# changelog

author: Remi Collet <remi@remirepo.net> - 7.2.34-16
changelog:
  - fix #81744: Password_verify() always return true with some hash
    CVE-2023-0567
  - fix #81746: 1-byte array overrun in common path resolve code
    CVE-2023-0568
  - fix DOS vulnerability when parsing multipart request body
    CVE-2023-0662


author: Remi Collet <remi@remirepo.net> - 7.2.34-17
changelog:
  - Fix Missing error check and insufficient random bytes in HTTP Digest
    authentication for SOAP
    GHSA-76gg-c692-v2mw  CVE-2023-3247
  - use oracle client library version 21.10


author: Remi Collet <remi@remirepo.net> - 7.2.34-19
changelog:
  - Fix Security issue with external entity loading in XML without enabling it
    GHSA-3qrf-m4j2-pcrr CVE-2023-3823
  - Fix Buffer mismanagement in phar_dir_read()
    GHSA-jqcx-ccgc-xwhv CVE-2023-3824
  - move httpd/nginx wants directive to config files in /etc


author: Remi Collet <remi@remirepo.net> - 7.2.34-20
changelog:
  - use oracle client library version 21.11 on x86_64, 19.19 on aarch64
  - use official Oracle Instant Client RPM


author: Remi Collet <remi@remirepo.net> - 7.2.34-21
changelog:
  - use oracle client library version 21.13 on x86_64, 19.19 on aarch64
  - Fix __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
    CVE-2024-2756
  - Fix password_verify can erroneously return true opening ATO risk
    CVE-2024-3096


author: Remi Collet <remi@remirepo.net> - 7.2.34-24
changelog:
  - Fix Bypass of CVE-2012-1823, Argument Injection in PHP-CGI
    CVE-2024-4577
  - Fix Bypass of CVE-2024-4577, Parameter Injection Vulnerability
    CVE-2024-8926
  - Fix cgi.force_redirect configuration is bypassable due to the environment variable collision
    CVE-2024-8927
  - Fix Erroneous parsing of multipart form data
    CVE-2024-8925


