Fix #77423 FILTER_VALIDATE_URL accepts URLs with invalid userinfo

  CVE-2020-7071

1 files changed, 10 insertions, 2 deletions

diff --git a/php72.spec b/php72.spec
index 8f002e8..5faf838 100644
--- a/php72.spec
+++ b/php72.spec
@@ -35,7 +35,7 @@
 
 %else
 %ifarch x86_64
-%global oraclever 19.8
+%global oraclever 19.9
 %else
 %global oraclever 19.6
 %endif
@@ -124,7 +124,7 @@
 Summary: PHP scripting language for creating dynamic web sites
 Name: php
 Version: %{upver}%{?rcver:~%{rcver}}
-Release: 1%{?dist}
+Release: 2%{?dist}
 # All files licensed under PHP version 3.01, except
 # Zend is licensed under Zend
 # TSRM is licensed under BSD
@@ -190,6 +190,7 @@ Patch91: php-7.2.0-oci8conf.patch
 # Upstream fixes (100+)
 
 # Security fixes (200+)
+Patch200: php-bug77423.patch
 
 # Fixes for tests (300+)
 # Factory is droped from system tzdata
@@ -225,6 +226,7 @@ BuildRequires: bzip2
 BuildRequires: perl
 BuildRequires: autoconf
 BuildRequires: automake
+BuildRequires: make
 BuildRequires: %{?dtsprefix}gcc
 BuildRequires: %{?dtsprefix}gcc-c++
 BuildRequires: libtool
@@ -437,6 +439,7 @@ Requires: php-cli%{?_isa} = %{version}-%{release}
 # always needed to build extension
 Requires: autoconf
 Requires: automake
+Requires: make
 Requires: gcc
 Requires: gcc-c++
 Requires: libtool
@@ -1123,6 +1126,7 @@ low-level PHP extension for the libsodium cryptographic library.
 # upstream patches
 
 # security patches
+%patch200 -p1 -b .bug77423
 
 # Fixes for tests
 %if 0%{?fedora} >= 25 || 0%{?rhel} >= 6
@@ -2223,6 +2227,10 @@ fi
 
 
 %changelog
+* Mon Jan  4 2021 Remi Collet <remi@remirepo.net> - 7.2.34-2
+- Fix #77423 FILTER_VALIDATE_URL accepts URLs with invalid userinfo
+  CVE-2020-7071
+
 * Wed Sep 30 2020 Remi Collet <remi@remirepo.net> - 7.2.34-1
 - Update to 7.2.34 - http://www.php.net/releases/7_2_34.php