Deprecated support for IBM i v7r2 due to openssl 1.1.1 deprecation by IBM. All IBM i >= v7r3 must use at least OSS base 7.3 to be able to install/upgrade.

Fixed

• Zend Server Z-Ray Database Queries failed to update placeholder value bindings in queries view when PDOStatement::bindValue() was called multiple times for the same placeholder.
• JQD excessive memory consumption when jobs failed in combination with redirects
• JQD crashes when running HTTPS jobs when Zend Server was used in cluster mode with MySQL database
• e-mail configuration testing
• Fixed e-mail notifications for Zend Server JobQueue events
• Monitor rules import, e-mail address export/import in monitoring rules

Added

• PHP directive max_multipart_body_parts in Zend Server GUI. Parameter has been added as PHP security fix

Changed

• Zend Server GUI, Plugins Gallery, change the plugin's package download url from static.zend.com to api-plugins.zend.com

Updated

PHP Extensions

• Linux
  • memcached 3.2.0
  • mongodb (php-specific) 1.19.1/1.16.2/1.11.1
  • redis 6.0.2
  • ssh2 1.4.1
• Windows
  • imagick 3.7.0
  • redis 6.0.2 (php >= 7.2) PHP and Zend Server dependency components
• Linux, IBM i (selected components only)
  • lighttpd 1.4.76
  • zlib 1.3.1
  • libxml2 2.11.8
  • libssh2 (where needed) 1.11.0
  • openldap (selected distros only) 2.5.18
  • freetype 2.13.2
  • libimagic 6.9.13.11
  • libsodium 1.0.20
  • libzip 1.10.1
  • xerces 3.2.5
  • IBM i builds linked with OpenSSL 3.
• Windows
  • httpd 2.4.62
  • libzip 1.10.1
  • curl 8.10.1
  • imagemagick 7.1.0-18

Backported PHP CVE fixes

PHP 7.4.33.7 changes

• CGI

  • Fixed bug GHSA-p99j-rfp4-xqvq: Bypass of CVE-2024-4577, Parameter Injection Vulnerability. (CVE-2024-8926)
  • Fixed bug GHSA-94p6-54jq-9mwp: cgi.force_redirect configuration is bypassable due to the environment variable collision. (CVE-2024-8927)

• FPM

  • Fixed bug GHSA-865w-9rf3-2wh5: Logs from childrens may be altered. (CVE-2024-9026)

• SAPI

  • Fixed bug GHSA-9pqp-7h25-4f32: Erroneous parsing of multipart form data. (CVE-2024-8925)

PHP 7.3.33.12, 7.2.34.20, 7.1.33.24 changes

• CGI

  • Fixed bug GHSA-p99j-rfp4-xqvq: Bypass of CVE-2024-4577, Parameter Injection Vulnerability. (CVE-2024-8926)
  • Fixed bug GHSA-94p6-54jq-9mwp: cgi.force_redirect configuration is bypassable due to the environment variable collision. (CVE-2024-8927)

• SAPI

  • Fixed bug GHSA-9pqp-7h25-4f32: Erroneous parsing of multipart form data. (CVE-2024-8925)

Contains only PHP security fixes and updated apache, lighttpd, curl, openssl components. No changes in Zend Server

Backported PHP CVE fixes

• PHP version 7.1.33.23, 7.2.34.19, 7.3.33.11 CVE fixes

  • CGI

    • Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of CVE-2012-1823, Argument Injection in PHP-CGI (CVE-2024-4577)

  • Filter

    • Fixed bug GHSA-w8qr-v226-r27w: Filter bypass in filter_var FILTER_VALIDATE_URL (CVE-2024-5458)

Known issues

RHEL 8 upgrade may fail with the message:

Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

This problem is related to RHEL RPM package dependency resolving, and cannot be fixed in Zend Server packaging. Dependency package libaio from RHEL repository does not install for unknown reasons.

Solution: Enter the following command when this error message has been displayed, and then retry the upgrade.

sudo yum install libaio-0.3.112-1.el8.i686 liboci8-zend

Contains only PHP security fixes and updated apache, lighttpd, curl, openssl components. No changes in Zend Server

Backported PHP CVE fixes

• PHP version 7.1.33.23, 7.2.34.19, 7.3.33.11, 7.4.33.6 CVE fixes

  • CGI

    • Fixed bug GHSA-3qgc-jrrr-25jv: Bypass of CVE-2012-1823, Argument Injection in PHP-CGI (CVE-2024-4577)

  • Filter

    • Fixed bug GHSA-w8qr-v226-r27w: Filter bypass in filter_var FILTER_VALIDATE_URL (CVE-2024-5458)

• PHP version 7.4.33.6 CVE fix

  • Standard
    • Fixed bug GHSA-9fcc-425m-g385: Bypass of CVE-2024-1874 (CVE-2024-5585)

Known issues

RHEL 8 upgrade may fail with the message:

Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

This problem is related to RHEL RPM package dependency resolving, and cannot be fixed in Zend Server packaging. Dependency package libaio from RHEL repository does not install for unknown reasons.

Solution: Enter the following command when this error message has been displayed, and then retry the upgrade.

sudo yum install libaio-0.3.112-1.el8.i686 liboci8-zend

Contains only PHP and installer/packaging fixes/changes.

Backported PHP CVE fixes:

• PHP version 7.1.33.22, 7.2.34.18, 7.3.33.10 CVE fixes:
  • Standard:
    • Fixed bug GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)
    • Fix bug GHSA-h746-cjrr-wfmr: password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)

Known issues

RHEL 8 upgrade may fail with the message:

Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

This problem is related to RHEL rpm package dependency resolving and cannot be fixed in Zend Server packaging. Dependency package libaio from the RHEL repository does not install, for reasons unknown to us. A possible reason is the Oracle library dependency requiring the i686 package instead of the distro default.

Solution: Enter the following command when this error message has been displayed and then retry the upgrade:

sudo yum install libaio-0.3.112-1.el8.i686 liboci8-zend

Contains only PHP and installer/packaging fixes/changes.

Added

• Adds support for Rocky Linux 8 (x68_64 only)
  • ZS Repository Installer script updated to allow usage with Rocky Linux 8.

Backported PHP CVE fixes

• PHP version 7.1.33.22, 7.2.34.18, 7.3.33.10, 7.4.33.5 CVE fixes
  • Standard
    • Fixed bug GHSA-wpj3-hf5j-x4v4: __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix. (CVE-2024-2756)
    • Fixed bug GHSA-h746-cjrr-wfmr: password_verify can erroneously return true, opening ATO risk. (CVE-2024-3096)
• PHP version 7.4.33.5 CVE fix
  • Standard
    • Fixed bug GHSA-pc52-254m-w9w7: Command injection via array-ish $command parameter of proc_open. (CVE-2024-1874)

Known issues

RHEL 8 upgrade may fail with the message:

Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

This problem is related to RHEL RPM package dependency resolving, and cannot be fixed in Zend Server packaging. Dependency package libaio from RHEL repository does not install for unknown reasons.

Solution: Enter the following command when this error message has been displayed, and then retry the upgrade.

sudo yum install libaio-0.3.112-1.el8.i686 liboci8-zend

Security Updates

• cURL update to 8.4.0; Windows release only.
• IBM i users can download a patched version of cURL here: https://downloads.zend.com/zendserver/2019.1.4/zend-server-2019.1.4-curl-8.4.0-pase.tar.gz

Security Updates

• cURL updated to 8.4.0; Windows release only.

Contains only PHP and installer/packaging fixes/changes; no changes in Zend Server.

Backported PHP 7.1.33.21, 7.2.34.17, 7.3.33.9 CVE Fixes

• Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
• Phar: Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)

Backported PHP 7.1.33.20, 7.2.34.16, 7.3.33.8 CVE Fixes

• Soap: Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)

Backported PHP 7.1.33.19, 7.2.34.15, 7.3.33.7 CVE Fixes

• Intl: Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).

Windows

• Updated Apache v.2.4.57 in Zend Server Windows installation package

Changes

• Added Support for IBM i 7.5

Backported PHP CVE fixes

• PHP version 7.1.33.21, 7.2.34.17, 7.3.33.9, 7.4.33.4
  • Libxml: Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)
  • Phar: Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)
• PHP version 7.1.33.20, 7.2.34.16, 7.3.33.8, 7.4.33.3
  • Soap: Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)

Bugfixes

• PHP version 7.1.33.19, 7.2.34.15, 7.3.33.7
  • Intl: Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).

Windows package updates

• Apache 2.4.57

Backported PHP CVE fixes

• PHP version 7.1.33.18, 7.2.34.14, 7.3.33.6, 7.4.33.2
  • Core
    • Fixed bug #81744 (Password_verify() always return true with some hash).   (CVE-2023-0567)
    • Fixed bug #81746 (1-byte array overrun in common path resolve code).   (CVE-2023-0568)
  • FPM
    • Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart   request body). (CVE-2023-0662)
• PHP version 7.1.33.17, 7.2.34.13, 7.3.33.5, 7.4.33.1
  • PDO/SQLite: Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)

Windows Package Updates

• Apache 2.4.56 (adding also MS vs17 64-bit c++ redistributable installation)
• OpenSSL 1.1.1t
• cURL 7.88.1