Overview
On January 18, 2016, cPanel announced that it had discovered vulnerabilities affecting all current versions of its control panel software. At the time of the announcement, cPanel issued a Targeted Security Release for each software tier, which the company said addresses 20 vulnerabilities in cPanel and WHM.
Because the issues were discovered internally by cPanel, and cPanel does not believe that there are any exploits of the vulnerabilities in the wild, they are not yet releasing any additional information on the exact nature of the issues. The company will allow sufficient time for potentially vulnerable servers to be updated before providing additional information.
Impact
- All servers running a version of cPanel/WHM lower than the versions indicated below are affected. All servers running a version of cPanel/WHM equal to or greater than those below are not affected:
- 54.0.4 (WHM 54.0 build 4) on the CURRENT and EDGE Tiers
- 11.52.2.4 (WHM 11.52.2 build 4) on the STABLE and RELEASE Tiers
- 11.50.4.3 (WHM 11.50.4 build 3) and 11.48.5.2 (WHM 11.48.5 build 2) on the Long-Term Support (LTS) Tiers
- There are no known “in the wild” exploits of the cPanel vulnerabilities at this time.
- cPanel’s regular update process automatically will download and apply the appropriate new software version for your chosen tier, addressing all known vulnerabilities.
Summary
If your cPanel server is configured to automatically check for updates, no action is required on your part, and the patch automatically will be applied at the server’s next check. If you have disabled automatic updates, you can follow the instructions in our tutorial, How To Upgrade and Patch cPanel to manually update cPanel. If you require any assistance, please contact GigaPros Support.
Is Your Server Affected?
To determine whether your cPanel server already has had the patch applied, you need only to log into WebHost Manager and check the version number, which is located at the top-center of every page in WHM:
In this example, on a server set to the CURRENT release tier, you can see that the cPanel/WHM version is 54.0.4 (54.0 build 4), and thus is not vulnerable. If you are on a different release tier (LTS, STABLE, RELEASE, or EDGE), you will need to check your version against the list above.
Resolution
The latest version of cPanel, 54.0.4 (54.0 build 4), is patched against the vulnerability. An upgrade to the current release version of cPanel/WHM will address the vulnerabilities and resolve the issues discovered by cPanel.
To upgrade, follow the instructions in our tutorial, How To Upgrade and Patch cPanel. If you require any assistance in verifying your current version or manually updating cPanel, please contact Support.
To check or change your current cPanel release tier, or ensure that automatic updates are enabled, click on “Update Preferences” in WHM’s left menu:
After changing any settings, click the “Save” button at the bottom of the page to apply them.