summaryrefslogtreecommitdiffstats
path: root/php.spec
diff options
context:
space:
mode:
Diffstat (limited to 'php.spec')
-rw-r--r--php.spec12
1 files changed, 11 insertions, 1 deletions
diff --git a/php.spec b/php.spec
index bc2e404..86b91f0 100644
--- a/php.spec
+++ b/php.spec
@@ -126,7 +126,7 @@
Summary: PHP scripting language for creating dynamic web sites
Name: %{?scl_prefix}php
Version: %{upver}%{?rcver:~%{rcver}}%{?gh_date:.%{gh_date}}
-Release: 4%{?dist}
+Release: 5%{?dist}
# All files licensed under PHP version 3.01, except
# Zend is licensed under Zend
# TSRM is licensed under BSD
@@ -205,6 +205,8 @@ Patch91: php-7.2.0-oci8conf.patch
# Upstream fixes (100+)
# Security fixes (200+)
+Patch200: php-cve-2024-2756.patch
+Patch201: php-cve-2024-3096.patch
# Fixes for tests (300+)
# Factory is droped from system tzdata
@@ -989,6 +991,8 @@ rm ext/openssl/tests/p12_with_extra_certs.p12
# upstream patches
# security patches
+%patch -P200 -p1 -b .cve2756
+%patch -P201 -p1 -b .cve3096
# Fixes for tests
%patch -P300 -p1 -b .datetests
@@ -1881,6 +1885,12 @@ EOF
%changelog
+* Wed Apr 10 2024 Remi Collet <remi@remirepo.net> - 8.0.30-5
+- Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
+ CVE-2024-2756
+- Fix password_verify can erroneously return true opening ATO risk
+ CVE-2024-3096
+
* Wed Mar 6 2024 Remi Collet <remi@remirepo.net> - 8.0.30-4
- use oracle client library version 21.13 on x86_64
- patch test suite for zlib-ng