# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-5
changelog:
  - Bump version to 1.3.10.2-5
  - Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-6
changelog:
  - Bump version to 1.3.10.2-6
  - Resolves: Bug 1839085 - IPA: Winsync not honoring parameters winSyncDirectoryFilter and winSyncWindowsFilter


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-7
changelog:
  - Bump version to 1.3.10.2-7
  - Resolves: Bug 1870624 - RHDS - allow more than 1 empty AttributeDescription for ldapsearch, without the risk of denial of service
  - Resolves: Bug 1876028 - errors log with incorrectly formatted message parent_update_on_childchange on PARENTUPDATE_DEL
  - Resolves: Bug 1860008 - On ADD replication URP issue internal searches with filter containing unescaped chars


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-8
changelog:
  - Bump version to 1.3.10.2-8
  - Resolves: Bug 1904145 - group rdn with leading space char and add fails error 21 invalid syntax and delete fails error 32
  - Resolves: Bug 1902042 - Entries conflict not resolved by replication


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-10
changelog:
  - Bump version to 1.3.10.2-10
  - Resolves: Bug 1909342 - DS crash in deref plugin while dereferencing an entry that exists but that is not returned by internal search
  - Resolves: Bug 1921856 - “write” permission of ACI changes ns-slapd’s behavior on search operation 
  - Resolves: Bug 1881968 - Replication Lag under high load


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-11
changelog:
  - Bump version to 1.3.10.2-11
  - Resolves: Bug 1953673 - Add new access log keywords for time spent in work queue and actual operation time
  - Resolves: Bug 1931182 - information disclosure during the binding of a DN


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-13
changelog:
  - Bump version to 1.3.10.2-13
  - Resolves: Bug 2005399 - Internal unindexed searches in syncrepl
  - Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
  - Resolves: Bug 2005434 - ACIs are being evaluated against the Replication Manager account in a replication context.
  - Resolves: Bug 2005435 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-14
changelog:
  - Bump version to 1.3.10.2-14
  - Resolves: Bug 2018257 - hang because of incorrect accounting of readers in vattr rwlock
  - Resolves: Bug 2010976 - IPA server (389ds) is very slow in execution of some searches (`&(memberOf=...)(objectClass=ipaHost)` in particular)


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-15
changelog:
  - Bump version to 1.3.10.2-15
  - Resolves: Bug 2049812 - Fix csn generator to limit time skew drift
  - Resolves: Bug 2048530 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in persistent search


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-16
changelog:
  - Bump version to 1.3.10.2-16
  - Resolves: Bug 2077395 - CVE-2022-0918 389-ds:1.4/389-ds-base: sending crafted message could result in DoS
  - Resolves: Bug 2014768 - Log the Auto Member invalid regex rules in the LDAP errors log
  - Resolves: Bug 2018153 - RFE - Provide an option to abort an Auto Member rebuild task
  - Resolves: Bug 2093294 - CVE-2022-0996 389-ds:1.4/389-ds-base: expired password was still allowed to access the database


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10-2-17
changelog:
  - Bump version to 1.3.10.2-17
  - Resolves: Bug 2113056 - Import may break replication because changelog starting csn may not be created
  - Resolves: Bug 2131083 - SIGSEGV in sync_repl


author: Simon Pichugin <spichugi@redhat.com> - 1.3.11.1-1
changelog:
  - Bump version to 1.3.11.1-1
  - Resolves: Bug 2170224 - Backport Rust password storage PBKDF2 schemes
  - Resolves: Bug 2170221 - Boolean attributes should be case insensitive
  - Resolves: Bug 2170218 - Slow memberof fixup task for large static groups, high CPU use


author: James Chapman <jachapma@redhat.com> - 1.3.11.1-5
changelog:
  - Bump version to 1.3.11.1-5
  - Resolves: RHEL-33337 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request
  - Resolves: RHEL-34817 - redhat-ds:11/389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c


author: Masahiro Matsuya <mmatsuya@redhat.com> - 1.3.11.1-6
changelog:
  - Bump version to 1.3.11.1-6
  - Resolves: RHEL-40941 - 389-ds-base: Malformed userPassword hash may cause Denial of Service


author: Viktor Ashirov <vashirov@redhat.com> - 1.3.11.1-7
changelog:
  - Bump version to 1.3.11.1-7
  - Resolves: RHEL-57442 - CVE-2024-8445 389-ds-base: server crash while modifying `userPassword` using malformed input (Incomplete fix for CVE-2024-2199) [rhel-7-els]


author: Jan Horak <jhorak@redhat.com> - 6.7.8.9-15
changelog:
  - Added fix for CVE-2016-5118, CVE-2016-5240, rhbz#1269562,
    rhbz#1326834, rhbz#1334188, rhbz#1269553


author: Thomas Haller <thaller@redhat.com> - 1:1.18.4-1
changelog:
  - Update to 1.18.4 release
  - cli: fix bash completion for slave-types (rh #1654062)
  - core: improve handling of policy routing rules when restarting daemon (rh #1696881)
  - ifcfg-rh: preserve existance of ethernet setting in profile (rh #1703960)
  - tui: only add bond options to profile that are supported by tui (rh #1715720)
  - cli: fix resetting default value for properties (rh #1715887)
  - core: fix detecting parent device by connection's UUID (rh #1716438)
  - core: fix setting IPv6 route options and destination (rh #1727193)
  - core: support more "arp_validate" bond options (rh #1730793)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.4-2
changelog:
  - dhcp: include conditionals from existing dhclient configuration (rh #1758550)
  - core: fix sending ARP announcements (rh #1767681)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.6-1
changelog:
  - Update to 1.18.6 release
  - cli: unset "ipv[46].never-default" when setting "ipv[46].gateway" (rh #1785039)
  - core: keep MTU of MACsec and MAC-VLAN interfaces in sync with parent (rh #1723690)
  - core: forbid autoactivation of parent when it is blocked by user request (rh #1765566)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.6-2
changelog:
  - vpn: gracefully handle invalid routes from VPN plugins
  - workaround g_strtoll() failing with EAGAIN (rh #1797915)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-1
changelog:
  - Update to 1.18.8 relase
  - ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841397, CVE-2020-10754)
  - ifcfg-rh: handle 802-1x.pin properties.


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-2
changelog:
  - Backport OVS related fixes (rh #1871935)
  - ovs: support changing the MTU of ovs interfaces (rh #1820052)
  - ovs: fix race condition in setting MAC address (rh #1852106)


author: Lubomir Rintel <lrintel@redhat.com> - 1.2.0-0.1.beta3
changelog:
  - Update to 1.2-beta3:
  - Added support for main exchange type (rh #1292912)
  - A device libreswan is unable listen on no longer aborts connection (rh #1285367)
  - Added import/export support (rh #1129878)
  - Replace NetworkManager-openswan (rh #1264552)


author: Thomas Haller <thaller@redhat.com> - 1.2.4-1
changelog:
  - Update to 1.2.4 release
  - Move base VPN plugin library to base libreswan package
  - Don't require nm-connection-editor anymore


author: Petr Pisar <ppisar@redhat.com> - 1.2.15-14
changelog:
  - Do not harness backing store by default. Export SDL_VIDEO_X11_BACKINGSTORE
    environment variable to enable it.
  - Resolves: rhbz#1245417


author: Wim Taymans <wtaymans@redhat.com> - 1.2.15-17
changelog:
  - Fix Some CVEs: CVE-2019-7572, CVE-2019-7573, CVE-2019-7574,
    CVE-2019-7575, CVE-2019-7576, CVE-2019-7577, CVE-2019-7578,
    CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638
  - Resolves: rhbz#1716201, rhbz#1716202, rhbz#1716206,
  - Resolves: rhbz#1716207, rhbz#1716208


author: Ray Strode <rstrode@redhat.com> - 0.6.45-6
changelog:
  - Don't return bogus password expiration policy when
    shadow file is unavailable
    Resolves: #1530659


author: Dean Nelson <dnelson@redhat.com> - 20130823-7
changelog:
  - Fix the dangling symlink issue for acpidump(1) and acpixtract(1) man pages
    that was reported in RHBZ 1074681.


author: Dean Nelson <dnelson@redhat.com> - 20130823-8
changelog:
  - Fix run-misc-tests.sh script to properly set the number of BITS to 64 when run
    on a ppc64le system as requested by RHBZ 1125471.


author: Dean Nelson <dnelson@redhat.com> - 20140926-1
changelog:
  - Update to the latest upstream version of acpica as requested by RHBZ 967963.
  - Refresh existing patches and add new ones to enable a clean build.
  - Fix build failures that start before and finish after midnight.


author: Dean Nelson <dnelson@redhat.com> - 20150619-1
changelog:
  - Update to the latest upstream version of acpica as requested by RHBZ 1211328.
  - Refresh existing patches and add/delete ones to enable a clean build.
  - Add missing return status checks after a few calls to AcpiDmDumpTable() and
    one to fopen().


author: Dean Nelson <dnelson@redhat.com> - 20150619-3
changelog:
  - Remove acpitests-unix-%{version} directory from the build because it was a
    mistake that it was present and it complicated the fixing of the file
    permissions done related to RHBZ 1211328's requested rebase.


author: Dean Nelson <dnelson@redhat.com> - 20160527-1
changelog:
  - Update to the latest upstream version of acpica as requested by RHBZ 1278038.
  - Refresh existing patches and add/delete ones to enable a clean build.


author: Al Stone <ahs3@redhat.com> - 20160527-2
changelog:
  - Corrected the use of percent signs in the change log and made sure
    they are all properly escaped.  Resolves: #1425899.


author: Sumit Bose <sbose@redhat.com> - 0.8.1-8
changelog:
  - Various updates for RHEL-7.7
  - many adcli-krb5-????? directories are created /tmp [#1588596]
  - adcli exports kerberos ticket with old kvno [#1642546]
  - [RFE] Have `adcli join` work without FQDN in `hostname` output [#1595911]
  - Improve handling of service principals [#1644311]
  - [RFE] adcli command with --unix-* options doesn't update
    values in UnixAttributes Tab for user [#1337489]
  - [RFE] adcli join should preserve SPN added by adcli preset-computer [#1630187]
  - [RFE] Need an option for adcli command which will show domain join status. [#1622583]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-9
changelog:
  - Fixes for RHEL-7.7 updates
  - additional patch for [RFE] adcli join should preserve SPN added by adcli
    preset-computer [#1630187]
  - new patches for many adcli-krb5-????? directories are created /tmp [#1588596]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-10
changelog:
  - adcli is failing with "Couldn't add keytab entries: FILE:/etc/krb5.keytab:
    Cannot allocate memory" [1665162]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-11
changelog:
  - Fixes and improvements for RHEL-7.8
  - Issue is that with arcfour-hmac as first encryption type in the config ... [#1683745]
  - adcli update --add-samba-data does not work as expected [#1738573]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-14
changelog:
  - Fixes for RHEL-7.9
  - Update' adcli update --add-samba-data ' info under correct section in man adcli [#1774622]
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1802258]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-15
changelog:
  - More fixes for RHEL-7.9
  - No longer able to delete computer from AD using adcli [#1840752]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1762633]


author: Than Ngo <than@redhat.com> - 1.15-21
changelog:
  - Resolves: #1711051, CVE-2019-8383 denial of service
  - Resolves: #1710910, CVE-2019-8379 null pointer dereference


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-6
changelog:
  - warn if processing prelinked binary objects and the prelink binary
    is not available
    Resolves: rbhz#1004826


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-10
changelog:
  - Updated the default configuration file. New defaults contributed
    by Steve Grubb.
    Resolves: rhbz#1304334


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
  - the correct solution is remove smp_flags, they don't work properly on ppc with
    the option mpower7
  - Related: rhbz#1048745


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-21
changelog:
  - correct the DST correction when using UTC time specification (#1328832)
  - clear non-job files from at dir and test for write error on fclose
    to fix bogus syslog messages


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-23
changelog:
  - fix the ownership of the spool directory (#1414228)
  - document the -n option of atd (#739870)
  - fix handling of the aborted jobs (due to possibly
    temporary conditions) and avoid flooding the syslog


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-5
changelog:
  - Merge fix from upstream pull request #25 for CVE-2015-7747.
    Test conversion from e.g. 16-bit LE stereo to 8-bit LE mono
    no longer causes corruption.


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-7
changelog:
  - Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix
    security issues.  CVE-2017-6827, CVE-2017-6828,
    CVE-2017-6829, CVE-2017-6830, CVE-2017-6831,
    CVE-2017-6832, CVE-2017-6833, CVE-2017-6834, CVE-2017-6835,
    CVE-2017-6836, CVE-2017-6837, CVE-2017-6838, CVE-2017-6839


author: Wim Taymans <wtaymans@redhat.com> - 1:0.3.6-9
changelog:
  - Apply security patches. CVE-2018-17095, CVE-2018-13440
  - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128


author: Ian Kent <ikent@redhat.com> - 5.0.7-108
changelog:
  - bz1728914 - getmntent returns additional "-hosts" entries when
    automounter is used with "hosts" map
    - remove unused function has_fstab_option().
    - remove unused function reverse_mnt_list().
    - remove a couple of old debug messages.
    - fix amd entry memory leak.
    - fix unlink_mount_tree() not umounting mounts.
    - add ignore mount option.
    - use ignore option for offset mounts as well.
    - add config option for "ignore" mount option
    - use bit flags for autofs mount types in mnt_list.
    - use mp instead of path in mnt_list entries.
    - always use PROC_MOUNTS to make mount lists.
    - add glibc getmntent_r().
    - use local getmntent_r in table_is_mounted().
    - refactor unlink_active_mounts() in direct.c.
    - don't use tree_is_mounted() for mounted checks.
    - use single unlink_umount_tree() for both direct and indirect mounts.
    - move unlink_mount_tree() to lib/mounts.c.
    - use local_getmntent_r() for unlink_mount_tree().
    - use local getmntent_r() in get_mnt_list().
    - use local getmntent_r() in tree_make_mnt_list().
  - Resolves: rhbz#1728914


author: Ian Kent <ikent@redhat.com> - 5.0.7-109
changelog:
  - bz1728914 - getmntent returns additional "-hosts" entries when
    automounter is used with "hosts" map
    - fix missing initialization of autofs_point flags.
  - Related: rhbz#1728914


author: Ian Kent <ikent@redhat.com> - 5.0.7-110
changelog:
  - bz1806514 - strictexpire option not set for offset mounts
    - also use strictexpire for offsets.
  - Resolves: rhbz#1806514


author: Ian Kent <ikent@redhat.com> - 5.0.7-111
changelog:
  - bz1806514 - strictexpire option not set for offset mounts
    - fix patch not applied.
  - Related: rhbz#1806514


author: Ian Kent <ikent@redhat.com> - 5.0.7-112
changelog:
  - bz1818664 - autofs cannot mount samba/cifs shares that end with a dollar sign
    - fix trailing dollar sun entry expansion.
  - Resolves: rhbz#1818664


author: Ian Kent <ikent@redhat.com> - 5.0.7-114
changelog:
  - bz1847762 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - initialize struct addrinfo for getaddrinfo() calls.
    - fix quoted string length calc in expandsunent().
    - fix autofs mount options construction.
  -Resolves: rhbz#1847762


author: Ian Kent <ikent@redhat.com> - 5.0.7-115
changelog:
  - bz1885511 - automount force unlink option (-F) does not work as expected
    on autofs-5.0.7-109.el7
    - fix direct mount unlink_mount_tree() path.
    - fix unlink mounts umount order.
  - bz1858586 - autofs share doesn't mount when using nobind over RDMA where
    nfs-server and nfs-client are the same systems
    - mount_nfs.c fix local rdma share not mounting.
  - Resolves: rhbz#1885511 rhbz#1858586


author: Ian Kent <ikent@redhat.com> - 5.0.7-116
changelog:
  - bz1885511 - automount force unlink option (-F) does not work as expected
    on autofs-5.0.7-109.el7
    - fix incorrect logical compare in unlink_mount_tree().
  - Related: rhbz#1885511


author: Ian Kent <ikent@redhat.com> - 5.0.7-116el7_9.1
changelog:
  - bz2107752 - autofs: send FAIL cmd/ioctl mess when encountering problems
    with mount trigger
    - fix kernel mount status notification.
  - Resolves: rhbz#2107752


author: Ian Kent <ikent@redhat.com> - 5.0.7-107
changelog:
  - bz1734057 - automount segfaults if a bad hosts entry is added
    in /etc/auto.master
    - fix reset flex scan buffer on init.
  - Resolves: rhbz#1734057


author: Jerome Marchand <jmarchan@redhat.com> - 0.6.1-1
changelog:
  - Rebase on v0.6.1
  - Fix tcpsubnet
  - Reinstate llcstat tool
  - Remove inject tool
  - Add NSS support to sslsniff
  - Fixes miscellaneous error uncovered by covscan


author: Jerome Marchand <jmarchan@redhat.com> - 0.10.0-1
changelog:
  - Rebase on bcc-0.10.0
  - Fix regression of vfscount
  - Drop tools that relies on features unavailable on RHEL 7


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.1
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.10
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Stepan Broz <sbroz@redhat.com> - 32:9.11.4-26.P2.16
changelog:
  - Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
    CVE-2023-50868)
  - Add missing design by contract tests to dns_catz*
  - Speed up parsing of DNS messages with many different names (CVE-2023-4408)
  - Do not use header_prev in expire_lru_headers


author: David Shea <dshea@redhat.com> - 32:9.11.4-26.P2.17
changelog:
  - Resolve CVE-2024-1975
  - Resolve CVE-2024-1737
  - Add ability to change runtime limits for max types and records per name


author: Stepan Broz <sbroz@redhat.com> - 32:9.11.4-26.P2.18
changelog:
  - Limit additional section records CPU processing (CVE-2024-11187)
  - Correct ANY queries to not have additional data appended
  - Switch to a more modern patch syntax


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-23.P2
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Fix invalid tsig request (CVE-2020-8617)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-72
changelog:
  - Fix automatic selinux boolean named_write_master_zones (#1569466)
  - Allow starting named with readonly home again


author: Tomas Krizek <tkrizek@redhat.com> - 11.1-1
changelog:
  - update to letest upstream version
  - resolves: #1393889 Rebase to bind-dyndb-ldap 11+
  - resolves: #1165796 bind-dyndb-ldap crashes if server is shutting down and connection to LDAP is down
  - resolves: #1413805 bind-dyndb-ldap default schema is shipped with syntax error


author: Petr Menšík <pemensik@redhat.com> - 11.1-6
changelog:
  - Bump BIND version and fix library dependecies
  - Rebuild for bind 9.11.3. Minor tweaks to compile.
  - Support for bind 9.11.5 headers


author: Nick Clifton <nickc@redhat.com> 2.27-42.base
changelog:
  - Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749085)


author: Nick Clifton <nickc@redhat.com> 2.27-44.base
changelog:
  - Allow the BFD library to handle the copying of files which contain secondary reloc sections.  (#1785294)
  - Implement assembler workaround for Intel JCC microcode bug.  (#1778892)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.94.1.el7]
changelog:
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Florian Westphal) [2196159] {CVE-2023-32233}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.95.1.el7]
changelog:
  - perf/s390x: Align the register list to what we support (Michael Petlan) [2207745]
  - Revert "[tools] s390/perf: add perf register support for floating-point registers" (Michael Petlan) [2207745]
  - s390/perf: add perf_regs support and user stack dump (Michael Petlan) [2207745]
  - s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR (Tobias Huschle) [2212672]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.96.1.el7]
changelog:
  - sched/fair: Eliminate bandwidth race between throttling and distribution (Phil Auld) [2180681]
  - sched/fair: Fix race between runtime distribution and assignment (Phil Auld) [2180681]
  - sched/fair: Don't assign runtime for throttled cfs_rq (Phil Auld) [2180681]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.97.1.el7]
changelog:
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216982] {CVE-2023-35788}
  - netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal) [2188190]
  - netfilter: conntrack: handle tcp challenge acks during connection reuse (Florian Westphal) [2128262]
  - netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst (Florian Westphal) [2128262]
  - netfilter: conntrack: remove unneeded indent level (Florian Westphal) [2128262]
  - netfilter: conntrack: ignore overly delayed tcp packets (Florian Westphal) [2128262]
  - netfilter: conntrack: prepare tcp_in_window for ternary return value (Florian Westphal) [2128262]
  - netfilter: conntrack: connection timeout after re-register (Florian Westphal) [2128262]
  - netfilter: conntrack: always store window size un-scaled (Florian Westphal) [2128262]
  - netfilter: conntrack: work around exceeded receive window (Florian Westphal) [2128262]
  - netfilter: conntrack: avoid misleading 'invalid' in log message (Florian Westphal) [2128262]
  - netfilter: remove BUG_ON() after skb_header_pointer() (Florian Westphal) [2128262]
  - netfilter: nf_conntrack_tcp: re-init for syn packets only (Florian Westphal) [2128262]
  - netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options (Florian Westphal) [2128262]
  - netfilter: conntrack: re-init state for retransmitted syn-ack (Florian Westphal) [2128262]
  - netfilter: conntrack: move synack init code to helper (Florian Westphal) [2128262]
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (Florian Westphal) [2128262]
  - netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options (Florian Westphal) [2128262]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.98.1.el7]
changelog:
  - GFS2: gfs2_dir_get_hash_table(): avoiding deferred vfree() is easy here... (Andrew Price) [2190450]
  - GFS2: use kvfree() instead of open-coding it (Andrew Price) [2190450]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.99.1.el7]
changelog:
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226841] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226841] {CVE-2023-20593}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226841] {CVE-2023-20593}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.100.1.el7]
changelog:
  - bnxt: count Tx drops (Jamie Bainbridge) [2175062]
  - bnxt: make sure xmit_more + errors does not miss doorbells (Jamie Bainbridge) [2175062]
  - netfilter: nf_tables: skip deactivated anonymous sets during lookups (Florian Westphal) [2196159] {CVE-2023-32233}
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (Florian Westphal) [2196159]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.101.1.el7]
changelog:
  - cifs: fix a buffer leak in smb2_query_symlink (Jay Shin) [2166706]
  - kernfs: Improve kernfs_notify() poll notification latency (Ian Kent) [1703180]
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221720] {CVE-2023-35001}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.102.1.el7]
changelog:
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Davide Caratti) [2225486] {CVE-2023-3609}
  - NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION (Benjamin Coddington) [2219604]


author: Qiao jijun <qiaojijun@kylinos.cn> - 3.10.0-1160.102.1.el7.01
changelog:
  - Type: update/cves
  - ID:   [TASK#178309] CVE-2023-42753
  - SUG:  NA
  - DESC:
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  -  Add patch 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  -  CVE: CVE-2023-42753 ,add patch 10005-netfilter-ipset-add-the-missing-IP_SET_HASH_WITH_NET.patch


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.103.1.el7]
changelog:
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225555] {CVE-2023-3611}
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Davide Caratti) [2225555]
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225639] {CVE-2023-3776}
  - redhat: fix to be able to build with rpm 4.19.0 (Denys Vlasenko)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.104.1.el7]
changelog:
  - CI: Remove unused kpet_tree_family (Nikolai Kondrashov)
  - xen/x86: don't lose event interrupts (Vitaly Kuznetsov) [RHEL-1534]
  - Documentation/x86: Fix backwards on/off logic about YMM support (Waiman Long) [2229893] {CVE-2022-40982}
  - KVM: Add GDS_NO support to KVM (Waiman Long) [2229893] {CVE-2022-40982}
  - x86/speculation: Add Kconfig option for GDS (Waiman Long) [2229893] {CVE-2022-40982}
  - x86/speculation: Add force option to GDS mitigation (Waiman Long) [2229893] {CVE-2022-40982}
  - x86/speculation: Add Gather Data Sampling mitigation (Waiman Long) [2229893] {CVE-2022-40982}
  - Documentation/ABI: Mention retbleed vulnerability info file for sysfs (Waiman Long) [2229893]
  - docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed (Waiman Long) [2229893]
  - x86/speculation: Add missing srbds=off to the mitigations= help text (Waiman Long) [2229893]
  - x86: Sync Intel family names & cpu_vuln_blacklist[] with upstream (Waiman Long) [2229893]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.105.1.el7]
changelog:
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}


author: Chengweizheng <chengweizheng@kylinos.cn> - [3.10.0-1160.105.1.el7.01]
changelog:
  - Type: cves
  - ID:   [TASK#187122]
  - SUG:  NA
  - DESC:
  -  debrand for kylin kernel productization
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  -  Add patch 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  -  CVE: CVE-2023-42753 ,add patch 10005-netfilter-ipset-add-the-missing-IP_SET_HASH_WITH_NET.patch


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.107.1.el7]
changelog:
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Phil Sutter) [RHEL-8433] {CVE-2023-42753}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.108.1.el7]
changelog:
  - net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez) [RHEL-6302]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.109.1.el7]
changelog:
  - x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (Waiman Long) [RHEL-17703]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko) [2224973]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (Oleksandr Natalenko) [2224973]
  - scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko) [2224973]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.111.1.el7]
changelog:
  - redhat: rewrite genlog and support Y- tags (Jan Stancek)
  - scsi: zfcp: Fix double free of FSF request when qdio send fails (Tobias Huschle) [RHEL-16335]
  - fbcon: set_con2fb_map needs to set con2fb_map! (Jocelyn Falempe) [RHEL-1204] {CVE-2023-38409}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.112.1.el7]
changelog:
  - net: sched: sch_qfq: Use non-work-conserving warning handler (Davide Caratti) [RHEL-14397]
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (Davide Caratti) [RHEL-14397] {CVE-2023-4921}
  - cpufreq: Initialize policy->kobj while allocating policy (Waiman Long) [2161654]
  - net: bonding: fix possible NULL deref in rlb code (Hangbin Liu) [RHEL-17227]
  - net: bonding: fix use-after-free after 802.3ad slave unbind (Hangbin Liu) [RHEL-17227]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.113.1.el7]
changelog:
  - igb: set max size RX buffer when store bad packet is enabled (Wander Lairson Costa) [RHEL-15181] {CVE-2023-45871}
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (David Marlin) [RHEL-2742] {CVE-2022-42896}
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (David Marlin) [RHEL-2742] {CVE-2022-42896}
  - Bluetooth: Use separate L2CAP LE credit based connection result values (David Marlin) [RHEL-2742] {CVE-2022-42896}
  - Bluetooth: L2CAP: Fix L2CAP_CR_SCID_IN_USE value (David Marlin) [RHEL-2742] {CVE-2022-42896}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.114.1.el7]
changelog:
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-23500] {CVE-2024-1086}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.114.2.el7]
changelog:
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26402] {CVE-2024-26602}


author: Chengweizheng <chengweizheng@kylinos.cn> - [3.10.0-1160.114.2.el7.01]
changelog:
  - Type: cves
  - ID:   [TASK#202889]
  - SUG:  NA
  - DESC:
  -  debrand for kylin kernel productization
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  -  Add patch 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch


author: Chengweizheng <chengweizheng@kylinos.cn> - [3.10.0-1160.114.2.el7.02]
changelog:
  - Type: cves
  - ID:   [TASK#210616]
  - SUG:  NA
  - DESC:
  -  perf: Fix perf_event_validate_size() {CVE-2023-6931}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.115.1.el7]
changelog:
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
  - NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.116.1.el7]
changelog:
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.117.1.el7]
changelog:
  - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-18052]
  - tracing: Fix race in perf_trace_buf initialization (Michael Petlan) [RHEL-18052]
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
  - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28785]
  - vt: vt_ioctl: fix race in VT_RESIZEX (Jay Shin) [RHEL-28639] {CVE-2020-36558}
  - selinux: cleanup and consolidate the XFRM alloc/clone/delete/free code (Ondrej Mosnacek) [RHEL-27751]
  - bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
  - cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
  - NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]
  - RDMA/i40iw: Prevent zero-length STAG registration (Kamal Heib) [RHEL-6299] {CVE-2023-25775}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26402] {CVE-2024-26602}


author: Chengweizheng <chengweizheng@kylinos.cn> - [3.10.0-1160.118.1.el7.01]
changelog:
  - Type: cves
  - ID:   [TASK#217334]
  - SUG:  NA
  - DESC:
  -  debrand for kylin kernel productization
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  -  Add patch 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  -  perf: Fix perf_event_validate_size() {CVE-2023-6931}


author: Jorge San Emeterio <jsanemet@redhat.com> [3.10.0-1160.120.1.el7]
changelog:
  - redhat: kernel.spec: run initramfs generation in %post (not only in %posttrans) (Denys Vlasenko) [RHEL-3292]
  - fuse: fix pipe buffer lifetime for direct_io (Miklos Szeredi) [2068267] {CVE-2022-1011}


author: Jorge San Emeterio <jsanemet@redhat.com> [3.10.0-1160.121.1.el7]
changelog:
  - tcp: fix zero cwnd in tcp_cwnd_reduction (Yuchung Cheng) [RHEL-43212]
  - epoll: fix use-after-free in eventpoll_release_file (Kenneth Yin) [RHEL-39665]


author: Jorge San Emeterio <jsanemet@redhat.com> [3.10.0-1160.122.1.el7]
changelog:
  - gfs2: Fix length of holes reported at end-of-file (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Only do glock put in gfs2_create_inode for free inodes (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Fix use-after-free in gfs2_logd after withdraw (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: fix use-after-free in trans_drain (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Clean up revokes on normal withdraws (Andreas Gruenbacher) [RHEL-8427]
  - GFS2: gfs2_free_extlen can return an extent that is too long (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe (Andreas Gruenbacher) [RHEL-8427]
  - GFS2: Refactor gfs2_remove_from_journal (Andreas Gruenbacher) [RHEL-8427]
  - GFS2: Only set PageChecked for jdata pages (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: keep bios separate for each journal (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Remove active journal side effect from gfs2_write_log_header (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: clean_journal improperly set sd_log_flush_head (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Excerpts from "Introduce new gfs2_log_header_v2" (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: change from write to read lock for sd_log_flush_lock in journal replay (Andreas Gruenbacher) [RHEL-8427]
  - GFS2: Reduce code redundancy writing log headers (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Grab glock reference sooner in gfs2_add_revoke (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: fix glock reference problem in gfs2_trans_remove_revoke (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Fix occasional glock use-after-free (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Make sure we don't miss any delayed withdraws (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Fix bad comment for trans_drain (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: add some much needed cleanup for log flushes that fail (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: fix trans slab error when withdraw occurs inside log_flush (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: initialize transaction tr_ailX_lists earlier (Andreas Gruenbacher) [RHEL-8427]
  - GFS2: Remove extra "if" in gfs2_log_flush() (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: fix use-after-free on transaction ail lists (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Trim the ordered write list in gfs2_ordered_write() (Andreas Gruenbacher) [RHEL-8427]
  - GFS2: Clean up releasepage (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Only set PageChecked if we have a transaction (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Fix case in which ail writes are done to jdata holes (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: simplify gfs2_block_map (Andreas Gruenbacher) [RHEL-8427]
  - gfs2: Remove unused gfs2_iomap_alloc argument (Andreas Gruenbacher) [RHEL-8427]
  - netfilter: ipset: fix ip_set_list allocation failure (Phil Sutter) [RHEL-6204]
  - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-37473]
  - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Remove useless assignment (Bob Peterson) [RHEL-37473]
  - gfs2: simplify slot_get (Bob Peterson) [RHEL-37473]
  - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-37473]
  - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-37473]
  - gfs2: use constant for array size (Bob Peterson) [RHEL-37473]
  - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-37473]
  - gfs2: Fix "Change inode qa_data to allow multiple users" backport (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Remove useless err set (Bob Peterson) [RHEL-37473]
  - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-37473]
  - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-37473]
  - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-37473]
  - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-37473]
  - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-37473]
  - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-37473]
  - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-37473]
  - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-37473]
  - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-37473]
  - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-37473]
  - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-37473]
  - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-37473]
  - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-37473]
  - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-37473]


author: Zhao Mengmeng <zhaomengmeng@kylinos.cn> [3.10.0-1160.123.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#345401]
  - SUG:  NA
  - DESC: Update from 3.10.0-1160.118.1.el7.01 to 3.10.0.1160.123.1.el7.01


author: Zhao Mengmeng <zhaomengmeng@kylinos.cn> [3.10.0-1160.123.1.el7.02]
changelog:
  - Type: cves
  - ID:   [TASK#349891]
  - SUG:  NA
  - DESC:
   - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) {CVE-2024-42232}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.124.1.el7]
changelog:
  - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28198] {CVE-2024-2201}
  - Documentation/hw-vuln: Document the interaction between IBRS and STIBP (Waiman Long) [RHEL-28198]
  - x86/bugs: Add X86_FEATURE_RETPOLINE (Waiman Long) [RHEL-28198]
  - x86/bugs: Extend VMware Retbleed workaround to Nehalem (Waiman Long) [RHEL-46175]


author: Roberto Bergantinos Corpas <rbergant@redhat.com> [3.10.0-1160.125.1.el7]
changelog:
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Kenton Groombridge) [RHEL-56845] {CVE-2024-41071}


author: Zhao Mengmeng <zhaomengmeng@kylinos.cn> [3.10.0-1160.125.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#365649]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.125.1.el7.01 to fix CVE-2024-2201 and CVE-2024-41071


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.126.1.el7]
changelog:
  - x86/fpu: Prevent FPU state corruption (Jay Shin) [RHEL-40475]
  - x86, fpu: Introduce per-cpu in_kernel_fpu state (Jay Shin) [RHEL-40475]


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.127.1.el7]
changelog:
  - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-56609]
  - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-56609]
  - proc: Use new_inode not new_inode_pseudo (Kenneth Yin) [RHEL-58926]
  - lockd: RHEL-only: skip shutdown of rpc clients with outstanding notifications (Benjamin Coddington) [RHEL-29342]
  - SUNRPC: ECONNRESET might require a rebind (Benjamin Coddington) [RHEL-29342]
  - SUNRPC: ECONNREFUSED should cause a rebind. (Benjamin Coddington) [RHEL-29342]


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.128.1.el7]
changelog:
  - neighbour: fix data-races around n->output (Ivan Vecera) [RHEL-39432]
  - redhat: fix create_distgit_changelog.sh to properly list Jiras on "Resolves:" line (Denys Vlasenko)


author: Roberto Bergantinos Corpas <rbergant@redhat.com> [3.10.0-1160.129.1.el7]
changelog:
  - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann)
  - VFS: Impose ordering on accesses of d_inode and d_flags (Ian Kent) [RHEL-56621]


author: Roberto Bergantinos Corpas <rbergant@redhat.com> [3.10.0-1160.130.1.el7]
changelog:
  - scsi: smartpqi: Fix DMA direction for RAID requests (Don Brace) [RHEL-8203]
  - scsi: smartpqi: Fix duplicate device nodes for tape changers (Don Brace) [RHEL-8203]


author: Roberto Bergantinos Corpas <rbergant@redhat.com> [3.10.0-1160.131.1.el7]
changelog:
  - namei: ->d_inode of a pinned dentry is stable only for positives (Bill O'Donnell) [RHEL-72505]
  - namei: results of d_is_negative() should be checked after dentry revalidation (Bill O'Donnell) [RHEL-72505]
  - namei: d_is_negative() should be checked before ->d_seq validation (Bill O'Donnell) [RHEL-72505]
  - VFS: Combine inode checks with d_is_negative() and d_is_positive() in pathwalk (Bill O'Donnell) [RHEL-72505]


author: Roberto Bergantinos Corpas <rbergant@redhat.com> [3.10.0-1160.132.1.el7]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CKI Backport Bot) [RHEL-78093] {CVE-2024-53104}


author: Zhao Mengmeng <zhaomengmeng@kylinos.cn> [3.10.0-1160.132.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#432520]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.132.1.el7.01 to fix CVE-2024-53104
  - 1. Update base kernel to 3.10.0-1160.132.1.el7.01
  - 2. Porting kylin patches:
  - 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch
  - 10001-add-KYLIN-support-ZHAOXIN.patch
  - 10002-add-x86_add_hygon_family_18h.patch
  - 10003-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  - 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  - 10006-debrand-for-kylin-kernel-productization.patch
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) {CVE-2023-6931}
  - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) {CVE-2024-42232}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.133.1.el7]
changelog:
  - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81823] {CVE-2024-50302}
  - can: bcm: Fix UAF in bcm_proc_show() (Marc Milgram) [RHEL-80731] {CVE-2023-52922}
  - ALSA: usb-audio: Fix a DMA to stack memory bug (Gonzalo Siero) [RHEL-81784]
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Gonzalo Siero) [RHEL-81784] {CVE-2024-53197}


author: Zhao Mengmeng <zhaomengmeng@kylinos.cn> [3.10.0-1160.133.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#444622]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.133.1.el7.01 to fix CVE-2024-50302 CVE-2023-52922 CVE-2024-53197
  - 1. Update base kernel to 3.10.0-1160.133.1.el7
  - 2. Porting kylin patches:
  - 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch
  - 10001-add-KYLIN-support-ZHAOXIN.patch
  - 10002-add-x86_add_hygon_family_18h.patch
  - 10003-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  - 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  - 10006-debrand-for-kylin-kernel-productization.patch
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) {CVE-2023-6931}
  - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) {CVE-2024-42232}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.134.1.el7]
changelog:
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Gonzalo Siero) [RHEL-86732] {CVE-2024-53150}
  - redhat: drop Y issues from changelog (Jan Stancek)


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.135.1.el7]
changelog:
  - netfilter: ipset: add missing range check in bitmap_ip_uadt (CKI Backport Bot) [RHEL-89172] {CVE-2024-53141}
  - block: initialize flush request via blk_mq_rq_ctx_init() (Ming Lei) [RHEL-86685]


author: Wu Heng <wuheng@kylinos.cn> [3.10.0-1160.135.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#467032]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.135.1.el7.01 to fix CVE-2024-53141
  - 1. Update base kernel to 3.10.0-1160.135.1.el7
  - 2. Porting kylin patches:
  - 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch
  - 10001-add-KYLIN-support-ZHAOXIN.patch
  - 10002-add-x86_add_hygon_family_18h.patch
  - 10003-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  - 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  - 10006-debrand-for-kylin-kernel-productization.patch
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) {CVE-2023-6931}
  - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) {CVE-2024-42232}


author: kuangkai <kuangkai@kylinos.cn> [3.10.0-1160.136.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#503005]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.136.1.el7.01 to fix CVE-2022-50066 CVE-2025-22004
  - net: atlantic: fix aq_vec index out of range error (Greg Kroah-Hartman) {CVE-2022-50066}
  - net: atm: fix use after free in lec_send() (Greg Kroah-Hartman) {CVE-2025-22004}


author: kuangkai <kuangkai@kylinos.cn> [3.10.0-1160.136.1.el7.02]
changelog:
  - Type: update
  - ID：[TASK#522045]
  - SUG: NA
  - DESC:
  -  stop_machine: Avoid potential race behaviour (Mark Rutland)


author: Wu Heng <wuheng@kylinos.cn> [3.10.0-1160.139.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#525541]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.139.1.el7.01 to fix CVE-2022-49788、CVE-2025-38000、CVE-2022-50020、CVE-2022-50022、CVE-2025-38177、CVE-2025-38350、CVE-2024-57980、CVE-2025-21980、CVE-2025-23150、CVE-2025-38079
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100336] {CVE-2022-49788}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Gonzalo Siero) [RHEL-105264] {CVE-2025-38000}
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg) [RHEL-101421] {CVE-2022-50020}
  - drivers:md:fix a potential use-after-free bug (Wentao_Liang) [RHEL-103454] {CVE-2022-50022}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Cong Wang) [RHEL-106566] {CVE-2025-38177}
  - net/sched: Always pass notifications when child class becomes empty (Lion Ackermann) [RHEL-93369] {CVE-2025-38350}
  - media: uvcvideo: Fix double free in error path (Laurent Pinchart) [RHEL-98782] {CVE-2024-57980}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (Zhang Lixu) [RHEL-98830] {CVE-2025-21928}
  - ext4: fix off-by-one error in do_split(Artem Sadovnikov) [RHEL-100354] {{CVE-2025-23150}
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102217] {CVE-2025-38079}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.136.1.el7]
changelog:
  - hugetlb, mempolicy: fix the mbind hugetlb migration (Rafael Aquini) [RHEL-47585]
  - net: atm: fix use after free in lec_send() (Rishikesh Oak) [RHEL-93113] {CVE-2025-22004}
  - net: atlantic: fix aq_vec index out of range error (Gonzalo Siero) [RHEL-100525] {CVE-2022-50066}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.137.1.el7]
changelog:
  - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100354] {CVE-2025-23150}
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100336] {CVE-2022-49788}
  - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98782] {CVE-2024-57980}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98830] {CVE-2025-21928}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (Gonzalo Siero) [RHEL-109294]
  - net/sched: Always pass notifications when child class becomes empty (Gonzalo Siero) [RHEL-93369] {CVE-2025-38350}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Gonzalo Siero) [RHEL-105264] {CVE-2025-38000}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Gonzalo Siero) [RHEL-106566] {CVE-2025-38177}
  - sch_cbq: make cbq_qlen_notify() idempotent (Gonzalo Siero) [RHEL-93369]
  - sch_htb: make htb_deactivate() idempotent (Gonzalo Siero) [RHEL-93369]
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Gonzalo Siero) [RHEL-93369]
  - sch_qfq: make qfq_qlen_notify() idempotent (Gonzalo Siero) [RHEL-93369]
  - sch_drr: make drr_qlen_notify() idempotent (Gonzalo Siero) [RHEL-93369]
  - sch_htb: make htb_qlen_notify() idempotent (Gonzalo Siero) [RHEL-93369]
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg) [RHEL-101421] {CVE-2022-50020}
  - drivers:md:fix a potential use-after-free bug (CKI Backport Bot) [RHEL-103454] {CVE-2022-50022}


author: Jose Guisado <jguisado@redhat.com> [3.10.0-1160.138.1.el7]
changelog:
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102217] {CVE-2025-38079}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.139.1.el7]
changelog:
  - scsi: lpfc: Use memcpy() for BIOS version (CKI Backport Bot) [RHEL-105924] {CVE-2025-38332}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Gonzalo Siero) [RHEL-112998] {CVE-2025-38352}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.140.1.el7]
changelog:
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (Rishikesh Oak) [RHEL-106311] {CVE-2025-38477}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106311] {CVE-2025-38477}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.141.1.el7]
changelog:
  - md-raid10: fix KASAN warning (Mikulas Patocka) [RHEL-104608] {CVE-2022-50211}
  - ALSA: bcd2000: Fix a UAF bug on the error path of probing (CKI Backport Bot) [RHEL-110782] {CVE-2022-50229}
  - ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() (Dongxiang Ke) [RHEL-98733] {CVE-2022-48701}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CKI Backport Bot) [RHEL-106034] {CVE-2025-38200}
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112236] {CVE-2023-53125}
  - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112236] {CVE-2023-53125}


author: wangsong <wangsong01@kylinos.cn> [3.10.0-1160.141.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#539939]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.141.1.el7.01 to fix CVE-2025-38477、CVE-2022-48701、CVE-2022-50211、CVE-2023-53125、CVE-2025-38200、CVE-2022-50229
  - 1. Update base kernel to 3.10.0-1160.141.1.el7
  - 2. Porting kylin patches:
  - 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch
  - 10001-add-KYLIN-support-ZHAOXIN.patch
  - 10002-add-x86_add_hygon_family_18h.patch
  - 10003-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  - 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  - 10006-debrand-for-kylin-kernel-productization.patch
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) {CVE-2023-6931}
  - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) {CVE-2024-42232}
  - stop_machine: Avoid potential race behaviour (Mark Rutland)


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.142.1.el7]
changelog:
  - HID: core: Harden s32ton() against conversion to 0 bits (Marc Milgram) [RHEL-111026] {CVE-2025-38556}
  - HID: stop exporting hid_snto32() (Marc Milgram) [RHEL-111026]
  - HID: simplify snto32() (Marc Milgram) [RHEL-111026]
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (Marc Milgram) [RHEL-111026] {CVE-2022-48978}
  - HID: core: detect and skip invalid inputs to snto32() (Marc Milgram) [RHEL-111026]
  - HID: core: don't use negative operands when shift (Marc Milgram) [RHEL-111026]
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109846] {CVE-2025-37797}
  - crypto: seqiv - Handle EBUSY correctly (Arif Badar) [RHEL-117226] {CVE-2023-53373}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114838] {CVE-2025-39751}
  - nfsd: don't ignore the return code of svc_proc_register() (Roberto Bergantinos Corpas) [RHEL-111645] {CVE-2025-22026}


author: dujinxiu <dujinxiu@kylinos.cn> [3.10.0-1160.142.1.el7.01]
changelog:
  - Type: update
  - ID:   [TASK#556019]
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.142.1.el7.01 to fix CVE-2022-48978、CVE-2025-22026、CVE-2025-37797、CVE-2025-38556、CVE-2025-39751、CVE-2023-53373


author: yetaixin <yetaixin@kylinos.cn> [3.10.0-1160.142.1.el7.02]
changelog:
  - Type: cves
  - ID:   [TASK#566333]
  - SUG:  NA
  - DESC:
  -  net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) {CVE-2024-57996}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.143.1.el7]
changelog:
  - Bluetooth: prefetch channel before killing sock (Rishikesh Oak) [RHEL-116274] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix user-after-free (Rishikesh Oak) [RHEL-117366] {CVE-2022-50386}
  - Bluetooth: L2CAP: Fix use-after-free (Rishikesh Oak) [RHEL-116274] {CVE-2023-53305}
  - Bluetooth: Fix l2cap_disconnect_req deadlock (Rishikesh Oak) [RHEL-116274]
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Rishikesh Oak) [RHEL-116274] {CVE-2022-3640}
  - Bluetooth: Fix refcount use-after-free issue (Rishikesh Oak) [RHEL-116274] {CVE-2022-3640}
  - Bluetooth: Check state in l2cap_disconnect_rsp (Rishikesh Oak) [RHEL-116274] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix build errors in some archs (Rishikesh Oak) [RHEL-116274] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression (Rishikesh Oak) [RHEL-116274] {CVE-2022-3640}
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Rishikesh Oak) [RHEL-116274] {CVE-2022-49909 CVE-2022-3640}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Rishikesh Oak) [RHEL-116274] {CVE-2022-3640}
  - Bluetooth: use the correct print format for L2CAP debug statements (Rishikesh Oak) [RHEL-116274]
  - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-97623]
  - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-97623]
  - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-97623]
  - i40e: Add a check to see if MFS is set (Mohammad Heib) [RHEL-97623]
  - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-97623]
  - bitops: Add non-atomic bitops for pointers [partial] (Mohammad Heib) [RHEL-97623]
  - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (Xiubo Li) [RHEL-117940] {CVE-2022-50408}
  - cifs: Remove duplicated include in cifsglob.h (Xiubo Li) [RHEL-118059]
  - cifs: fix oops during encryption (Xiubo Li) [RHEL-118059] {CVE-2022-50341}
  - SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL (Xiubo Li) [RHEL-118059]
  - fix smb3-encryption breakage when CONFIG_DEBUG_SG=y (Xiubo Li) [RHEL-118059]
  - sctp: linearize cloned gso packets in sctp_rcv (Xiubo Li) [RHEL-113345] {CVE-2025-38718}
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Marc Milgram) [RHEL-118006] {CVE-2023-53365}


author: wangsong <wangsong01@kylinos.cn> [3.10.0-1160.143.1.el7.01]
changelog:
  - Type: cves
  - ID:   CVE-2022-3640、CVE-2022-50408、CVE-2023-53365、CVE-2023-53305、CVE-2022-50341、CVE-2022-50386、CVE-2025-38718
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.143.1.el7.01 to fix CVE-2022-3640、CVE-2022-50408、CVE-2023-53365、CVE-2023-53305、CVE-2022-50341、CVE-2022-50386、CVE-2025-38718
  - 1. Update base kernel to 3.10.0-1160.143.1.el7
  - 2. Porting kylin patches:
  - 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch
  - 10001-add-KYLIN-support-ZHAOXIN.patch
  - 10002-add-x86_add_hygon_family_18h.patch
  - 10003-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  - 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  - 10006-debrand-for-kylin-kernel-productization.patch
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) {CVE-2023-6931}
  - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) {CVE-2024-42232}
  - stop_machine: Avoid potential race behaviour (Mark Rutland)
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) {CVE-2024-57996}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.144.1.el7]
changelog:
  - NFSD: Protect against send buffer overflow in NFSv2 READ (Roberto Bergantinos Corpas) [RHEL-116843] {CVE-2022-50410}
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Xiubo Li) [RHEL-116655] {CVE-2022-50367}
  - mm: zswap: fix missing folio cleanup in writeback race path (Jose Guisado) [RHEL-116237] {CVE-2023-53178}
  - mm: fix zswap writeback race condition (Jose Guisado) [RHEL-116237] {CVE-2023-53178}
  - iomap: iomap: fix memory corruption when recording errors during writeback (John Pittman) [RHEL-119654] {CVE-2022-50406}
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118474] {CVE-2023-53297}
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Malaya Kumar Rout) [RHEL-117588] {CVE-2022-50403}
  - net: sched: sfb: fix null pointer access issue when sfb_init() fails (Xiubo Li) [RHEL-116606] {CVE-2022-50356}
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Xiubo Li) [RHEL-120659] {CVE-2025-39955}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Xiubo Li) [RHEL-114679 RHEL-116019] {CVE-2025-38729 CVE-2025-39757}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Xiubo Li) [RHEL-114679] {CVE-2025-39757}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Xiubo Li) [RHEL-114679] {CVE-2025-39757}
  - scsi: qla2xxx: Wait for io return on terminate rport (John Pittman) [RHEL-124590] {CVE-2023-53322}


author: Gonzalo Siero <gsierohu@redhat.com> [3.10.0-1160.145.1.el7]
changelog:
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-126856] {CVE-2025-37823}
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() (John Pittman) [RHEL-121313]
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses (John Pittman) [RHEL-121313] {CVE-2023-53675}
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses (John Pittman) [RHEL-121313]
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() (John Pittman) [RHEL-121313]
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (Xiubo Li) [RHEL-137390] {CVE-2025-68285}
  - ipv6: Fix out-of-bounds access in ipv6_find_tlv() (CKI Backport Bot) [RHEL-124738] {CVE-2023-53705}


author: kuangkai <kuangkai@kylinos.cn> [3.10.0-1160.145.1.el7.01]
changelog:
  - Type: cves&bugfix
  - ID:   CVE-2025-37823、CVE-2023-53675、CVE-2025-68285、CVE-2023-53705
  - SUG:  NA
  - DESC: Update to 3.10.0-1160.145.1.el7.01 to fix CVE-2025-37823、CVE-2023-53675、CVE-2025-68285、CVE-2023-53705 and fix the parameter RemapEn update error of AMD IOMMU driver.
  - 1. Update base kernel to 3.10.0-1160.145.1.el7
  - 2. Porting kylin patches:
  - 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch
  - 10001-add-KYLIN-support-ZHAOXIN.patch
  - 10002-add-x86_add_hygon_family_18h.patch
  - 10003-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  - 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch
  - 10006-debrand-for-kylin-kernel-productization.patch
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) {CVE-2023-6931}
  - libceph: fix race between delayed_work() and ceph_monc_stop() (Ilya Dryomov) {CVE-2024-42232}
  - stop_machine: Avoid potential race behaviour (Mark Rutland)
  - net_sched: sch_sfq: don't allow 1 packet limit (Octavian Purdila) {CVE-2024-57996}
  - 10011-iommu-amd-Restore-IRTE.RemapEn-bit-after-programming.patch
  - 10012-iommu-amd-Use-cmpxchg_double-when-updating-128-bit-I.patch
  - 10013-iommu-amd-Disable-AMD-IOMMU-if-CMPXCHG16B-feature-is.patch
  - 10014-iommu-amd-Fix-potential-entry-null-deref.patch


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.12.1.el7]
changelog:
  - [mm] mmap: relax file size limit for regular files (Rafael Aquini) [1855985]
  - [mm] mmap: introduce sane default mmap limits (Rafael Aquini) [1855985]
  - [of] Move dynamic node fixups out of powerpc and into common code (Laurent Vivier) [1866138]
  - [fs] nfs: Fix double-free in filelayout_alloc_commit_info/filelayout_free_lseg (Benjamin Coddington) [1679980]
  - [hid] HID: hid-plantronics: Re-resend Update to map button for PTT products (Torez Smith) [1769502]
  - [fs] dlm: make posix locks interruptible (Alexander Aring) [1826858]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.13.1.el7]
changelog:
  - [s390] zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl (Philipp Rudo) [1896826]
  - [block] block/diskstats: more accurate approximation of io_ticks for slow disks (Ming Lei) [1859364]
  - [block] block: delete part_round_stats and switch to less precise counting (Ming Lei) [1859364]
  - [md] dm: simplify start of block stats accounting for bio-based (Ming Lei) [1859364]
  - [block] block/rsxx: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
  - [block] drbd: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
  - [md] md: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
  - [nvme] limit number of IO queues on Dell/Kioxia config (Gopal Tiwari) [1883403]
  - [netdrv] hv_netvsc: make recording RSS hash depend on feature flag (Mohammed Gamal) [1898280]
  - [netdrv] hv_netvsc: record hardware hash in skb (Mohammed Gamal) [1898280]
  - [fs] block: Fix use-after-free in blkdev_get() (Ming Lei) [1902414] {CVE-2020-15436}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.14.1.el7]
changelog:
  - [fs] nfsd: fix incorrect umasks ("J. Bruce Fields") [1905208]
  - [hv] vmbus: Add timeout to vmbus_wait_for_unload (Mohammed Gamal) [1888979]
  - [scsi] qla2xxx: Fix device loss on 4G and older HBAs (Nilesh Javali) [1889311]
  - [s390] dasd: Fix zero write for FBA devices (Philipp Rudo) [1896839]
  - [net] ipv6: use in6_dev_put in dad timer handler instead of __in6_dev_put (Xin Long) [1809519]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.15.1.el7]
changelog:
  - [fs] ceph: quota: fix null pointer dereference in quota check (Jeff Layton) [1890386]
  - [netdrv] revert "mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query" (Alaa Hleihel) [1896756]
  - [kernel] timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion (Waiman Long) [1890911]
  - [kernel] exit: Optimize forget_original_parent() for large thread group exiting (Waiman Long) [1872110]
  - [kernel] exit: reparent: call forget_original_parent() under tasklist_lock (Waiman Long) [1872110]
  - [kernel] Disable tasklist_waiters when qrwlock is enabled (Waiman Long) [1872110]
  - [fs] cifs: handle ERRBaduid for SMB1 (Leif Sahlberg) [1847041]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.16.1.el7]
changelog:
  - [tty] Fix ->pgrp locking in tiocspgrp() (Chris von Recklinghausen) [1908193] {CVE-2020-29661}
  - [net] fix struct pid memory leak (Jay Shin) [1901797]
  - [hid] Fix assumption that devices have inputs (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] microsoft: the driver now neeed MEMLESS_FF infrastructure (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] microsoft: Add rumble support for Xbox One S controller (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] microsoft: Convert private data to be a proper struct (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] revert "hid: microsoft: fix invalid rdesc for 3k kbd" (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] input: ignore System Control application usages if not System Controls (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [hid] hid-microsoft: Do the check for the ms usage page per device (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
  - [net] net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc (Antoine Tenart) [1903819]
  - [net] net-sysfs: take the rtnl lock when storing xps_cpus (Antoine Tenart) [1903819]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.17.1.el7]
changelog:
  - [x86] kvm: svm: Initialize prev_ga_tag before use ("Dr. David Alan Gilbert") [1909036]
  - [scsi] scsi_dh: fix scheduling while atomic and also missing unlock in error path (Mike Snitzer) [1619147]
  - [video] hyperv_fb: Fix the cache type when mapping the VRAM (Mohammed Gamal) [1908896]
  - [video] hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (Mohammed Gamal) [1908896]
  - [scsi] target: iscsi: Fix cmd abort fabric stop race (Maurizio Lombardi) [1784540]
  - [scsi] target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock (Maurizio Lombardi) [1784540]
  - [s390] kernel/uv: handle length extension properly (Claudio Imbrenda) [1899172]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.18.1.el7]
changelog:
  - [fs] nfs: Fix security label length not being reset (Dave Wysochanski) [1917504]
  - [target] scsi: Fix XCOPY NAA identifier lookup (Maurizio Lombardi) [1900469] {CVE-2020-28374}
  - [ipc] sem.c: fully initialize sem_array before making it visible (Vladis Dronov) [1877264]
  - [netdrv] geneve: add transport ports in route lookup for geneve (Sabrina Dubroca) [1885144] {CVE-2020-25645}
  - [kernel] perf/core: Fix race in the perf_mmap_close() function (Michael Petlan) [1869936] {CVE-2020-14351}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.19.1.el7]
changelog:
  - [kernel] watchdog: use nmi registers snapshot in hardlockup handler (Prarit Bhargava) [1916589]
  - [nvme] nvmet: allow Keep Alive for Discovery controller (Gopal Tiwari) [1910817]
  - [net] netfilter: ctnetlink: add a range check for l3/l4 protonum (Florian Westphal) [1888296] {CVE-2020-25211}
  - [net] icmp: randomize the global rate limiter (Antoine Tenart) [1896515] {CVE-2020-25705}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.20.1.el7]
changelog:
  - [md] Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1889372]
  - [md] improve variable names in md_flush_request() (Xiao Ni) [1889372]
  - [kernel] timer: Fix potential bug in requeue_timers() (Waiman Long) [1914011]
  - [x86] kvm: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Vitaly Kuznetsov) [1890669]
  - [x86] kvm: avoid incorrect writes to host MSR_IA32_SPEC_CTRL (Vitaly Kuznetsov) [1890669]
  - [md] dm-mirror: fix a crash if the underlying block device doesn't have merge_bvec_fn (Mikulas Patocka) [1916407]
  - [gpu] drm/i915: Fix use-after-free when destroying GEM context (Dave Airlie) [1814731] {CVE-2020-7053}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.21.1.el7]
changelog:
  - [pinctrl] devicetree: Avoid taking direct reference to device name string (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [pinctrl] Delete an error message (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [tty] vt: keyboard, reorder user buffer handling in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, rename i to kb_func in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, extend func_buf_lock to readers (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, simplify vt_kdgkbsent (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] keyboard, do not speculate on func_table index (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: fix write/write race in ioctl(KDSKBSENT) handler (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [iommu] amd: return error on real irq alloc failure (Jerry Snitselaar) [1918273]
  - [iommu] amd: Set DTE[IntTabLen] to represent 512 IRTEs (Jerry Snitselaar) [1921187]
  - [iommu] amd: Increase interrupt remapping table limit to 512 entries (Jerry Snitselaar) [1921187]
  - [scsi] lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix ADISC reception terminating login state if a NVME target (Dick Kennedy) [1875961]
  - [netdrv] i40e: revert "i40e: don't report link up for a VF who hasn't enabled queues" (Stefan Assmann) [1901064]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.22.1.el7]
changelog:
  - mm: do not stall register_shrinker() (Rafael Aquini) [1926043]
  - sched/rt: Fix PI handling vs. sched_setscheduler() (Phil Auld) [1928082]
  - sched/rt: Simplify pull_rt_task() logic and remove .leaf_rt_rq_list (Phil Auld) [1928082]
  - sched: Queue RT tasks to head when prio drops (Phil Auld) [1928082]
  - sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/task_rq_lock() (Phil Auld) [1928082]
  - mmc: block: handle complete_work on separate workqueue (Ming Lei) [1918916]
  - tcp: fix to update snd_wl1 in bulk receiver fast path (Vladis Dronov) [1929804]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.23.1.el7]
changelog:
  - tcm_loop: add WQ_MEM_RECLAIM and flush_work (Maurizio Lombardi) [1925652]
  - net/mlx4_en: Handle TX error CQE (Alaa Hleihel) [1925691]
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Alaa Hleihel) [1925691]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.24.1.el7]
changelog:
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930826] {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930849] {CVE-2021-27363}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930807] {CVE-2021-27364}
  - redhat: add CI file for kernel-private (Bruno Meneguele)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.25.1.el7]
changelog:
  - redhat: Enable CKI RT verification for kernel-private (Juri Lelli)
  - redhat: Enable CKI RT verification (Juri Lelli)
  - RDMA/ipoib: Remove racy Subnet Manager sendonly join checks (Honggang Li) [1922460]
  - net: sched: protect against stack overflow in TC act_mirred (Davide Caratti) [1916682]
  - floppy: check_events callback should not return a negative number (Jay Shin) [1928576]
  - floppy: fix lock_fdc() signal handling (Jay Shin) [1928576]
  - ipv6: clean up anycast when an interface is destroyed (Xin Long) [1917700]
  - virtio_net: fix virtnet_open and virtnet_probe competing for try_fill_recv (Laurent Vivier) [1895319]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.33.1.el7]
changelog:
  - CI: Disable result checking for realtime check (Veronika Kabatova)
  - CI: Explicitly disable result checking for private CI (Veronika Kabatova)
  - CI: Rename variable (Veronika Kabatova)
  - mm: memcontrol: switch to rcu protection in drain_all_stock() (Waiman Long) [1957719]
  - sctp: Don't add the shutdown timer if its already been added (Xin Long) [1953052]
  - media: xirlink_cit: add missing descriptor sanity checks (Mark Langsdorf) [1826877] {CVE-2020-11668}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.34.1.el7]
changelog:
  - futex: remove lockdep_assert_held() in pi_state_update_owner() (Donghai Qiao) [1965495]
  - video: hyperv_fb: Add ratelimit on error message (Mohammed Gamal) [1957803]
  - Drivers: hv: vmbus: Increase wait time for VMbus unload (Mohammed Gamal) [1957803]
  - Drivers: hv: vmbus: Initialize unload_event statically (Mohammed Gamal) [1957803]
  - blk-mq: always allow reserved allocation in hctx_may_queue (Ming Lei) [1926825]
  - s390/pci: fix out of bounds access during irq setup (Philipp Rudo) [1917943]
  - s390/pci: improve irq number check for msix (Philipp Rudo) [1917943]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.35.1.el7]
changelog:
  - CI: Merge configuration (Veronika Kabatova)
  - [pci/aer] Work around use-after-free in pcie_do_fatal_recovery() (Al Stone) [1933663]
  - [pci/aer] do not invoke error recovery with non-fatal errors (Al Stone) [1933663]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.36.1.el7]
changelog:
  - cipso,calipso: resolve a number of problems with the DOI refcounts (Antoine Tenart) [1967720]
  - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() (Alaa Hleihel) [1962406]
  - sched/debug: Fix cgroup_path[] serialization (Waiman Long) [1912221]
  - sched/debug: Reset watchdog on all CPUs while processing sysrq-t (Waiman Long) [1912221]
  - vt: vt_ioctl: fix use-after-free in vt_in_use() (Vladis Dronov) [1872778]
  - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console (Vladis Dronov) [1872778]
  - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines (Vladis Dronov) [1872778]
  - vt: selection, introduce vc_is_sel (Vladis Dronov) [1872778]
  - redhat: genspec: generate changelog entries since last release (Augusto Caringi)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.37.1.el7]
changelog:
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971457]
  - net: Update window_clamp if SOCK_RCVBUF is set (Balazs Nemeth) [1962196]
  - bpf, x86: Validate computation of branch displacements for x86-64 (Jiri Olsa) [1947249] {CVE-2021-29154}
  - mm: vmalloc: add cond_resched() in __vunmap() (Rafael Aquini) [1896794]
  - mm/vmalloc: __vmalloc_area_node(): avoid 32-bit overflow (Rafael Aquini) [1896794]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.38.1.el7]
changelog:
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975251]
  - memcg, slab: Fix incorrect placement of rcu_head in struct memcg_cache_params (Waiman Long) [1951810]
  - netfilter: x_tables: Use correct memory barriers. (Phil Sutter) [1949087] {CVE-2021-29650}
  - netfilter: nf_nat: don't bug when mapping already exists (Florian Westphal) [1972970]
  - netfilter: don't setup nat info for confirmed ct (Florian Westphal) [1972970]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.39.1.el7]
changelog:
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980489] {CVE-2021-22555}
  - Revert "be2net: disable bh with spin_lock in be_process_mcc" (Petr Oros) [1971744]
  - futex: futex_requeue can potentially free the pi_state structure twice (Donghai Qiao) [1966856]
  - xfs: sync lazy sb accounting on quiesce of read-only mounts (Carlos Maiolino) [1921551]
  - scsi: lpfc: Fix crash caused by switch reboot (Dick Kennedy) [1897576]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.40.1.el7]
changelog:
  - redhat: ppc64: CONFIG_RTAS_FILTER (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - powerpc/rtas: Restrict RTAS requests from userspace (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - IB/mlx5: Fix initializing CQ fragments buffer (Alaa Hleihel) [1962499]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.42.1.el7]
changelog:
  - [s390] s390/dasd: fix list corruption of lcu list (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: fix list corruption of pavgroup group list (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: prevent inconsistent LCU device data (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: fix hanging device offline processing (Claudio Imbrenda) [1889418]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.43.1.el7]
changelog:
  - PCI: hv: Add support for protocol 1.3 and support PCI_BUS_RELATIONS2 (Mohammed Gamal) [1984128]
  - PCI: hv: Decouple the func definition in hv_dr_state from VSP message (Mohammed Gamal) [1984128]
  - PCI: hv: Only queue new work items in hv_pci_devices_present() if necessary (Mohammed Gamal) [1984128]
  - i40e: improve locking of mac_filter_hash (Stefan Assmann) [1993850]
  - i40e: always propagate error value in i40e_set_vsi_promisc() (Stefan Assmann) [1993850]
  - i40e: fix return of uninitialized aq_ret in i40e_set_vsi_promisc (Stefan Assmann) [1993850]
  - i40e: Remove scheduling while atomic possibility (Stefan Assmann) [1993850]
  - scsi: lpfc: Fix pt2pt discovery on SLI3 HBAs (Dick Kennedy) [1922479]
  - qed: Disable "MFW indication via attention" SPAM every 5 minutes (Manish Chopra) [1854544]
  - NFS: Fix a performance regression caused by buffered IO locking (Benjamin Coddington) [1995649]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.44.1.el7]
changelog:
  - fs: dlm: change handling of reconnects (Bob Peterson) [1834878]
  - DLM: fix NULL pointer dereference in send_to_sock() (Bob Peterson) [1834878]
  - DLM: fix to reschedule rwork (Bob Peterson) [1834878]
  - DLM: fix to use sk_callback_lock correctly (Bob Peterson) [1834878]
  - DLM: fix overflow dlm_cb_seq (Bob Peterson) [1834878]
  - DLM: fix conversion deadlock when DLM_LKF_NODLCKWT flag is set (Bob Peterson) [1834878]
  - DLM: use CF_CLOSE flag to stop dlm_send correctly (Bob Peterson) [1834878]
  - DLM: Reanimate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
  - DLM: fix race condition between dlm_recoverd_stop and dlm_recoverd (Bob Peterson) [1834878]
  - DLM: close othercon at send/receive error (Bob Peterson) [1834878]
  - DLM: retry rcom when dlm_wait_function is timed out. (Bob Peterson) [1834878]
  - DLM: fix to use sock_mutex correctly in xxx_accept_from_sock (Bob Peterson) [1834878]
  - DLM: fix race condition between dlm_send and dlm_recv (Bob Peterson) [1834878]
  - DLM: fix double list_del() (Bob Peterson) [1834878]
  - DLM: Eliminate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975511]
  - vxlan: check return value of gro_cells_init() (Aristeu Rozanski) [1970618]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988218] {CVE-2021-37576}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.45.1.el7]
changelog:
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - mm: page_counter: mitigate consequences of a page_counter underflow (Scott Wood) [2000973]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested(CVE-2021-3656) (Jon Maloy) [1985425] {CVE-2021-3656}
  - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted (Marcelo Tosatti) [1991856]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985408] {CVE-2021-3653}
  - scsi: qedf: Initiate cleanup for ELS commands as well (Nilesh Javali) [1982702]


author: Wang Gang <wanggang@kylinos.cn> [3.10.0-1160.45.1.el7.01]
changelog:
  - Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.58.1.el7]
changelog:
  - Bluetooth: fix use-after-free error in lock_sock_nested() (Gopal Tiwari) [2005687]
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047597] {CVE-2022-22942}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.60.1.el7]
changelog:
  - svcrdma: Fix leak of svc_rdma_recv_ctxt objects (Benjamin Coddington) [2028740]
  - sunrpc: Remove unneeded pointer dereference (Benjamin Coddington) [2028740]
  - x86/platform/uv: Add more to secondary CPU kdump info (Frank Ramsay) [2042462]
  - [s390] s390/AP: support new dynamic AP bus size limit (Claudio Imbrenda) [1997156]
  - CI: Enable baseline realtime checks (Veronika Kabatova)
  - CI: Rename pipelines to include release names (Veronika Kabatova)
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032075] {CVE-2021-4028}
  - fget: clarify and improve __fget_files() implementation (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fget: check that the fd still exists after getting a ref to it (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - net: Set fput_needed iff FDPUT_FPUT is set (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - vfs, fdtable: Add fget_task helper (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: add fget_many() and fput_many() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs/file.c: __fget() and dup2() atomicity rules (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - vfs: Don't let __fdget_pos() get FMODE_PATH files (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - get rid of fget_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - sockfd_lookup_light(): switch to fdget^W^Waway from fget_light (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: __fget_light() can use __fget() in slow path (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: factor out common code in fget_light() and fget_raw_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - fs: factor out common code in fget() and fget_raw() (Miklos Szeredi) [2032478] {CVE-2021-4083}
  - introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty() (Miklos Szeredi) [2032478] {CVE-2021-4083}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.61.1.el7]
changelog:
  - x86/efi: reset the correct tlb_state when returning from efi_switch_mm() (Rafael Aquini) [2055587]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.62.1.el7]
changelog:
  - cifs: fix handling of DFS links where we can not access all components (Ronnie Sahlberg) [1937304]
  - redhat: kernel.spec: install new kernel boot entry in posttrans, not post (Denys Vlasenko) [1893756]
  - [s390] s390/cpumf: Support for CPU Measurement Facility CSVN 7 (Mete Durlu) [2048920]
  - dm table: fix iterate_devices based device capability checks (Mike Snitzer) [2054743]
  - buffer: eliminate the need to call free_more_memory() in __getblk_slow() (Carlos Maiolino) [2030609]
  - buffer: grow_dev_page() should use __GFP_NOFAIL for all cases (Carlos Maiolino) [2030609]
  - buffer: have alloc_page_buffers() use __GFP_NOFAIL (Carlos Maiolino) [2030609]
  - mm: memcg: do not fail __GFP_NOFAIL charges (Rafael Aquini) [2054345]
  - mm: filemap: do not drop action modifier flags from the gfp_mask passed to __add_to_page_cache_locked() (Rafael Aquini) [2054345]
  - Added ZSTREAM=yes to makefile (Lucas Zampieri)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.63.1.el7]
changelog:
  - NFSv4: Set the connection timeout to match the lease period (Benjamin Coddington) [2066699]
  - SUNRPC: Allow changing of the TCP timeout parameters on the fly (Benjamin Coddington) [2066699]
  - SUNRPC: Refactor TCP socket timeout code into a helper function (Benjamin Coddington) [2066699]
  - SUNRPC: Remove unused function rpc_get_timeout() (Benjamin Coddington) [2066699]
  - kernel/timer: Fix incorrect assertion in requeue_timers() (Waiman Long) [2048502]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.65.1.el7]
changelog:
  - CI: Remove deprecated option (Veronika Kabatova)
  - RDMA/core: Fix panic when port_pkey_list isn't initialized (Kamal Heib) [2046571]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.66.1.el7]
changelog:
  - net-sysfs: add check for netdevice being present to speed_show (William Zhao) [2055457]
  - CI: Drop baseline runs (Veronika Kabatova)
  - perf/x86/intel: Add more Icelake CPUIDs (Michael Petlan) [2072317]
  - perf vendor events intel: Add Icelake V1.00 event file (Michael Petlan) [2072317]
  - perf vendor events intel: Add core event list for Icelake Server (Michael Petlan) [2072317]


author: Yu Peng <yupeng@kylinos.cn> - [3.10.0-1160.66.1.el7.01]
changelog:
  - cpu: Add suport HYGON and Zhaoxin.
  - l2tp: Fix yzbot kernel-fuzzing system [85529]{CNVD-C-2022-231201}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.72.1.el7]
changelog:
  - sched,perf: Fix periodic timers (Valentin Schneider) [2077346]
  - sched: debug: Remove the cfs bandwidth timer_active printout (Valentin Schneider) [2077346]
  - sched: Cleanup bandwidth timers (Valentin Schneider) [2077346]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.73.1.el7]
changelog:
  - qede: Reduce verbosity of ptp tx timestamp (Manish Chopra) [2080646]
  - RDMA/cma: Fix unbalanced cm_id reference count during address resolve (Kamal Heib) [2085425]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.75.1.el7]
changelog:
  - xfs: fix up non-directory creation in SGID directories (Andrey Albershteyn) [2089360]
  - x86/speculation/mmio: Print SMT warning (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - KVM: x86/speculation: Disable Fill buffer clear within guests (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/srbds: Update SRBDS mitigation selection (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - cpu/speculation: Add prototype for cpu_show_srbds() (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - Documentation: Add documentation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - [s390] s390/zcrypt: use kvmalloc instead of kmalloc for 256k alloc (Mete Durlu) [2072970]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.77.1.el7]
changelog:
  - net/mlx5: Add Fast teardown support (Jay Shin) [2077711]
  - net/mlx5: Free IRQs in shutdown path (Jay Shin) [2077711]
  - net/mlx5: Change teardown with force mode failure message to warning (Jay Shin) [2077711]
  - net/mlx5: Cancel health poll before sending panic teardown command (Jay Shin) [2077711]
  - net/mlx5: Add fast unload support in shutdown flow (Jay Shin) [2077711]
  - net/mlx5: Expose command polling interface (Jay Shin) [2077711]
  - posix-timers: Remove remaining uses of tasklist_lock (Oleg Nesterov) [2115147]
  - posix-timers: Use sighand lock instead of tasklist_lock on timer deletion (Oleg Nesterov) [2115147]
  - posix-cpu-timers: remove tasklist_lock in posix_cpu_clock_get() (Oleg Nesterov) [2115147]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.78.1.el7]
changelog:
  - net_sched: cls_route: remove from list when handle is 0 (Davide Caratti) [2121809] {CVE-2022-2588}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.79.1.el7]
changelog:
  - x86/speculation: Add LFENCE to RSB fill sequence (Rafael Aquini) [2115073] {CVE-2022-26373}
  - x86/speculation: Protect against userspace-userspace spectreRSB (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/speculation: cope with spectre_v2=retpoline cmdline on retbleed-affected Intel CPUs (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - KVM: emulate: do not adjust size of fastop and setcc subroutines (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/speculation: Disable RRSBA behavior (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kexec: Disable RET on kexec (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add Cannon lake to RETBleed affected CPU list (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu/amd: Enumerate BTC_NO (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/common: Stamp out the stepping madness (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu/amd: Add Spectral Chicken (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Do IBPB fallback check only once (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add retbleed=ibpb (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Report Intel retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Enable STIBP for JMP2RET (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Add AMD retbleed= boot parameter (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/bugs: Report AMD retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Add magic AMD return-thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Use return-thunk in asm code (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/sev: Avoid using __x86_return_thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Fix SETcc emulation for return thunks (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86,objtool: Create .return_sites (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Undo return-thunk damage (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/retpoline: Use -mfunction-return (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Move RETPOLINE flags to word 11 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - objtool: Add ELF writing capability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Prepare asm files for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86: Prepare inline-asm for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Fix fastop function ELF metadata (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/kvm: Move kvm_fastop_exception to .fixup section (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/vdso: Fix vDSO build if a retpoline is emitted (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Carve out CQM features retrieval (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeatures: Re-tabulate the X86_FEATURE definitions (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpufeature: Move processor tracing out of scattered features (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
  - x86/alternatives: Cleanup DPRINTK macro (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.80.1.el7]
changelog:
  - scsi: lpfc: Fix FCP I/O flush functionality for TMF routines (Dick Kennedy) [1969988]
  - scsi: lpfc: Fix illegal memory access on Abort IOCBs (Dick Kennedy) [1969988]
  - NFS: Fix extra call to dput() in nfs_prime_dcache (Benjamin Coddington) [2117856]


author: Li Chenguang <lichenguang@kylinos.cn> - 3.10.0-1160.80.1.el7.01
changelog:
  - Type: update
  - ID:   [TASK#]
  - SUG:  NA
  - DESC:
  - net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  - cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  - Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.81.1.el7]
changelog:
  - [netdrv] bnxt: don't lock the tx queue from napi poll (Jamie Bainbridge) [2110869]
  - [netdrv] bnxt_en: reverse order of TX disable and carrier off (Jamie Bainbridge) [2110869]
  - [netdrv] qede: confirm skb is allocated before using (Jamie Bainbridge) [2131145]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.82.1.el7]
changelog:
  - net: usb: ax88179_178a: Fix packet receiving (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - net: usb: ax88179_178a: fix packet alignment padding (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
  - mm: swap: disable swap_vma_readahead for PPC64 (Rafael Aquini) [2142455]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.83.1.el7]
changelog:
  - x86/sme: avoid using __x86_return_thunk (Rafael Aquini) [2122158]
  - scsi: core: Simplify control flow in scmd_eh_abort_handler() (Ewan D. Milne) [2128337]
  - scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run (Ewan D. Milne) [2128337]
  - [netdrv] i40e: Fix freeing of uninitialized misc IRQ vector (Jamie Bainbridge) [2129248]
  - x86/speculation: Use generic retpoline by default on AMD (Rafael Aquini) [2062165] {CVE-2021-26401}


author: Li Chenguang <lichenguang@kylinos.cn> - 3.10.0-1160.83.1.el7.01
changelog:
  - Type: update
  - ID:   [TASK#136581]
  - SUG:  NA
  - DESC:
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.84.1.el7]
changelog:
  - blk-mq: fix flush-rq race (Ming Lei) [2088029]
  - scsi: target: iscsi: Fix a race condition between login_work and the login thread (Maurizio Lombardi) [2154243]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.85.1.el7]
changelog:
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [2054037]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [2054037]
  - sctp: handle errors when updating asoc (Xin Long) [2054037]
  - sctp: no need to check assoc id before calling sctp_assoc_set_id (Xin Long) [2054037]
  - s390/topology: fix warning when disabling cpus (Tobias Huschle) [2071980]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.86.1.el7]
changelog:
  - openvswitch: fix OOB access in reserve_sfa_size() (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - openvswitch: fix flow actions reallocation (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - gitlab-ci: use CI templates from production branch (Michael Hofmann)
  - mm: prevent page_frag_alloc() from corrupting the memory (Rafael Aquini) [2141062]
  - mm: Use fixed constant in page_frag_alloc instead of size + 1 (Rafael Aquini) [2141062]
  - mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs (Rafael Aquini) [2141062]
  - x86/pat: Pass valid address to sanitize_phys() (Jeff Moyer) [1974485]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.87.1.el7]
changelog:
  - Revert "openvswitch: fix flow actions reallocation" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - Revert "openvswitch: fix OOB access in reserve_sfa_size()" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
  - kvm/emulate: Fix SETcc emulation function offsets with SLS (Vitaly Kuznetsov) [2143438]
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Rafael Aquini) [2138620] {CVE-2022-42703}
  - mm, rmap: handle anon_vma_prepare() common case inline (Rafael Aquini) [2138620] {CVE-2022-42703}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152565] {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152565] {CVE-2022-4378}
  - scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (Nilesh Javali) [2092105]
  - fs: move S_ISGID stripping into the vfs_*() helpers (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
  - fs: Add missing umask strip in vfs_tmpfile (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
  - fs: add mode_strip_sgid() helper (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.88.1.el7]
changelog:
  - KVM: x86: add bit to indicate correct tsc_shift (Marcelo Tosatti) [2152838]
  - KVM: x86: rewrite handling of scaled TSC for kvmclock (Marcelo Tosatti) [2152838]
  - KVM: x86: rename argument to kvm_set_tsc_khz (Marcelo Tosatti) [2152838]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.90.1.el7]
changelog:
  - NFSv4.1: Fix open stateid recovery (Benjamin Coddington) [2156890]
  - NFS: Don't open code clearing of delegation state (Benjamin Coddington) [2156890]


author: Li Chenguang <lichenguang@kylinos.cn> - 3.10.0-1160.90.1.el7.01
changelog:
  - Type: update
  - ID:   [TASK#151007]
  - SUG:  NA
  - DESC:
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.92.1.el7]
changelog:
  - packet: fix use-after-free in prb_retire_rx_blk_timer_expired() (Florian Westphal) [2182642]
  - x86/bugs: Workaround for incorrectly set X86_BUG_RETBLEED under VMware (Waiman Long) [2189556]


author: Cheng Weizheng <chengweizheng@kylinos.cn> - 3.10.0-1160.92.1.el7.01
changelog:
  - Type: update
  - ID:   [TASK#156509]
  - SUG:  NA
  - DESC:
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch


author: Zhao Mengmeng <zhaomengmeng@kylinos.cn> - 3.10.0-1160.92.1.el7.03
changelog:
  - Type: update
  - ID:   [TASK#165498] 
  - SUG:  NA
  - DESC: ext4: don't BUG on inconsistent journal feature


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.93.1.el7]
changelog:
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Wander Lairson Costa) [2152941] {CVE-2022-3564}
  - proc/pagemap: walk page tables under pte lock (Rafael Aquini) [2190338]


author: Qiao jijun <qiaojijun@kylinos.cn> - 3.10.0-1160.99.1.el7.01
changelog:
  - Type: update
  - ID:   [TASK#171500]
  - SUG:  NA
  - DESC:
  -  net: Add patch 10000-KYLIN-Fix-OOB-read-and-write-in-hw_atl_utils_fw_rpc_wait.patch to fix CVE-2021-43975
  -  cpu: Add suport HYGON and Zhaoxin.
  -  Add patch 10001-KYLIN-support-ZHAOXIN.patch
  -  Add patch 000_x86_add_hygon_family_18h.patch
  -  Add patch 10002-KYLIN-Fix-CNVD-C-2022-231201-l2tp.patch
  -  Add patch 10004-ext4-don-t-BUG-on-inconsistent-journal-feature.patch


author: Qiao jijun <qiaojijun@kylinos.cn> - 3.10.0-1160.99.1.el7.02
changelog:
  - Type: cves
  - ID:   [TASK#177638] CVE-2023-42753
  - SUG:  NA
  - DESC:
  - CVE: CVE-2023-42753 ,add patch 10005-netfilter-ipset-add-the-missing-IP_SET_HASH_WITH_NET.patch


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.1-5
changelog:
  - Apply a patch by Stephen Gallagher to patch autoconf, not configure to
    allow optflags to be passed in by build environment
  - Run autoreconf before configure
  - git rm obsolete patches
  - Apply upstream patch to stop overriding AC_CONFIG_MACRO_DIR


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-1
changelog:
  - New upstream release 1.10
  - Obsolete upstreamed patches
  - Amend the multilib patch, there's no need to patch configure since we
    are running autoreconf anyways
  - https://raw.github.com/bagder/c-ares/cares-1_10_0/RELEASE-NOTES


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-8
changelog:
  - Disable iterate-10 test which fails intermitently (#1596161)
  - Add BuildRequires for running autoreconf


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-9
changelog:
  - Remove patch to pass _PROXY, _proxy, LANG and LC_* environment
    variables to helpers. The root cause was a bug in IPA (#1596161)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-12
changelog:
  - Add documentation for the '-N' option to the dogtag-ipa-renew-agent-submit
    man page (#1651368)
  - SCEP: Don't set message=<ca ident> with GetCaps and GetCACert (#1608781)
  - SCEP operation GetCAChain is not valid. Should be GetCACertChain (#1590727)
  - Document owner and permission parameters to getcert (#1549585)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-17
changelog:
  - certmonger creates CSRs with invalid DER syntax for X509v3 extensions
    with critical=FALSE (#2015511)


author: Martin Pitt <mpitt@redhat.com> 193-1
changelog:
  - Storage: Fix fstab entries for VDO volumes rhbz#1669402
  - Storage: Only show NFS mounts in NFS table rhbz#1689235
  - Docker: Include kubernetes containers in CPU/memory graphs rhbz#1525794


author: Martin Pitt <mpitt@redhat.com> 195-1
changelog:
  - Machines: Reset source when changing source type rhbz#1707655
  - Machines: Disallow detaching disks on paused VMs rhbz#1708515
  - Machines: Fix crash with non-existing storage pools rhbz#1712441
  - Machines: Fix issues with NIC edit dialog rhbz#1708976
  - Machines: Always shut off the VMs before deletion rhbz#1706678
  - cockpit-machines: Require libvirt-dbus rhbz#1712911


author: Martin Pitt <mpitt@redhat.com> 195.4-2
changelog:
  - Machines: Disable Create VM button if virt-install command is not
    available (rhbz#1704853)
  - Machines: Add tooltip next to VCPUs when VM is running (rhbz#1720076)
  - Machines: Use libvirt-dbus on RHEL 7
  - Machines: Support storage pool types other than "dir" (rhbz#1719556)
  - Update translations (rhbz#1733994)


author: Martin Pitt <mpitt@redhat.com> 195.5-2
changelog:
  - machines: Fix incorrect disk format when attaching existing volume
    (rhbz#1765488)
  - machines: Limit pool deletion if pool/volumes are used by any VM
    (rhbz#1765491)
  - machines: When changing installation source, always try to
    re-autodetect the OS (rhbz#1765500)


author: Martin Pitt <mpitt@redhat.com> 195.8-2
changelog:
  - Machines: Avoid D-Bus introspection to libvirt-dbus, to speed up polkit
    operations (rhbz#1780400)
  - Machines: Fix CPU statistics (rhbz#1763641)


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
  - New upstream version
  - Do not unconditionally enable BPC on the color transform
  - Fix profile created time for non-UTC timezones
  - Record the gamma table in the session helper error message


author: Richard Hughes <richard@hughsie.com> 1.0.2-1
changelog:
  - New upstream version
  - Add cd_icc_save_data() so that we can easily set _ICC_PROFILE
  - Add CdIccStore to monitor directories of ICC profiles
  - Add SystemVendor and SystemModel properties to the main interface
  - Allow to specify a non-qualified path when using FindProfileByFilename
  - Allow using the key 'Filename' when using FindProfileByProperty
  - Always return the error if any sync method failed
  - Fix GObject introspection when getting lists
  - Fix GObject introspection when getting metadata


author: Richard Hughes <richard@hughsie.com> 1.0.4-1
changelog:
  - Rebase to a new upstream version to fix small security bug
  - Use %ghost in the to avoid removing databases on upgrades
  - Resolves: #1012832


author: Jan Grulich <jgrulich@redhat.com> - 0.23-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1568618


author: Jan Grulich <jgrulich@redhat.com> - 0.26-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1668355


author: Jindrich Novy <jnovy@redhat.com> - 0.8.6-2
changelog:
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-8
changelog:
  + control-center-3.26.2-8
  - Fix Wi-Fi networks not getting updated
  - Show "Wi-Fi disabled" page when Wi-Fi is disabled
  - Resolves: #1545713


author: Liutao1 <liutao1@kylinos.cn> - 3.28.1-7.ns7.01
changelog:
  - add Patch 103, support dot of hostname.
  - add Patch 102, show cpu info for arm64.
  - add Patch101, fix po for homepage.
  - add Patch100, to fix meson build error.


author: guochao <guochao@kylinos.cn> - 3.28.1-8.1.ns7.01
changelog:
  - Type:updates
  - ID:NA
  - SUG:NA
  - DESC: add Patch 103, support dot of hostname.
          add Patch 102, show cpu info for arm64.
          add Patch101, fix po for homepage.
          add Patch100, to fix meson build error.


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-18
changelog:
  - fix xfs build failure in chrooted environment (#1263341)
  - update filesystem lists for stat and tail from latest upstream
    (#1327881, #1280357) 
  - disable id/setgid.sh test(missing chroot feature), fix 
    cp-a-selinux test (#1266500,#1266501)
  - colorls.sh - change detection of interactive shell for ksh
    compatibility (#1321648)
  - fix date --date crash with empty or invalid TZ envvar (#1325786)
  - df -l: do not hang on a dead autofs mount point (#1309247)
  - sort -h: fix functionality of human readable numeric sort for other
    than first field (#1328360)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-19
changelog:
  - timeout: fix race possibly terminating wrong process (#1439465)
  - ls: allow interruption when reading slow directories (#1421802)
  - fold: preserve new-lines in mutlibyte text (#1418505)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-23
changelog:
  - update description of the -a/--all option in df.1 man page (#1553212)
  - sort -M: fix memory leak when using multibyte locale (#1540059)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-24
changelog:
  - doc: improve description of the --kibibytes option of ls (#1527391)
  - doc: fix typo in date example (#1620624)
  - stat,tail: sync the list of file systems with coreutils-8.31 (#1659530)
  - df: avoid stat() for dummy file systems with -l (#1668137)
  - df: prioritize mounts nearer the device root (#1042840)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-1
changelog:
  - Resolves: rhbz#1732039
  - Resolves: rhbz#1153818
  - Resolves: rhbz#1647120

  - Rebase to Corosync 2.4.5


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-2
changelog:
  - Resolves: rhbz#1656492

  - totem: Increase ring_id seq after load (rhbz#1656492)
  - merge upstream commit 1061804d09565363aba73e369faf310a7d2c4d86 (rhbz#1656492)


author: Jan Friesse <jfriesse@redhat.com> - 2.4.5-3
changelog:
  - Resolves: rhbz#1737884
  - Resolves: rhbz#1737887

  - Do not set exec permission for service file
  - Fix CFLAGS definition


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-5
changelog:
  - Resolves: rhbz#1679792
  - Resolves: rhbz#1780134

  - votequorum: Ignore the icmap_get_* return value (rhbz#1780134)
  - merge upstream commit 8ad3c6bbb4556332c5a6b7fecdab73310c045b24 (rhbz#1780134)
  - votequorum: Reflect runtime change of 2Node to WFA (rhbz#1780134)
  - merge upstream commit bfbed8c320b0c0c5d3db48630f3de77e5fd62b75 (rhbz#1780134)
  - votequorum: set wfa status only on startup (rhbz#1679792)
  - merge upstream commit 6894792d76b1e8932bc822bb040933ae17e1a0c7 (rhbz#1679792)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-6
changelog:
  - Resolves: rhbz#1835885

  - stats: Add basic schedule-miss stats to needle (rhbz#1835885)
  - merge upstream commit 274fda334a84253222e01b779349784ec552921b (rhbz#1835885)
  - main: Add schedmiss timestamp into message (rhbz#1835885)
  - merge upstream commit 3166a87749fa4817d90ed335f3c5843fc38e7304 (rhbz#1835885)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-7
changelog:
  - Related: rhbz#1835885

  - main: Make schedmiss in cmap and log equal (rhbz#1835885)
  - merge upstream commit 44c1c8ea31f981bdd7856d4eb8f4ac49f95a85e3 (rhbz#1835885)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-7.1
changelog:
  - Resolves: rhbz#1896311
  - Resolves: rhbz#1897087

  - spausedd: Fix log_perror (rhbz#1896311)
  - spausedd: Add ability to move process into root cgroup (rhbz#1897087)


author: Dave Anderson <anderson@redhat.com> - 7.2.3-5
changelog:
  - Rebase to github commits b9d76838 to c79a11fa
    Resolves: rhbz#1559460
  - Fix ppc64/ppc6le stacksize calculation
    Resolves: rhbz#1589685


author: Dave Anderson <anderson@redhat.com> - 7.2.3-7
changelog:
  - Support ppc64 increased VA range
  - Fix ppc64 "bt" command failure reporting invalid NIP value
    Resolves: rhbz#1617936


author: Dave Anderson <anderson@redhat.com> - 7.2.3-8
changelog:
  - Fix ppc64 "bt" command failure reporting invalid NIP value for a user-space task. 
    Resolves: rhbz#1617936


author: Dave Anderson <anderson@redhat.com> - 7.2.3-9
changelog:
  - Alternate list loop detection option
    Resolves: rhbz#1595389
  - Readline library tab completion plugin
    Resolves: rhbz#1656165


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.3-11.1
changelog:
  - crash/sadump, kaslr: fix failure of calculating kaslr_offset due to an sadump format restriction
    Resolves: rhbz#1854016


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-16
changelog:
  - disable mail from anacron with empty MAILTO
  - crontab: do not block access with PAM when running as root
  - improve the crontab man page
  - do not hardcode system_u selinux user but use the user from
    the current context


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-17
changelog:
  - make anacron not to contradict itself in syslog
    (job output does not have to be necessarily mailed)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-18
changelog:
  - fix regression - spurious PAM log message from crontab (#1479064)
  - allow empty variables in crontabs (#1439217)


author: Marcel Plch <mplch@redhat.com> - 1.4.11-20
changelog:
  - Fix race condition when crontab is modified the same second
    before and after reading the crontab
  - Resolves: rhbz#1638691


author: Marcel Plch <mplch@redhat.com> - 1.4.11-22
changelog:
  - Backport upstream patch to fix cron failing on
    smart card authentication
  - Resolves: rhbz#1650314


author: Jan Staněk <jstanek@redhat.com> - 1.4.11-24
changelog:
  - Limit memory allocated for file descriptors
    Backports https://github.com/cronie-crond/cronie/commit/584911514ce6aa2f16e1d79431bac816ea62cb2c
    Resolves: rhbz#2026289


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-44
changelog:
  - 1774460 - CVE-2019-8696 cups: stack-buffer-overflow in libcups's asn1_get_packed function [rhel-7]
  - 1774461 - CVE-2019-8675 cups: stack-buffer-overflow in libcups's asn1_get_type function [rhel-7]
  - 1753809 - Settings in ~/.cups/client.conf aren't used


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-46
changelog:
  - 1715907 - CUPS- client: cupsGetPPD3() function tries to load PPD from IPP printer and not from the CUPS queue


author: Bryan Mason <bmason@redhat.com> - 1:1.6.3-52.1
changelog:
  - RHEL-6523 - cups: memory leak in _ppdOpen()
  - CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.35-28
changelog:
  - 1816109 - Queues are not cleaned up after stopping cups-browsed
  - 1811190 - cups-browsed leaks memory


author: Bryan Mason <bmason@redhat.com> - 1.0.35-29.1
changelog:
  - CVE-2024-47176 - cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source
  - CVE-2024-47076 'cfGetPrinterAttributes' API does not perform sanitization on returned IPP attributes
  - CVE-2024-47175 remote command injection via attacker controlled data in PPD file


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-21
changelog:
  - Fix heap-based buffer overflow in texttopdf filter (bug #1241242,
    CVE-2015-3258, CVE-2015-3279).


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-50
changelog:
  - remove dead code, detected by Coverity Analysis
  - remove unused variable, detected by GCC and Clang


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
  - prevent curl --rate-limit from hanging on file URLs (#1281969)
  - fix NTLM password overflow via integer overflow (CVE-2018-14618)
  - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
  - backport options to force TLS 1.3 in curl and libcurl (#1672639)
  - prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Jakub Jelen <jjelen@redhat.com> 2.1.26-18
changelog:
  - Revert updated GSSAPI flags as in RFC 4752 to restore backward compatibility (#1154566)
  - Add and document ability to run saslauth as non-root user (#1188065)
  - Support AIX SASL GSSAPI (#1174322)
  - Update client library to be thread safe (#1147659)
  - Fix problem, that parsing short prefix matches the whole mechanism name (#1089267)
  - Don't use unnecessary quotes around user description (#1082564)
  - Fix confusing message when config file has typo (#1022479)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-127
changelog:
  - Add 0256-RHBZ-1672175-retry-no-fd-paths.patch
    * retry adding paths if they couldn't be opened initially
  - Add 0257-RHBZ-1679556-dont-check-dm-devices.patch
    * don't check if dm devices are multipath paths
  - Add 0258-RHBZ-1634183-ANA-prioritizer.patch
    * Add NVMe ANA path prioritizer
  - Resolves: bz #1634183, #1672175, #1679556


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-128
changelog:
  - Modify 0258-RHBZ-1634183-ANA-prioritizer.patch
    * minor change
  - Add 0259-RHBZ-1701604-fix-nr-active.patch
    * recalculate the number of active paths whenever a path is checked
  - Add 0260-RHBZ-1634183-prio-fixes.patch
  - Add 0261-RHBZ-1714506-skip-blacklisted-paths.patch
    * ignore blacklisted paths in mpathpersist
  - Add 0262-RHBZ-1699486-reload-with-failed-paths.patch
    * allow forced reloads even if there are no reusable paths
  - Add 0263-RHBZ-1686708-nvme-hcil.patch
    * make nvme ids work like in upstream
  - Add 0264-RHBZ-1699441-de-series-config.patch
  - Resolves: bz #1686708, #1699441, #1699486, #1701604, #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-129
changelog:
  - Add 0265-RHBZ-1721855-mpathpersist-speedup.patch
    * only grab path information from necessary devices, and allow batch files.
  - Add 0266-RHBZ-1696817-fix-emc-checker.patch
    * fix detection of inactive snapshots
  - Add 0267-RHBZ-1661156-powermax-config.patch
  - Remove 0261-RHBZ-1714506-skip-blacklisted-paths.patch
    * This fix is superseded by 0265-RHBZ-1721855-mpathpersist-speedup.patch
  - Resolves: bz #1661156, #1696817, #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-130
changelog:
  - Add 0268-RHBZ-1721855-mpathpersist-fixes.patch
    * Fix issues in the mpathpersist speedup code
  - Resolves: bz #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-131
changelog:
  - Modify 0268-RHBZ-1721855-mpathpersist-fixes.patch
    * The fix for 1721855 broke 1714506.
  - Resolves: bz #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-132
changelog:
  - Add 0269-RHBZ-1804420-remove-kpartx-limit.patch
    * Remove the 256 device limit, when searching loop devices with kpartx
  - Resolves: bz #1804420


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-133
changelog:
  - Add 0270-RHBZ-1775481-segfault-fix.patch
    * Fix segfault related to missing dm device tables
  - 0271-RHBZ-1806197-mpathconf-typo.patch
  - Resolves: bz #1775481, #1806197


author: Marian Csontos <mcsontos@redhat.com> - 0.7.3-1
changelog:
  - Update to latest bugfix and documentation update release.
  - *_restore tools wipe superblock as a last resort.
  - Add thin_check --override-mapping-root.


author: Jakub Jelinek <jakub@redhat.com> 0.9-1
changelog:
  - fix up handling of DIE equality if more than one DIE in the same
    CU compare equal (#889283)
  - check DW_FORM_ref_addr properly during fi_multifile phase


author: Jakub Jelinek <jakub@redhat.com> 0.10-1
changelog:
  - when creating DW_AT_stmt_list, use DW_FORM_sec_offset for dwarf4
    and DW_FORM_data4 for dwarf[23] rather than vice versa (#919755)


author: Josh Stone <jistone@redhat.com> - 9.2.0-4
changelog:
  - rhbz1366656: fix ppc64 relocation rewriting
  - rhbz1366726: check mmap constrains for locality
  - rhbz1367225: fix x86 codegen for 64-bit offsets


author: Mark Wielaard <mjw@redhat.com> - 0.166-1
changelog:
  - Update to elfutils 0.166 (#1322412)
    Drop upstreamed patches:
    - elfutils-0.165-elf-libelf.patch
    - elfutils-0.165-nobitsalign-strip.patch


author: Mark Wielaard <mjw@redhat.com> - 0.167-1
changelog:
  - Update to elfutils 0.167 (#1366182,#1356263)
    Drop upstreamed patch: elfutils-0.166-elfcmp-comp-gcc6.patch


author: Mark Wielaard <mjw@redhat.com> - 0.168-1
changelog:
  - New upstream release from new project home https://sourceware.org/elfutils/
    Resolves: Rebase elfutils to 0.168 bugfix release (#1412299)


author: Mark Wielaard <mark@klomp.org> - 0.168-3
changelog:
  - Adjust internal library so names (#1412305).
  - Never use old, deprecated, filter_provides_in, it really is too broken.


author: Petr Machata <pmachata@redhat.com> - 0.7.91-7
changelog:
  - Add an upstream patch that fixes missed initialization of some
    fields in struct process after atteching to a multi-threaded
    process.  (ltrace-0.7.2-e_machine.patch)
  - Add upstream patch-set that implements support for the new aarch64
    architecture.  (ltrace-0.7.91-aarch64.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-9
changelog:
  - Add upstream fix for a bug in labeling PLT slots
    (ltrace-0.7.91-x86-plt_map.patch,
    ltrace-0.7.91-x86-unused_label.patch)


author: Petr Machata <pmachata@redhat.com> - 0.7.91-10
changelog:
  - Add fixes in handling of bogus paths that come from XDG_CONFIG_DIRS
    (ltrace-0.7.91-XDG_CONFIG_DIRS.patch,
    ltrace-0.7.91-XDG_CONFIG_DIRS-2.patch)
  - Add test suite fixes
    (ltrace-0.7.91-testsuite-system_call_params.patch,
    ltrace-0.7.91-testsuite-system_call_params-2.patch,
    ltrace-0.7.91-testsuite-system_calls.patch)
  - Add upstream fixes for tracing multi-threaded processes without -f
    (ltrace-0.7.91-multithread-no-f-1.patch,
    ltrace-0.7.91-multithread-no-f-2.patch)


author: DJ Delorie <dj@redhat.com> - 0.7.91-15
changelog:
  Jeff Law <law@redhat.com>
  - Pull in fc24 patches
  - Remove local patch #204
  - Sync BuildRequires and %build with Fedora to fix aarch64 problem
  - Add missing #includes to some aarch64 code


author: DJ Delorie <dj@redhat.com> - 0.7.91-17
changelog:
  - Remove mentions of (and one attempt to patch) backup files in 
    ltrace-0.7.91-unwind-elfutils.patch (#1427140)


author: Petr Machata <pmachata@redhat.com> - 1:3.82-18
changelog:
  - Backport upstream patch that adds wildcard expansion to pattern
    rules. (make-3.82-stem_glob.patch)


author: Petr Machata <pmachata@redhat.com> - 1:3.82-19
changelog:
  - make now restores rlimit to its original values before launching
    subprocess via $(shell) (make-3.82-func_shell-rlimit.patch)
  - Determinize one test (make-3.82-tests-SECONDARY.patch)


author: Patsy Franklin <pfrankli@redhat.com> - 1:3.82-22
changelog:
  - Check if the target-specific variable is the same as the global
    variable, and if it is, don't free it.  Savannah bug #31743.
    Resolves: #1323206


author: Patsy Franklin <pfrankli@redhat.com> - 1:3.82-23
changelog:
  - In very obscure situations we may incorrectly write the free token
    back to the pipe.
    Resolves: #1322670


author: Patsy Franklin <pfrankli@redhat.com> - 4.1-3
changelog:
  - Increase time before timeout for test fopen-fail to prevent
    failing before issuing expected error.


author: Will Cohen <wcohen@redhat.com> - 0.9.9-5
changelog:
  - Update Intel Haswell events.
  - Add support for Intel Silvermont (Avoton).
  - Add support for Intel Broadwell.
  - Add support for aarch64.
  - Update IBM power8 events.


author: Will Cohen <wcohen@redhat.com> - 0.9.9-7
changelog:
  - LLC_REFS and LLC_MISSES do not work on some CPUs.
  - incorrect handling of default unit masks longer than 11 characters
  - Oprofile updates for Avoton
  - Unable to profile jited JVM code when using static huge pages
  - operf causes rpmbuild to fail


author: Will Cohen <wcohen@redhat.com> - 1.1.0-4
changelog:
  - Update events non-x86 architectures (aarch64, power, zseries)
  - Add support for newer Intel processors.


author: DJ Delorie <dj@redhat.com> - 4.12-3
changelog:
  - Merge upstream patches for vhangup and chown
  - Skip some tests on older kernels (RHEL 6)
  - Remove -m64 that rpm macros adds
  - Duplicate vhangup/chown patch for -m32 also.


author: Frank Ch. Eigler <fche@redhat.com> - 3.0-3s
changelog:
  - rhbz1346112 delay tls cert creation
  - rhbz1269062 null elevator
  - rhbz1337416 'count' tapset variable - autocast/@defined


author: Mark Wielaard <mjw@redhat.com> - 3.11.0-26
changelog:
  - Rebase against fedora package:
    - Only build valgrind-openmpi when not creating a software collection.
    - No support for multilib on secondary arches when creating scl.
    - Mandatory Perl build-requires added
    - Add valgrind-3.11.0-shr.patch
    - Add valgrind-3.11.0-pcmpxstrx-0x70-0x19.patch
    - Update valgrind-3.11.0-wrapmalloc.patch
    - Add valgrind-3.11.0-sighandler-stack.patch
    - Update valgrind-3.11.0-ppoll-mask.patch (#1344082)
    - Add valgrind-3.11.0-arm64-handle_at.patch
    - Add valgrind-3.11.0-ppc64-syscalls.patch
    - Add valgrind-3.11.0-deduppoolalloc.patch
    - Add valgrind-3.11.0-ppc-bcd-addsub.patch
    - Add valgrind-3.11.0-ppc64-vgdb-vr-regs.patch
    - Update valgrind-3.11.0-cxx-freeres.patch (x86 final_tidyup fix)
    - Add valgrind-3.11.0-s390x-risbgn.patch
    - Add valgrind-3.11.0-cxx-freeres.patch (#1312647)
    - Add valgrind-3.11.0-ppc64-separate-socketcalls.patch
    - Add valgrind-3.11.0-isZeroU.patch
    - Replace valgrind-3.11.0-arm64-ldpsw.patch with upstream version


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-0.1-BETA1
changelog:
  - Update to valgrind 3.12.0 pre-release.
    - Drop upstreamed patches.
    - Disable exp-tests in %check. GDB crashes on gdb_server tests.


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-0.2-BETA1
changelog:
  - Add valgrind-3.12-beta1-ppc64be.patch. (#1378963)
  - Enable gdb_server tests again. (#1378143)
  - And disable it again on rhel6 (both i686 and x86_64)
    and rhel7 (ppc64 and ppc64le only) (#1380513)


author: Stan Cox <scox@redhat.com> - 9.3.2-3
changelog:
  - rhbz1503116 possible soname clashes between base rhel- and devtoolset- dyninst
  - rhbz1538757 segfault with a glibc built with binutils-2.27: handle R_*_IRELATIVE


author: Mark Wielaard <mjw@fedoraproject.org> - 0.169-3
changelog:
  - Add elfutils-0.169-dup-shstrtab.patch (#1455687)
  - Add elfutils-0.169-strip-empty.patch (#1455620)


author: Mark Wielaard <mjw@redhat.com> - 0.170-4
changelog:
  - Add elfutils-0.170-dwarf_aggregate_size.patch (#1527966).
  - Add elfutils-0.170-x86_64-backtrace-test-override.patch.


author: Patsy Franklin <pfrankli@redhat.com> - 4.2.1-1
changelog:
  - Rebase to make-4.2.1
    Removed two patches that have been resolved upstream.
    Reworked seven patches.
    Resolves: #1455702 and #1455705
  - make no longer segfaults inside a chroot without /dev/pts
    Resolves: #1451452 and #1455695


author: Mark Wielaard <mjw@redhat.com> - 3.12.0-6
changelog:
  - Add valgrind-3.12.0-arm64-ppc64-prlimit64.patch
  - Add valgrind-3.12.0-arm64-hint.patch
  - Add valgrind-3.12.0-clone-spawn.patch
  - Add valgrind-3.12.0-quick-fatal-sigs.patch
  - Add valgrind-3.12.0-exit_group.patch
  - Add valgrind-3.12.0-deregister-stack.patch
  - Add valgrind-3.12.0-x86-gdt-and-ss.patch
  - Add valgrind-3.12.0-cd-dvd-ioctl.patch
  - Add valgrind-3.12.0-tests-cxx11_abi_0.patch
  - Add valgrind-3.12.0-helgrind-dl_allocate_tls-supp.patch
  - Add valgrind-3.12.0-ppc-xxsel.patch


author: Mark Wielaard <mjw@fedoraproject.org> - 3.13.0-0.1.RC1
changelog:
  - Update description as suggested by Ivo Raisr.
  - Workaround gdb/python bug in testsuite (#1434601)
  - Update to upstream 3.13.0-RC1.
  - Drop all upstreamed patches.
  - Add valgrind-3.13.0-arm-dcache.patch
  - Add valgrind-3.13.0-g++-4.4.patch
  - Add valgrind-3.13.0-s390x-GI-strcspn.patch
  - Add valgrind-3.13.0-xtree-callgrind.patch


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-4
changelog:
  - Rebase to fedora valgrind version (#1467952)
    - Add --error-exitcode=1 to /bin/true check.
    - Add valgrind-3.13.0-arm-index-hardwire.patch
    - Add valgrind-3.13.0-ucontext_t.patch
    - Add valgrind-3.13.0-gdb-8-testfix.patch
    - Add valgrind-3.13.0-disable-vgdb-child.patch
    - Add valgrind-3.13.0-arm64-hwcap.patch
    - Add valgrind-3.13.0-epoll_pwait.patch
    - Add valgrind-3.13.0-ppc64-diag.patch


author: Mark Wielaard <mjw@redhat.com> - 3.13.0-10
changelog:
  - Add valgrind-3.13.0-ppc64-timebase.patch (#1523871)
  - Sync with rhel 7.5 valgrind (#1523872)
    - Add --error-exitcode=1 to /bin/true check.
    - Add valgrind-3.13.0-xml-socket.patch
    - Add valgrind-3.13.0-ppc64-vex-fixes.patch
    - Add valgrind-3.13.0-amd64-eflags-tests.patch
    - Add valgrind-3.13.0-suppress-dl-trampoline-sse-avx.patch
    - Add valgrind-3.13.0-static-tls.patch


author: Nick Clifton <nickc@redhat.com> - 2.30-47
changelog:
  - Fix a potential buffer overrun when parsing a corrupt ELF file.  (#1632912)
  - Add a .attach_to_group pseuo-op to assembler (for use by annobin).  (#1630574)
  - Stop the binutils from statically linking with libstdc++.  (#1630550)
  - Include gold testsuite results in test logs.
  - Update x86_64 linker testsuite after previous delta.  (#1624779)
  - Disable the x86_64 linker's elimination of PLT entries.  (#1624779)
  - Disable readelf's reporting of gaps in build notes.  (#1623556)
  - Fix some more PowerPC64 linker testsuite failures.  (#1584565)
  - Remove PLT eliision patch.  (#1618748)
  - Restore the binutils-2.25-set-long-long.patch.
  - Fix GOLDs creation of PT_NOTE segments.  (#1614908)  (#1614920)
  - Improve objcopy's --merge-notes option.  (#1608390)
  - Remove x86 ISA property notes with empty bits.  (#1609801)
  - Rebuild with fixed binutils
  - Move the .gnu.build.attributes section to after the .comment section.
  - Merge .gnu.build.attribute sections together.  (#1608390)
  - Fix the gold linker so that it can handle relocs in discardeable note sections.  (#1607054)
  - Fix the generation of relocations for assembler created notes.  (#1598551)


author: Nick Clifton <nickc@redhat.com> - 2.30-54
changelog:
  - Fix AArch64 linker testsuite problems.  (#1702247)
  - Fix S390x linker testsuite problems.  (#1702248)
  - Fix PPC64le linker testsuite problems.  (#1702249)


author: Stan Cox <scox@redhat.com> - 9.3.2-6
changelog:
  - rhbz1498558 Needs dyninst-devtoolset installed
  - rhbz1470149 Use separate debuginfo for dyninst-testsuite
  - rhbz1647471 so name clashes


author: Mark Wielaard <mjw@fedoraproject.org> - 0.170-11
changelog:
  - Add explict libstdc++-devel BuildRequires for demangle support.
  - Add elfutils-0.170-unwind.patch. (#1555726)


author: Mark Wielaard <mjw@fedoraproject.org> - 0.171-1
changelog:
  - New upstream release.
    - DWARF5 and split dwarf, including GNU DebugFission, support.
    - readelf: Handle all new DWARF5 sections.
      --debug-dump=info+ will show split unit DIEs when found.
      --dwarf-skeleton can be used when inspecting a .dwo file.
      Recognizes GNU locviews with --debug-dump=loc.
    - libdw: New functions dwarf_die_addr_die, dwarf_get_units,
      dwarf_getabbrevattr_data and dwarf_cu_info.
      libdw will now try to resolve the alt file on first use
      when not set yet with dwarf_set_alt.
      dwarf_aggregate_size() now works with multi-dimensional arrays.
    - libdwfl: Use process_vm_readv when available instead of ptrace.
    - backends: Add a RISC-V backend.


author: Mark Wielaard <mjw@fedoraproject.org> - 0.172-1
changelog:
  - New upstream release.
    - No functional changes compared to 0.171.
    - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5
      data. Thanks to running the afl fuzzer on eu-readelf and various
      testcases.
    - eu-readelf -N is ~15% faster.


author: Mark Wielaard <mjw@redhat.com> - 0.173-1
changelog:
  - New upstream release
    - More fixes for crashes and hangs found by afl-fuzz. In particular
      various functions now detect and break infinite loops caused by bad
      DIE tree cycles.
    - readelf: Will now lookup the size and signedness of constant value
      types to display them correctly (and not just how they were encoded).
    - libdw: New function dwarf_next_lines to read CU-less .debug_line data.
      dwarf_begin_elf now accepts ELF files containing just .debug_line
      or .debug_frame sections (which can be read without needing a DIE
      tree from the .debug_info section).
      Removed dwarf_getscn_info, which was never implemented.
    - backends: Handle BPF simple relocations.
      The RISCV backends now handles ABI specific CFI and knows about
      RISCV register types and names.

  - Add scl macros and elfutils-0.173-dts.patch.


author: Mark Wielaard <mjw@redhat.com> - 0.174-1
changelog:
  - New upstream release
    - libelf, libdw and all tools now handle extended shnum and shstrndx
      correctly
    - elfcompress: Don't rewrite input file if no section data needs
      updating.  Try harder to keep same file mode bits (suid) on rewrite.
    - strip: Handle mixed (out of order) allocated/non-allocated sections.
    - unstrip: Handle SHT_GROUP sections.
    - Fixes CVE-2018-16062, CVE-2018-16402 and CVE-2018-16403.


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - Update to elfutils-0.176.
    - Fixes CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
            CVE-2019-7664, CVE-2019-7665.


author: Marek Polacek <polacek@redhat.com> 8.2.1-7
changelog:
  - update from Fedora gcc-8.2.1-7 (#1664796)
  - drop gcc8-fortran-include.patch
  - add -fdec-include and -fpad-source (#1647048)
  - include forgotten ppc* intrinsic headers


author: Marek Polacek <polacek@redhat.com> 8.3.1-2
changelog:
  - update from Fedora 8.3.1-2 gcc (#1664796)
  - put liblsan_preinit.o to FULLPATH instead of FULLLPATH


author: Marek Polacek <polacek@redhat.com> 8.3.1-3
changelog:
  - update from Fedora 8.3.1-3
  - two small autoFDO fixes (#1684650)
  - fix std::hash for 2GB+ strings (PR libstdc++/89629)


author: Marek Polacek <polacek@redhat.com> 8.3.1-3.1
changelog:
  - fix tree-outof-ssa.c ICE with vector types (PR middle-end/90139, #1730724)
  - fix out-of-ssa with unsupported vector types (PR rtl-optimization/90756,
    - fix ICE with template placeholder for TTP (PR c++/86098, #1730726)


author: Marek Polacek <polacek@redhat.com> 8.3.1-3.2
changelog:
  - move UNSPEC_DARN* from altivec.md to rs6000.md (#1760208)
  - use unspec_volatile for darn (PR target/91481, #1760208, CVE-2019-15847)


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.1.90.20180727-41.fc29
changelog:
  - Reenable libipt.
  - Rebuild due to new libipt release.
  - Adjust bundled libipt; remove unnecessary patch.
  - Sync IPv6 patch with F-28 GDB.


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.2-1.fc29
changelog:
  - Rebase to FSF GDB 8.2.
  - Backport "Indicate batch mode failures by exiting with nonzero status"
    (Gary Benson, RH BZ 1491128).


author: Sergio Durigan Junior <sergiodj@redhat.com> - 8.2-2.fc29
changelog:
  - Backport "Use pulongest in aarch64-linux-tdep.c" (Tom Tromey),
    needed to unbreak the compilation on 32-bit architectures.


author: Keith Seitz <keiths@redhat.com> - 8.2-3.el7
changelog:
  - Merge from Fedora 29:
    gdb-rhbz1560010-fix-assertion-symbol-language-dict-language-?of5.patch
    (Keith Seitz, RHBZ 1664456).
  - Update gdb.spec for RHEL supported architectures and multilibs.
  - Merge from Fedora 29:
     gdb-rhbz1639242-fix-dwarf2_find_containing_comp_unit-binary-search.patch
     [RHEL RHBZ#1660220]
     gdb-rhbz1653410-avoid-crash-when-calling-warning-too-early.patch
     [RHEL RHBZ#1660221]
  - Fix annobin complaints (RH BZ 1630564):
    --without-stage1-ldflags: Disable static libstdc++ and libgcc linking.
    --disable-libmcheck: That is a distro-level decision, not package decision.


author: Mark Wielaard <mjw@fedoraproject.org> - 3.13.0-21
changelog:
  - Add valgrind-3.13.0-separate-code.patch (#1600034)
  - Add valgrind-3.13.0-arm-disable-vfp-test.patch


author: Mark Wielaard <mjw@fedoraproject.org> - 3.13.0-26
changelog:
  - Use valgrind_arches for ExclusiveArch when defined.
  - Use restorecon for scl on rhel6 to work around rpm bug (#1610676).


author: Mark Wielaard <mjw@redhat.com> - 3.14.0-16
changelog:
  - Add valgrind-3.14.0-gettid.patch
  - Add valgrind-3.14.0-ppc64-quotactl.patch
  - Add valgrind-3.14.0-ppc-subfe.patch
  - Add valgrind-3.14.0-s390x-vec-facility-bit.patch.
  - Update valgrind-3.14.0-rsp-clobber.patch
  - Add valgrind-3.14.0-subrange_type-count.patch


author: Petr Menšík <pemensik@redhat.com> - 12:4.2.5-74
changelog:
  - Use bind-export-libs package instead of bind99
  - Use isc-config.sh to configure bind libs
  - Change requirement to bind-export-devel
  - Compile with recent bind includes, that does not include isc/util.h


author: Lianbo Jiang <lijiang@redhat.com> - 1:3.2-4
changelog:
  - Fix System Slot Information for PCIe SSD
  - Resolves: rhbz#1793900
  - Sync with upstream(commit:62bce59fed1)
  - Resolves: rhbz#1767323


author: Petr Menšík <pemensik@redhat.com> - 2.76-16.1
changelog:
  - Accept responses only on correct sockets (CVE-2020-25684)
  - Use strong verification on queries (CVE-2020-25685)
  - Handle multiple identical DNS queries better (CVE-2020-25686)
  - Link against nettle for sha256 hash implementation


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-161.git64e9980
changelog:
  - make failure message for CVE-2020-1702 more obvious (#1804024)
  - drop patch for #1734482 as it breaks compilation


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-203.git0be3e21
changelog:
  - do not enable CollectMode support yet because it is not still present in
    7.6-ALT
  - Related: #1766665


author: Jindrich Novy <jnovy@redhat.com> - 2:1.13.1-205.git7d71120
changelog:
  - fix mounting volume with incorrect permission
  - fix dockerd leaking SELinux MCS labels
  - Resolves: #1734482
  - Resolves: #1896883


author: Than Ngo <than@redhat.com> - 1:1.8.4-3
changelog:
  - backport upstream patches to fix issues:
     * Generated XML is malformed
     * Missing space before optional option in method argument list
     * Closing ) of function in function documentation is in wrong color
     * Segmentation fault parsing a fortran file


author: Than Ngo <than@redhat.com> - 1:1.8.5-4
changelog:
  - Resolves: #1483569, incorrect processing of code blocks
  - Resolves: #1724173 - CVE-2016-10245, cross-site scripting


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.0.1-1
changelog:
  - Ekiga 4.0.1 stable release - Changelog
    http://ftp.gnome.org/pub/gnome/sources/ekiga/4.0/ekiga-4.0.1.news


author: Jan Synáček <jsynacek@redhat.com> - 1:24.3-21
changelog:
  - fix libjpeg detection fails with gcc7 (#1487557)
  - fix Emacs GUI Toolbar icons missing (#1477745)
  - fix hardening: TLS certificate warnings should be hard errors (#1403643)


author: xiehongyu<xiehongyu@kylinos.cn> - 1:24.3-23.01
changelog:
  - need to solve require libMagickCore.so.5()(64bit),libMagickWand.so.5()(64bit),libotf.so.0()(64bit)


author: Jakub Skunda <jskunda@redhat.com> - 1:24.3-23.2
changelog:
  - Fix man.el shell injection vulnerability (CVE-2025-1244)
  - Change patches applying to use -P parameter


author: Milan Crha <mcrha@redhat.com> - 3.22.7-4
changelog:
  - Add patch for RH bug #1441608 (Use-after-free when setting summary for component with alarms)
  - Add patch for RH bug #1439590 ([IMAPx] Unsubscribed folders shown after refresh)


author: Milan Crha <mcrha@redhat.com> - 3.22.7-7
changelog:
  - Add patch for RH bug #1504071 (Prefer SSL over STARTTLS for mail when both are set in GOA)
  - Add patch for RH bug #1476329 (Deadlock on exit under e-categories.c:finalize_categories())


author: Milan Crha <mcrha@redhat.com> - 3.28.2-1
changelog:
  - Update to 3.28.2
  - Add patch for GNOME bug #795997 (Fails to parse Google OAuth2 authorization code)
  - Resolves: #1575495


author: Milan Crha <mcrha@redhat.com> - 3.28.5-4
changelog:
  - Add patch for RH bug #1392567 (Sync CategoryList with mail Labels)
  - Add patch for RH bug #1764669 (Send meeting change notifications only if being the organizer)


author: Milan Crha <mcrha@redhat.com> - 3.12.10-5
changelog:
  - Add patch for RH bug #1366206 (Free/Busy Information returns wrong time)
  - Add patch for RH bug #1367455 (No contacts are displayed until search is started)


author: Milan Crha <mcrha@redhat.com> - 3.22.6-2
changelog:
  - Add patch for RH bug #1520936 (Unable to authenticate using Kerberos without krb5-auth-dialog package)


author: Jan Grulich <jgrulich@redhat.com> - 0.26-2
changelog:
  - Fix heap-based buffer over-read in Exiv2::Image::byteSwap4 in image.cpp
    Resolves: bz#1547207

    Fix heap-based buffer over-read in Exiv2::getULong function in types.cpp
    Resolves: bz#1545232


author: Jan Grulich <jgrulich@redhat.com> - 0.26-3
changelog:
  - Fix uncontrolled recursion in image.cpp:Exiv2::Image::printIFDStructure() which can allow a
    remote attacker to cause a denial of service via a crafted tif file
    Resolves: bz#1548410


author: Jan Grulich <jgrulich@redhat.com> - 0.27.0-4
changelog:
  - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS
    Resolves: bz#1990352


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-13
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-14
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Chris Leech <cleech@redhat.com> - 1.0.30-4.git91c0c8c
changelog:
  - 1039779 replace README that contained mostly build instructions with
    README.redhat containing better distro-specific information


author: Chris Leech <cleech@redhat.com> - 1.0.31-1.git5dfd3e4
changelog:
  - 1274530 rebase to upstream 1.0.31+
  - no longer requires libhbaapi/libhbalinux
  - no longer attempts to connect to lldpad if DC_REQUIRED is configured off
    for all interfaces


author: Chris Leech <cleech@redhat.com> - 1.0.32-1
changelog:
  - 1384707 fcoeadm --target segfaults if non-FCoE FC targets are present
  - 1321611 fcoemon should only try to connect to lldpad when required


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-39
changelog:
  - fence_vmware_rest: add filter parameter to avoid 1000 VM API limit
    and avoid failing when hitting it during the monitor-action
    Resolves: rhbz#1654058


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-41.1
changelog:
  - fence_lpar: fix issue with long username, hostname, etc not
    working when the command run by the agent exceeds 80 characters
  - fence_evacuate: enable evacuation of instances using private flavors

    Resolves: rhbz#1860545
    Resolves: rhbz#1862024


author: Liutao <liutao1@kylinos.cn> - 102.10.0-1.ns7.01
changelog:
  - Modify homepage url to https://www.kylinos.cn in firefox-redhat-default-prefs.js
  - ExcludeArch remove aarch64
  - Modify requires redhat-indexhtml to neokylin-indexhtml
  - Modify buildRequires system-bookmarks to neokylin-bookmarks
  - Add requires neokylin-bookmarks
  - Comment check step


author: Like <like@kylinos.cn> - 102.11.0-2.ns7.01
changelog:
  - Modify homepage url to https://www.kylinos.cn in firefox-redhat-default-prefs.js
  - ExcludeArch remove aarch64
  - Modify requires redhat-indexhtml to neokylin-indexhtml
  - Modify buildRequires system-bookmarks to neokylin-bookmarks
  - Add requires neokylin-bookmarks


author: Like <like@kylinos.cn> - 102.12.0-1.ns7.01
changelog:
  - Type: NA
  - ID: NA
  - SUG: NA
  - DESC:Modify homepage url to https://www.kylinos.cn in firefox-redhat-default-prefs.js
  - -ExcludeArch remove aarch64
  - -Modify requires redhat-indexhtml to neokylin-indexhtml
  - -Modify buildRequires system-bookmarks to neokylin-bookmarks
  - -Add requires neokylin-bookmarks


author: Like <like@kylinos.cn> - 1.0.9-15.el7_9.ns7.01
changelog:
  - Type:compile
  - ID:NA
  - SUG:NA
  - DESC:add buildrequire:elfutils-libelf-devel fix builderror configure: error: libelf not found


author: Parag Nemade <pnemade AT redhat DOT com> - 20120731b-9
changelog:
  - Added cflags -Wstrict-aliasing
  - Fixed some compile-time errors from invalid Makefile rules
  - Fixed bogus date in changelog


author: Parag Nemade <pnemade AT redhat DOT com> - 20120731b-10
changelog:
  - Revert previously added -Wstrict-aliasing cflags
  - We actaully need -fno-strict-aliasing (rh#903288)
  - Remove %defattr() (rh#1003518)
  - fontforge.xml should not be executable (rh#1003518)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
  - Fix double free in rlm_sql acct_redundant
    Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                          unknown value" when using module sql rlm_sql


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-10
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699414 authentication bypass with an invalid curve attack
    Resolves: bz#1699419 fake authentication using reflection


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-11
changelog:
  - Fixes logrotate, EAP-PWD vulnerability
    Resolves: bz#1719368 privilege escalation due to insecure logrotate configuration
    Resolves: bz#1751796 eap-pwd: Information leak due to aborting when needing more than 10 iterations


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-15
changelog:
  - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
    Resolves: bz#1818808

    * Fri Feb 7 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.13-14
  - Fixes receiving of multiple RADIUS packets under load
    Resolves: bz#1630684


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
  - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
  - CVE-2020-11523: Fix integer overflow in region.c (#1837622)
  - CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Antonio Vieiro <avieirov@redhat.com> - 2.8-15.1
changelog:
  - Fix for CVE-2025-27363 out-of-bound write vulnerability
  - Patch initially by Marc Deslauriers of Canonical
  - https://www.openwall.com/lists/oss-security/2025/03/14/3
  - Adjusted for EL9 by Jonathan Wright of AlmaLinux
  - and a member of the Meta security team
  - Resolves: RHEL-83092


author: Richard Hughes <richard@hughsie.com> 1.0.1-1
changelog:
  - Rebase to 1.0.1, specifically the wip/hughsie/rhel75 branch which adds
    back the automake build system and lowers the required versions of deps.
  - This also un-neuters fwupd so that most of the plugins are functional,
    for instance allowing updates of Thunderbolt controllers and Logitech
    Unifying devices. However, the LVFS is still disabled.
  - Resolves: #1313086


author: Honza Horak <hhorak@redhat.com> - 2.0.35-19
changelog:
  - Spec file cleanup
  - Compile and run test suite during build
  - Using chrpath to get rid of --rpath in gd-progs


author: Filip Januš <fjanus@redhat.com> - 2.0.35-27
changelog:
  - Fix CVE-2016-5766
  - Resolves: #1356813
  - Upstream patch: https://github.com/libgd/libgd/commit/aba3db8


author: Keith Seitz <keiths@redhat.com> - 7.6.120.el7
changelog:
  - Don't classify struct members as filenames (numerous, RH BZ 1815690)
  - Fix commas in source paths bugs (Keith Seitz, RH BZ 1779246)


author: Dongqi <dongqi1@kylinos.cn> 3.28.2-26.ns7.01
changelog:
  - TYPE: update
  - ID: NA
  - SUG: NA
  - DESC: move 3.28.2-22.ns7.01 gdm-3.22.3-neokylin-lic.patch to 3.28.2-26


author: Nils Philippsen <nils@redhat.com> - 0.2.0-11
changelog:
  - replace lua-5.2 patch by upstream commit
  - fix buffer overflow in and add plausibility checks to ppm-load op
    (CVE-2012-4433)
  - fix multi-lib issue in generated documentation


author: Paul Howarth <paul@city-fan.org> - 2.2.2-1
changelog:
  - Update to 2.2.2
    - geoipupdate now calls fsync on the database directory after a rename to
      make it durable in the event of a crash
  - Update autotools patch


author: Paul Howarth <paul@city-fan.org> - 2.3.1-1
changelog:
  - Update to 2.3.1
    - geoipupdate now uses TCP keep-alive when compiled with cURL 7.25 or
      greater
    - Previously, on an invalid gzip file, geoipupdate would output binary data
      to stderr; it now displays an appropriate error message
    - Install README, ChangeLog, GeoIP.conf.default etc. into docdir (GH#33)
    - $(sysconfdir) is now created if it doesn't exist (GH#33)
    - The sample config file is now usable (GH#33)


author: Paul Howarth <paul@city-fan.org> - 2.4.0-1
changelog:
  - Update to 2.4.0
    - geoipupdate now checks that the database directory is writable: if it is
      not, it reports the problem and aborts
    - geoipupdate now acquires a lock when starting up to ensure only one
      instance may run at a time: a new option, 'LockFile', exists to set the
      file to use as a lock ('.geoipupdate.lock' in the database directory by
      default)
    - geoipupdate now prints out additional information from the server when a
      download request results in something other than HTTP status 2xx; this
      provides more information when the API does not respond with a database
      file
    - ${datarootdir}/GeoIP is now created on 'make install' (GH#29)
    - Previously, a variable named 'ERROR' was used, which caused issues building
      on Windows (GH#36)
  - Drop EL-5 support
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section
    - noarch subpackages always available now
    - libcurl-devel always available now


author: Paul Howarth <paul@city-fan.org> - 2.5.0-1
changelog:
  - Update to 2.5.0
    - Replace use of strnlen() due to lack of universal availability (GH#71)
    - Document the 'LockFile' option in the 'GeoIP.conf' man page (GH#64)
    - Remove unused base64 library (GH#68)
    - Add the new configuration option 'PreserveFileTimes'; if set, the
      downloaded files will get the same modification times as their original on
      the server (default is '0') (GH#63)
    - Use the correct types when calling 'curl_easy_setopt()'; this fixes
      warnings generated by libcurl's 'typecheck-gcc.h' (GH#61)
    - In 'GeoIP.conf', the 'UserId' option was renamed to 'AccountID' and the
      'ProductIds' option was renamed to 'EditionIDs'; the old options will
      continue to work, but upgrading to the new names is recommended for
      forward compatibility


author: Andrew Price <anprice@redhat.com> - 3.1.10-3
changelog:
  - libgfs2: Issue one write per rgrp when creating them
  - mkfs.gfs2: Fix resource group alignment issue
  - mkfs.gfs2: Free unnecessary cached pages, disable readahead
    Resolves: rhbz#1440269


author: Andrew Price <anprice@redhat.com> - 3.1.10-5
changelog:
  - Update URL in spec file
    Resolves: rhbz#1501738
  - fsck.gfs2: Make -p, -n and -y conflicting options
    Resolves: rhbz#1507091


author: Andrew Price <anprice@redhat.com> - 3.1.10-9
changelog:
  - fsck.gfs2: Don't check fs formats we don't recognise
  - libgfs2: Fix pointer cast byte order issue
    Resolves: rhbz#1616389


author: Andrew Price <anprice@redhat.com> - 3.1.10-10
changelog:
  - libgfs2: Use sizeof for 'reserved' fields in ondisk.c
  - fsck.gfs2: Disambiguate 'check_data'
  - gfs2-utils: Accept a char* instead of a buffer head in gfs2_check_meta
  - fsck.gfs2: Disambiguate check_metalist
  - fsck.gfs2: Fix segfault in build_and_check_metalist
  - fsck.gfs2: Retain context for indirect pointers in ->check_metalist
  - fsck.gfs2: Clear bad indirect block pointers when bitmap meets expectations
    Resolves: rhbz#1487726


author: Andrew Price <anprice@redhat.com> - 3.1.10-11
changelog:
  - gfs2_jadd: Handle out-of-space issues
  - gfs2_jadd: error handling overhaul
    Resolves: rhbz#1837640


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29
changelog:
  - Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)
  - Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-31
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621158)
    - CVE-2018-15910 (bug #1621160)
    - CVE-2018-16542 (bug #1621382)


author: Martin Osvald <mosvald@redhat.com> - 9.07-32
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621385 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649722 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621162 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621384 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)
  - Resolves: #1652902 - CVE-2018-16863 ghostscript: incomplete fix for
    CVE-2018-16509
  - Resolves: #1654045 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage)
  - Resolves: #1651150 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650061 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652936 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1654622 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650211 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645517 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648892 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643117 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655939 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1657694 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)
  - Resolves: #1661210 pdf2ps reports an error when reading from stdin
  - Resolves: #1657334 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660570 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660829 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661279 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1667443 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata


author: Martin Osvald <mosvald@redhat.com> - 9.25-1
changelog:
  - Rebase to latest upstream version (bug #1636115)
  - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678172 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680026 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-3
changelog:
  - Resolves: #1737339 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)
  - Resolves: #1744009 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744013 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744004 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744229 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Jan Jansky <jjansky@redhat.com> - 2:2.8.22-1.1
changelog:
  - Backporting fix for CVE-2023-44442
    Resolves: RHEL-16659
  - Backporting fix for CVE-2023-44444
    Resolves: RHEL-16665


author: Stepan Broz <sbroz@redhat.com> - 2:2.8.22-1.2
changelog:
  - Fix CVE-2025-48797 (RHEL-95804)
  - Fix CVE-2025-48798 (RHEL-95810)
  - Fix CVE-2025-5473 (RHEL-95693)


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-15
changelog:
  - move instaweb to separate git-instaweb subpackage.
  	Resolves: #1213059
  - move gnome-keyring to a separate git-gnome-keyring subpackage.
  	Resolves: #1284081


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-16
changelog:
  - Remove EL-5 settings and old Fedora conditionals.
    Taken from fedora commits 903d8f35ed8ae16bece8ae8033f3d3926cc97595 and
    2c6eff99d7b50b87e8a1fe2e4a0489dfd90659b8.
  - Fix builds using '--without docs'
  - Change git-instaweb default from lighttpd(not available in rhel7) to
    apache2.
  - Add requires for git-{instaweb,gnome-keyring} to pull them, when
    installing git-all.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-17
changelog:
  - Correctly return an error from fsck on encountering a .gitmodules symlink.
    This was broken in the debian 2.1.x backport and found by covscan.
    Fix the test to catch this.
  - Correct a typo in changelog.


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
  - Fix httpd modules path to be independent from system architecture.
  Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
  Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
  - Fix CVE-2018-17456: arbitrary code execution via .gitmodules
    Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Ondrej Pohorelsky <opohorel@redhat.com> - 1.8.3.1-21
changelog:
  - Fix CVE-2019-1387: remote code execution in recursive clones with nested
    submodules
    Resolves: CVE-2019-1387


author: Vít Ondruch <vondruch@redhat.com> - 1.8.3.1-23
changelog:
  - Prevent crafted URL containing new lines, empty host or lacks a scheme
    to cause credential leak.
    Resolves: CVE-2020-11008


author: chenjianhu <chenjianhu@kylinos.cn> - 1.8.3.1-25.ns7.01
changelog:
  - Type:cves
  - ID:CVE-2025-48384 CVE-2025-48386
  - SUG:NA
  - DESC:fix CVE-2025-48384 and CVE-2025-48386


author: Kalev Lember <kalevlember@gmail.com> - 2:3.8.2-1
changelog:
  - Revert back to gtk2-based 3.8.2 -- following upstream, the gtk3
    version is now in 'glade' package (#731227)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
  - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
    sincosl, and tanl function. (#1812119)


author: Florian Weimer <fweimer@redhat.com> - 2.17-325
changelog:
  - Support /etc/sysconfig/strcasecmp-nonascii for enabling non-ASCII case
    conversion in strcasecmp, strncasecmp (#1993930)


author: Liang Changwei <liangchangwei@kylin.com.cn> - 2.17-326.ns7.01
changelog:
  - Type: update
  - ID:   [TASK#101537]
  - SUG:  NA
  - DESC: [Patch20671] Add glibc-2.17-c758a686-neokylin-timezone.patch


author: Florian Weimer <fweimer@redhat.com> - 2.17-326.2
changelog:
  - nscd: Do not use sendfile for the netgroup cache
  - nscd: Use-after-free in netgroup cache
  - CVE-2021-27645: nscd: double-free in netgroup cache
  - CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34263)
  - CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
  - CVE-2024-33601: nscd: crash on out-of-memory condition
  - CVE-2024-33602: nscd: memory corruption with NSS netgroup modules


author: Like <like@kylin.com.cn> - 2.17-326.3.ns7.01
changelog:
  - Type: update
  - ID:   [TASK#196631]
  - SUG:  NA
  - DESC: add old patch glibc-2.17-c758a686-neokylin-timezone.patch and patch
          0001-Complete-GB18030-2022-level-2-2-17.patch


author: wanggang <wanggang1@kylin.com.cn> - 2.17-326.ns7.01
changelog:
  - Type: update
  - ID:   [TASK#196631]
  - SUG:  NA
  - DESC: Add glibc-2.17-c758a686-neokylin-timezone.patch and patch
  0001-Complete-GB18030-2022-level-2-2-17.patch


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-57
changelog:
  - fixes bugs bz#1600379 bz#1689375 bz#1782428 bz#1798897 bz#1815462 
    bz#1889966 bz#1891403 bz#1901468 bz#1903911 bz#1908635 bz#1917488 bz#1918018 
    bz#1919132 bz#1925425 bz#1927411 bz#1927640 bz#1928676 bz#1942816 bz#1943467 
    bz#1945143 bz#1946171 bz#1957191 bz#1957641


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-60
changelog:
  - fixes bugs bz#1668303 bz#1853631 bz#1901468 bz#1904137 bz#1911665 
    bz#1962972 bz#1973566 bz#1994593 bz#1995029 bz#1997447 bz#2006205


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-3
changelog:
  - Disable the print button in the selection toolbar when printing isn't
    supported
    Resolves: #1438362


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-6
changelog:
  - Adjust the LOKDocView detection to work with GJS 1.48.0
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
    Resolves: #1517704


author: Debarshi Ray <rishi@fedoraproject.org> - 3.22.2-8
changelog:
  - Initialize the getting started PDF only when presenting a UI, and before any
    SPARQL has been submitted
  - Suppress WARNINGs from GJS 1.50.0 by using var instead of let/const for
    exported symbols
  - Use the standard dialect of String.prototype.replace
    Resolves: #1517770


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.1-1
changelog:
  - Update to 3.28.1
  - Rebased downstream patches
  - Revert to using Python 2 and Tracker 1.0
  - Resolves: #1568171


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-1
changelog:
  - Update to 3.28.2
  - Rebased downstream patches
  - Fix crash on right-click on local collection
    Resolves: #1611565


author: Debarshi Ray <rishi@fedoraproject.org> - 3.14.5-5
changelog:
  - Ensure that temporary accounts are really removed from the keyring and
    avoid a WARNING
  Resolves: #1261940


author: Richard Hughes <rhughes@redhat.com> - 3.14.3-6
changelog:
  - Create a -common subpackage and make the "parent" package depend on all
    the split out applications. This fixes upgrades from old versions.
  - Resolves: #1290868


author: Benjamin Berg <bberg@redhat.com> - 3.28.1-9
changelog:
  - Keep auto-logout working inside VMs
    Resolves: #1672998
  - Never log out automatically from greeter sessions
    Resolves: #1729296


author: Carlos Garnacho <cgarnach@redhat.com> - 3.28.1-11
changelog:
  - Fix possible crash on gsd-media-keys startup
    Resolves: #1878167
  - Ignore permission issues during gsd-housekeeping file deletion
    Resolves: #1909954
  - Revert mapping of "XF86RFKill" key
    Resolves: #1888412


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.87.e7.2
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
  - Hack the gtk-doc to remove plugin docs that are not shipped
  - Drop mythtv, opencv sources that are no longer buildable


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-21
changelog:
  - Remove insecure NSF plugin
  - vmncdec: Sanity-check width/height before using it
  Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-22
changelog:
  - h264parse: Ensure codec_data has the required size when reading number of SPS
  Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-24
changelog:
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Disable gtk-doc to fix the build
  - Resolves: RHEL-16792


author: Wim Taymans <wtaymans@redhat.com> - 1.4.5-6
changelog:
  - Fix h264 and h265 buffer size checks
  - Fix mpegts pat parsing and add more size checks
  Resolves: rhbz#1400898


author: Wim Taymans <wtaymans@redhat.com> - 1.10.4-4
changelog:
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Disable gtk-doc to fix build
  - Resolves: RHEL-16793


author: Wim Taymans <wtaymans@redhat.com> - 1.10.4-3
changelog:
  - Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615
    Resolves: RHEL-70973, RHEL-71009, RHEL-70985


author: Wim Taymans <wtaymans@redhat.com> - 1.10.4-3
changelog:
  - CVE-2024-47537, CVE-2024-47540, CVE-2024-47606, CVE-2024-47613
  - Disable gtk-doc to make things build
    Resolves: RHEL-70948, RHEL-70935, RHEL-71021, RHEL-70997


author: Miroslav Lichvar <mlichvar@redhat.com> - 5:2.0.9-3
changelog:
  - drop renaming to guile2
  - fix multilib conflicts
  - fix post scriptlet to not remove files on upgrade
  - remove obsolete code from slib trigger
  - fix weekdays in changelog


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-2
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1632960)
  - CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887)


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
  - Gzip overwrite existing files when user choose "no" on yes/no question.
    It's due to wrong dupicit declaration of yesno() function in gzip.h
    which is compiled wrong with -O2 option.
    Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.7
changelog:
  - Fix: "Argument list too long" when using virt-v2v on Windows guest
    with French copy of Citrix installed
    related: rhbz#1145056


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.8
changelog:
  - Tolerate corruption in some hives
    resolves: rhbz#1423436
  - Switch to using git to manage patches.


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-90
changelog:
  - Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
    in mod_auth_digest
  - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
    bypass due to race condition
  - Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-91
changelog:
  - Resolves: #1630886 - scriptlet can fail if hostname is not installed
  - Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
    mod_authnz_ldap when using too small Accept-Language values
  - Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
    failure in reading the HTTP request
  - Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
    directive
  - Resolves: #1633152 - mod_session missing apr-util-openssl
  - Resolves: #1649470 - httpd response contains garbage in Content-Type header
  - Resolves: #1724034 - Unexpected OCSP in proxy SSL connection


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
  - Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: xiehongyu<xiehongyu@kylinos.cn> - 2.4.6-97.1.ns7.01
changelog:
  - Hide Version.
  - Set Trace off.
  - change Redhat to Kylin in index.html
  - Change Redhat to Kylin in spec
  - delete For information on Redhat in index.html
  - Rebranding and replaced index.html


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
  - Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
    corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
  - Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: dongqi<dongqi1@kylinos.cn> - 2.4.6-99.1.ns7.01
changelog:
  - Type: Update
  - ID: [TASK#196626]
  - SUG: NA
  - DESC: migrate confige file and rebrand patch from httpd-2.4.6-97.el7_9.4.ns7.03
    - Hide Version.
    - Set Trace off.
    - delete For information on centos in index.html
    - Rebranding and replaced index.html


author: Bryan Mason <bmason@redhat.com> - 2.4.6-99.2
changelog:
  - Fix CVE-2024-38484 - httpd: Substitution encoding issue in mod_rewrite
  - and CVE-2024-38475 - httpd: Improper escaping of output in mod_rewrite
  - Fix CVE-2024-38477 - httpd: null pointer dereference in mod_proxy


author: Like<like@kylinos.cn> - 2.4.6-99.2.ns7.01
changelog:
  - Type:Update
  - ID: NA
  - SUG:NA
  - DESC:Hide Version.Set Trace off in httpd.conf.
        change Redhat to Kylin in index.html
        Change Redhat to Kylin in spec
        delete For information on Redhat in index.html
        Rebranding and replaced index.html


author: Bryan Mason <bmason@redhat.com> - 2.4.6-99.3
changelog:
  - CVE-2024-38476 httpd:2.4/httpd: Security issues via backend
    applications whose response headers are malicious or exploitable
  - Fix regression introduced by CVE-2024-38474 fix


author: gongxingliang <gongxingliang@kylinos.cn> - 2.4.6-99.6.ns7.02
changelog:
  - Type:cves
  - ID:CVE-2022-22719 CVE-2022-23943 CVE-2022-22721 CVE-2022-26377 CVE-2022-28615 CVE-2022-29404 CVE-2023-31122 CVE-2022-31813 CVE-2022-28614
  - SUG:NA
  - DESC: add patch 1000-1007 to fix cves


author: Jay Fenlason <fenlason@redhat.com> 1.5.7-8
changelog:
  - Add the -output patch to have programs use /var/cache/ibutils
    instead of /tmp
    Resolves: bz958569


author: Doug Ledford <dledford@redhat.com> - 1.5.7-12
changelog:
  - Change ExclusiveArch to ExcludeArch instead so we don't have
    the same problem again in the future
  - Update to the git repo tarball that we shipped in rhel6.6
  - Related: bz1123998


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
  - updated to 1.6.2
  - fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
  - generated maven metadata (isntalled but not used. 
  set -e 
     _pompart="need" 
     _jarpart="tobe" 
  _filelist=".mfiles" 
  install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments 
  for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
      if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart ]; then 
  	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart" 
      fi 
  done 
  python -m /usr/share/java-utils/maven_depmap   \
            -p "/usr" -n "" \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments/icedtea-web \
            /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-poms/$_pompart \
          >> ${_filelist} 
  sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64::' ${_filelist} 
  sort -u -o ${_filelist} ${_filelist} 


  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-3
changelog:
  - added --family to make it part of javas alternatives alignment
  - java-javaver-openjdk collected into preffered_java 
  - Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7-1
changelog:
  - updated to itw 1.7 and sync from fedora
  - added forgotten slaves of itweb-settings policyeditor
  - Own %{_datadir}/%{name} dir
  - Mark non-English man pages with %lang
  - Install COPYING as %license
  - last three by Ville Skytta <ville.skytta@iki.fi> via 1481270
  - for sake of rpms added patch0, bashCompDirHardcodedAgain.patch to hardcode bashcompletion dir
  - removed maven macros in favour of manual handling (bug)
  - Resolves: rhbz#1475411


author: Jiri Vanek <jvanek@redhat.com> 1.7.1-2
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: Doug Ledford <dledford@redhat.com> - 1.6.2-1
changelog:
  - Update to latest upstream release (resolves bz998816)
  - Revive all_hcas patch (otherwise would be a regression)
  - Fix ibnodes -h output (another regression, bz1054545)
  - Resolves: bz998816, bz1054545


author: Michal Schmidt <mschmidt@redhat.com> - 1.6.5-1
changelog:
  - Update to latest upstream release. Adds rdma-ndd daemon.
  - Rebase patches, cherry-pick fixes from upstream git.
  - Enable build on s390(x).
  - Fixed bogus changelog dates.
  - Add Conflicts with old rdma. It needs to be aware of rdma-ndd.
  - Resolves: bz1169968


author: Honggang Li <honli@redhat.com> - 1.6.7-1
changelog:
  - Rebase to latest upstream release 1.6.7.
  - Remove patches merged into upstream release.
  - Remove sub-package rdma-ndd as it merged into rdma-core.
  - Resolves: bz1382809


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
  - network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
  - Configure autorelabel service to output to journal and to console if set (bug #1634661)
  - Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
  - ifup-eth: Check that device name is set (bug #1741830)
  - Add option for IPv6 GRE tunnel (bug #1691552)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-3.el7
changelog:
  - Resolves: #1834385 Man page syntax issue detected by rpminspect
    - Man pages: fix syntax issues
  - Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case
    - Make check_required_principal() case-insensitive
  - Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3
    - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found
  - Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1
  - Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection
    - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.5
changelog:
  - Resolves: #1931405 krb5kdc crash - Segmentation fault in ldap_first_entry().
    - ipa-kdb: fix compiler warnings
    - ipa-kdb: add missing prototypes
    - ipa-kdb: reformat ipa_kdb_certauth
    - ipa-kdb: mark test functions as static
    - ipa-kdb: do not use OpenLDAP functions with NULL LDAP context
  - Resolves: #1835741 krb5kdc crashing on ipa server
  - Resolves: #1929372 krb5kdc is crashing intermittently on IPA server.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.7
changelog:
  - Resolves: #1956550 - IPA server installation fails when cert contains non-ASCII character
    - CA less installation: non ASCII chars in CA subject
    - ipatests: use non-ascii chars in CA-less install
  - Resolves: #1974328 - Revise PKINIT upgrade code
    - Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.9
changelog:
  - Resolves: #2000261 - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
    - extdom: return LDAP_NO_SUCH_OBJECT if domains differ


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
changelog:
  - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server 
    - Fix cert_request for KDC cert
  - Resolves: 2021444 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
    - SMB: switch IPA domain controller role


author: xiehongyu <xiehongyu@kylinos.cn> - 4.6.8-5.el7_9.10.ns7.01
changelog:
  - Add Patch2000, add ipaplatform dir neokylin to fix build error - remake patch according rhel dir.
  - replace backgrounds png and header-logo.png and product-name.png


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.11
changelog:
  - Resolves: 2082272 - [RFE] Require confirmation to change "Default host group" in IdM automember rules
    - WebUI: Add confirmation dialog for changing default user/host group


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.12
changelog:
  - Resolves: 2084223 - 'ipa idview-show idviewname' & IPA WebUI takes longer time to return the results
    - idviews: use cached ipaOriginalUid value when resolving ID override
  - Resolves: 2124369 - OTP token sync always returns OK even with random numbers
    - ipa otptoken-sync: return error when sync fails
    - ipatests: add negative test for otptoken-sync
    - ipatests: python2 does not support f-strings
    - Fix otptoken_sync plugin


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.13
changelog:
  - Resolves: 2148249 - ipa-client-install does not maintain server affinity during installation
    - Defer creating the final krb5.conf on clients
    - Move client certificate request after krb5.conf is created
    - server install: remove error log about missing bkup file


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.14
changelog:
  - Resolves: 2180919 [rhel-7] Sequence processing failures for group_add using server context
    - ipaserver: deepcopy objectclasses list from IPA config


author: Like <like@kylinos.cn> -4.6.8-5.el7_9.16.ns7.01
changelog:
  - Type:compile
  - ID: NA
  - SUG:NA
  - DESC:  Add Patch2000, add ipaplatform dir neokylin to fix build error 
  -- remake patch according rhel dir.
  -- replace backgrounds png and header-logo.png and product-name.png


author: Julien Rische <jrische@redhat.com> - 4.6.8-5.el7_9.17
changelog:
  - Resolves: RHEL-29926 ipa: user can obtain a hash of the passwords of all domain users and perform offline brute force


author: Masahiro Matsuya <mmatsuya@redhat.com> - 4.6.8-5.el7_9.23
changelog:
  - ipa: Privilege escalation from host to domain admin in FreeIPA [rhel-7-els] (CVE-2025-7493)
    Resolves: RHEL-110056
  - backport 62400d6d240c1bb68987a1ff194ee7cd6c6d3cf0 in pagure.io
    Prevent local account takeover
  - backport Enforce-uniqueness-across-krbprincipalname-and-krbca_rhel#110061.patch
  - backport ipatests-extend-test-for-unique-krbcanonicalname_rhel#110061.patch
  - Adapt for python2 in admin_root_alias func of upgrade test


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
  - Related: #913329 - [RFE] include iperf3 in RHEL 7
                     - adding requires to spec file for devel package


author: Therese Cornell <tcornell@redhat.com> - 3.1.7-3.1
changelog:
  - Resolves: RHEL-72934 - Denial of Service in iperf Due to Improper JSON Handling
    (CVE-2024-53580)


author: Josef Ridky <jridky@redhat.com> - 0:1.8.18-3
changelog:
  - Fix issues with warning: dereferencing type-punned pointer 
    will break strict-aliasing rules from RPMDiff


author: Pavel Cahyna <pcahyna@redhat.com> - 0:1.8.18-10
changelog:
  - Protect against negative values to memmove that caused
    "ipmitool sol activate" to crash against an IBM DataPower appliance
    (#1951480) and IP-131 Dayton blades in a SGI ICE-X (#2025519)
    Cherry-picked from upstream PR#78.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-11
changelog:
  - Add upstream ipmievd patch to check received msg id against expectation
    Fixes problem where SEL response is not recognized correctly
    when SEL request times out
    Resolves: rhbz#2224569


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
  - Resolves: #1274367 - [7.3 FEAT] iprutils package update
  - Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
  - Resolves: #1364131 - Integrate various important bug fixes for iprutils in
    RHEL7.3 by updating iprutils to 2.4.12


author: Sinny Kumari <skumari@redhat.com> - 2.4.16.1-1
changelog:
  - Resolves: #1587834 - vpdupdate takes over an hour on system with 104 drive
  - Resolves: #1521052 - iprutils package update for POWER
  - Resolves: #1547891 - iprconfig unable to Download microcode on all applicable devices
  - Resolves: #1576013 - iprconfig tools shows wrong error message, while creating raid using RI SSDs and normal SSDs


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-17
changelog:
  - 1518367 boot from iSCSI not establishing all sessions persistently
  - 1667965 A manual restart of iscsi.service modifies records node.startup value


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-18
changelog:
  - 1809945 backport new CHAP modes for FIPS environments (SHA1 and SHA256 only, no SHA3 in OpenSSL-1.0.2)


author: liudingyao <liudingyao@kylinos.cn> - 6.2.0.874-22.ns7.02
changelog:
  - Type:bugfix
  - ID:[BUG#202903]
  - SUG:NA
  - DESC:add patch to change initiatorname.iscsi output prefix


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.4.ea
changelog:
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.5.ea
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Introduce jfr_arches for architectures which support JFR.
  - Introduce sa_arches for architectures which support the serviceability agent.
  - Introduce share_arches for architectures which support class sharing (-Xshare:dump).
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-1
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b03 (EA)
  - Update release notes for 8u312-b03.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b04 (EA)
  - Update release notes for 8u312-b04.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05 (EA)
  - Update release notes for 8u312-b05.
  - Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Add patch to improve performance of common separators in Scanner.useLocale
  - Move alt-java patch to correct section.
  - Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07
  - Update release notes for shenandoah-8u342-b07.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Rebase JDK-8186464 patch so it applies after JDK-8190753
  - Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112383


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Switch to EA mode for 8u362 pre-release builds.
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2159458


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b01 (EA)
  - Update release notes for shenandoah-8u382-b01.
  - Switch to EA mode.
  - Remove JDK-8271199 patch which is now upstream.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
  - Update to shenandoah-jdk8u382-b04 (EA)
  - Update release notes for shenandoah-8u382-b04.
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u372-b05 (GA)
  - Update release notes for shenandoah-8u372-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
  - Update to shenandoah-jdk8u382-b05 (GA)
  - Update release notes for shenandoah-8u382-b05.
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11319


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Update release notes for shenandoah-8u392-b08.
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12212
  - Resolves: RHEL-13574
  - Resolves: RHEL-13575
  - Resolves: RHEL-13576
  - Resolves: RHEL-11319
  - Resolves: RHEL-13577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-3
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b01 (EA)
  - Update release notes for shenandoah-8u402-b01.
  - Switch to EA mode.
  - Sync NEWS with vanilla branch version.
  - Related: RHEL-17914


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Drop local copy of JDK-8312489 which is now included upstream
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17914
  - Resolves: RHEL-20965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b01 (EA)
  - Update release notes for shenandoah-8u412-b01.
  - Switch to EA mode.
  - Related: RHEL-30926


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Remove -T0 argument from systemtap tar invocation
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Normalise whitespace
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - jconsole.desktop.in: Restored by running icedtea_sync.sh
  - policytool.desktop.in: Likewise.
  - Restore IcedTea sources correctly in spec file
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Update release notes for shenandoah-8u412-b07.
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Resolves: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-1
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u422-b01 (EA)
  - Update release notes for shenandoah-8u422-b01.
  - Switch to EA mode.
  - Related: RHEL-46862


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
changelog:
  - Update to shenandoah-jdk8u422-b05 (GA)
  - Update release notes for shenandoah-8u422-b05.
  - Rebase PR2462 patch following patched hunk being removed by JDK-8322106
  - Switch to GA mode.
  - Limit Java only tests to one architecture using jdk_test_arch
  - Remove redundant prefix from remove-intree-libraries.sh to match portable
  - Document policy repacking script and rename to correct spelling and style
  - Sync README.md with RHEL 8
  - Add missing build dependency on zlib-devel
  - Add missing bundled Provides for LCMS
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-46862
  - Resolves: RHEL-47083


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-1
changelog:
  - Update to shenandoah-jdk8u432-b06 (GA)
  - Update release notes for shenandoah-8u432-b06.
  - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
  - Add build dependency on make
  - Remove redundant build dependency on gtk2-devel
  - Reorganise build dependencies to retain alphabetical order for unconditional deps
  - Include backport of JDK-8328999 to update giflib to 5.2.2
  - Use bundled giflib as RHEL 7 version is very old (4.1.6)
  - Remove lcms2 and giflib removal from remove-intree-libraries.sh as we use bundled
  - List version of bundled giflib as 5.2.2 following JDK-8328999
  - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
  - Add missing build requirements for libXext-devel and libXrender-devel, previously masked by Gtk2+ dependency.
  - fontconfig build requirement should be fontconfig-devel, previously masked by Gtk2+ dependency
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
  - Resolves: RHEL-58787
  - Resolves: RHEL-62293
  - Resolves: RHEL-62274
  - Resolves: RHEL-61279


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.1.ea
changelog:
  - Update to 8u442-b05 (EA).
  - Update release notes for 8u442-b05.
  - Switch to EA mode for pre-release.
  - Resolves: RHEL-73991


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-1
changelog:
  - Update to 8u442-b06 (GA)
  - Update release notes for 8u442-b06.
  - Switch to GA mode for final release
  - Resolves: RHEL-73564


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.452.b09-1
changelog:
  - Update to 8u452-b09 (GA)
  - Update release notes for 8u452-b09.
  - Remove long option documentation from JDK-8335912/JDK-8337499 as not present in 8u
  - Require tzdata 2024a due to upstream inclusion of JDK-8347965
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
  - Resolves: RHEL-86968
  - Resolves: RHEL-86611


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-1
changelog:
  - Update to 8u462-b08 (GA)
  - Update release notes for 8u462-b08.
  - Require tzdata 2025b due to upstream inclusion of JDK-8352716
  - Add early backport of JDK-8339414
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-101650
  - Resolves: RHEL-102300


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-1
changelog:
  - Update to 8u462-b08 (GA)
  - Update release notes for 8u462-b08.
  - Require tzdata 2025b due to upstream inclusion of JDK-8352716
  - Add early backport of JDK-8339414
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-101650
  - Resolves: RHEL-102300
  - Resolves: RHEL-102903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-2
changelog:
  - Update get_bundle_versions.sh to match other scripts
  - * get_bundle_versions.sh: Add license
  - * get_bundle_versions.sh: Set compile-command in Emacs
  - * get_bundle_versions.sh: Use different error codes for different failures
  - * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
  - * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
  - * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
  - Add OpenJDK 8u support to get_bundle_versions.sh
  - Print bundle updates and backouts at end of openjdk_news.sh output
  - Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
  - Add timezone data update check to openjdk_news.sh
  - Add duplicate check to openjdk_news.sh
  - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
  - Resolves: RHEL-119330


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.472.b08-1
changelog:
  - Update to 8u472-b08 (GA).
  - Update release notes for 8u472-b08.
  - Drop local JDK-8339414 fix as this is now included upstream
  - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. **
  - Resolves: RHEL-118768
  - Resolves: RHEL-119439


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-1
changelog:
  - Update to 8u482-b08 (GA).
  - Update release notes for 8u482-b08.
  - Turn on system FreeType as on later JDK versions and add to _privatelibs
  - Set bundled FreeType version to 2.13.2 following JDK-8316028
  - Bump LCMS 2 version to 2.14.0 following JDK-8297088
  - Add test to ensure blocked.certs is valid (OPENJDK-4362)
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-142688
  - Resolves: RHEL-139512
  - Resolves: RHEL-142692
  - Resolves: RHEL-142695


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Resolves: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+1
  - Update release notes to 11.0.15.0+1
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Related: rhbz#2047531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8284920 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-1
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119512


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.17+1
  - Update release notes to 11.0.17+1
  - Switch to EA mode for 11.0.17 pre-release builds.
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Include Aleksey's patch for JDK-8291053 to try and get HarfBuzz to build again
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
  - Try to build using system HarfBuzz to avoid build failures with 4.4.1 & gcc 4.8.5
  - Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Switch to GA mode for release
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - Remove unneeded JDK-8291053 patch as we no longer build in-tree HarfBuzz
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.20+1 (EA)
  - Update release notes to 11.0.20+1
  - Switch to EA mode
  - Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
  - Add missing Swing release note
  - Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
  - Update to jdk-11.0.20.0+8 (GA)
  - Update release notes to 11.0.20.0+8
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
  - Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Update release notes to 11.0.20.1+1
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Synchronise runtime and buildtime tzdata requirements
  - Update README.md to match the version in later RHEL releases
  - Resolves: rhbz#2236229


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - For non debug subpackages, ghosted all alternatives (rhbz1649776)
  - For non system JDKs, if-outed versionless provides.
  - Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
  - Related: RHEL-11320


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-1
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Update release notes to 11.0.21+9
  - Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12217
  - Resolves: RHEL-12910
  - Resolves: RHEL-12913
  - Resolves: RHEL-11320
  - Resolves: RHEL-13227
  - Resolves: RHEL-13217


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
  - Resolves: RHEL-19642


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.6-0.1.ea
changelog:
  - Update to jdk-11.0.22+6 (EA)
  - Update release notes to 11.0.22+6
  - Switch to EA mode
  - Drop local copy of JDK-8312489 which is now included upstream
  - Resolves: RHEL-21031


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Update release notes to 11.0.22+7
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20966


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.1-0.1.ea
changelog:
  - Update to jdk-11.0.23+1 (EA)
  - Update release notes to 11.0.23+1
  - Switch to EA mode
  - Speed up PPC build by removing ppc64le --with-jobs=1 workaround


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
  - Update to jdk-11.0.23+9 (GA)
  - Update release notes to 11.0.23+9
  - Switch to GA mode for release
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-30914


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-2
changelog:
  - Fix 11.0.22 release date in NEWS
  - Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.24.0.8-1
changelog:
  - Update to jdk-11.0.24+8 (GA)
  - Update release notes to 11.0.24+8
  - Adjusted DTLS & RPATH NEWS entries to match OpenJDK 17 & 21 release notes
  - Switch to GA mode for release
  - Add zlib to build required
  - Resolves: RHEL-45205
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.6-0.1.ea
changelog:
  - Update to jdk-11.0.25+6 (EA)
  - Update release notes to 11.0.25+6
  - Switch to EA mode
  - Related: RHEL-58768


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.9-1
changelog:
  - Update to jdk-11.0.25+9 (GA)
  - Update release notes to 11.0.25+9
  - Switch to GA mode for release
  - Related: RHEL-58768
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-3
changelog:
  - Bugzilla #1534772 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data (cfu)
  - Bugzilla #1554056 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-2
changelog:
  - Bugzilla #1747967 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-3
changelog:
  - Bugzilla #1710105 - JSS: add RSA PSS support (jmagne)
  - Bugzilla #1796642 - JSS -- remove hardcoded native library
    /usr/lib{64}/jss/libjss4.so (ascheel)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.9-4
changelog:
  - Updated nspr-devel and nss-devel build requirements as well as nss runtime
    requirements [mharmsen]
  - RHEL-18401 - JSS - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHEL 7.9.z] [jmagne]
  - JSS: add RSA PSS support
    Add PSS cases to algorithm name translating method [jmagne]
  - Add GitLab synchronization job [edewata]
  - Add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z]
    Back port AES KWP wrap alg support only for JSS in this branch to allow for
    the TMS bug referenced above to work. [jmagne]
  - Empty commit to fix commit msg from previous commit
    JSS- add AES support for TMS server-side keygen on latest HSM / FIPS
    environment [RHCS 9.7.z]
    Back port AES KWP wrap alg support only for JSS in this branch to allow for
    the TMS bug referenced above to work. [jmagne]
  - RHEL-23935 - JSS - PrettyPrintCert does not properly translate AIA
    information into a readable format [RHEL 7.9.z] [mfargett]
  - Fix AIA extension print
    The "Authority Info Access" extension was not included in the oid
    extension  map so it was not correctly printed.
    This add AIA extension to the oid map. [mfargett]
  - Fix SIA extension
    The "Subject Info Access" extension was not included in the oid
    extension  map so it was not correctly printed.
    This add SIA extension to the oid map. [mfargett]


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
  - Fix vlock doesn't perform PAM account management or credential reinitialization
    Resolves: #1032140


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-14
changelog:
  - Replace CtrlL_Lock with Caps_Lock in generated us.map
    Resolves: #1441411
  - Improve man pages and usage messages quality and consistency
    Resolves: #949015


author: Jan Grulich <jgrulich@redhat.com> - 4.10.5-10
changelog:
  - Avoid duplicates in solid device automounter kcm
    Resolves: bz#1084191
  - Enable automount overrides even when automatic mounting is disabled
    Resolves: bz#1084497


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-8
changelog:
  - Powerdevil: do not notify about a non existent action
    Resolves: bz#1289149
  - Plasma taskmanager: close context menu when task is closed
    Resolves: bz#1262603


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-10
changelog:
  - Fix grouping of tasks in taskmanager applet
    Resolves: bz#1348917
  - Fix unlocking of kscreenlocker, unlock it just once
    Resolves: bz#1333441


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-13
changelog:
  - Sanitise notification HTML
    Resolves: bz#1568853

  - Increase cpu buffer size in ksysguard
    Resolves: bz#1611762


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-14
changelog:
  - Do not show disabled buttons in Plastik decoration theme
    Resolves: bz#1677641

  - Taskmanager: dismiss group when application is closed and there is enough space
    Resolve: bz#1698048


author: Rex Dieter <rdieter@fedoraproject.org> - 6:4.10.3-2
changelog:
  - pull in a few upstream fixes, including a couple minor security issues
  - Crash in DialogShadows::Private::freeX11Pixmaps() (kde#319137)


author: Martin Briza <mbriza@redhat.com> - 4.10.5-3
changelog:
  - make kpac_dhcp_helper full relro
  - set the variables in the generated cmake files to contain both 64b and 32b paths
  - hide "command not found" for one pkg-config invocation in the spec
  - fix macro expansion in the spec changelog
  - Resolves: #884052


author: Martin Briza <mbriza@redhat.com> - 4.10.5-4
changelog:
  - use a better way to figure out if lib or lib64 should be used
  - use -fno-strict-aliasing for type punned source files
  - Resolves: #884052


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-48
changelog:
  - dracut-module-setup.sh: ensure cluster info is ready before query.
  - dracut-module-setup.sh: improve get_alias()


author: Kevin Kofler <Kevin@tigcc.ticalc.org> - 4.4.0-2
changelog:
  - update docbook version to make doc-translations build with kdelibs >= 4.5,
    fixes FTBFS (#599843)


author: Prasad Kalanke <pkalanke@redhat.com> - 1.15.1-55.1
changelog:
  - CVE-2024-37370 CVE-2024-37371
  - Fix vulnerabilities in GSS message token handling
  - Resolves: RHEL-45381 RHEL-45393


author: Prasad Kalanke <pkalanke@redhat.com> - 1.15.1-55.2
changelog:
  - CVE-2024-37370 CVE-2024-37371
  - Updated the previous commit patches
  - Resolves: RHEL-45381 RHEL-45393


author: Like <like@kylinos.cn> - 1.15.1-55.2.el7_9.ns7.01
changelog:
  - Type:compile
  - ID:NA
  - SUG:NA
  - DESC:Skip partial check to fix BUILDSTDERR: 
         keyctl_join_session_keyring: Operation not permitted


author: Julien Rische <jrische@redhat.com> - 1.15.1-55.3
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55453
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-56071


author: wanglixing <wanglixing@kylinos.cn> - 1.15.1-55.el7_9.ns7.01
changelog:
  - Type:compile
  - ID:NA
  - SUG:NA
  - Desc:Skip partial check to fix BUILDSTDERR: keyctl_join_session_keyring: Operation not permitted


author: Jan Grulich <jgrulich@redhat.com> - 4.10.5-7
changelog:
  - Fix installed files for -java subpkg
    Resolves: bz#1253143, build failure when java is installed in build enviroment


author: Jan Grulich <jgrulich@redhat.com> - 4.10.5-8
changelog:
  - Properly remove kross-java files
    Resolves: bz#1253143, build failure when java is installed in build enviroment


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-37
changelog:
  - Add configuration option to enable signal bubbling for backward compatibility
    Resolves: #1484937


author: Kamil Dudka <kdudka@redhat.com> - 20120801-137
changelog:
  - Increase the release number by 100 to make sure it stays higher than in RHEL-6
    Related: #1484937


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-3
changelog:
  - Resolves: #1634267 - ECP signature check fails with
                         LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when assertion signed
                         instead of response


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-4
changelog:
  - Resolves: #1730009 - lasso includes "Destination" attribute in SAML
                         AuthnRequest populated with SP
                         AssertionConsumerServiceURL when ECP workflow
                         is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-5
changelog:
  - Resolves: #1719014 - Expired certificate prevents tests from running
  - Actually apply the patch file for the previous build
  - Related: #1730009 - lasso includes "Destination" attribute in SAML
                         AuthnRequest populated with SP
                         AssertionConsumerServiceURL when ECP workflow
                         is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-6
changelog:
  - Resolves: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                         vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-7
changelog:
  - Fix Coverity warning introduced by the previous patch
  - Related: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                        vulnerability when parsing SAML responses


author: John Dennis <jdennis@redhat.com> - 2.4.1-8
changelog:
  - Add explicit minimum dependency on glib2 2.42,
    for some reason RPM is not automatically detecting the dependency
    Resolves: #1254989


author: Fridolin Pokorny <fpokorny@redhat.com> - 458-3
changelog:
  - Expanded lessecho usage (#948597)
  - Added lessfilter info to man (#948597)
  - Expanded lesskey usage (#948597)
  - Added --old-bot to help (#948597)


author: Jozef Mlich <jmlich@redhat.com> - 458-5
changelog:
  - fixing regression in 72dfd3f63594e1d4c9416180a95c47ae583934c6
    incorrect parsing of commandline arguments
  - Resolves #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-8
changelog:
  - changes introduced in less-458-old-bot-in-help.patch
    wasn't compiled in. It is necessary to use mkhelp tool.
    Resolves: #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-9
changelog:
  - The --use-backslash option documented in the man page
    was missing from online help for less.
    Resolves: #1109090


author: Luboš Uhliarik <luhliari@redhat.com> - 4.4.8-6
changelog:
  - Fix lftp does not follow http redirect (302) in mirror mode (#1181580)
  - Fix lftp exists randomly when "cmd:fail-exit" is set (#1193984)
  - Added RFE - lftp configurations for restricting each SSL/TLS 
    version (#1182987)
  - Fixed bogus dates of this SPEC


author: Michal Ruprich - 4.4.8-9
changelog:
  - Resolves: #1374653 -  File size decreases when synchronizing folders with a sftp account using lftp


author: Michal Ruprich - 4.4.8-10
changelog:
  - Related: #1374653 - File size decreases when synchronizing folders with a sftp account using lftp
                      - Patch edited so that it corresponds to upstream


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-11
changelog:
  - Resolves: #1514815 - lftp doesn't seems to consider 'set net:max-retries'
  - Resolves: #1556675 - "get" command with lftp does not fail on net:max-retries


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-12
changelog:
  - Resolves: #1611641 - CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-13
changelog:
  - Resolves: #1573296 - lftp with ssl gives error Fatal error: gnutls_record_recv: The TLS connection was non-properly terminated


author: Pavel Raiskup <praiskup@redhat.com> - 3.1.2-11
changelog:
  - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
  - fix crash on crafted 7zip archives (CVE-2019-1000019)
  - fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.11-1
changelog:
  - Make the KbdZRAMDevicesTestCase inherit from KbdZRAMTestCase (vpodzime)
  - Allow non-source directory builds (kailueke)
  - Add a way to disable runtime dependency checks (vpodzime)
  - Link to GObject even if no plugin is activated (kailueke)
  - Skip zram tests on Rawhide (vpodzime)
  - Keep most utilities available for tests (vpodzime)
  - Use new libmount function to get (un)mount error message (vtrefny)
  - Update the documentation URL (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 2.12-1
changelog:
  - Own directories /etc/libblockdev and /etc/libblockdev/conf.d (vtrefny)
  - Wait for resized partition (kailueke)
  - Make sure the device is opened for libparted (vpodzime)
  - Fix label check in swap_test (vtrefny)
  - Use "run_tests" script for running tests from Makefile (vtrefny)
  - Add a script for running tests (vtrefny)
  - Tests: Move library initialization to setUpClass method (vtrefny)
  - Stop skipping FAT resize tests on rawhide (vtrefny)
  - Close filesystem before closing the partition during FAT resize (vtrefny)
  - Use mountpoint for "xfs_info" calls (vtrefny)
  - Use libmount cache when parsing /proc/mounts (vtrefny)
  - Add some space for the CI status (vpodzime)
  - Confirm the force when creating PVs in FS tests (vpodzime)
  - Skip vgremove tests on 32bit Debian (vtrefny)
  - Fix names of backing files in tests (vtrefny)
  -  Fix checking for available locales (vtrefny)
  - Skip dependency checking in mpath tests on Debian (vtrefny)
  - Skip zRAM tests on Debian (vtrefny)
  - Skip the test for device escrow on Debian too (vtrefny)
  - Skip free region tests on Debian too (vtrefny)
  - Fix redirecting command output to /dev/null in tests (vtrefny)
  - Try harder to unmount devices in test cleanup (vtrefny)
  - Require only plugins that are needed for given test (vtrefny)
  - Try to get distribution info from "PrettyName" if "CPEName" isn't available (vtrefny)
  - Use -ff when creating PVs in FS tests (vpodzime)
  - Sync spec with downstream (vpodzime)


author: David Tardon <dtardon@redhat.com> - 0.5.0-2
changelog:
  - Related: rhbz#1290152 autoreconf is not needed
  - Related: rhbz#1290152 add a bunch of fixes found by coverity


author: Petr Sabata <psabata@redhat.com> - 0.6.20-1
changelog:
  - 0.6.20 bump
  - Repackaging prehistoric libexif-docs, introducing version string in filename
  - Buildroot cleanup


author: Petr Šabata <contyk@redhat.com> - 0.6.21-1
changelog:
  - 0.6.21 bump
  - A security bugfixing release (CVE-2012-2812, CVE-2012-2813, CVE-2012-2814,
    CVE-2012-2836, CVE-2012-2837, CVE-2012-2840, CVE-2012-2841 & CVE-2012-2845)
  - Drop the pre-generated docs and introduce a doc subpackage


author: Than Ngo <than@redhat.com> - 4.10.5-2
changelog:
  - bz#970713, CVE-2013-2126, double-free flaw when handling
    damaged full-color in Foveon and sRAW files


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.29-1
changelog:
  - Resolves: rhbz#1393810 - Rebase libldb to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.2-1
changelog:
  - Resolves: rhbz#1470056 - Rebase libldb to enable samba rebase to
                             version 4.7.x


author: Mahaveer Darade <mah.darade@gmail.com> - 0.3.5-1
changelog:
  - upgrade to upstream version 0.3.5
  - drop patch0, merged upstream
    liblognorm-0.3.4-rename-to-lognormalizer.patch
  - remove trailing whitespace


author: Jiri Vymazal <jvymazal@redhat.com> 2.0.2-2
changelog:
  RHEL 7.6 erratum
  - added patch with skipempty support
    resolves: rhbz#1565219
  - removed no longer used patch file


author: Jiri Pirko <jpirko@redhat.com> - 1.2-1
changelog:
  - Update to 1.2
  - libndp: silently ignore packets with optlen 0 [1016064]
  - libndp: fix processing for larger options [1016064]
  - libndp: do not fail on receiving non-ndp packets [1016078]


author: Jiri Pirko <jpirko@redhat.com> - 1.2-3
changelog:
  - libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf() [1044084]


author: Lubomir Rintel <lrintel@redhat.com> - 1.2-5
changelog:
  - libndp: validate the IPv6 hop limit [CVE-2016-3698]
  - libndb: reject redirect and router advertisements from non-link-local [CVE-2016-3698]


author: Eric Garver <egarver@redhat.com> - 1.2-7
changelog:
  - libndp: add option flags to send messages
  - ndptool: add option to send messages types
  - libndp: fix type of field "na" in "struct ndp_msgna"
  - libndp: revert API change for ndp_msg_send() and add


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-4
changelog:
  - disable TPACKET_V3 memory mapped packet capture on AF_PACKET socket, use TPACKET_V2 instead (#1085096)


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-5
changelog:
  - display also first packet when capturing in cooked mode (#1176612)
  - make sure that userland bpf filter interpreter is given snaplen such that size of
    cooked header is account for


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-6
changelog:
  - libpcap now correctly recognizes Netlink datalink type (#1031974)
  - fix vlan tagged packet filtering (#1079525)


author: Tom Lane <tgl@redhat.com> 2:1.5.12-1
changelog:
  - Update to libpng 1.5.12 for minor bug fixes
  - Activate chunk size limits by default, with a very generous default limit


author: Petr Hracek <phracek@redhat.com> - 2:1.5.13-7
changelog:
  - Security fix for CVE-2015-8126
  - Changing png_ptr to info_ptr base on upstream
  - Related: #1283575


author: Stephan Bergmann <sbergman@redhat.com> - 1:5.3.6.1-17
changelog:
  - Resolves: rhbz#1545262 Workaround for spurious ppc64le automated testing crash
  - Resolves: rhbz#1610692 silence console warnings from print dialog


author: Eike Rathke <erack@redhat.com> - 1:5.3.6.1-26
changelog:
  - Fix CVE-2022-38745 Empty entry in Java class path
  - Fix CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing
  - Fix CVE-2023-1183 libreoffice: Arbitrary File Write
  - Fix CVE-2023-6185 escape url passed to gstreamer


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.12-1
changelog:
  - downloader: Allow max one resume + nicer message if xattr cannot be set (RhBug: 1130685)
  - downloader: Resume only files that were originaly downloaded by Librepo (RhBug: 1130685)
  - downloader: Show also calculated checksums in error message about bad checksum
  - Python: Return all strings in unicode


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.13-1
changelog:
  - Fix ABI compatibility (RhBug: 1185180)
  - fastestmirror: Add LRO_FASTESTMIRRORTIMEOUT option
  - downloader: Move broken mirror at the end of the list of mirrors (RhBug: 1183998)
  - Make building tests and docs optional
  - librepo: Don't download remote mirrorlist/metalink when LRO_LOCAL is specified (Resolves #41)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.14-1
changelog:
  - tests: Use g_assert_cmpuint instead of ck_assert_uint_eq (Pullrequest #43)
  - Add LRO_OFFLINE
  - Python: Handle: Raise ValueError instead of TypeError when an unknown option is specified
  - Python: Result: Use ValueError instead of TypeError when an unknown option value is specified
  - Add LR_VERSION constant with version string
  - python: Import contants from C librepo module in a loop
  - repoconf: Add support for failover and skip_if_unavailable options
  - handle: Change of LRO_LOCAL causes invalidation of internal mirrorlist (related to RhBug: 1188600)
  - Load local mirrorlists when LRO_LOCAL is on (related to RhBug: 1188600)
  - util: Add lr_is_local_path()
  - New module repoconf for reading *.repo files
  - Add LRO_HTTPHEADER option (RhBug: 1181123)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.15-1
changelog:
  - Do not inlude header in the body output (RhBug: 1207685)
  - metalink: Proper error handling
  - New LRR_RPMMD_* contants
  - Support for client certificates
  - Use 'metadata in the rpm-md format' instead of 'yum metadata' (Issue #51)
  - CMakeLists.txt: do not check for CXX
  - build: Use solely pkg-config to find glib


author: Colin Walters <tmlcoch@redhat.com> - 1.7.16-1
changelog:
  - Add LRI_LOWSPEEDTIME and LRI_LOWSPEEDLIMIT
  - downloader: Don't consider CURLE_RECV_ERROR and CURLE_SEND_ERROR as fatal errors (RhBug: 1219817)
  - test_repoconf: Fix SIGSEGV in repoconf_assert_na (RhBug: 1222471)
  - repoconf: Proper handling of gint64 and guint64 types
  - build: Be compatible with cmake 2.8
  - handle: Do not free temporary error msg if there is no one (RhBug: 1219822)
  - utils/make_rpm.sh: Accept rpmbuild options as second argument (Issue #49)
  - Python: call lr_global_init() during module initialization
  - Add global function log_set_file that allow user to set a file where logs will be written (Issue #53)
  - util: Honor RFC 3986 (Issue #55)


author: Marek Blaha <mblaha@redhat.com> - 1.8.1-1
changelog:
  - Add yumrecord substitution mechanism (mluscon)
  - Fix a memory leak in signature verification (cwalters)
  - Add new option LRO_FTPUSEEPSV
  - downloader prepare_next_transfer(): simplify long line
  - downloader prepare_next_transfer(): add missing error check
  - downloader prepare_next_transfer(): cleanup error path
  - downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
  - handle: Don't use proxy cache for downloads of metalink/mirrorlist
  - handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
  - downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
  - Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
  - New test: always try to download from the fastest mirror (Alexander Todorov)


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
  - Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1553406 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted
  - Resolves: rhbz#1572425 shared IKE SA leads to rekey interop issues


author: Paul Wouters <pwouters@redhat.com> - 3.25-1
changelog:
  - Resolves: rhbz#1591817 rebase libreswan to 3.25
  - Resolves: rhbz#1536404 CERT_PKCS7_WRAPPED_X509 error
  - Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1574011 libreswan is missing a Requires: unbound-libs >= 1.6.6


author: Paul Wouters <pwouters@redhat.com> - 3.25-2
changelog:
  - Resolves: rhbz#1597322 Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors


author: Paul Wouters <pwouters@redhat.com> - 3.25-5
changelog:
  - Resolves: rhbz#1639404 Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth
  - Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N
  - Resolves: rhbz#1629902 libreswan assertion failed when OAKLEY_KEY_LENGTH is zero for IKE using AES_CBC
  - Resolves: rhbz#1623279 [abrt] [faf] libreswan: strncpy(): /usr/libexec/ipsec/pluto killed by 11
  - Resolves: rhbz#1625303 config: recursive include check doesn't work
  - Resolves: rhbz#1664521 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits


author: Paul Wouters <pwouters@redhat.com> - 3.25-6
changelog:
  - Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N [updated]
  - Resolves: rhbz#1679735 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure


author: Paul Wouters <pwouters@redhat.com> - 3.25-7
changelog:
  - Resolves: rhbz#1673105 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart


author: Paul Wouters <pwouters@redhat.com> - 3.25-8
changelog:
  - Resolves: rhbz#1686991 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE


author: Paul Wouters <pwouters@redhat.com> - 3.25-9
changelog:
  - Resolves: rhbz#1724200 libreswan: XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.25-12.1
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985024)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-2
changelog:
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty hostnames
  - Resolves: #1598838


author: Tomas Popela <tpopela@redhat.com> - 2.62.2-3
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Resolves: RHEL-67071


author: John Castranio <jcastran@redhat.com> - 2.62.2-4
changelog:
  - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict
    Resolves: RHEL-76375


author: Sucharita Viswanathan <suviswan@redhat.com> - 2.62.2-5
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-93782
    Resolves: RHEL-93797
    Resolves: RHEL-93799


author: Sucharita Viswanathan <suviswan@redhat.com> - 2.62.2-6
changelog:
  - Add patches to improve test reliability
  - Backport patches for various CVEs
    Resolves: RHEL-92276
    Resolves: RHEL-95752
    Resolves: RHEL-95753
    Resolves: RHEL-95755


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
  - curl consumes too much memory during scp download (#1080459)
  - prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
  - session: avoid printing misleading debug messages (#1503294)
  - scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Tony Asleson <tasleson@redhat.com> - 1.8.1-2
changelog:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1872745
  - https://bugzilla.redhat.com/show_bug.cgi?id=1903665


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.8-1
changelog:
  - Rebase to libtalloc 2.1.8
  - Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.9-1
changelog:
  - Rebase to libtalloc 2.1.9
  - Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.10-1
changelog:
  - Rebase to libtalloc 2.1.10
  - Resolves: rhbz#1470053 - Rebase libtalloc to enable samba rebase to
                             version 4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.14-1
changelog:
  - Rebase to libtalloc 2.1.14
  - Resolves: rhbz#1658747 - Rebase libtalloc to version 2.1.14 for Samba


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-1
changelog:
  - Rebase to libtalloc 2.1.16
  - Resolves: rhbz#1736005 - Rebase libtalloc to version 2.1.16 for Samba


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.6-2
changelog:
  - Resolves: rhbz#1241015 - tdb deadlocks if you acquire allrecord_lock
                             and start two traverses


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.12-2
changelog:
  - Resolves: rhbz#1441231 - The tdb robust mutexes runtime check is not thread safe and ends in a deadlock


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.15-1
changelog:
  - Resolves: rhbz#1470049 - Rebase libtdb to enable samba rebase to
                             version 4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.33-1
changelog:
  - Resolves: #1470054 - Rebase libtevent to enable samba rebase to version
                         4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.34-1
changelog:
  - Resolves: #1512414 - tevent can cause a Samba file corruption bug under
                         heavy threaded load


author: Nikola Forró <nforro@redhat.com> - 4.0.3-28
changelog:
  - Fix CVE-2016-3186
  - Resolves: #1319503
  - Fix CVE-2018-7456
  - Resolves: #1561318
  - Fix CVE-2018-8905
  - Resolves: #1574548
  - Fix CVE-2018-10779
  - Resolves: #1598503
  - Fix CVE-2018-10963
  - Resolves: #1598726
  - Fix CVE-2018-12900
  - Resolves: #1600430
  - Fix CVE-2018-17100
  - Resolves: #1632578
  - Fix CVE-2018-17101
  - Resolves: #1632579
  - Fix CVE-2018-18557
  - Resolves: #1647737
  - Fix CVE-2018-18661
  - Resolves: #1647965


author: Stepan Broz <sbroz@redhat.com> - 4.0.3-35.1
changelog:
  - Fix CVE-2025-9900
    Resolves: RHEL-112526
  - Fix CVE-2025-8177
    Resolves: RHEL-120197
  - Fix CVE-2025-8176
    Resolves: RHEL-120227


author: David Shea <dshea@redhat.com> - 0.4.1-4
changelog:
  - Merge fixes from lp:timezonemap
  - Add cc-timezone-location.h to timezonemapincludes_HEADERS so it gets installed (iain.lane)
  - Set en_name correctly (iain.lane)
  - Don't call g_type_init() on glib >= 2.35; it's deprecated (iain.lane)


author: David Shea <dshea@redhat.com> - 0.4.2-6
changelog:
  - Updated the time zone map images
  - Updated the city data from geonames.org
  - Fix a memory leak and potential crash with the locations list
  - Cycle through a smaller list of map locations on repeated clicks


author: David Shea <dshea@redhat.com> - 0.4.4-1
changelog:
  - Fixes for LP#1440157:
    Port to libsoup directly for geoname results
    Fix some memory leaks
    Do not reuse GCancellables
  - Upstream merges of SVG update and constrained location cycles


author: Simone Caronni <negativo17@gmail.com> - 1.17-20
changelog:
  - Make doc package noarch.
  - Remove executable bits from LICENSE file and source files.
  - Require isaed library for devel subpackage.
  - Require CVE fixed libtommath library.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.17-26
changelog:
  - Merge EPEL changes: fix CVE-2016-6129 (#1370955, #1370957), update URLs (#1463608, #1463547)
  - Fix strict aliasing warnings by adding -fno-strict-aliasing


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-34
changelog:
  - vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (rhbz#1815269)
  - vmx: make 'fileName' optional for CD-ROMs (rhbz#1815269)
  - RHEL: Fix migration on AMD hosts with old QEMU (rhbz#1815572)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35
changelog:
  - qemu: don't take agent and monitor job for shutdown (CVE-2019-20485)
  - qemu: don't hold a monitor and agent job for reboot (CVE-2019-20485)
  - qemu: don't hold monitor and agent job when setting time (CVE-2019-20485)
  - qemu: remove use of qemuDomainObjBeginJobWithAgent() (CVE-2019-20485)
  - qemu: remove qemuDomainObjBegin/EndJobWithAgent() (CVE-2019-20485)
  - storage: Fix daemon crash on lookup storagepool by targetpath (CVE-2020-10703)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
  - virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support (rhbz#1823976)
  - virDevMapperGetTargetsImpl: quit early if device is not a devmapper target (rhbz#1823976)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.1
changelog:
  - qemu: end the agent job in qemuDomainSetTimeAgent (rhbz#1844952)
  - util: string: Introduce macro for automatic string lists (rhbz#1839992)
  - util: Rework virStringListAdd (rhbz#1839992)
  - qemu: Create multipath targets for PRs (rhbz#1839992)
  - util: Move virIsDevMapperDevice() to virdevmapper.c (rhbz#1839992)
  - virDevMapperGetTargetsImpl: Check for dm major properly (rhbz#1839992)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.3
changelog:
  - rpc: gendispatch: handle empty flags (CVE-2020-25637)
  - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
  - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
  - conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1868549)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.4
changelog:
  - virdevmapper.c: Join two WITH_DEVMAPPER sections together (rhbz#1933557)
  - virDevMapperGetTargetsImpl: Use VIR_AUTOSTRINGLIST (rhbz#1933557)
  - virdevmapper: Don't use libdevmapper to obtain dependencies (rhbz#1933557)
  - virdevmapper: Don't cache device-mapper major (rhbz#1933557)
  - virdevmapper: Handle kernel without device-mapper support (rhbz#1933557)
  - virdevmapper: Ignore all errors when opening /dev/mapper/control (rhbz#1933557)
  - virdevmapper: fix stat comparison in virDMSanitizepath (rhbz#1933557)
  - virDevMapperGetTargetsImpl: Use correct length when copying into dm.name (rhbz#1933557)


author: guochao <guochao@kylinos.cn> - 4.5.0-36.el7_9.5.ns7.01
changelog:
  - Type:updates
  - ID:NA
  - SUG:NA
  - DESC:add Patch1000: Remove arbitrary limit on socket_id/core_id to solve virt-namager


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-10
changelog:
  - Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157671)
  - Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
    (bug #1157671)
  - Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
    handling) (bug #1157671)
  - Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
    (bug #1157671)
  - Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
    handling) (bug #1157671)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-11
changelog:
  - Fix a crash in the VNC server library on connecting an IPv4 client if the
    server could not start listening on an IPv6 socket (bug #1314814)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-13
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662996)


author: Rahul Sundaram <sundaram@fedoraproject.org> - 0.3.0-1
changelog:
  - upstream release 0.3.0
  - enable gif2webp
  - add build requires on giflib-devel and libtiff-devel
  - use make_install and hardened macros
  - list binaries explicitly


author: Jaromir Capik <jcapik@redhat.com> - 0.3.0-5
changelog:
  - Removing __PPC__ macro conflicting with __BYTE_ORDER__ endian check (#1127230)
  - Resolves: rhbz#1127230


author: Michal Sekletar <msekleta@redhat.com> - 4.6.1-9
changelog:
  - put static libraries into subpackage
  - disable strict aliasing optimizations to prevent warnings and possible crashes
  - fix changelog dates


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6
changelog:
  - Fix missing entities after CVE-2014-3660 fix
  - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
  - Fix regressions introduced by CVE-2014-0191 patch


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
  - Fix a series of CVEs (rhbz#1286496)
  - CVE-2015-7941 Stop parsing on entities boundaries errors
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - CVE-2015-1819 Enforce the reader to run in constant memory


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
  - Fix CVE-2015-8035 (#1595697)
  - Fix CVE-2018-14404 (#1602817)
  - Fix CVE-2017-15412 (#1729857)
  - Fix CVE-2016-5131 (#1714050)
  - Fix CVE-2017-18258 (#1579211)
  - Fix CVE-2018-1456 (#1622715)


author: David King <dking@redhat.com> - 2.9.1-6.5
changelog:
  - Fix CVE-2019-19956 (#1793000)
  - Fix CVE-2019-20388 (#1810057)
  - Fix CVE-2020-7595 (#1810073)
  - Fix xsd:any schema validation (#1812145)


author: Yogeshwar Rasal <yrasal@redhat.com> - 2.9.1-6.10
changelog:
  - Fix CVE-2025-32414 (RHEL-99863)
  - Fix CVE-2025-6021 (RHEL-96497)
  - Fix CVE-2025-49794 (RHEL-97060)
  - Fix CVE-2025-49796 (RHEL-97063)


author: Matthias Clasen <mclasen@redhat.com> - 1.1.28-3
changelog:
  - Don't ship api docs twice (they were included in both
    the main and the devel package, by accident (need to save
    space on the f19 live images)


author: Guo Jianxing <jianxing.guo@cs2c.com.cn> -1.2.-23
changelog:
  - add Patch48&Patch49, add check device type before add to list, get permanent mac in gernerate fbcode.
  - modify spec, add: 'Requires: NetworkManager-glib' & 'BuildRequires: NetworkManager-glib-devel'
  - add Patch50, do not print dmidecode error message.


author: Guo Jianxing <jianxing.guo@cs2c.com.cn> 2.0-5
changelog:
  - add Patch206, set machine change info to po-mo.
  -     resize the dialog height, to fix button does not display in en_US.
  - add Patch207, fix get_PID error.


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-3.20140718gitbdb6a3
changelog:
  - fix resetting of linreg servo (#1165045)
  - fix phc2sys automatic mode with multiple interfaces (#1108795)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-5
changelog:
  - add support for active-backup bonding (#1002657)
  - add support for IP over InfiniBand (#1472880)
  - fix handling of unknown/invalid management TLVs in pmc (#1459446 #1459449)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-6
changelog:
  - add support for bonding to timemaster (#1549015)
  - improve timemaster to restart terminated processes (#1527170)
  - start ptp4l, timemaster and phc2sys after network-online target (#1541991)
  - don't forward management requests to UDS port (#1520366)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-1
changelog:
  - update to 2.0 (#1623919)
  - add support for more accurate synchronization to phc2sys (#1643977)
  - add support for active-backup team interface (#1650672)
  - limit unicast message rate per address and grant duration


author: Chris Leech <cleech@redhat.com> - 1.0.1-3.git036e314
changelog:
  - 1273663 sync with upstream v1.0.1-26-g036e314
    system capability incorrect advertised as station only


author: Martin Sehnoutka <msehnout@redhat.com> - 3.4.0-0.20160601gitf9185e5.1
changelog:
  - New upstream release
  - Drop patches that are already present in upstream
  - Apply upstream fix for systemd paths
  - Resolves: #1297795


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-6.20160601gitf9185e5
changelog:
  - Fix License field capitalization
  - Resolves: rhbz#1577175
  - Add detection of AMD Ryzen w/ Vega graphics
  - Resolves: rhbz#1569542
  - Fix issues found by Coverity Scan
  - Resolves: rhbz#1578007


author: Bryan Mason <bmason@redhat.com> - 3.4.0-8.20160601gitf9185e5.el7_9.1
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.
  - Resolves: RHEL-17699


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.2
changelog:
  - Fix dmeventd crash with modified reserved_stack configuration option.
  - Fix lvm crashing when .cache file is changed by external tools.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.5
changelog:
  - Fix fsadm failure due to accessing unbound variable.
  - Fix segfault in vgextend when a PV is missing in the processed VG.


author: Pavel Šimerda <psimerda@redhat.com> - 3:2.1.15-23
changelog:
  - Resolves: #1232749 - fix bad subject of the welcome email when creating list
    using newlist command


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893261, #1893249, #1893229):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
      0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
      to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
      to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
      to 0xde;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
      up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
      up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
      to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
      to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
      to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
      up to 0xa0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
      up to 0xe0.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.4
changelog:
  - Update Intel CPU microcode to microcode-20201112 release:
    - Addition of 06-8a-01/0x10 (LKF B2/B3) microcode at revision 0x28;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x32 up
      to 0x34;
    - Updated releasenote file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.5
changelog:
  - Do not use "grep -q" in a pipe in check_caveats.
  - Add 06-55-04/06-55-06/06-55-07 (SKX-SP/CLX-SP) microcode-20201110 caveats
    (#1905111).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.8
changelog:
  - Update Intel CPU microcode to microcode-20210216 release (#1905111):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a08 up
      to 0x2006a0a;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003003
      up to 0x4003006;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003003 up to 0x5003006.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.9
changelog:
  - Update Intel CPU microcode to microcode-20210525 release, addresses
    CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513
    (#1962659, #1962709, #1962729, #1962675):
    - Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
    - Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
    - Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
    - Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
      at revision 0xb00000f;
    - Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
      at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
    - Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
    - Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
    - Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
    - Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
    - Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
    - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
      intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up
      to 0xb00003e;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up
      to 0x2006b06;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up
      to 0xea;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xde up to 0xea;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up
      to 0xea;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x44 up to 0x46;
    - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up
      to 0x19;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159
      up to 0x100015b;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006
      up to 0x4003102;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003006 up to 0x5003102;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e
      up to 0x7002302;
    - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
      0x7000019 up to 0x700001b;
    - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000017
      up to 0xf000019;
    - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
      0xe00000f up to 0xe000012;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x40 up
      to 0x44;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x1e up
      to 0x20;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x2e up
      to 0x34;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x34 up
      to 0x36;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x18 up
      to 0x1a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa0
      up to 0xa6;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x28 up
      to 0x2a;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xe0 up
      to 0xea;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xe0
      up to 0xea;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xe0
      up to 0xec;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe0
      up to 0xe8;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode from revision
      0xe0 up to 0xea.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.10
changelog:
  - Make intel-06-2d-07, intel-06-4e-03, intel-06-4f-01, intel-06-55-04,
    intel-06-5e-03, intel-06-8c-01, intel-06-8e-9e-0x-0xca,
    and intel-06-8e-9e-0x-dell caveats dependent on intel caveat.
  - Enable 06-8c-01 microcode update by default.
  - Enable 06-5e-03 microcode update by default (#1897684).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.12
changelog:
  - Update Intel CPU microcode to microcode-20220204 release, addresses
    CVE-2021-0127, CVE-2021-0145, CVE-2021-33120 (#2051547, #2049549, #2049566):
    - Removal of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
    - Removal of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
      at revision 0xb00000f;
    - Removal of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
      at revision 0xb00000f;
    - Removal of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xea up to 0xec;
    - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
      intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb00003e up
      to 0xb000040;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006b06 up
      to 0x2006c0a;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xea up to 0xec;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x88 up to 0x9a;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x46 up to 0x49;
    - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x19 up
      to 0x1a;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015b
      up to 0x100015c;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003102
      up to 0x400320a;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003102 up to 0x500320a;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002302
      up to 0x7002402;
    - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
      0x700001b up to 0x700001c;
    - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000019
      up to 0xf00001a;
    - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
      0xe000012 up to 0xe000014;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x44 up
      to 0x46;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x20 up
      to 0x24;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x34 up
      to 0x36;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0002a0
      up to 0xd000331;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x36 up
      to 0x38;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1a up
      to 0x1c;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa6
      up to 0xa8;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2a up
      to 0x2d;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x16 up
      to 0x22;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x2c up
      to 0x3c;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xea
      up to 0xec;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
      0xea up to 0xec;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
      revision 0xea up to 0xec;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xea up
      to 0xec;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xea up to 0xec;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x11 up
      to 0x15;
    - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x1d up
      to 0x2400001f;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
      revision 0xea up to 0xec;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xea up to 0xec;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xea
      up to 0xec;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
      0xea up to 0xec;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0xea up to 0xec;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xea up
      to 0xec;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xea
      up to 0xec;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xec
      up to 0xee;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe8
      up to 0xea;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xea up to 0xec;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x40 up
      to 0x50.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.14
changelog:
  - Update Intel CPU microcode to microcode-20220510 release, addresses
    CVE-2022-0005, CVE-2022-21131, CVE-2022-21136, CVE-2022-21151 (#2090246,
      - Addition of 06-97-02/0x03 (ADL-HX C0) microcode at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      at revision 0x1f;
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
      intel-ucode/06-97-05) at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      at revision 0x1f;
    - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode at
      revision 0x41c;
    - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) at revision 0x41c;
    - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) at revision 0x41c;
    - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode at revision 0x41c;
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
      intel-ucode/06-bf-02) at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
      at revision 0x1f;
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
      intel-ucode/06-bf-05) at revision 0x1f;
    - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) at revision 0x1f;
    - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
      at revision 0x1f;
    - Addition of 06-bf-05/0x03 (ADL C0) microcode at revision 0x1f;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xec up to 0xf0;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006c0a up
      to 0x2006d05;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xec up to 0xf0;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x9a up to 0xa4;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xec up
      to 0xf0;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xec up to 0xf0;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xec up
      to 0xf0;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xec up
      to 0xf0;
    - Update of 06-37-09/0x0f (VLV D0) microcode from revision 0x90c up
      to 0x90d;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015c
      up to 0x100015d;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400320a
      up to 0x4003302;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x500320a up to 0x5003302;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002402
      up to 0x7002501;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x46 up
      to 0x48;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x24 up
      to 0x28;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x36 up
      to 0x38;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000331
      up to 0xd000363;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1c up
      to 0x1e;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa8
      up to 0xb0;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2d up
      to 0x31;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x22 up
      to 0x26;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3c up
      to 0x3e;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x15 up
      to 0x16;
    - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x2400001f
      up to 0x24000023;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xec up
      to 0xf0;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xec
      up to 0xf0;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xee
      up to 0xf0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xea
      up to 0xf0;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xec up to 0xf0;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x50 up
      to 0x53.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.15
changelog:
  - Update Intel CPU microcode to microcode-20220510 release, addresses
    CVE-2022-21233 (#2119080):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006d05 up
      to 0x2006e05;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015d
      up to 0x100015e;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000363
      up to 0xd000375;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3a up
      to 0x3c;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1e up
      to 0x20;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb0
      up to 0xb2;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x26 up
      to 0x28;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3e up
      to 0x40;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode from revision
      0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x1f up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x1f up to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x1f up to 0x22;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode from revision 0x1f
      up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x1f up to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x1f up to 0x22;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x41c up to 0x421;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x41c up to 0x421;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x41c up to 0x421;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x41c
      up to 0x421;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x53 up
      to 0x54;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode from revision 0x1f up
      to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x1f up to 0x22;
    - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
    - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
    - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x1f up to 0x22;
    - Update of 06-bf-05/0x03 (ADL C0) microcode from revision 0x1f up
      to 0x22.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.16
changelog:
  - Update Intel CPU microcode to microcode-20230214 release, addresses
    CVE-2022-21216, CVE-2022-33196, CVE-2022-33972, CVE-2022-38090 (#2171238,
      - Addition of 06-6c-01/0x10 (ICL-D B0) microcode at revision 0x1000211;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode at revision
      0x2b000181;
    - Addition of 06-8f-04/0x10 microcode at revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) at revision 0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) at
      revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2c000170;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) at
      revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode at revision
      0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode at revision
      0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) at
      revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) at revision 0x2c000170;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) at
      revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) at revision 0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode at revision
      0x2b000181;
    - Addition of 06-8f-06/0x10 microcode at revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) at revision 0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) at revision 0x2c000170;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode at revision
      0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) at revision 0x2b000181;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) at
      revision 0x2c000170;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) at revision 0x2c000170;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) at
      revision 0x2c000170;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) at revision 0x2b000181;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode at revision
      0x2b000181;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode at revision
      0x2c000170;
    - Addition of 06-b7-01/0x32 (RPL-S S0) microcode at revision 0x112;
    - Addition of 06-ba-02/0xc0 microcode at revision 0x410e;
    - Addition of 06-ba-03/0xc0 microcode (in intel-ucode/06-ba-02) at
      revision 0x410e;
    - Addition of 06-ba-02/0xc0 microcode (in intel-ucode/06-ba-03) at
      revision 0x410e;
    - Addition of 06-ba-03/0xc0 microcode at revision 0x410e;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa4 up to 0xa6;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xf0 up to 0xf4;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xf0 up
      to 0xf4;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015e
      up to 0x1000161;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003302
      up to 0x4003303;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003302 up to 0x5003303;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002501
      up to 0x7002503;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000375
      up to 0xd000389;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3c up
      to 0x3e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x20 up
      to 0x22;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb2
      up to 0xb8;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x31 up
      to 0x32;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x40 up
      to 0x42;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x16 up
      to 0x17;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x22
      up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x421 up to 0x429;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x421 up to 0x429;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x421 up to 0x429;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x421
      up to 0x429;
    - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x24000023
      up to 0x24000024;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf0 up
      to 0xf4;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf0
      up to 0xf4;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf0
      up to 0xf4;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf0
      up to 0xf4;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xf0 up to 0xf4;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x54 up
      to 0x57;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x22 up to
      0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x22 up to 0x2c (old pf 0x3);
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x22 up to
      0x2c (old pf 0x3).
  - Change the logger severity level to warning to align with the kmsg one.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.17
changelog:
  - Force locale to C in check_caveats, reload_microcode, and update_ucode.
  - Cleanup the dangling symlinks in update_ucode.
  - Avoid spurious find failures due to calls on directories that may not exist.
  - Add support for the new, more correct, variant of dracut's default
    $fw_dir path in dracut_99microcode_ctl-fw_dir_override_module_init.sh.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.18
changelog:
  - Update Intel CPU microcode to microcode-20230516 release:
    - Addition of 06-be-00/0x01 (ADL-N A0) microcode at revision 0x10;
    - Addition of 06-9a-04/0x40 (AZB A0) microcode at revision 0x4;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006e05 up
      to 0x2006f05;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa6 up to 0xaa;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000161
      up to 0x1000171;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003303
      up to 0x4003501;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003303 up to 0x5003501;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002503
      up to 0x7002601;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000389
      up to 0xd000390;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000211
      up to 0x1000230;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb8
      up to 0xba;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x32 up
      to 0x33;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x28 up
      to 0x2a;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x42 up
      to 0x44;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf0
      up to 0xf2;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
      0xf0 up to 0xf2;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
      revision 0xf0 up to 0xf2;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf0 up
      to 0xf2;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xf4 up to 0xf6;
    - Update of 06-8f-04/0x10 microcode from revision 0x2c000170 up to
      0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
      0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000181
      up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c000170 up to
      0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000181
      up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000170 up to 0x2c0001d1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000181 up to 0x2b000461;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x429 up to 0x42a;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x429 up to 0x42a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x429 up to 0x42a;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x429
      up to 0x42a;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
      revision 0xf0 up to 0xf2;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xf0 up to 0xf2;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf0
      up to 0xf2;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
      0xf0 up to 0xf2;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0xf4 up to 0xf8;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf4 up
      to 0xf6;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xf4 up to 0xf6;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x57 up
      to 0x58;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x112 up
      to 0x113;
    - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x410e up to 0x4112;
    - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x410e up to 0x4112;
    - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x410e up to 0x4112;
    - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode from revision 0x410e
      up to 0x4112.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.19
changelog:
  - Update Intel CPU microcode to microcode-20230808 release, addresses
    CVE-2022-40982, CVE-2022-41804, CVE-2023-23908 (#2223994):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006f05 up
      to 0x2007006;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xaa up to 0xac;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000171
      up to 0x1000181;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003501
      up to 0x4003604;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003501 up to 0x5003604;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002601
      up to 0x7002703;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000390
      up to 0xd0003a5;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xba
      up to 0xbc;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2a up
      to 0x2c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x44 up
      to 0x46;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
      0xf2 up to 0xf4;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf2
      up to 0xf4;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
      revision 0xf2 up to 0xf4;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf2 up
      to 0xf4;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xf6 up to 0xf8;
    - Update of 06-8f-04/0x10 microcode from revision 0x2c0001d1 up to
      0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
      0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000461
      up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c0001d1 up to
      0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000461
      up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c0001d1 up to 0x2c000271;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000461 up to 0x2b0004b1;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x2c up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2c up to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2c up to 0x2e;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2c
      up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2c up to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2c up to 0x2e;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x42a up to 0x42c;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x42a up to 0x42c;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x42a up to 0x42c;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42a
      up to 0x42c;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
      revision 0xf2 up to 0xf4;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xf2 up to 0xf4;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf2
      up to 0xf4;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
      0xf2 up to 0xf4;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0xf8 up to 0xfa;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf6 up
      to 0xf8;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf6
      up to 0xf8;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf6
      up to 0xf8;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf6
      up to 0xf8;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xf6 up to 0xf8;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x58 up
      to 0x59;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x113 up
      to 0x119;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2c up
      to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x2c up to 0x2e;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x2c up to 0x2e;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2c up
      to 0x2e;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4112 up to 0x4119 (old pf 0xc0);
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4112 up to 0x4119 (old pf 0xc0);
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4112 up to 0x4119 (old pf 0xc0);
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4112
      up to 0x4119 (old pf 0xc0);
    - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x10 up
      to 0x11 (old pf 0x1).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.20
changelog:
  - Update Intel CPU microcode to microcode-20231009 release, addresses
    CVE-2023-23583 (RHEL-3920):
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xac up to 0xb4;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003a5
      up to 0xd0003b9;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000230
      up to 0x1000268;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xbc
      up to 0xc2;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2c up
      to 0x34;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x46 up
      to 0x4e;
    - Update of 06-8f-04/0x10 microcode from revision 0x2c000271 up to
      0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0004b1
      up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c000271 up to
      0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0004b1
      up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2e up to 0x32;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2e
      up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2e up to 0x32;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x42c up to 0x430;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x42c up to 0x430;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x42c up to 0x430;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42c
      up to 0x430;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x4 up
      to 0x5;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x59 up
      to 0x5d;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x119 up
      to 0x11d;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4119 up to 0x411c;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4119 up to 0x411c;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4119 up to 0x411c;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4119
      up to 0x411c;
    - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x11 up
      to 0x12;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2e up
      to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x2e up to 0x32;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2e up
      to 0x32.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.21
changelog:
  - Update Intel CPU microcode to microcode-20240531 release, addresses
    CVE-2023-22655, CVE-2023-23583. CVE-2023-28746, CVE-2023-38575,
    CVE-2023-39368, CVE-2023-42667, CVE-2023-43490, CVE-2023-45733,
    CVE-2023-46103, CVE-2023-49141 (RHEL-30837, RHEL-30843, RHEL-30847,
    RHEL-30851, RHEL-30854):
    - Addition of 06-aa-04/0xe6 (MTL-H/U C0) microcode at revision 0x1c;
    - Addition of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) at
      revision 0x4121;
    - Addition of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) at
      revision 0x4121;
    - Addition of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) at revision 0x4121;
    - Addition of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) at revision 0x4121;
    - Addition of 06-ba-08/0xe0 microcode at revision 0x4121;
    - Addition of 06-cf-01/0x87 (EMR-SP A0) microcode at revision
      0x21000230;
    - Addition of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) at revision 0x21000230;
    - Addition of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) at revision 0x21000230;
    - Addition of 06-cf-02/0x87 (EMR-SP A1) microcode at revision
      0x21000230;
    - Removal of 06-8f-04/0x10 microcode at revision 0x2c000290;
    - Removal of 06-8f-04/0x87 (SPR-SP E0/S1) microcode at revision
      0x2b0004d0;
    - Removal of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) at revision 0x2c000290;
    - Removal of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b0004d0;
    - Removal of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) at
      revision 0x2c000290;
    - Removal of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b0004d0;
    - Removal of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b0004d0;
    - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2c000290;
    - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) at revision 0x2b0004d0;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb4 up to 0xb6;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000181
      up to 0x1000191;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003604
      up to 0x4003605;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003604 up to 0x5003605;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002703
      up to 0x7002802;
    - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
      0xe000014 up to 0xe000015;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x38 up
      to 0x3e;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003b9
      up to 0xd0003d1;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000268
      up to 0x1000290;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3e up
      to 0x42;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x22 up
      to 0x24;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc2
      up to 0xc4;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x34 up
      to 0x36;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x4e up
      to 0x50;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xf8 up to 0xfa;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c000290 up to 0x2c000390;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0004d0
      up to 0x2b0005c0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c000290 up to
      0x2c000390;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0004d0
      up to 0x2b0005c0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000290 up to 0x2c000390;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000290 up to 0x2c000390;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b0004d0 up to 0x2b0005c0;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x17 up
      to 0x19;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x32 up to 0x35;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x32 up to 0x35;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x32 up to 0x35;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x32 up to 0x35;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x32 up to 0x35;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x32
      up to 0x35;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x32 up to 0x35;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x32 up to 0x35;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x430 up to 0x433;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x430 up to 0x433;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x430 up to 0x433;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x430
      up to 0x433;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x5 up
      to 0x7;
    - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x24000024
      up to 0x24000026;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
      revision 0xf4 up to 0xf8;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xf4 up to 0xf6;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
      0xf4 up to 0xf6;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0xfa up to 0xfc;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf8 up
      to 0xfa;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf8
      up to 0xfa;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf8
      up to 0xfa;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf8
      up to 0xfa;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xf8 up to 0xfa;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5d up
      to 0x5e;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x11d up
      to 0x123;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x411c up to 0x4121;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x411c up to 0x4121;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x411c up to 0x4121;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x411c
      up to 0x4121;
    - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x12 up
      to 0x17;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x32 up to 0x35;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x32 up to 0x35;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x32 up
      to 0x35;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x32 up to 0x35;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x32 up to 0x35;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x32 up to 0x35;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x32 up to 0x35;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x32 up
      to 0x35.


author: Jorge San Emeterio <jsanemet@redhat.com> - 2:2.1-73.22
changelog:
  - Update Intel CPU microcode to microcode-20241112 release, addresses
    CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984,
    CVE-2024-24853, CVE-2024-24968, CVE-2024-24980, CVE-2024-25939 (RHEL-67363):
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb6 up to 0xb8;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003605 up to 0x5003707;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802
      up to 0x7002904;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1
      up to 0xd0003e7;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290
      up to 0x10002b0;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4
      up to 0xc6;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up
      to 0x38;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up
      to 0x52;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
      0xf4 up to 0xf6;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
      revision 0xf4 up to 0xf6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf4 up
      to 0xf6;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode from revision 0xfa up to 0xfc;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0
      up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0
      up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b0005c0 up to 0x2b000603;
    - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up
      to 0x1a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x35 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x35 up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x35 up to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x35 up to 0x37;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x35 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35
      up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x35 up to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x35 up to 0x37;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x433 up to 0x435;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x433 up to 0x435;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x433 up to 0x435;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433
      up to 0x435;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xf6 up to 0xf8;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf4
      up to 0xf6;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
      0xf6 up to 0xf8;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up
      to 0xfc;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa
      up to 0xfc;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa
      up to 0xfc;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa
      up to 0xfe;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfa up to 0xfc;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up
      to 0x62;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c
      up to 0x20;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up
      to 0x12b;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4121 up to 0x4123;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4121 up to 0x4123;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4121 up to 0x4123;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4121 up to 0x4123;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121
      up to 0x4123;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4121 up to 0x4123;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4121 up to 0x4123;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4121 up to 0x4123;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4123;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x35 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x35 up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up
      to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x35 up to 0x37;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x35 up to 0x37;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x35 up to 0x37;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x35 up to 0x37;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up
      to 0x37;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230
      up to 0x21000283;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230
      up to 0x21000283;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up
      to 0x1a (old pf 0x11).


author: Gonzalo Siero <gsierohu@redhat.com> - 2:2.1-73.23
changelog:
  - Update Intel CPU microcode to microcode-20250211 release, addresses
    CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047,
    CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157,
    CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79190, 
    RHEL-79192, RHEL-79194, RHEL-79196, RHEL-79207):
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at
      revision 0x38;
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at
      revision 0x38;
    - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330;
    - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at
      revision 0x12c;
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at
      revision 0x38;
    - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at
      revision 0x38;
    - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at
      revision 0x38;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7
      up to 0xd0003f5;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0
      up to 0x10002c0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000603
      up to 0x2b000620;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c000390 up to
      0x2c0003e0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000603
      up to 0x2b000620;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000603 up to 0x2b000620;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000390 up to 0x2c0003e0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000603 up to 0x2b000620;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x37 up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x37 up to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x37 up to 0x38;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37
      up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x37 up to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x37 up to 0x38;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x435 up to 0x436;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x435 up to 0x436;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x435 up to 0x436;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435
      up to 0x436;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up
      to 0x9;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
      0xf8 up to 0xfa;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
      0x100 up to 0x102;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up
      to 0x63;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up
      to 0x12c;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4123 up to 0x4124;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4123 up to 0x4124;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123
      up to 0x4124;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4123 up to 0x4124;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4123 up to 0x4124;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up
      to 0x1c;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x37 up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up
      to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x37 up to 0x38;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x37 up to 0x38;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x37 up to 0x38;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x37 up to 0x38;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up
      to 0x38;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283
      up to 0x21000291;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283
      up to 0x21000291.


author: Jorge San Emeterio <jsanemet@redhat.com> - 2:2.1-73.24
changelog:
  - Add a caveat to provide ability to persistently disable SPR-EE updates
    beyond 0x2b0005c0 on systems where absence of latency spikes
    is more important than lack of the latest CVE mitigations.
  - Update Intel CPU microcode to microcode-20250512 release, addresses
    CVE-2024-28956:
    - Addition of 06-8f-04/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-06/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision
      0xa0000d1;
    - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision
      0x10003a2;
    - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa;
    - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) at revision 0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in
      intel-ucode/06-c6-02) at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision
      0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xfc up to 0x100;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up
      to 0x104;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003707 up to 0x5003901;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904
      up to 0x7002b01;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5
      up to 0xd000404;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0
      up to 0x10002d0;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up
      to 0x26;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6
      up to 0xca;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up
      to 0x3c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up
      to 0x56;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to
      0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38
      up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x436 up to 0x437;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x436 up to 0x437;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x436 up to 0x437;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up
      to 0xa;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436
      up to 0x437;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up
      to 0x100;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe
      up to 0x102;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up
      to 0x64;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20
      up to 0x24;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330
      up to 0x3000341;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up
      to 0x12f;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12c up to 0x12f;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124
      up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up
      to 0x1d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291
      up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291
      up to 0x210002a9;


author: John Dennis <jdennis@redhat.com> - 0.13.1-2
changelog:
  - Resolves: rhbz#1481330 Add diagnostic logging
  - Resolves: rhbz#1295472 Add MellonSignatureMethod config option to set
    signature method used to sign SAML messages sent by Mellon.
    Defaults to original sha1.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-3
changelog:
  - Resolves: rhbz#1652980 - mod_auth_mellon Cert files name wrong when
                             hostname contains a number


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-4
changelog:
  - Resolves: rhbz#1576719 - ECP flow not triggering, instead client access
                             secured resources without ECP authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-5
changelog:
  - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
changelog:
  - Apply the patch from the previous commit
  - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
changelog:
  - Resolves: rhbz#1727789 - mod_auth_mellon fix for AJAX header name
                             X-Requested-With


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-8
changelog:
  - Resolves: rhbz#1731052 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via
                             the login?ReturnTo= substring which could facilitate
                             information theft [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-9
changelog:
  - Resolves: rhbz#1791264 - Backport SameSite=None cookie from upstream to
                             support latest browsers


author: John Dennis <jdennis@redhat.com> - 1.8.8-3
changelog:
  - fix unit test failure caused by apr_jwe_decrypt_content_aesgcm()
    failing to null terminate decrypted string
    Resolves: bug#1292561 New package: mod_auth_openidc


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-4
changelog:
  - Resolves: rhbz#1626299 - CVE-2017-6059 mod_auth_openidc: Shows
                             user-supplied content on error pages [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
changelog:
  - Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
                             OIDCAuthNHeader not skipped in an "AuthType oauth20"
                             configuration [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
changelog:
  - Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                             issue exists in URLs with slash and backslash [rhel-7]
  - Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
                             in logout url when using URLs with leading slashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
changelog:
  - Fix a regression in the previous patches
  - Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                            issue exists in URLs with slash and backslash [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-8
changelog:
  - Resolves: rhbz#1823762 - Backport SameSite=None cookie from
                             mod_auth_openidc upstream to support
                             latest browsers [rhel-7.9.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-9
changelog:
  - Rebuild to pick up the proper build tag
  - Related: rhbz#1823762 - Backport SameSite=None cookie from
                            mod_auth_openidc upstream to support
                            latest browsers [rhel-7.9.z]


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-9.el7
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs when
    mok-variables aren't present.
    Resolves: rhbz#1868820


author: openEuler Buildteam <buildteam@openeuler.org> - 6.1-12
changelog:
  - Type:cves
  - ID:CVE-2019-17594  CVE-2019-17595
  - SUG:NA
  - DESC:fix CVE-2019-17594 and CVE-2019-17595


author: liutao <liutao1@kylinos.cn> - 6.1-14.el7.01
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:unpack static subpackage corresponding to version 5.9-14.20130511.el7_4


author: liutao <liutao1@kylinos.cn> - 6.1-14.el7.02
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:unpack static subpackage corresponding to version 5.9-14.20130511.el7_4
  - Add Obsoletes:     ncurses < 6.1-14.el7.02


author: Jeff Moyer <jmoyer@redhat.com> - 62-1
changelog:
  - Rebase to v62 (Jeff Moyer)
    - a new monitor command / daemon
    - an ndctl udev rule for recording the unsafe shutdown count
    - smart error injection
    - create-namespace fix for fragmented namespaces
  - Resolves: bz#1610649 bz#1611833 bz#1456320


author: Jeff Moyer <jmoyer@redhat.com> - 64.1-1
changelog:
  - Rebase to v64.1 (Jeff Moyer)
    - add security commands
    - fix broken udev rule for dirty shutdown count
  - Resolves: bz#1634348 bz#1635441


author: Jeff Moyer <jmoyer@redhat.com> - 65.1.el7
changelog:
  - Rebase to v65
    - clear-errors: new command to clear errors on a namespace
    - monitor: remove the requirement of a default config
    - sanitize-dimm: allow a zero-key for secure-erase
    - sanitize-dimm: preserve keys after an overwrite
    - load-keys: fix for non-TPM keys
  - Fix test harness to run against the rhel7 test kernel modules
  - Related: rhbz#1722481


author: Jeff Moyer <jmoyer@redhat.com> - 65.2.el7
changelog:
  - Remove 'daxctl migrate-device-model' command.  We won't
    support hot-plugging device dax into the memory hierarchy
    on RHEL 7.
  - Resolves: rhbz#1734153


author: Jeff Moyer <jmoyer@redhat.com> - 65.3.el7
changelog:
  - modify nvdimm-security.conf touse '&&' instead of ';'
    Without this change, the module doesn't load
  - Resolves: rhbz#1725405


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-44
changelog:
  - add support for glusterfs (#1316386)
  - change services to start after network-online.target (#1388118)
  - fix interface fadeout configuration (#1547355)
  - fix scanf pattern for ICMP stats (#1693547)
  - change buffer size in pass_common.c file (#1695363 and #1731357)
  - remove initial whitespace reading from scanf pattern of /sys/dev/block/../stat file (#1700494)
  - fix for CVE-2018-18066 (#1638911)
  - add Counter64 support for UCD-SNMP-MIB (#1703752)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
  - add missing part of memory leak patch (#1794168)
  - fix if_inet6 messages floood (#1765449)
  - revert bz#1486733 (#1771050)
  - fix issue for process status when process name contains whitespace (#1782180)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.18.20131004git
changelog:
  - Resolves: #1063913 - netstat doesn't list sctp servers in -A mode
  - Resolves: #1257549 - netstat tool does not throw correct exit code on wrong parameter
  - Resolves: #1392910 - ifconfig inaccurately rounds exabytes


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.25.20131004git
changelog:
  - Resolves: #1632905 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Lubomir Rintel <lrintel@redhat.com> - 1.8.0-0.1.git20170326.f260f8a
changelog:
  - Update to network-manager-applet 1.8 snapshot
  - c-e: add missing mnemonic characters to buttons (rh #1434317)
  - c-e: fix handling of devices without permanent MAC address in devices combo box (rh #1380424)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.63
changelog:
  - nfs.conf: Fixed manage-gids option typo (bz 1677403)
  - sm-notify: Added -f flag to nfs.conf parsing (bz 1688932)
  - Add nfs.conf equivalent for the statd --no-notify cmdline option (bz 1688918)
  - nfs-server: Use reload not restart to start gssproxy (bz 1644169)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.67
changelog:
  - rpc.gssd: removed a number memory leaks (bz 1807110)
  - mount: Report correct error in the fall_back cases (bz 1752329)
  - gssd: daemonize earlier (bz 1645083)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-5
changelog:
  - Fix pkix name constraints processing to only process the common name if the
    certusage you are checking is IPSEC or SSL Server.


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-8
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
  - Explicitly enable upgradedb/sharedb test cycles


author: xiehongyu<xiehongyu@kylinos.cn> - 3.53.1-3.ns7.01
changelog:
  - Add modify at check ,fix failed:SSL_ERROR_BAD_CERT_ALERT: SSL peer cannot verify your certificate.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - revert sql default language in man pages
  - fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Like<like@kylinos.cn> - 3.90.0-2.ns7.01
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: modify at check ,fix failed:SSL_ERROR_BAD_CERT_ALERT: SSL peer cannot verify your certificate.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-3
changelog:
  - include patches for CVE-2020-6829, CVE-2020-12400,
    and CVE-2020-12401 from upstream (ECC constant time issues).
  - include patches for CVE-2020-12403 from upstream
    (CHACHA issues).
  - include self-tests for kdfs and cmac.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn off ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - Include softoken specific patches required by the NSS 3.67
    release including:
  -  sdb timeout fixes.
  -  coverity patch.
  -  fixing private key macing


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
  - Rebase to NSS 3.79.
  - add reader/writer lock on encrypted attribute access
  - skip attribute verification on attributes with default values
  - don't export trust objects if they are default trust objects from dbm


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-26
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29.el7_8.2
changelog:
  - don't update transmission time on invalid response (CVE-2020-11868)
  - randomize transmit timestamp in client requests (CVE-?, #1813787)


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Ade Lee <alee@redhat.com> 1.0.2-1
changelog:
  - Allow passwords to be retrieved post-init phase
  - Fix null termination issue on returned stored passwords


author: Dogtag Team <pki-devel@redhat.com> 1.0.5-1
changelog:
  - Resolves: rhbz #1509040 - nuxwdog spec file has outdated
    source for tarballs (dmoluguw)
  - Rebase to upstream nuxwdog 1.0.5-1


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22
changelog:
  - Update to last 4.01 version from OCaml git.
  - Fix bug in argument parsing
    resolves: rhbz#1139803


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22.2
changelog:
  - Use -fno-strict-aliasing when building the compiler
  - ppc, ppc64, ppc64le: Mark stack as non-executable.
    resolves: rhbz#990521
  - Provides ocaml(runtime) 4.01.1.
    related: rhbz#1098459


author: Richard W.M. Jones <rjones@redhat.com> - 4.05.0-4
changelog:
  - Rebase to 4.05.0 (same as Fedora Rawhide).
  - Adds support for POWER, z/VM.
  - Improves support for aarch64.
    resolves: rhbz#1447988


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.0-2
changelog:
  - ovt-Enable-cloud-init-by-default-to-change-the-systemd-u.patch [bz#1662278]
  - ovt-Fix-RELRO-flag.patch [bz#1678576]
  - Resolves: bz#1662278
    ([ESXi][RHEL7.7]Enable cloud-init by default to change the systemd unit file vmtoolsd.service)
  - Resolves: bz#1678576
    ([ESXi][RHEL7.6] Several files lost Full RELRO)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.10-1
changelog:
  - Rebase to 10.3.10 [bz#1725187]
  - Resolves: bz#1725187
    ([ESXi][RHEL7.8 ]Rebase open-vm-tools to 10.3.10)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.10-2
changelog:
  - ovt-Fix-memory-leaks-in-vix-tools-plugin.patch [bz#1760625]
  - ovt-End-VGAuth-impersonation-in-the-case-of-error.patch [bz#1760625]
  - ovt-Fix-leaks-in-ListAliases-and-ListMappedAliases-9bc72.patch [bz#1760625]
  - Resolves: bz#1760625
    ([ESXi][RHEL7.8]Need to backport some severe memory leak fixes from upstream)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-1
changelog:
  - Rebase to 11.0.5 [bz#1806675]
  - Resolves: bz#1806675
   ([ESXi][RHEL7.9]Rebase open-vm-tools to 11.0.5 for RHEL 7.9)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-2.el7
changelog:
  - ovt-Fix-ldconfig-call.patch [bz#1815549]
  - ovt-add-appinfo-plugin.patch [bz#1809753]
  - Resolves: bz#1809753
    ([ESXi][RHEL7.9]open-vm-tools add appinfo plugin patch)
  - Resolves: bz#1815549
    ([ESXi][RHEL7.9]open-vm-tools reports line 1: ?ldconfig: command not found during system installation)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7
changelog:
  - ovt-Fix-a-trivial-memory-leak-in-namespacetool.c.patch [bz#1818109]
  - ovt-Update-copyright-to-reflect-previous-change.patch [bz#1818109]
  - Resolves: bz#1818109
    ([ESXi][RHEL7.9]open-vm-tools coverity scan issue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.1
changelog:
  - ovt-Updated-PAM-configuration-file-to-follow-configured-.patch [bz#1840309]
  - Resolves: bz#1840309
    ([ESXi][RHEL7]vmtoolsd authentication issues with ActiveDirectory (AD) [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.2
changelog:
  - ovt-Rectify-a-log-spew-in-vmsvc-logging-vmware-vmsvc-roo.patch [bz#1911853]
  - Resolves: bz#1911853
    ([ESXi][RHEL7.9][ warning] [guestinfo] GuestInfoGetDiskDevice: Missing disk device name; VMDK mapping unavailable for "/", fsName: "/dev/sda2")


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.3
changelog:
  - ovt-Fix-memory-leaks-in-guestInfo-diskInfo.c.patch [bz#1937420]
  - Resolves: bz#1937420
    ([ESXi][RHEL7.9] Memory leak in vmtoolsd when disable-query-diskinfo is set to false [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.4
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119310]
  - Resolves: bz#2119310
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-7.9.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.5
changelog:
  - ovt-Track-Linux-filesystem-id-FSID-for-quiesced-frozen-f.patch [bz#1880404 bz#1994590]
  - Resolves: bz#1880404
    ([ESXi] [RHEL7] vmtoolsd task is blocked in the uninterruptible state while attempting to delete (unlink) the file 'quiesce_manifest.xml')
  - Resolves: bz#1994590
    ([ESXi][RHEL7.9][open-vm-tools] Snapshot of the RHEL7 guest on the VMWare ESXi hypervisor failed vm hangs)


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.6
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2215562]
  - Resolves: bz#2215562
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.7
changelog:
  - ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [RHEL-2413]
  - Resolves: RHEL-2413
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.8
changelog:
  - ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [bz#2226921]
  - Resolves: bz#2226921
    ([RHEL7.9][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.9
changelog:
  - ovt-Don-t-accept-tokens-with-unrelated-certs.patch [RHEL-14642]
  - ovt-File-descriptor-vulnerability-in-the-open-vm-tools-v.patch [RHEL-14676]
  - Resolves: RHEL-14642
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-7.9.z])
  - Resolves: RHEL-14676
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-7.9.z])


author: Than Ngo <than@redhat.com> - 3.11.0-1
changelog:
  - Resolves: #1063763 - opencryptoki tools should inform the user that he is not in pkcs11 group 
  - Resolves: #1641027 - enhanced IBM z14 functions
  - Resolves: #1641026 - support m_*Single functions from ep11 lib
  - Resolves: #1641025 - rebase to 3.11.0
  - Resolves: #1519386 - use CPACF hashes in ep11 token
  - Resolves: #1373833 - lock file directory is %ghost now


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
  - Resolves: #1688891 - C_EncryptInit fails with CKR_KEY_TYPE_INCONSISTENT. on ep11 token when using imported RSA public key


author: Nicolas Chauvet <kwizart@gmail.com> - 2.4.4-0.1.beta
changelog:
  - Update to 2.4.4 beta
  - Drop python-imaging also from requires
  - Drop merged patch for additionals codecs
  - Disable the java binding for now (untested)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
  - MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
  - MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
  - MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-17
changelog:
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1575549)
  - Reset OPTIND in libexec/functions for getopts to work in subsequent calls (#1564382)
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1543451)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-18
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1543955)
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1471039)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
  - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
  - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
  - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-6.20170227git
changelog:
  - Use label from certificate DN if there is none (#1448555)
  - Use Cardholder name in the token label (#1449740)
  - Avoid infinite loop when reading CAC cards (#1473335)
  - Workaround for CAC Alt tokens (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-8.20170227git
changelog:
  - Copy labels from certificate (#1448555)
  - Avoid infinite loop in CAC driver when reading non-CAC cards (#1473335)
  - Properly parse Simple TLV structures in CAC driver (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-9.20170227git
changelog:
  - make ECPoint behavior standards compliant by default (#1562572)
  - allow mechanism to be specified in hexadecimal (#1562572)
  - Disable pinpad by default (#1547117, #1547744)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
  - Rebase to new upstream release (#1656791)
    - Add Support for HID Crescendo 144K (#1612372)
    - Add Support for CAC Alt tokens (#1645581)
    - Fix usage detection from certificates (#1672898)
    - Fix security issues:
      - CVE-2018-16391
      - CVE-2018-16392
      - CVE-2018-16393
      - CVE-2018-16418
      - CVE-2018-16419
      - CVE-2018-16420
      - CVE-2018-16421
      - CVE-2018-16422
      - CVE-2018-16423
      - CVE-2018-16426
      - CVE-2018-16427


author: Matěj Týč <matyc@redhat.com> - 1.2.17-6
changelog:
  - Enabled the virtual '(all)' profile support for the scanner (RHBZ#1769272).
  - Enabled the '(all)' profile support for oscap-ssh (RHBZ#1769272).


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
  - Fix segfault in systemdunitdependency probe (RHBZ#1478285)
  - Build and ship HTML manual (RHBZ#1465661)
  - Fix oscap-ssh with --sudo (RHBZ#1803114)
  - Change category of verbose message (RHBZ#1640522)
  - Fix segfault in CVRF module (RHBZ#1642283)


author: Marcus Burghardt <maburgha@redhat.com> - 1.2.17-14
changelog:
  - Fix memory leaks in probe-api (RHBZ#1861793)
  - Prevent duplicate variables in Ansible Playbooks (RHBZ#1944683)
  - Fix trailing whitespace in Ansible Playbooks
  - Fix inconsistent result from security_patches_up_to_date (RHBZ#1858502)
  - Fix multiple segfaults and broken test (RHBZ#1911999)
  - Improve --stig-viewer output when there is no 1:1 connection between rules
  - Lower memory limits and improve their checking (RHBZ#1932833)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
  - invalidate supplemental group cache used by temporarily_use_uid()
    when the target uid differs (#1583735)


author: xiaodong yang <xiaodong.yang@cs2c.com.cn> -7.4p1-21+0.10.3-2.01
changelog:
  - Fix fo CVE-20085161
  - Fix for CVE-2019-6111、CVE-2019-6110、CVE-2019-6109
  - add Patch10000, reset SSH_VERSION


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: like <like@kylinos.cn> 1.0.2k-21.ns7.01
changelog:
  - Add patch openssl-1.0.2k-neokylin-add-gmAlg.patch
  - - import patch1001 and modify spec from 1.0.2k-19.ns7.02:
  - - Add China cryptographic algorithm SM2 SM3 SMS4
  - Add patch openssl-1.0.2k-neokylin-fix-CVE-2020-1968.patch


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: like <like@kylinos.cn> 1.0.2k-25.ns7.01
changelog:
  - Add patch openssl-1.0.2k-neokylin-add-gmAlg.patch
  - - import patch1001 and modify spec from 1.0.2k-19.ns7.02:
  - - Add China cryptographic algorithm SM2 SM3 SMS4
  - Add patch openssl-1.0.2k-neokylin-fix-CVE-2020-1968.patch
  - Add patch Patch1003: CVE-2022-1292.patch


author: liudingyao <liudingyao@kylinos.cn> 1.0.2k-26.ns7.01
changelog:
  - Type:update
  - ID:NA
  - SUG:NA
  - DESC: Add patch openssl-1.0.2k-neokylin-add-gmAlg.patch
    import patch1001 and modify spec from 1.0.2k-19.ns7.02:
    Add China cryptographic algorithm SM2 SM3 SMS4
    Add patch openssl-1.0.2k-neokylin-fix-CVE-2020-1968.patch
    Add patch Patch1003: CVE-2022-1292.patch
    Disabled test


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-3
changelog:
  - Support more than 64KB of fence agent output
  - Avoid unnecessary recovery of group member
  - Improve IPC clients' authentication of servers (CVE-2018-16877)
  - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
  - Fix use-after-free with potential information disclosure (CVE-2019-3885)
  - Resolves: rhbz#1549366
  - Resolves: rhbz#1609453
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-4
changelog:
  - Update security patches
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-1
changelog:
  - Recover from quiesced DC disk
  - Avoid timeouts and excessive stonithd CPU usage at start-up in large clusters
  - Default serialized order constraints to symmetrical=false
  - Avoid fence loops due to incorrect Pacemaker Remote ordering
  - Default concurrent-fencing to true
  - Harden GnuTLS priorities
  - Rebase on upstream 1.1.21 final version
  - Resolves: rhbz#1596125
  - Resolves: rhbz#1625671
  - Resolves: rhbz#1672225
  - Resolves: rhbz#1704870
  - Resolves: rhbz#1710422
  - Resolves: rhbz#1727280
  - Resolves: rhbz#1731189


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-3
changelog:
  - Avoid invalid transition when guest node's host is unclean but can't be fenced
  - Resolves: rhbz#1755659


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


