-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 07 May 2024 02:47:26 +0200
Source: php7.3
Architecture: source
Version: 7.3.31-1~deb10u6
Distribution: buster-security
Urgency: high
Maintainer: Debian PHP Maintainers <team+pkg-php@tracker.debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Changes:
php7.3 (7.3.31-1~deb10u6) buster-security; urgency=high
.
* Non-maintainer upload by the LTS Security Team.
* Fix CVE-2024-2756: Due to an incomplete fix to CVE-2022-31629, network and
same-site attackers can set a standard insecure cookie in the victim's
browser which is treated as a __Host- or __Secure- cookie by PHP
applications.
* Fix CVE-2024-3096: If a password stored with password_hash starts with a
null byte (\x00), testing a blank string as the password via
password_verify() will incorrectly return true.
* d/p/CVE-2023-3823.patch: Also backport upstream commit 62228a25685 (a
no-op on Linux.)
Checksums-Sha1:
3f3cc4a570e87184ebf3b3f6af4f95d6a712e8bd 5867 php7.3_7.3.31-1~deb10u6.dsc
dd58696a4287a4ad99145305e6ba8af375ed8510 86992 php7.3_7.3.31-1~deb10u6.debian.tar.xz
92a5fd56cb61aab5a319ee28b0601884cd14a7e5 35906 php7.3_7.3.31-1~deb10u6_amd64.buildinfo
Checksums-Sha256:
2aea4fd63d9b4c986a49f99c60ef7fdbecc54d26f3afd40fdabb78e49db9588d 5867 php7.3_7.3.31-1~deb10u6.dsc
a306ee0b9dad8b5566483a17f56da5f9a5c08d4233819347ca140204b65842b7 86992 php7.3_7.3.31-1~deb10u6.debian.tar.xz
e8cc29adba8f45c91a5bce4e217a4e26c436c867da53a5c56d17ddcd9ac580e1 35906 php7.3_7.3.31-1~deb10u6_amd64.buildinfo
Files:
f151f11801207262583c6300b75885ef 5867 php optional php7.3_7.3.31-1~deb10u6.dsc
71bf69cec419ce379c44d132cef55ab8 86992 php optional php7.3_7.3.31-1~deb10u6.debian.tar.xz
8f167c0fa62ed329350d09ab442ec58f 35906 php optional php7.3_7.3.31-1~deb10u6_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmY6QmEACgkQ05pJnDwh
pVK1yhAAs+682vPubwLN2R28wkO0BEtF4PFSCK7JvZhgUsE51lE/UvgJX3VAdXuD
WaB2jMGfD218bt+G+gn4Fs8/jO+20df/AJLfR3prkX/d+HtWpLZ1G2X0CGXSkY6m
D3vUfgZSG2am98Ieh4syxAXg9eZ6tPN8kriupoN6oS3LOLm0xf8J+BaS4Wd5i11z
dnuG/QX3ARrRrEpUXSccTE5AyOyM2/uy3eHEqn/K5y/ZvPubkqkgaVNiBXV87aJR
6Gcta+ixJ4reuQxmuv5ZH/4D56P0A9SwebX3D2rjiOJsIRONi5ZPKO86j+Q5y1/c
m5aLsoyvxE6W5Dr9aNoarhzb6SSB6PTUpCHCtj4iMSsEarg9qtv7GtQIWqhASCDP
sifxeNtZavV8vFuWFuJX0ZzHq5oHGoe4Y1EVwTFNCD5ynqPi8w7SwMhO3TVE67Ng
Sws2a2J2QB/d4RFyREird8zD2/cVjYTMiLxwjFs8Y0wUU41/O3xiFAte8DjSg9Jf
lH6V445W6ps1ao04qGulvQ5kW4pDdYf6G2FO+SAa6WNKNI9RAf7obXM4pck/Yp7p
YIJhqsJO9Xgba47WUcnDxqXb+TCvtfZXkEdoNDQUGh+x3Nx7XfiRPcbt3e/vfcZa
9rTustb4JFK0QXKPh5TSefDhTCP5wrJ8EWcZsfMDd4/vxuuZXTg=
=lKW1
-----END PGP SIGNATURE-----
Attachment:
pgphu9Vt0D6Ho.pgp
Description: PGP signature