From: Stanislav Malyshev <stas@php.net>
Date: Tue, 29 Sep 2020 17:09:33 +0000 (-0700)
Subject: [ci skip] Add 7.3.23 security fixes to NEWS
X-Git-Tag: php-7.3.24RC1~25
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ae95d06f68768054fa3c4986d4cda24aca275541;p=php

[ci skip] Add 7.3.23 security fixes to NEWS
---

diff --git a/NEWS b/NEWS
index a090a64eee..214c5ac342 100644
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,8 @@ PHP                                                                        NEWS
   . Fixed bug #80048 (Bug #69100 has not been fixed for Windows). (cmb)
   . Fixed bug #80049 (Memleak when coercing integers to string via variadic
     argument). (Nikita)
+  . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` 
+    cookies can be sent). (CVE-2020-7070) (Stas)
 
 - Calendar:
   . Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
@@ -52,6 +54,10 @@ PHP                                                                        NEWS
   . Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode
     handlers changed). (SammyK)
 
+- OpenSSL:
+  . Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 
+    bytes IV). (CVE-2020-7069) (Jakub Zelenka)
+
 - PDO:
   . Fixed bug #80027 (Terrible performance using $query->fetch on queries with
     many bind parameters (Matteo)