From 5eae232649f2a9bffbfd98bc08bb1a47ea2a8e8c Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Mon, 19 Dec 2022 14:52:37 +0100
Subject: pdo: fix #81740: PDO::quote() may return unquoted string

  CVE-2022-31631
use oracle client library version 21.8
---
 php.spec | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

(limited to 'php.spec')

diff --git a/php.spec b/php.spec
index 9a825ac..b58b04a 100644
--- a/php.spec
+++ b/php.spec
@@ -49,7 +49,7 @@
 
 %global mysql_sock %(mysql_config --socket  2>/dev/null || echo /var/lib/mysql/mysql.sock)
 
-%global oraclever 21.7
+%global oraclever 21.8
 %global oraclelib 21.1
 
 # Build for LiteSpeed Web Server (LSAPI)
@@ -110,7 +110,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name:    %{?scl_prefix}php
 Version: %{upver}%{?rcver:~%{rcver}}%{?gh_date:.%{gh_date}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -175,6 +175,7 @@ Patch91: php-7.2.0-oci8conf.patch
 # Upstream fixes (100+)
 
 # Security fixes (200+)
+Patch200: php-bug81740.patch
 
 # Fixes for tests (300+)
 # Factory is droped from system tzdata
@@ -953,6 +954,7 @@ rm ext/openssl/tests/p12_with_extra_certs.p12
 # upstream patches
 
 # security patches
+%patch200 -p1 -b .bug81740
 
 # Fixes for tests
 %patch300 -p1 -b .datetests
@@ -1670,6 +1672,19 @@ fi
 %endif
 
 
+%posttrans common
+cat << EOF
+=====================================================================
+
+  WARNING : PHP 7.4 have reached its "End of Life" in
+  November 2022. Even, if this package includes some of
+  the important security fix, backported from 8.0, the
+  UPGRADE to a maintained version is very strongly RECOMMENDED.
+
+=====================================================================
+EOF
+
+
 %{!?_licensedir:%global license %%doc}
 
 %files
@@ -1829,6 +1844,11 @@ fi
 
 
 %changelog
+* Mon Dec 19 2022 Remi Collet <remi@remirepo.net> - 7.4.33-1
+- pdo: fix #81740: PDO::quote() may return unquoted string
+  CVE-2022-31631
+- use oracle client library version 21.8
+
 * Tue Nov  1 2022 Remi Collet <remi@remirepo.net> - 7.4.33-1
 - Update to 7.4.33 - http://www.php.net/releases/7_4_33.php
 
-- 
cgit