From 0922c90661ef4431565f9d8fb8b7e306d4d8443b Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Wed, 10 Apr 2024 12:28:15 +0200
Subject: use oracle client library version 21.11 on x86_64, 19.19 on aarch64

Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
  CVE-2024-2756
Fix password_verify can erroneously return true opening ATO risk
  CVE-2024-3096
---
 php73.spec | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

(limited to 'php73.spec')

diff --git a/php73.spec b/php73.spec
index 8cb841b..795e811 100644
--- a/php73.spec
+++ b/php73.spec
@@ -30,7 +30,7 @@
 %global oraclelib 19.1
 %global oracledir 19.19
 %else
-%global oraclever 21.11
+%global oraclever 21.13
 %global oraclelib 21.1
 %global oracledir 21
 %endif
@@ -122,7 +122,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 12%{?dist}
+Release: 13%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -207,6 +207,8 @@ Patch208: php-cve-2023-0662.patch
 Patch209: php-cve-2023-3247.patch
 Patch210: php-cve-2023-3823.patch
 Patch211: php-cve-2023-3824.patch
+Patch212: php-cve-2024-2756.patch
+Patch213: php-cve-2024-3096.patch
 
 # Fixes for tests (300+)
 # Factory is droped from system tzdata
@@ -1205,6 +1207,8 @@ low-level PHP extension for the libsodium cryptographic library.
 %patch -P209 -p1 -b .cve3247
 %patch -P210 -p1 -b .cve3823
 %patch -P211 -p1 -b .cve3824
+%patch -P212 -p1 -b .cve2756
+%patch -P213 -p1 -b .cve3096
 
 # Fixes for tests
 %if 0%{?fedora} >= 25 || 0%{?rhel} >= 6
@@ -2299,6 +2303,13 @@ EOF
 
 
 %changelog
+* Wed Apr 10 2024 Remi Collet <remi@remirepo.net> - 7.3.33-13
+- use oracle client library version 21.11 on x86_64, 19.19 on aarch64
+- Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
+  CVE-2024-2756
+- Fix password_verify can erroneously return true opening ATO risk
+  CVE-2024-3096
+
 * Thu Sep 21 2023 Remi Collet <remi@remirepo.net> - 7.3.33-12
 - use oracle client library version 21.11 on x86_64, 19.19 on aarch64
 - use official Oracle Instant Client RPM
-- 
cgit