during DST change
•  Zend Server RPM php-sources-zend-server packages missing PHP 7.1 sources

Updated

• Upgrade angularjs to latest perforce-angular 1.8.4 in Zend Server

Backported PHP CVE fixes

• PHP versions: 7.1.33.16, 7.2.34.12, 7.3.33.4, 7.4.33
  • Fixed bug #81738: buffer overflow in hash_update() on long parameter.(CVE-2022-37454) (applies to 7.4.33 ONLY)
  • Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)
  • Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
  • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629).

Updates

• Updated to PHP 7.4.28
• Updated to 7.1.33.12
• Updated to 7.2.34.8
• Updated to 7.3.33

All above versions were rebuilt with the latest timezone database.

Backported CVE Fixes

• Fix #81708: UAF due to php_filter_float() failing for ints. Relevant for PHP 7.4 only (CVE-2021-21708)

IBM i

• The freetds library is updated to new version 1.3.9

Windows

• Windows installer update notification text change

Linux

• RPM repositories: Qt libraries package dependency fix for libicu.
• Repository installer script displays correct Zend Server Web UI port number (10101)

PHP version 7.1.33.16.

Backported CVE fixes

• Core
  • Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)
  • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629).

PHP version 5.6.40.17.

Backported CVE fixes

• Core:
  • Fixed bug #81726: phar wrapper: DOS when using quine gzip file (CVE-2022-31628).
  • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning (CVE-2022-31629).

Security Updates

• cURL update to 8.4.0; Windows release only.
• IBM i users can download a patched version of cURL here: https://downloads.zend.com/zendserver/2019.1.4/zend-server-2019.1.4-curl-8.4.0-pase.tar.gz

Added

• webp support for gd extension, linux and IBM i (ZEND-2255,2084)

Fixed

• jobqueueAddJob output in JSON format (ZEND-2244)
• ZendServer MonitorNode schema check with invalid version  (ZEND-2077)
• Vhost attach functionality with Nginx (ZEND-2351)
• Installation on RHEL8, apache php-fpm setup (ZEND-2454)
• Removed php-fpm binary from IBM i package (ZEND-2369)
• IBM i green screen ZS info page errors (ZEND-2166)
• PHP version check failure on zpk install (ZEND-1961)
• Unable to Save changes after switching GUI tabs in ZS Settings (ZEND-2249)
• Change UI License Expiration information for IBM i (suggesting ZendPHP) (ZEND-1141)
• ZDD lock issues (zend_deployment.detect_apps ignored) (ZEND-1952)
• Application defining failures (ZEND-2291)

Updated

• PHP versions 7.1.33.15 (incl. TLSv1.2 support for mysql), 7.2.34.10, 7.3.33.2, 7.4.30.
• ZendServerSDK v.1.2.1 (ZEND-2451)
• PHPToolkit for IBM i v.1.9.1 (ZEND-2161)
• angularJs update to 1.8.2 Perforce release (ZEND-2423,2434)

CVE fixes

• mysqlnd: Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
• pgsql: Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

PECL extensions updated

• IBM_DB2 extension v.2.1.5 for PHP v>=7.3 (not compatible with PHP 7.2) (ZEND-2172)
• ssh2 extension v.1.3.1 (ZEND-2165)
• pdo_ibm v.1.4.2
• imagick v.3.7.0 (Windows v.3.5.0)
• mongodb v. 1.11.1
• redis v.5.3.5

Windows

• Windows installer: changed misleading message during upgrade (PHP version change) (ZEND-2230)
• installer contains Apache 2.4.53
• MS ODBC drivers v.17 (for sqlsrv ext)
• vcredist c++ 64 bit VS2017

Linux

• lighttpd v.1.4.64

IBM i

• Support tool improvements: display created spool file location (ZEND-2167)
• Added php-cli.sh shell script on IBM i for running php scripts from green screen (ZEND-2374)
  • Sample use: CALL PGM(QP2SHELL) PARM('/usr/local/zendphp74/bin/php-cli.sh' 'test.php')
  • Script output is stored as process print file, not displayed on the terminal screen.

Extra notes

Upgrade from 2019.x.x to 2021.2.0 on RHEL8 may fail, reporting:

Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

• nothing provides libaio.so.1 needed by liboci8-zend-21.1.0.0-25.x86_64

To continue from such a situation, liboci8-zend package (new version) should be installed manually.

sudo yum install -y liboci8-zend

Then restart the upgrade sequence from the step (including) that caused the error (re-run repository installer or other method you have chosen for ZendServer upgrade).

Known problems (fix postponed)

• php-fpm restart on Linux.

  Related to PHP version change through GUI. php-fpm processes do not restart automatically. As a workaround, php-fpm should be restarted manually from the console after switching PHP version:

  sudo /usr/local/zend/bin/php-fpm.sh restart
  

• JobQueue misbehavior during DST change (DST end in October).

  Jobs scheduled during the hour of DST change get executed large number of times. No known easy workaround. One option is to temporarily disable specific jobs for the specific DST change time period.

Changes

• Default customer web server port on IBM i Apache instance changed from 10080 to 10280 (ZEND-2258)
• Updated PHP versions to 7.1.33.14, 7.2.34.9, 7.3.33.1
  • PHP CVE fixes after 2019.0.7: CVE-2021-21703, CVE-2021-21704, CVE-2021-21705, CVE-2021-21706, CVE-2021-21707
  • Backported functionality improvement for PHP 7.1: TLSv1.2 functionality for MySql
• GeoIP library dynamic linking (required due to licensing type)

Fixes

• Fix: Removed PHPRC env variable in IBMi fastcgi.conf, now proper php.ini file is being used for active php version (ZEND-1348, ZEND-1486, ZEND-1773, ZEND-2002, ZEND-1773))
• Fix: Filled Installation_UID placeholder in IBMi fastcgi.conf (ZEND-1182)
• Fix: ZendMonitor segfault (ZEND-1488)
• Fix: Buffer overflow fix (ZEND-2046)
• Fix: HTTPS GUI access on linux, lighttpd is updated to v1.4.64
• Fix: Broken jqd.ini file caused "Unable to connect to Job Queue server" (ZEND-797, ZEND-1007)
• Fix: jobqueueAddJob output in JSON format (ZEND-2127)

Updated extensions

• xdebug 2.9.8 in all versions (ZEND-1485)
• ssh2 extension v.1.3.1, libssh2 version to 1.9.0 (ZEND-2071)
• ibm_db2 2.1.5
• imagick 3.5.0 (Windows receives 3.7.0)
• mongodb 1.11.1
• pdo_ibm 1.4.2
• redis 5.3.5
• sqlsrv extension versions 5.9.0 (PHP 7.3), 5.8.1 (PHP 7.2), 5.6.1 (PHP 7.1); Windows installer sets up MS ODBC driver v 17.9
• IBM i PHP Toolkit 1.9.1 (ZEND-1367)
• ZendServerSDK to version 1.2.0 (ZEND-1224)
• Backport Olson timezonedb from latest PHP to LTS PHP versions (ZEND-2287)
• Apache v2.4.53 in Windows package
• Oracle Instant Client updated to version 18.5.0.0.0 for all PHP versions on Windows (ZEND-1801)
• MySql installer for Windows version 5.7.37, MySql server version 5.7.36 (ZEND-2389)

Added

• sqlsrv / pdo_sqlsrv extensions for Linux distributions (ZEND-1177)
• Compile GD extension with WebP support - Linux, IBM i (ZEND-2168)

Known issues

• When changing configuration parameter via GUI, sometimes the order of parameters list is shuffled after saving.(ZEND-2190)
• JobQueue email notifications not working reliably (ZEND-265)
• GUI Time Not Synced With PHP & Services (ZEND-1206)
• The export of monitor rules doesn't contain all necessary data (ZEND-2106)
• ppc64 linux not supported, planned for 2019.2.0

Contains only PHP security fixes and updated apache, lighttpd, curl, openssl components. No changes in Zend Server

Backported PHP CVE fixes

• PHP version 7.1.33.23, 7.2.34.19, 7.3.33.11, 7.4.33.6 CVE fixes

  • CGI

    • Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of CVE-2012-1823, Argument Injection in PHP-CGI (CVE-2024-4577)

  • Filter

    • Fixed bug GHSA-w8qr-v226-r27w: Filter bypass in filter_var FILTER_VALIDATE_URL (CVE-2024-5458)

• PHP version 7.4.33.6 CVE fix

  • Standard
    • Fixed bug GHSA-9fcc-425m-g385: Bypass of CVE-2024-1874 (CVE-2024-5585)

Known issues

RHEL 8 upgrade may fail with the message:

Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

This problem is related to RHEL RPM package dependency resolving, and cannot be fixed in Zend Server packaging. Dependency package libaio from RHEL repository does not install for unknown reasons.

Solution: Enter the following command when this error message has been displayed, and then retry the upgrade.

sudo yum install libaio-0.3.112-1.el8.i686 liboci8-zend

PHP version 7.1.33.13.

Changes

• Adds TLS v1.2 support for mysqlnd.

Backported CVE fixes

• Fix #79971: special character is breaking the path in xml function CVE-2021-2170729
• Fix bug #81026 (PHP-FPM oob R/W in root process leading to priv escalation) CVE-2021-2170305
• Fix #81420: ZipArchive::extractTo extracts outside of destination CVE-2021-2170602
• Fix #81211: Symlinks are followed when creating PHAR archive
• Fix #76448: Stack buffer overflow in firebird_info_cb CVE-2021-21704
• Fix #76449: SIGSEGV in firebird_handle_doer
• Fix #76450: SIGSEGV in firebird_stmt_execute
• Fix #76452: Crash while parsing blob data in firebird_fetch_blob
• Fix #81122: SSRF bypass in FILTER_VALIDATE_URL CVE-2021-2170503
• Fix #80710: imap_mail_compose() header injection