Beta Branch add php-fpm brotli CVE-2026-111497 override tools/phpfpm-brotli.sh in…

add php-fpm brotli CVE-2026-111497 override tools/phpfpm-brotli.sh in 140.00beta01

Distro brotli on EL8/EL9 (1.0.6/1.0.9) lacks the CVE-2026-111497
decoder fix, and php-fpm loads it through libcurl, freetype and libjxl.
libcurl decodes brotli sent by remote servers, and on EL8/EL9 it also
decodes a server-forced Transfer-Encoding: br when the request never
asked for decoding. php-fpm now loads a source-built brotli 1.2.1 via a
systemd LD_LIBRARY_PATH drop-in until the distro package has the fix.

---

Changes:
- add tools/phpfpm-brotli.sh on|off|status: sha256 pinned brotli 1.2.1
build (GitHub, parts mirror fallback) into a new versioned directory
under /opt/brotli_php, php-fpm -t preflight, php-fpm.service drop-in,
restart and maps check with rollback
- add prepare/verify subcommands for menu 5 that never fail the menu
- retire the override once the distro brotli changelog lists the CVE or
its version includes the fix
- add PHPFPM_BROTLI_SOURCE='y' to centmin.sh
- refresh the override before the menu 5 php-fpm restart and confirm it
after the restart in inc/php_upgrade.inc
- enable the override on new installs after php-fpm starts
- split brotli_fixed_version out of brotli_version_check in inc/brotli.inc,
which now takes an optional brotli binary path

Continue reading...

140.00beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/140.00beta01
• Commit History: https://github.com/centminmod/centminmod/commits/140.00beta01