                                                                   Revision: 1.1
--------------------------------------------------------------------------------
Package            fix-evo4-2shell.cbsa

Version            any, the installed version does not change

Required version   any

Support models     Evolution Box with Ubuntu 14.04 (evo4)

--------------------------------------------------------------------------------
WHAT THIS PACKAGE DOES

 It closes two vulnerabilities on the Evolution Box with Ubuntu 14.04, which
 gets no public fix for either:

  1. pg2shell (CVE-2025-8714), which lets a crafted project (.cbse) run code
     on the Evolution Box when it is imported: a plain PostgreSQL dump can
     carry psql meta-commands that run as a shell on restore.

     The PostgreSQL 9.3 client (psql) is upgraded to ours, version
     9.3.24-0ubuntu0.14.04+evo1, which refuses those meta-commands, and
     Evolution's restore wraps an imported project so that psql refuses
     them. The database server is not touched and is not restarted. A
     legitimate project, old or new, imports exactly as before.

  2. php2shell (CVE-2026-109618), a critical vulnerability that lets anyone
     who reaches the web of the Evolution Box run code on it, without a user
     or password.

     PHP is upgraded to ours, PHP 5.5.9 of Ubuntu with the fix, version
     5.5.9+dfsg-1ubuntu4.29+evo1. Only the PHP packages already installed are
     upgraded, with their configuration. It also turns off
     session.upload_progress in the PHP configuration, which Evolution does
     not use.

 New in revision 1.1: the fix of pg2shell.

--------------------------------------------------------------------------------
NOTES

 The package carries the PostgreSQL client and PHP, and needs no internet.

 The Evolution Box doesn't need to reboot, and the web stays up: the next
 import and each request already use the fixed versions.

 The restore script there was is kept in /var/backups/evolution/.

 If the installation fails, it says so and the PHP and the PostgreSQL client
 there were keep running. Fix the cause and install the package again.

--------------------------------------------------------------------------------
LIMITATIONS

 Only for Ubuntu 14.04: on any other Evolution Box it changes nothing and says
 so. Those need fix-php2shell-offline.cbsa and fix-pg2shell-offline.cbsa.

 If the restore script of the Evolution Box was changed by hand, it is left as
 it is and the installation says so: it has to be changed by hand.

 CVE-2026-109619, the other half of php2shell, does not apply to an evo4: each
 request runs in a new PHP process.

 A crafted project can still run SQL as a database superuser when it is
 imported. That is a different issue, fixed separately.
