PHP CVE Patching

FreePBX Security
, , ,
41

Yes, there is a backported PHP 7.4 RPM for FreePBX 16 in the works, and it has gone through some QA but not nearly as full as usual, and if you’d like to help :slight_smile: then please test on a v16 machine that you don’t mind potentially scrapping (mostly because the binary package overlap is a one-way trip right now when it comes to dependencies, and, it could break other things):

yum install sangoma-devel16
yum upgrade
reboot

EDIT: The fix landed in production less than a week after the above message, so there is no longer a need to install the devel/test repos. A yum update should be sufficient (then process restarts and/or reboot.) Also users of FreePBX versions <= v16 are strongly encouraged to update to v17 ASAP!

42

Thanks for confirming, I’ve asked one of our support team to test it.

43

@here anybody else want to test the v16 fix proposal ^^^ and drop a note ?

44

First test went through fine with no errors or warnings. About to test on a couple more systems.

45

I don’t think we have anything that is lab based rather than production, but I’ve asked my guys. Back on Monday.

S

46

Another 2 systems done with no issues either so it looks to be fine from our perspective.

47

You’ve confirmed they are now on updated PHP using php -v (output ?) and what (general ?) other testing ?

48

Yes, we’ve verified the new PHP version is present and checked WebUI for any issues. No apparent issues detected since update. They may have done other checks but they’ve finished for the day so I can’t ask.

49

I have PHP 7.4.16 installed and ‘sudo yum upgrade’ shows that there are no packages marked for update. Am I good?

50

Welcome to the forums!

Did you add the testing repo sangoma-devel16 per post above PHP CVE Patching - #41 by penguinpbx ?

Following those steps, the version you should see is 7.4.33 not 7.4.16:

# php -v
PHP 7.4.33 (cli) (built: Oct 23 2026 10:26:52) ( NTS )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
    with the ionCube PHP Loader + ionCube24 v10.4.5, Copyright (c) 2002-2020, by ionCube Ltd.
    with Xdebug v2.9.8, Copyright (c) 2002-2020, by Derick Rethans

EDIT: if for some reason you didn’t see the update, even after enabling the testing repo, then try a little more step-by-step approach:

yum install sangoma-devel16
yum clean all
yum makecache
yum install php oniguruma5php fail2ban-fpbx libwebp7

…on an already-upgraded system, you should see this last bit of output:

Failed to set locale, defaulting to C
Loaded plugins: fastestmirror, versionlock
Loading mirror speeds from cached hostfile
Package php-7.4.33-31.el7.sng.x86_64 already installed and latest version
Package oniguruma5php-6.9.9-1.el7.remi.x86_64 already installed and latest version
Package fail2ban-fpbx-0.8.14-80.sng7.noarch already installed and latest version
Package libwebp7-1.0.3-2.el7.remi.x86_64 already installed and latest version
Nothing to do

(Then either an Apache restart, at minimum, or just a reboot for good measure.)

51

Two systems upgraded, not issues noticed. All inbound/outbound operational, Sangoma Phone also working as expected.

52

Fixed original post.

53

Two FPBX16 systems updated, no issues.

54

Patched FBX v16 system. No issues.

55

Apologies, I missed the detail in the previous posts that gave the proper repo information. I have followed the step-by-step approach outlined in your post, and can confirm I’m now on the more recent PHP 7.4.33. I had to reboot (as was recommended) to regain use of my web UI but other than that, I have experienced no issues thus far.

Running FreePBX v16.0.50

56

I just patched FreePBX v16 with PHP 7.4.33 and outbound/inbound calls seems fine so far. thank you @penguinpbx

57

php -v displaying the updated version isn’t the only test I’d run. Check for already running process that were running the older PHP version prior to your upgrade. Something like:

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -i ‘php.*(deleted)’

should display those process IDs. You want to make sure those processes are restarted so they use the updated php.

Learned the hard way on some FusionPBX boxes I am supporting.

58

I am using freepbx on Sangoma Linux release 7.8.2003 (Core). Can you share the reposiotory

59

Updated on 4 x freepbx 16 boxes, no isuues at all, thanks folks.

60

Upgraded on two systems, confirmed with php -v that version is 7.4.33, no issues whatsoever!