# changelog

author: Jorge San Emeterio <jsanemet@redhat.com> - 2:2.1-73.24
changelog:
  - Add a caveat to provide ability to persistently disable SPR-EE updates
    beyond 0x2b0005c0 on systems where absence of latency spikes
    is more important than lack of the latest CVE mitigations.
  - Update Intel CPU microcode to microcode-20250512 release, addresses
    CVE-2024-28956:
    - Addition of 06-8f-04/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-06/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision
      0xa0000d1;
    - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision
      0x10003a2;
    - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa;
    - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) at revision 0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in
      intel-ucode/06-c6-02) at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision
      0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xfc up to 0x100;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up
      to 0x104;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003707 up to 0x5003901;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904
      up to 0x7002b01;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5
      up to 0xd000404;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0
      up to 0x10002d0;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up
      to 0x26;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6
      up to 0xca;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up
      to 0x3c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up
      to 0x56;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to
      0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38
      up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x436 up to 0x437;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x436 up to 0x437;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x436 up to 0x437;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up
      to 0xa;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436
      up to 0x437;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up
      to 0x100;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe
      up to 0x102;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up
      to 0x64;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20
      up to 0x24;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330
      up to 0x3000341;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up
      to 0x12f;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12c up to 0x12f;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124
      up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up
      to 0x1d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291
      up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291
      up to 0x210002a9;


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.7-21
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: John Dennis <jdennis@redhat.com> - 0.13.1-2
changelog:
  - Resolves: rhbz#1481330 Add diagnostic logging
  - Resolves: rhbz#1295472 Add MellonSignatureMethod config option to set
    signature method used to sign SAML messages sent by Mellon.
    Defaults to original sha1.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-3
changelog:
  - Resolves: rhbz#1652980 - mod_auth_mellon Cert files name wrong when
                             hostname contains a number


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-4
changelog:
  - Resolves: rhbz#1576719 - ECP flow not triggering, instead client access
                             secured resources without ECP authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-5
changelog:
  - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
changelog:
  - Apply the patch from the previous commit
  - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
changelog:
  - Resolves: rhbz#1727789 - mod_auth_mellon fix for AJAX header name
                             X-Requested-With


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-8
changelog:
  - Resolves: rhbz#1731052 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via
                             the login?ReturnTo= substring which could facilitate
                             information theft [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-9
changelog:
  - Resolves: rhbz#1791264 - Backport SameSite=None cookie from upstream to
                             support latest browsers


author: John Dennis <jdennis@redhat.com> - 1.8.8-3
changelog:
  - fix unit test failure caused by apr_jwe_decrypt_content_aesgcm()
    failing to null terminate decrypted string
    Resolves: bug#1292561 New package: mod_auth_openidc


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-4
changelog:
  - Resolves: rhbz#1626299 - CVE-2017-6059 mod_auth_openidc: Shows
                             user-supplied content on error pages [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
changelog:
  - Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
                             OIDCAuthNHeader not skipped in an "AuthType oauth20"
                             configuration [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
changelog:
  - Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                             issue exists in URLs with slash and backslash [rhel-7]
  - Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
                             in logout url when using URLs with leading slashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
changelog:
  - Fix a regression in the previous patches
  - Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                            issue exists in URLs with slash and backslash [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-8
changelog:
  - Resolves: rhbz#1823762 - Backport SameSite=None cookie from
                             mod_auth_openidc upstream to support
                             latest browsers [rhel-7.9.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-9
changelog:
  - Rebuild to pick up the proper build tag
  - Related: rhbz#1823762 - Backport SameSite=None cookie from
                            mod_auth_openidc upstream to support
                            latest browsers [rhel-7.9.z]


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-9.el7
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs when
    mok-variables aren't present.
    Resolves: rhbz#1868820


author: openEuler Buildteam <buildteam@openeuler.org> - 6.1-12
changelog:
  - Type:cves
  - ID:CVE-2019-17594  CVE-2019-17595
  - SUG:NA
  - DESC:fix CVE-2019-17594 and CVE-2019-17595


author: liutao <liutao1@kylinos.cn> - 6.1-14.el7.01
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:unpack static subpackage corresponding to version 5.9-14.20130511.el7_4


author: liutao <liutao1@kylinos.cn> - 6.1-14.el7.02
changelog:
  - Type:enhancement
  - ID:NA
  - SUG:NA
  - DESC:unpack static subpackage corresponding to version 5.9-14.20130511.el7_4
  - Add Obsoletes:     ncurses < 6.1-14.el7.02


author: Ray Strode <rstrode@redhat.com> 70.0.3-1
changelog:
  - Shrink supplemental backgrounds by making them jpegs instead
    of pngs.
    Related: #1053025 1065938


author: guochao <guochao@kylinos.cn> - 0.7.1-1.02
changelog:
  - Type:bugfix
  - ID:[BUG#194107]
  - SUG:NA
  - DESC:Add patch neokylin-logos-70.7.0-neokylin-COPYINGfix.patch


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-44
changelog:
  - add support for glusterfs (#1316386)
  - change services to start after network-online.target (#1388118)
  - fix interface fadeout configuration (#1547355)
  - fix scanf pattern for ICMP stats (#1693547)
  - change buffer size in pass_common.c file (#1695363 and #1731357)
  - remove initial whitespace reading from scanf pattern of /sys/dev/block/../stat file (#1700494)
  - fix for CVE-2018-18066 (#1638911)
  - add Counter64 support for UCD-SNMP-MIB (#1703752)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
  - add missing part of memory leak patch (#1794168)
  - fix if_inet6 messages floood (#1765449)
  - revert bz#1486733 (#1771050)
  - fix issue for process status when process name contains whitespace (#1782180)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.18.20131004git
changelog:
  - Resolves: #1063913 - netstat doesn't list sctp servers in -A mode
  - Resolves: #1257549 - netstat tool does not throw correct exit code on wrong parameter
  - Resolves: #1392910 - ifconfig inaccurately rounds exabytes


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.25.20131004git
changelog:
  - Resolves: #1632905 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.63
changelog:
  - nfs.conf: Fixed manage-gids option typo (bz 1677403)
  - sm-notify: Added -f flag to nfs.conf parsing (bz 1688932)
  - Add nfs.conf equivalent for the statd --no-notify cmdline option (bz 1688918)
  - nfs-server: Use reload not restart to start gssproxy (bz 1644169)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.67
changelog:
  - rpc.gssd: removed a number memory leaks (bz 1807110)
  - mount: Report correct error in the fall_back cases (bz 1752329)
  - gssd: daemonize earlier (bz 1645083)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-5
changelog:
  - Fix pkix name constraints processing to only process the common name if the
    certusage you are checking is IPSEC or SSL Server.


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-8
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
  - Explicitly enable upgradedb/sharedb test cycles


author: xiehongyu<xiehongyu@kylinos.cn> - 3.53.1-3.ns7.01
changelog:
  - Add modify at check ,fix failed:SSL_ERROR_BAD_CERT_ALERT: SSL peer cannot verify your certificate.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - revert sql default language in man pages
  - fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Like<like@kylinos.cn> - 3.90.0-2.ns7.01
changelog:
  - Type: bugfix
  - ID: NA
  - SUG: NA
  - DESC: modify at check ,fix failed:SSL_ERROR_BAD_CERT_ALERT: SSL peer cannot verify your certificate.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-3
changelog:
  - include patches for CVE-2020-6829, CVE-2020-12400,
    and CVE-2020-12401 from upstream (ECC constant time issues).
  - include patches for CVE-2020-12403 from upstream
    (CHACHA issues).
  - include self-tests for kdfs and cmac.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn off ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - Include softoken specific patches required by the NSS 3.67
    release including:
  -  sdb timeout fixes.
  -  coverity patch.
  -  fixing private key macing


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
  - Rebase to NSS 3.79.
  - add reader/writer lock on encrypted attribute access
  - skip attribute verification on attributes with default values
  - don't export trust objects if they are default trust objects from dbm


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-26
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29.el7_8.2
changelog:
  - don't update transmission time on invalid response (CVE-2020-11868)
  - randomize transmit timestamp in client requests (CVE-?, #1813787)


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Ade Lee <alee@redhat.com> 1.0.2-1
changelog:
  - Allow passwords to be retrieved post-init phase
  - Fix null termination issue on returned stored passwords


author: Dogtag Team <pki-devel@redhat.com> 1.0.5-1
changelog:
  - Resolves: rhbz #1509040 - nuxwdog spec file has outdated
    source for tarballs (dmoluguw)
  - Rebase to upstream nuxwdog 1.0.5-1


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22
changelog:
  - Update to last 4.01 version from OCaml git.
  - Fix bug in argument parsing
    resolves: rhbz#1139803


author: Richard W.M. Jones <rjones@redhat.com> - 4.01.0-22.2
changelog:
  - Use -fno-strict-aliasing when building the compiler
  - ppc, ppc64, ppc64le: Mark stack as non-executable.
    resolves: rhbz#990521
  - Provides ocaml(runtime) 4.01.1.
    related: rhbz#1098459


author: Richard W.M. Jones <rjones@redhat.com> - 4.05.0-4
changelog:
  - Rebase to 4.05.0 (same as Fedora Rawhide).
  - Adds support for POWER, z/VM.
  - Improves support for aarch64.
    resolves: rhbz#1447988


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.0-2
changelog:
  - ovt-Enable-cloud-init-by-default-to-change-the-systemd-u.patch [bz#1662278]
  - ovt-Fix-RELRO-flag.patch [bz#1678576]
  - Resolves: bz#1662278
    ([ESXi][RHEL7.7]Enable cloud-init by default to change the systemd unit file vmtoolsd.service)
  - Resolves: bz#1678576
    ([ESXi][RHEL7.6] Several files lost Full RELRO)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.10-1
changelog:
  - Rebase to 10.3.10 [bz#1725187]
  - Resolves: bz#1725187
    ([ESXi][RHEL7.8 ]Rebase open-vm-tools to 10.3.10)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.10-2
changelog:
  - ovt-Fix-memory-leaks-in-vix-tools-plugin.patch [bz#1760625]
  - ovt-End-VGAuth-impersonation-in-the-case-of-error.patch [bz#1760625]
  - ovt-Fix-leaks-in-ListAliases-and-ListMappedAliases-9bc72.patch [bz#1760625]
  - Resolves: bz#1760625
    ([ESXi][RHEL7.8]Need to backport some severe memory leak fixes from upstream)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-1
changelog:
  - Rebase to 11.0.5 [bz#1806675]
  - Resolves: bz#1806675
   ([ESXi][RHEL7.9]Rebase open-vm-tools to 11.0.5 for RHEL 7.9)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-2.el7
changelog:
  - ovt-Fix-ldconfig-call.patch [bz#1815549]
  - ovt-add-appinfo-plugin.patch [bz#1809753]
  - Resolves: bz#1809753
    ([ESXi][RHEL7.9]open-vm-tools add appinfo plugin patch)
  - Resolves: bz#1815549
    ([ESXi][RHEL7.9]open-vm-tools reports line 1: ?ldconfig: command not found during system installation)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7
changelog:
  - ovt-Fix-a-trivial-memory-leak-in-namespacetool.c.patch [bz#1818109]
  - ovt-Update-copyright-to-reflect-previous-change.patch [bz#1818109]
  - Resolves: bz#1818109
    ([ESXi][RHEL7.9]open-vm-tools coverity scan issue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.1
changelog:
  - ovt-Updated-PAM-configuration-file-to-follow-configured-.patch [bz#1840309]
  - Resolves: bz#1840309
    ([ESXi][RHEL7]vmtoolsd authentication issues with ActiveDirectory (AD) [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.2
changelog:
  - ovt-Rectify-a-log-spew-in-vmsvc-logging-vmware-vmsvc-roo.patch [bz#1911853]
  - Resolves: bz#1911853
    ([ESXi][RHEL7.9][ warning] [guestinfo] GuestInfoGetDiskDevice: Missing disk device name; VMDK mapping unavailable for "/", fsName: "/dev/sda2")


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.3
changelog:
  - ovt-Fix-memory-leaks-in-guestInfo-diskInfo.c.patch [bz#1937420]
  - Resolves: bz#1937420
    ([ESXi][RHEL7.9] Memory leak in vmtoolsd when disable-query-diskinfo is set to false [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.4
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119310]
  - Resolves: bz#2119310
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-7.9.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.5
changelog:
  - ovt-Track-Linux-filesystem-id-FSID-for-quiesced-frozen-f.patch [bz#1880404 bz#1994590]
  - Resolves: bz#1880404
    ([ESXi] [RHEL7] vmtoolsd task is blocked in the uninterruptible state while attempting to delete (unlink) the file 'quiesce_manifest.xml')
  - Resolves: bz#1994590
    ([ESXi][RHEL7.9][open-vm-tools] Snapshot of the RHEL7 guest on the VMWare ESXi hypervisor failed vm hangs)


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.6
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2215562]
  - Resolves: bz#2215562
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.7
changelog:
  - ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [RHEL-2413]
  - Resolves: RHEL-2413
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.8
changelog:
  - ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [bz#2226921]
  - Resolves: bz#2226921
    ([RHEL7.9][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.9
changelog:
  - ovt-Don-t-accept-tokens-with-unrelated-certs.patch [RHEL-14642]
  - ovt-File-descriptor-vulnerability-in-the-open-vm-tools-v.patch [RHEL-14676]
  - Resolves: RHEL-14642
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-7.9.z])
  - Resolves: RHEL-14676
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-7.9.z])


author: Than Ngo <than@redhat.com> - 3.11.0-1
changelog:
  - Resolves: #1063763 - opencryptoki tools should inform the user that he is not in pkcs11 group 
  - Resolves: #1641027 - enhanced IBM z14 functions
  - Resolves: #1641026 - support m_*Single functions from ep11 lib
  - Resolves: #1641025 - rebase to 3.11.0
  - Resolves: #1519386 - use CPACF hashes in ep11 token
  - Resolves: #1373833 - lock file directory is %ghost now


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
  - Resolves: #1688891 - C_EncryptInit fails with CKR_KEY_TYPE_INCONSISTENT. on ep11 token when using imported RSA public key


author: Nicolas Chauvet <kwizart@gmail.com> - 2.4.4-0.1.beta
changelog:
  - Update to 2.4.4 beta
  - Drop python-imaging also from requires
  - Drop merged patch for additionals codecs
  - Disable the java binding for now (untested)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
  - MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
  - MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
  - MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-17
changelog:
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1575549)
  - Reset OPTIND in libexec/functions for getopts to work in subsequent calls (#1564382)
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1543451)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-18
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1543955)
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1471039)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
  - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
  - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
  - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-6.20170227git
changelog:
  - Use label from certificate DN if there is none (#1448555)
  - Use Cardholder name in the token label (#1449740)
  - Avoid infinite loop when reading CAC cards (#1473335)
  - Workaround for CAC Alt tokens (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-8.20170227git
changelog:
  - Copy labels from certificate (#1448555)
  - Avoid infinite loop in CAC driver when reading non-CAC cards (#1473335)
  - Properly parse Simple TLV structures in CAC driver (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-9.20170227git
changelog:
  - make ECPoint behavior standards compliant by default (#1562572)
  - allow mechanism to be specified in hexadecimal (#1562572)
  - Disable pinpad by default (#1547117, #1547744)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
  - Rebase to new upstream release (#1656791)
    - Add Support for HID Crescendo 144K (#1612372)
    - Add Support for CAC Alt tokens (#1645581)
    - Fix usage detection from certificates (#1672898)
    - Fix security issues:
      - CVE-2018-16391
      - CVE-2018-16392
      - CVE-2018-16393
      - CVE-2018-16418
      - CVE-2018-16419
      - CVE-2018-16420
      - CVE-2018-16421
      - CVE-2018-16422
      - CVE-2018-16423
      - CVE-2018-16426
      - CVE-2018-16427


author: Matěj Týč <matyc@redhat.com> - 1.2.17-6
changelog:
  - Enabled the virtual '(all)' profile support for the scanner (RHBZ#1769272).
  - Enabled the '(all)' profile support for oscap-ssh (RHBZ#1769272).


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
  - Fix segfault in systemdunitdependency probe (RHBZ#1478285)
  - Build and ship HTML manual (RHBZ#1465661)
  - Fix oscap-ssh with --sudo (RHBZ#1803114)
  - Change category of verbose message (RHBZ#1640522)
  - Fix segfault in CVRF module (RHBZ#1642283)


author: Marcus Burghardt <maburgha@redhat.com> - 1.2.17-14
changelog:
  - Fix memory leaks in probe-api (RHBZ#1861793)
  - Prevent duplicate variables in Ansible Playbooks (RHBZ#1944683)
  - Fix trailing whitespace in Ansible Playbooks
  - Fix inconsistent result from security_patches_up_to_date (RHBZ#1858502)
  - Fix multiple segfaults and broken test (RHBZ#1911999)
  - Improve --stig-viewer output when there is no 1:1 connection between rules
  - Lower memory limits and improve their checking (RHBZ#1932833)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
  - invalidate supplemental group cache used by temporarily_use_uid()
    when the target uid differs (#1583735)


author: xiaodong yang <xiaodong.yang@cs2c.com.cn> -7.4p1-21+0.10.3-2.01
changelog:
  - Fix fo CVE-20085161
  - Fix for CVE-2019-6111、CVE-2019-6110、CVE-2019-6109
  - add Patch10000, reset SSH_VERSION


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: like <like@kylinos.cn> 1.0.2k-21.ns7.01
changelog:
  - Add patch openssl-1.0.2k-neokylin-add-gmAlg.patch
  - - import patch1001 and modify spec from 1.0.2k-19.ns7.02:
  - - Add China cryptographic algorithm SM2 SM3 SMS4
  - Add patch openssl-1.0.2k-neokylin-fix-CVE-2020-1968.patch


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: like <like@kylinos.cn> 1.0.2k-25.ns7.01
changelog:
  - Add patch openssl-1.0.2k-neokylin-add-gmAlg.patch
  - - import patch1001 and modify spec from 1.0.2k-19.ns7.02:
  - - Add China cryptographic algorithm SM2 SM3 SMS4
  - Add patch openssl-1.0.2k-neokylin-fix-CVE-2020-1968.patch
  - Add patch Patch1003: CVE-2022-1292.patch


author: liudingyao <liudingyao@kylinos.cn> 1.0.2k-26.ns7.01
changelog:
  - Type:update
  - ID:NA
  - SUG:NA
  - DESC: Add patch openssl-1.0.2k-neokylin-add-gmAlg.patch
    import patch1001 and modify spec from 1.0.2k-19.ns7.02:
    Add China cryptographic algorithm SM2 SM3 SMS4
    Add patch openssl-1.0.2k-neokylin-fix-CVE-2020-1968.patch
    Add patch Patch1003: CVE-2022-1292.patch
    Disabled test


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-1
changelog:
  - Resolves: rhbz#1737367 - Update to latest upstream release
  - Resolves: rhbz#1737369 - Add 7.8 to the osinfo-db which will be used on 7.8


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-2
changelog:
  - Resolves: rhbz#1750807 - Fedora/RHEL/CentOS JeOS kickstart files for
                             unattended installation are broken


author: Fabiano Fidêncio <fidencio@redhat.com< - 20200529-1
changelog:
  - Resolves: rhbz#1839905 - [RHEL7.9] "virt-install --os-variant rhel7.9"i
                             fails with error
  - Resolves: rhbz##1840085 - Rebase to the latest upstream release


author: xiaoyuliang <xiaoyuliang@kylinos.cn> - 20200529-1
changelog:
  - Add Patch0002-Patch0004 from osinfo-db-20200203-1.p03.kylin from koji 238
  - Change osinfo-db-20200529-neokylin-and-kylin-release.patch
  - Add a neokylin-7.9.xml in /usr/share/osinfo/os/cs2c.com.cn/ to detect ns-7.9 or nsKylin-7.9
  - Resolves: http://172.17.50.104/biz/bug-view-44149.html


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-3
changelog:
  - Support more than 64KB of fence agent output
  - Avoid unnecessary recovery of group member
  - Improve IPC clients' authentication of servers (CVE-2018-16877)
  - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
  - Fix use-after-free with potential information disclosure (CVE-2019-3885)
  - Resolves: rhbz#1549366
  - Resolves: rhbz#1609453
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-4
changelog:
  - Update security patches
  - Resolves: rhbz#1694556
  - Resolves: rhbz#1694559
  - Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-1
changelog:
  - Recover from quiesced DC disk
  - Avoid timeouts and excessive stonithd CPU usage at start-up in large clusters
  - Default serialized order constraints to symmetrical=false
  - Avoid fence loops due to incorrect Pacemaker Remote ordering
  - Default concurrent-fencing to true
  - Harden GnuTLS priorities
  - Rebase on upstream 1.1.21 final version
  - Resolves: rhbz#1596125
  - Resolves: rhbz#1625671
  - Resolves: rhbz#1672225
  - Resolves: rhbz#1704870
  - Resolves: rhbz#1710422
  - Resolves: rhbz#1727280
  - Resolves: rhbz#1731189


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-3
changelog:
  - Avoid invalid transition when guest node's host is unclean but can't be fenced
  - Resolves: rhbz#1755659


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
  - Improve help for clean-up option
  - Avoid pending DC fencing getting "stuck" in status display
  - Rebase on upstream 1.1.23-rc1
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1787749
  - Resolves: rhbz#1792492


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-14
changelog:
  - pam_unix: add no_pass_expiry option for ignoring password
    expiration in crond and sshd with public key authentication
  - add manual page for environment(5) (#1110257)
  - pam_loginuid: log if auditd not detected
  - always ignore audit error when -EPERM is returned (#1287800)
  - pam_lastlog: fix possible NULL dereference when localtime fails (#1313537)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-19
changelog:
  - pam_access: (group) match syntax is prioritized over network@netgroup
    match (#1358881), add support for additional /etc/security/access.d/*.conf
    files, improve documentation (#1421735)
  - pam_lastlog: fix pt_BR translation (#1185697)
  - pam_faillock: support admin_group with users equivalent to root in
    faillock handling (#1285550)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-23
changelog:
  - pam_get_authtok_verify: ensure no double verification happens
  - manual page fixes for pam_tty_audit and pam_wheel
  - pam_unix: lower the excessive maximum number of closed fd descriptors
    when spawning handlers
  - pam_loginuid: do not prevent login in unprivileged containers


author: Masahiro Matsuya <mmatsuya@redhat.com> 1.1.8-23.2
changelog:
  - pam: Incomplete fix for CVE-2025-6020 [rhel-7-els]
    pam_namespace: fix potential privilege escalation
    Resolves: CVE-2025-8941 and RHEL-109053


author: Nathan Scott <nathans@redhat.com> - 4.3.2-1
changelog:
  - Numerous fixes in pmlogger daily scripts (BZs 1677848, 1697182, 1579881, 1603143)
  - Update PCP selinux policy rules (BZs 1692305, 1695066)
  - Adjust spec file /var/run/pcp settings (BZ 1533154)
  - Fix pmdaproc kernel process misreporting (BZ 1673250)
  - Fix pmdalinux SYSV IPC metric scalability (BZ 1699232)
  - Ensure pmdaroot reaps all of its children (BZ 1698517)
  - Corrections to python version dependencies (BZ 1676867)
  - Fix pcp-atopsar(1) -A (all) option handling (BZ 1673996)
  - Update to a more recent PCP bug fix release (BZ 1647308)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-2
changelog:
  - Rework the pcp-libs ldconfig post-op (BZ 1705362)
  - Resolve a QA file permissions diagnostic issue


author: Nathan Scott <nathans@redhat.com> - 4.3.2-4
changelog:
  - Fix a pmdaproc memory leak (BZ 1721107)
  - Rebuild with selinux runtime dependency update (BZ 1714101)
  - Update selinux-policy to latest upstream (BZs 1699830, 1700989)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
  - Fix hugepage metrics in pmdalinux (BZ 1730107)
  - Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
  - Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
  - Fix pcp-atopsar sample count command line argument (BZ 1764748)
  - Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
  - Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
  - Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
  - Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-13
changelog:
  - Fix pcp-atopsar memory allocation problem with some options (BZ 1857580)
  - Fix __pmGetArchiveEnd_ctx sigsegv with corrupt PCP archives (BZ 1878754)


author: Ivan Devat <idevat@redhat.com> - 0.9.168-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1730747 rhbz#1725849 rhbz#1551663 rhbz#1595444 rhbz#1671174 rhbz#1712315 rhbz#1619253 rhbz#1710750 rhbz#1466088 rhbz#1558063 rhbz#1665898 rhbz#1500012 rhbz#1673829


author: Ivan Devat <idevat@redhat.com> - 0.9.168-2
changelog:
  - Do not generate custom DH key if it was not requested by setting its custom length
  - Resolves: rhbz#1760434


author: Ivan Devat <idevat@redhat.com> - 0.9.168-3
changelog:
  - More fixes for the case when PATH environment variable is not set
  - Pcsd no longer sends Server HTTP header
  - Empty constraint option are not allowed in pcs constraint order and pcs constraint colocation add commands
  - Resolves: rhbz#1500012 rhbz#1765606 rhbz#1671174


author: Ondrej Mular <omular@redhat.com> - 0.9.168-4
changelog:
  - Added command 'pcs resource relations'
  - Added command 'pcs resource safe-disable'
  - Resolves: rhbz#1770975 rhbz#1770973


author: Ivan Devat <idevat@redhat.com> - 0.9.169-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1822078 rhbz#1759269 rhbz#1448569


author: Ivan Devat <idevat@redhat.com> - 0.9.169-2
changelog:
  - Keep autogenerated IDs of set constraints reasonably short
  - Use fixed version of python module subprocess (package python2-subprocess32)
  - Resolves: rhbz#1820813 rhbz#1824206


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3
changelog:
  - Added option: pcs resource [safe-]disable --simulate` has a new option `--brief` to print only a list of affected resources
  - Fixed race-condition when removing multiple resources from web UI
  - Resolves: rhbz#1833115 rhbz#1843593


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3.el7_3.1
changelog:
  - Explicitly close libcurl connections to prevent stalled TCP connections in CLOSE-WAIT state
  - Added support for loading DH keys from a file
  - Resolves: rhbz#1870551 rhbz#1888479


author: Ivan Devat <idevat@redhat.com> - 0.9.167-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1649732 rhbz#1554302 rhbz#1447349 rhbz#1647640 rhbz#1594738 rhbz#1676956 rhbz#1474747 rhbz#1679534 rhbz#1642514 rhbz#1389140 rhbz#1522858 rhbz#1676944 rhbz#1638376 rhbz#1515021 rhbz#1598197


author: Anuar Beisembayev <abeisemb@redhat.com> - 0.9.169-3.el7_9.5
changelog:
  - Fixed CVE-2025-61770, CVE-2025-61919, CVE-2025-61771 by updating bundled rubygem rack
    Resolves: RHEL-124931, RHEL-121029, RHEL-123669


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
  - Backported and sub-packaged libraries historically supplied with Perl 4
    into perl-Perl4-CoreLibs


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
  - Add SSL support to Net::SMTP (bug #1557574)
  - Do not overload ".." in Math::BigInt (bug #1497734)
  - Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Marcela Mašláňová <mmaslano@redhat.com> 0.33-1
changelog:
  - Specfile autogenerated by cpanspec 1.79.
  - apply patch to automatically create alias -> DP on Data::Peek


author: Paul Howarth <paul@city-fan.org> - 1.05-10
changelog:
  - Drop -tests subpackage (general lack of interest in this), but include
    them as documentation for the main package
  - Don't use macros for commands
  - No need to remove empty directories from buildroot
  - Add buildreqs for Perl core modules that might be dual-lived
  - Rename makefile patch to include module name and version
  - Fix script interpreter for test suite since we're packaging it
  - Add filter for doc-file dependencies if we don't have %perl_default_filter
  - Make %files list more explicit
  - Use tabs


author: Petr Šabata <contyk@redhat.com> - 1.05-26.2
changelog:
  - Fix the package for el7
  - Modernize the spec
  - Correct a bogus date in changelog
  - Unify spec whitespace


author: Remi Collet <remi@fedoraproject.org> 1:1.9.4-14
changelog:
  - add explicit requires on all needed extensions (phpci)
  - fix pecl launcher (need ini to be parsed for some
    extenstions going to be build as shared, mainly simplexml)
  - add fix for new unpack format (php 5.5)


author: Ville Skyttä <ville.skytta@iki.fi> - 2.2.5-1
changelog:
  - Update to 2.2.5.
  - Hardlink binaries instead of shipping duplicates (#785834).
  - Build with $RPM_LD_FLAGS.
  - Run test suite during build.


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-13
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base
    build (jmagne)
  - Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot
    be processed (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-14
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1911472 - Revoke via REST API not working when Agent
    certificate not issued by CA [rhel-7.9.z] (cfu)
  - Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version
    String.java.io.FileNotFoundException (ckelley)
  - Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching
    PIN_RESET=YES to NO [rhel-7.9.z] (jmagne)
  - Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA
    fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
    per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
    Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
    the CA is Down [cfu]
  - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
    Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 9):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-18
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 10):
  - ##########################################################################
  - Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward
    Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen)
  - Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could
    have been worked around after installation [RHEL 7.9.z] (cfu)
  - Bugzilla Bug 2016773 - Directory authentication plugin requires directory
    admin password just for user authentication (rhel-7.9.z)
    (awnuk@purestorage.com, jmagne)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-19
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 11):
  - ##########################################################################
  - Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu)
  - Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail
    in FIPS Mode (cfu)
  - Bugzilla Bug 2018608 - Invalid certificates with creation of subCA
    (pkispawn single step) [rhel-7.9.0.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-20
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 14):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-21
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 15):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-22
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-25
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #2160355 - RA Separation by KeyType - Set Token Status
    [RHCS 9.7 bu 21] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-26
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 22):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 22):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-27
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 23):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 23):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-28
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-29
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-30
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-31
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-32
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Tomas Orsava <torsava@redhat.com> - 4.5.1-7
changelog:
  - New subpackage platform-python-coverage without files from /usr/bin/*
  - python3-coverage contains only files from /usr/bin/* and depends
    on platform-python-coverage
  - Resolves: rhbz#1658674


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.3-1
changelog:
  - Update to upstream version 2.3
  - Use apache-commons-compress for bzip2 (de)compression
  - Resolves: CVE-2012-2098


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.4.2-2
changelog:
  - Update to latest packaging guidelines
  - Remove MIT license (only applies to test cases not binary rpm)


author: Like <like@kylinos.cn> -0:2.4.2-6.el7_9.ns7.01
changelog:
  - Type:compile
  - ID: NA
  - SUG:NA
  - DESC: add BuildRequires:  java-1.7.0-openjdk-devel fix builderror


author: caiyinan <caiyinan@kylinos.cn> -0.112-26.1.ns7.01
changelog:
  - fix chandao bug #97314 
  - add file:10-shutdown.rules to intsall path '/etc/polkit-1/rules.d/' to solve non-root user reboot system needs root authentication.


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Like <like@kylinos.cn> - 9.2.24-9.1.ns7.01
changelog:
  - Type: update
  - ID:	BUG#264475
  - SUG:	NA
  - DESC:	Modify Language. and buildrequires fix build error


author: Like <like@kylinos.cn> - 9.2.24-9.2.ns7.01
changelog:
  - Type: update
  - ID:	BUG#264475
  - SUG:	NA
  - DESC:	add patch fix Modify TW Language and buildrequires fix build error


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-4
changelog:
  - don't use removed macro %add_to_maven_depmap (#992816)
  - lint: trim-lines, reuse %{name} macro, fedora-review fixes
  - merge cleanup changes by Stano Ochotnicky


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-29
changelog:
  - make radius plugin config parser less strict
  - add creation of dip system group
  - resolves : #906913, #918296


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-30
changelog:
  - don't ship /var/lock/ppp in rpm payload and create it in %post instead
  - fix installation of tmpfiles.d configuration
  - enable hardened build
  - fix bogus dates in changelog
  - compile all binaries with hardening flags
  - fix possible NULL pointer dereferencing


author: Jeff Fearn <jfearn@redhat.com> 3.1.2-0
changelog:
  - Fix tests failing when publican not installed. BZ #908956
  - Fix broken mr-IN/Conventions.po. BZ #908956
  - Fix footnote link unclickable. BZ #909006
  - Fix missing translations for common files. BZ #908976
  - Fix using edition for version on cover pages. BZ #912180
  - Fix nested entities causing XML::TreeBuilder to fail. BZ #912187


author: Jeff Fearn <jfearn@redhat.com> 3.1.3-1
changelog:
  - Fix add_revision breaking XML parser. BZ #912985
  - Stronger fix for cover pages causing page number overrun. BZ #912967
  - Fix CSS for article front page subtile. BZ #913016


author: Jeff Fearn <jfearn@redhat.com> 3.1.4-0
changelog:
  - Fix entities in Book_Info braking build. BZ #917898
  - add translations of "Revision History". BZ #918365
  - Fix TOC title not translated in PDF. BZ #918365
  - Fix translated strings with parameters. BZ #891166
  - update translations
  - add it-IT translation of PUG via <fedora@marionline.it> BZ #797515


author: Jeff Fearn <jfearn@redhat.com> 3.2.0-0
changelog:
  - Add spaces to web-spec.xsl to work around newer libxml2 eating white space in spec files  BZ #982424
    - Fix typos in common content BZ #952490 #974918
    - Stop menu bouncing. BZ #953716
    - Fix ID missing from admonitions. BZ #966494
    - Support corpauthor for PDF. BZ #908666
    - Fix nested block tags breaking translation flow. BZ #909728
    - Fix multiple calls to update_po breaking packaging. BZ #891167
    - Add website labels and translations. BZ #979885
    - Add orgname to block/inline code. BZ #872955
    - Fix get_keywords not using correct info file. BZ #957956
    - Improve web print CSS. BZ #927513
    - Fix pre border in PDF. BZ #905752
    - Fix epub DOCTYPE. BZ #875129
    - Fix step first child style. BZ #971221
    - Fix long link word wrap in PDF. BZ #923481
    - Support case-insensitive "language" attribute. BZ #919474
    - Apply title style patch from Jaromir Hradilek. BZ #924518
    - Expose %book_ver_list to products/versions_index.tmpl. BZ #962643
    - Allow brands to ship web templates. Add site config toc_js. BZ #956935
    - Add pdftool option to build for pdf tool control. BZ #953728
    - Add default mapping for language to locale. BZ #844202
    - Fix ID missing from translated Revision History. BZ #911462
    - Add pub_dir option to override publish directory. BZ #830062
    - Removed show_unknown parameter and associated code. BZ #915428
    - Add img_dir parameter to override images directory. BZ #919481
    - Support all DocBook conditionals. BZ #919486
    - Flag spaces in product number as invalid. BZ #973895
    - Standardized prompts in commands. BZ #880456sources
    - Updated web_formats publican.cfg info BZ #839141
    - Replaced 'home page' with 'product or version page' BZ #921803
    - Replaced a broken link to CPAN with a working link BZ# 973461
    - Remove duplicate brand files from base install. BZ #966143
    - Add extras_dir parameter to override extras directory. BZ #953998
    - Fix PDF ignoring cover logo. BZ #974353
    - Add trans_drop action to freeze source language for translation. BZ #887707
    - Fix empty pot files not being deleted. BZ #961413
    - Fix long title layout on cover page in PDF. BZ #956934
    - Add Mac OS X Lion installation instructions. BZ# 979229
    - Add file handle limit workaround to FAQ BZ #952476
    - Support CDATA tags. BZ #958343
    - Fix UTF8 image names getting mangled in publish. BZ #953618
    - Add wkhtmltopdf_opts parameter to pass options to wkhtmltopdf. BZ #951290
    - Fix edition missing on PDF cover pages. BZ #956940
    - Support XML in add_revision member. BZ #862465
    - Fix duplicate footnotes in bibliography. BZ #653447
    - Fix Link from footlink to footlink-ref not working in PDF. BZ #909786
    - Fix TOC draft watermark in PDF. BZ #905271
    - Add common-db5 sub package. BZ #958495
    - Support decimals in colwidth & convert exact measures to pixels. BZ #913775
    - Tweak equation formatting. BZ #804531
    - Fix POT-Creation-Date format. BZ #985836
    - Fix site stats report swapping languages and products.
    - Fix web_dir not used for home page packages. BZ #988191
    - Updated web site instructions - BZ#979224


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: Wim Taymans <wtaymans@redhat.com> - 10.0-4
changelog:
  - Add support for usb audio in the Dell dock TB16
  - Add patches to improve default sinks
  - Resolves: #1457385


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.3.1-1
changelog:
  - Update to 2.3.1.
  - Re-enable some tests, ignore others.
  - Docs are available in English and Japanese now.


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.3.5-1
changelog:
  - Update to 2.3.5.
  - Docutils needed now to build README.html.
  - Add some BR optionally used by the testsuite.


author: Thomas Moschny <thomas.moschny@gmx.de> - 2.3.5-2
changelog:
  - Use python-sphinx for rhel > 6 (rhbz#973318).
  - Update BR to use python-pexpect instead of pexpect.


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: liudingyao<liudingyao@kylinos.cn> - 2.7.5-94.ns7.01
changelog:
  - Type: Tasks#196628
  - ID: NA
  - SUG: NA
  - DESC: add Patch1000: 01000-Kylin_recommend_2_socket_check.patch


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 2.0.0-2
changelog:
  - Use python2- prefix for Fedora dependencies if possible
  - Use parallel make to build documentation


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.0.0-3
changelog:
  - Remove examples-directory from Source tarball due to possible
    licensing issues
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511222


author: Ralph Bean <rbean@redhat.com> - 3.4.0.2-4
changelog:
  - Apply upstream patch to fix python namespace handling.
  - Narrow down directory ownership to just the ssl_match_hostname module.


author: Toshio Kuratomi <toshio@fedoraproject.org> - - 3.5.0.1-1
changelog:
  - New upstream release
  - Brings IP Address ServerAltName handling
  - Better fix for namespace issues that doesn't involve setuptools.


author: David Lehman <dlehman@redhat.com> - 0.61.15.68-1
changelog:
  - Catch lvm metadata lookup failure in md post create. (dlehman)
    Related: rhbz#1223564
    Resolves: rhbz#1543579


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
  - Deactivate incomplete VGs along with everything else. (dlehman)
    Resolves: rhbz#1554224
  - Work around udev timing issues. (dlehman)
    Resolves: rhbz#1592253
    Resolves: rhbz#1592191
  - nvdimm: don't crash on non-block devices (rvykydal)
    Related: rhbz#1280500
  - Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
    Related: rhbz#1558942
  - Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a function for identifying NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a singleton for NVDIMM namespaces management (vtrefny)
    Resolves: rhbz#1558942
  - Backport DependencyGuard from master (vtrefny)
    Related: rhbz#1558942
  - Ignore nvdimm devices unless configured in kickstart (rvykydal)
    Related: rhbz#1280500
  - Do not ignore nvdimm (pmemX) devices (rvykydal)
    Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
  - Remove dependency on libblockdev-nvdimm (vtrefny)
    Resolves: rhbz#1601557
  - Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
    Related: rhbz#1601557
  - Add version to the LUKS format (vtrefny)
    Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
  - Install ndctl when NVDIMMs are used. (dlehman)
    Related: rhbz#1600496
  - Escape dots in lvm filter devices (vtrefny)
    Resolves: rhbz#1614039


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.73-1
changelog:
  - Use --yes when calling pvresize (vtrefny)
    Related: rhbz#1657000
  - Fix typo in partitioning test cleanup. (dlehman)
    Related: rhbz#1657000
  - Remove selinux test that doesn't do anything meaningful. (dlehman)
    Related: rhbz#1657000
  - Improve parsing of mdadm detail output. (dlehman)
    Related: rhbz#1657000
  - Update btrfs tests to use sufficiently large loop devices. (dlehman)
    Related: rhbz#1657000
  - vfat labels apparently cannot contain lower case characters. (dlehman)
    Related: rhbz#1657000
  - Check label format regardless of mechanism used to set it. (dlehman)
    Related: rhbz#1657000
  - Adapt to presence or absence of python-mock. (dlehman)
    Related: rhbz#1657000
  - Fixed KS forcing zerombr onto RO disk (japokorn)
    Resolves: rhbz#1544425
  - Tell LVM to wipe cachepool metadata when attaching the cachepool (vtrefny)
    Resolves: rhbz#1643531
  - Add dependency on python-six (vtrefny)
    Resolves: rhbz#1647173


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: haoyawen <haoyawen@kylinos.cn> - 0.61.15.76-1.ns7.01
changelog:
  - add Patch11, support reading /etc/redhat-release.
  - add Patch10, rebranding for /etc/neokylin-release.


author: José Matos <jamatos@fedoraproject.org> - 3.5.0b2-0.2
changelog:
  - Improve description to make it clear that this package in only needed for python 2.7
  - Make the license tag information more explicit.


author: Avram Lubkin <aviso@fedoraproject.org> - 3.5.0b2-1
changelog:
  - Updated to build for el6
  - Updated to build Python3 packages
  - Changed Python2 package name to python2-configparser for Fedora 24+
  - Updated description
  - Removed license comments


author: Rahul Sundaram <sundaram@fedoraproject.org> - 1.5-1
changelog:
  - New upstream release
  - Fix UTF8 encoding correctly
  - Drop buildroot, clean, defattr and use macro for Source


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
  - Reverted flawed patch for #1051427 (this reintroduces #1052102).
  - Spec cleanup (removed rhel < 7 specific stuff).
  - Update to 2.7.2.
  Resolves: rhbz#1052777


author: Miro Hrončok <mhroncok@redhat.com> - 2.7.2-3
changelog:
  - Replace lambda for 'dict' with dict itself to support all dict constructors
  Resolves: rhbz#1697237


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.4.16-3
changelog:
  - Bundle python-keyring
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511228


author: David Malcolm <dmalcolm@redhat.com> - 1.1.2-5
changelog:
  - rebuild for https://fedoraproject.org/wiki/Features/Python_3.3
  - disable selftests that fail under 3.3


author: Tomas Orsava <torsava@redhat.com> - 1.3.7-21
changelog:
  - Disabled docs because the docs build config is not ported to Python 3 and
    thus cannot be built with Python 3 version of Sphinx


author: Lumír Balhar <lbalhar@redhat.com> - 1.3.7-27
changelog:
  - Remove nosetest-3 executable/manpage. This will be provided by python3 module.
  - Resolves: rhbz#1615727


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Tomas Orsava <torsava@redhat.com> - 8.1.2-1
changelog:
  - Update to 8.1.2
  - Moved to a new PyPI URL format
  - Updated the prefix-stripping patch because of upstream changes in pip/wheel.py


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.1.13-1
changelog:
  - Fix "python2-s3transfer" from EPEL issue by adding it to Obsoletes
  - Rebase to v0.1.13 to fix missing "max_bandwidth" issue

    Resolves: rhbz#1576985
    Resolves: rhbz#1578083


author: Shruti Dhamankar <sdhamank@redhat.com> - 4.2.1-5.1
changelog:
  - httputil: Raise errors instead of logging in  multipart/form-data parsing
  - Resolves: RHEL-91994
  - Fix CVE-2025-47287


author: Julian Sikorski <belegdol@fedoraproject.org> - 11.1.0-1
changelog:
  - Updated to 11.1.0
  - Obsoleted zsh subpackage (upstream ticket #3078)
  - mktap is gone (upstream ticket #5293)
  - Dropped obsolete Group, Buildroot, %clean and %defattr


author: Lumír Balhar <lbalhar@redhat.com> - 12.1.0-7
changelog:
  - Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
  Resolves: rhbz#1813439 rhbz#1813447
  - Remove useless macros definitions


author: Ralph Bean <rbean@redhat.com> - 1.5-3
changelog:
  - Renamed patches to python-urllib3-*
  - Fixed ssl check patch to use the correct cert path for Fedora.
  - Included dependency on ca-certificates
  - Cosmetic indentation changes to the .spec file.


author: Ralph Bean <rbean@redhat.com> - 1.5-4
changelog:
  - Upstream patch to fix Accept header when behind a proxy.
  - Reorganize patch numbers to more clearly distinguish them.


author: bkabrda <bkabrda@redhat.com> - 1.10.2-2
changelog:
  - Fix the way we unbundle six to make ovirt work even when they remove .py files
  Resolves: rhbz#1247093


author: Tomas Orsava <torsava@redhat.com> - 1.10.1-3
changelog:
  - Added a patch that shows a custom error message when a FILE passed to
    virtualenv to be used as 'home dir' already exists and is NOT a directory.
  Resolves: rhbz#1306513


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
  - Rebase to version 15.1.0
  - Disable automatic downloads from pypi on new venv creation
  Resolves: rhbz#1461154


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
  - Add three new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1643829


author: Iryna Shcherbina <ishcherb@redhat.com> - 4.1.2-2
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
  - Security fix for CVE-2023-24329
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2173917


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-2
changelog:
  - Allow to import pip10's main from pip9's /usr/bin/pip
  - Do not show the "new version of pip" warning outside of venv
  Resolves: rhbz#1569488
  Resolves: rhbz#1571650
  Resolves: rhbz#1573755


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-3
changelog:
  - Converting pip specfile from F28 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled building of docs, because we don't ship its build dependencies in
    RHEL7
  - Updated to a newer version of tests to match the package version
  - Backported Patch3 and Patch4 from Fedora
  Resolves: rhbz#1660573


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Miro Hrončok <mhroncok@redhat.com> - 4.11.3-8
changelog:
  - Sync with rpm-4.11.3-43.el7 (RHEL 7.8)
  - Fix packages getting removed on failed update via dnf (#1710691)
  - Fix segfault on fingerprint symlink (#1660232)
  - Fix bogus if-condition in find-debuginfo.sh (#1720590)


author: Tomas Orsava <torsava@redhat.com> - 4.14.0-1
changelog:
  - Rebase to rpm 4.14.0 final (http://rpm.org/wiki/Releases/4.14.0)
  - Re-synchronize version/release macros with the rpm Fedora package


author: Tomas Orsava <torsava@redhat.com> - 6-2
changelog:
  - Modifying python-rpm-generators from F29 to be used in RHEL7
  - The regex in pythondist.attr has been modified to only match Python 3
    modules, so that we do not affect the building of python2 files in RHEL7 at
    this late stage
  - Removed python.attr and pythondeps.sh files, because they are contained in
    rpm-build in RHEL7 and we do not want to modify them
  - the pythondist.attr and pythondistdeps.py are completely new, therefore we
    don't need to conflict with anything in RHEL7
  Resolves: rhbz#1660578


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-7
changelog:
  - Converting specfile from F28 to RHEL7
  - Tests disabled because the minimal RHEL7 Python 3 stack does not contain test
    dependencies
  - Disabled building of the Python 2 subpackage
  Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
  - SRPM renamed from python-setuptools to python3-setuptools
  - Package prepared to contain only Python 3 version
  Resolves: rhbz#1660563


author: Tomas Orsava <torsava@redhat.com> - 0.30.0a0-8
changelog:
  - Switch macros to bcond's and make Python 2 optional to facilitate building
    the Python 2 and Python 3 modules


author: Lumír Balhar <lbalhar@redhat.com> - 0.31.1-4
changelog:
  - Converting specfile from F29 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled tests (by setting the bootstrap on - see note)
  - Removed python-wheel-wheel package with the wheel of wheel
  Resolves: rhbz#1660574


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-171.el7
changelog:
  - kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638471]
  - kvm-Add-missing-brackets-to-CPUID-0x80000008-code.patch [bz#1760607]
  - Resolves: bz#1638471
    ([Intel 7.8 Feat] qemu-kvm Introduce Cascade Lake (CLX) cpu model)
  - Resolves: bz#1760607
    (Corrupted EAX values due to missing brackets at CPUID[0x800000008] code)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
  - Resolves: bz#1771961
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
  - Resolves: bz#1791560
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
  - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
  - kvm-slirp-disable-tcp_emu.patch [bz#1791679]
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
  - Resolves: bz#1791679
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
  - Resolves: bz#1800515
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
  - Resolves: bz#1802215
    (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
  - Resolves: bz#1810408
    (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
  - kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
  - Resolves: bz#1837565
    (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
  - Resolves: bz#1869693
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
  - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
  - kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
  - Resolves: bz#1842923
    (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
  - Resolves: bz#1860960
    (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
  - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
  - Resolves: bz#1884997
    (qemu-kvm FTBFS on rhel7.9)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.4
changelog:
  - kvm-ide-atapi-check-logical-block-address-and-read-size-.patch [bz#1917449]
  - Resolves: bz#1917449
    (CVE-2020-29443 qemu-kvm: QEMU: ide: atapi: OOB access while processing read commands [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.5
changelog:
  - kvm-dma-helpers-Initialize-DMAAIOCB-in_cancel-flag.patch [bz#2007036]
  - Resolves: bz#2007036
    (Memory leak when using dma_read/write with virtio-scsi)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.6
changelog:
  - kvm-rbd-avoid-qemu_rbd_snap_list-memory-leaks.patch [bz#2056725]
  - Resolves: bz#2056725
    (qemu-kvm leaks on qemu_rbd_snap_list)


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Sumit Bose <sbose@redhat.com> - 0.16.1-6
changelog:
  - Resolves: rhbz#1258745
  - Resolves: rhbz#1258488
  - Resolves: rhbz#1267563
  - Resolves: rhbz#1293390
  - Resolves: rhbz#1273924
  - Resolves: rhbz#1274368
  - Resolves: rhbz#1291924


author: Sumit Bose <sbose@redhat.com> - 0.16.1-10
changelog:
  Use current Samba options and read NetBIOS name from keytab
  - Resolves: rhbz#1484072
  - Resolves: rhbz#1370457


author: Sumit Bose <sbose@redhat.com> - 0.16.1-12
changelog:
  Fixes for RHEL-7.9
  - Resolves: rhbz#1625001
  - Resolves: rhbz#1625005
  - Resolves: rhbz#1638396
  - Resolves: rhbz#1714223
  - Resolves: rhbz#1832134


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
    Resolves: rhbz1631183
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size
    Resolves: rhbz1610638
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
    Resolves: rhbz1610647
  - Apply upstream patch PR1993
    Automatically exclude $BUILD_DIR from the backup
    Resolves: rhbz1655956
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
    Resolves: rhbz1462189


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
  - Backport fix for upstream issue 2187 (disklayout.conf file contains
    duplicate lines, breaking recovery in migration mode or when
    thin pools are used). PR2194, 2196.
    Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
  - Apply upstream PR2173 - Cannot restore using Bacula method
    due to "bconsole" not showing its prompt
    Resolves: rhbz1726982


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-11
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807
  - Apply upstream PR212: Be safe against empty docker_root_dir (issue 1989)
    Resolves: rhbz1711123, where ReaR can not create a backup in rescue mode,
    because it thinks that the Docker daemon is running and hits the problem
    with empty docker_root_dir.
  - Apply upstream PR2223 and commit 36cf20e to avoid an empty string in the
    list of users to clone, which can lead to bash overflow with lots of users
    and groups per user and to wrong passwd/group files in the rescue system.
    Resolves: rhbz1692575
  - Backport of Upstream fix for issue 2035: /run is not mounted in the rescue
    chroot, which causes LVM to hang, especially if rebuilding initramfs.
    Resolves: rhbz1697815
  - Backport upstream PR 2218: avoid keeping build dir on errors
    by default when used noninteractively
    Resolves: rhbz1693608


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-15
changelog:
  - Backport PR2608:
    Fix setting boot path in case of UEFI partition (ESP) on MD RAID
    Resolves: rhbz1945869
  - Backport PR2625 & 2675
    Prevents accidental backup removal in case of errors
    Resolves: rhbz1843585
  - Fix rsync error and option handling
    Fixes metadata storage when rsync user is not root
    Resolves: rhbz1947064
  - Changes for NetBackup (NBU) support, upstream PR2544
    Resolves: rhbz2031833
  - On POWER add bootlist & ofpathname to the list of required programs
    conditionally (bootlist only if running under PowerVM, ofpathname
    always except on PowerNV) - upstream PR2665, add them to package
    dependencies
    Resolves: rhbz1983008
  - On POWER mount /sys in the chroot, otherwise ofpathname does not work
    and we risk ending up with not instlaling the bootloader properly
    Resolves: rhbz1983000


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.8
changelog:
  - gcp-vpc-move-route, gcp-vpc-move-vip: add project parameter and
    make vpc_network parameter optional

    Resolves: rhbz#1913936


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.13
changelog:
  - SAPHana: use actual_mode from global.ini and fallback to mode when
    it's not set

    Resolves: rhbz#1855888


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.15
changelog:
  - gcp-pd-move/gcp-vpc-move-route/gcp-vpc-move-vip: dont fail with
    configuration rc when it might be a network hickup

    Resolves: rhbz#2042070


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.18
changelog:
  - db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check

    Resolves: rhbz#2127477


author: Tom Lane <tgl@redhat.com> 9.1.0-1
changelog:
  - Update pg_filedump to version 9.1.0, to support PostgreSQL 9.1.
  - Point to new upstream home at pgfoundry.org.


author: Vinzenz Feenstra <evilissimo@redhat.com> - 1.0.9-4
changelog:
  - Enable logind based session locking
  - ovirt-guest-agent.service to modprobe for virtio_console
  Resolves: BZ#1072326


author: Liutao <liutao1@kylinos.cn> - 4.11.3-45.01
changelog:
  - modify spec, set configuer with-vendor from redhat to neokylin,and
    buildrequires redhat-rpm-config to neokylin-rpm-config and add 
    patch507 for rebranding, Red Hat to CS2C


author: wanglixing <wanglixing@kylinos.cn> - 4.11.3-48.01
changelog:
  - Type:updates
  - ID:NA
  - SUG:NA
  - DESC: modify spec, set configuer with-vendor from redhat to neokylin,and
    buildrequires redhat-rpm-config to neokylin-rpm-config and add
    patch507 for rebranding, Red Hat to CS2C


author: Michal Ruprich - 3.1.2-4
changelog:
  - Related: #1432899 - removing dependencies on perl
  - using the bundled zlib.h(#1491582)
  - turning on upstream tests


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
  - Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
  RHEL 7.8 ERRATUM
  - added patch resolving crash on wrong MsgProperty
    resolves: rhbz#1549706
  - added patch resolving CVE in pmaixforward module
    resolves: rhbz#1768320
  - added patch resolving CVE in pmcisconames module
    resolves: rhbz#1768323
  - added patch implementing file ID for imfile
    resolves: rhbz#1763746
  - added patch fixing omelasticsearch with ES 6.X
    resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
  RHEL 7.8 ERRATUM
  - fixed fsync patch to actually revognize the new option
    resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
  RHEL 7.8 ERRATUM
  - edited patch file ID for imfile to not log useless errors
    also improved file-id behavior to adress newly found problems
    resolves: rhbz#1763746


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-53
changelog:
  RHEL 7.9 ERRATUM
  - one more fix for file ID patch to extend to offline behavior
    resolves: rhbz#1806493
  - added patch resoving race in serialization resulting in crash
    resolves: rhbz#1778841


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-55
changelog:
  RHEL 7.9 ERRATUM
  - edited imfile file-id patch to not segfault on selinux block
    resolves: rhbz#1843992


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-57
changelog:
  RHEL 7.9 ERRATUM
  - added patch resolving buffer overflows in select() function
    resolves: rhbz#1858297


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
  - Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
    failures with newest openssl.
    Resolves: rhbz#1416123
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Extend 'gem_' macros for pre-release version support.
    Resolves: rhbz#1397390
  - Make symlinks for json gem.
    Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
  - Kill bundled certificates.
  - Add macros to edit files lists in .gemspec
  - Fix buffer under-read in String#unpack
    Resolves: CVE-2018-8778
  - Fix HTTP response splitting in WEBrick
    Resolves: CVE-2017-17742
  - Fix DoS by large request in WEBrick
    Resolves: CVE-2018-8777
  - Fix directory traversal by poisoned NULL byte in Dir.
    Resolves: CVE-2018-8780
  - Fix file and directory creation with directory traversal.
    Resolves: CVE-2018-6914
  - Fix socket creation by poisoned NULL byte.
    Resolves: CVE-2018-8779
  - Fix: return default path with nonexistent home dir
  - Fix flags not propagated in Array#pack and String#unpack.
    Resolves: CVE-2018-16396
  - Fix strictly interpret octal fields in tar headers.
    Resolves: CVE-2018-1000075
  - Fix a security error for duplicate files in a package.
    Resolves: CVE-2018-1000076
  - Enforce URL validation on spec homepage attribute.
    Resolves: CVE-2018-1000077
  - Mitigate XSS vulnerability in homepage attribute.
    Resolves: CVE-2018-1000078
  - Prevent Path Traversal issue during gem installation.
    Resolves: CVE-2018-1000079
  - Fix unsafe Object Deserialization Vulnerability in gem owner.
    Resolves: CVE-2018-1000074
  - Refresh expired certificates.
  - Fix path traversal when writing to a symlinked basedir outside of the root
    Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
    Resolves: CVE-2019-8322
  - Fix escape sequence injection vulnerability in API response handling.
    Resolves: CVE-2019-8323
  - Prohibit arbitrary code execution when installing a malicious gem.
    Resolves: CVE-2019-8324
  - Fix escape sequence injection vulnerability in errors.
    Resolves: CVE-2019-8325
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc10
changelog:
  - fix "RHEL 7.8: cleaning up mounts of Kubernetes service account secrets of deleted pods failing"
  - Resolves: #1823374


author: Jan Černý <jcerny@redhat.com> - 0.1.57-1
changelog:
  - Rebase to the 0.1.57 upstream release
  - Update RHEL7 DISA STIG profile to v3r4 (RHBZ#1996678)
  - Split CIS profile (RHBZ#1953787)


author: Watson Sato <wsato@redhat.com> - 0.1.57-7
changelog:
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix name of antivirus package in STIG profile (RHBZ#2066321)
  - Update RHEL7 DISA STIG profile to v3r7 (RHBZ#2079217)


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
  - Update to the latest upstream release (RHBZ#2116359)
  - Fix SSH Key permissions (RHBZ#2021258)
  - Remove PCI-DSS Benchmark(RHBZ2038165)
  - Updated source of CVE data feed(RHBZ#2028432)
  - Improved alignment with DISA's RHEL7 STIG(RHBZ#1967950)
  - Update RHEL7 STIG profile to v3r8 (RHBZ#2112939)
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix smartcard_auth rule for systems installed without authconfig (RHBZ#2116359)
  - Fix check of enable_fips_mode on s390x (RHBZ#2116359)
  - Fix applicability of pam_pkcs11 and grub2 rules on s390x (RHBZ#2116359)


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2158410)
  - Update RHEL7 STIG profile to V3R10 (RHBZ#2152657)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2123284)
  - Fix remediation of audit watch rules (RHBZ#2123367)
  - Fix check firewalld_sshd_port_enabled (RHBZ#2158410)
  - Fix accepted control flags for pam_pwhistory (RHBZ#2158410)
  - Unselect rule logind_session_timeout (RHBZ#2158410)
  - Add support rainer scripts in rsyslog rules (RHBZ#2170038)


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
  - Rebase to the latest upstream release (RHBZ#2221694)
  - Make IPv6 related rules applicable only in case IPv6 is actually enabled. (RHBZ#2210276)
  - update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155793)
  - Correct URL used to download CVE checks. (RHBZ#2223817)


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
  - Rebase to a new upstream release 0.1.72 (RHEL-25251)
  - Include filter to dracut files in audit_rules_privileged_commands rule (RHEL-11938)


author: dongqi <dongqi1@kylinos.cn> - 0.1.72-2.ns7.01
changelog:
  - Type: update
  - ID: [TASK#196626]
  - SUG: NA
  - DESC: migrate patch from 0.1.57-8.el7.ns7.01
          add Patch101, rebranding for neokylin installer.


author: dongqi <dongqi1@kylinos.cn> - 0.1.73-1.ns7.01
changelog:
  - Type: update
  - ID: [TASK#329101]
  - SUG: NA
  - DESC: migrate patch from 0.1.72-2.ns7.01
          rebranding for neokylin installer.


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
  - Multiple packages are installing files under /etc/tmpfiles.d
  - comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
  - Resolves: rhbz#1121958


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Update sudo_role_template() to allow caller domain to read syslog pid files
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command
  Resolves: rhbz#1765063


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-1
changelog:
  - Fix summary and "if" text for AVCs with unknown target path (#1437772)
  - Remove unused booleans.py file
  - src/sealert: Finish dbus communication after error (#1461486)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-3
changelog:
  - Check for the existence of setroubleshoot group separately (#1478118)
  - Fix AVC.__typeMatch to handle aliases properly (#1459844, #1459835, #1459875)
  - Fix allowed_target_types (#1460642, #1460648)


author: Vit Mojzis <vmojzis@redhat.com> - 3.2.30-4
changelog:
  - Catch exceptions caused by lookup_signature (#1636369, #1627908)
  - Fix translation of hex values in AVCs (#1477236)


author: guochao <guochao@kylinos.cn> - 3.2.30-8.01
changelog:
  - Type:bugfix
  - ID:[BUG#194144]
  - SUG:NA
  - DESC:Add patch 0008-setroubleshoot_bugzilla_update_to_kylin.patch


author: Bastien Nocera <bnocera@redhat.com> - 1.8-3
changelog:
  + shared-mime-info-1.8-3
  - Remove triggers, they're not supported in RHEL 7.4's RPM
  Resolves: #1433916


author: Bastien Nocera <bnocera@redhat.com> - 1.8-4
changelog:
  + shared-mime-info-1.8-4
  - Fix CSV files being associated with LibreOffice Math instead
    of LibreOffice Calc
  - Resolves: #1438589


author: Peter Jones <pjones@redhat.com> - 15-5
changelog:
  - Fix a couple more things that are breaking reproducability, and thus
    breaking external review.
    Related: rhbz#1649270


author: Peter Jones <pjones@redhat.com> - 15-6
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Peter Jones <pjones@redhat.com> - 15.6-3.el7
changelog:
  - Patch to work around upstream issue #533
    Related: CVE-2020-14372
  - Run the test suite during the build, to be sure.


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-8
changelog:
  - Fixed: #1473572
  - Changes of ID overrides now force clearing of affected SSSD cache entries on IPA master
  - Related: #1473577
  - Synchronize timeout-enabled code with ipa-extdom-extop


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1820124 When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1820122 ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED
  - Resolves: rhbz#1819018 ipa slapi-nis stack traces review request for LDAP server deadlock
  - Resolves: rhbz#1830894 Memory leak during search of idview overrides


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
  - CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1942937


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1978748
    Release adds following fixes:
    - Fix ID views integration
    - Fix base scope lookups
    - Bump NIS max dgram size to 8KB by default instead of 1KB
    - Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-11869


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.4
changelog:
  - [candlepin/foreman] psql with --no-password
    Resolves: bz1932772
  - [pacemaker] password scrub fix
    Resolves: bz1903144
  - [filesys] never collect panfs
    Resolves: bz1886784
  - [openstack_ceilometer] backend_url protected
    Resolves: bz1892692


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.5
changelog:
  - [sssd] Add individual SSSD log files
    Resolves: bz1938932
  - [sssd] sssd plugin when sssd-common
    Resolves: bz1946641
  - [foreman] fix unmatched group in scrubbing installer logs
    Resolves: bz1956817
  - [foreman] Sizelimit foreman-maintain and installer logs
    Resolves: bz1964000
  - [pulpcore] add plugin for pulp-3
    Resolves: bz1956672


author: wanglixing <wanglixing> - 3.9-5.el7.11.ns.01
changelog:
  - Type:update
  - ID:NA
  - SUG:NA
  - DESC:add patch:sos-kylin-rebranding.patch  sos-3.9-neokylin-collecting-productInfo.patch


author: Matthias Saou <http://freshrpms.net/> 1.6.3-1
changelog:
  - Update to 1.6.3.
  - Include init script and sysconfig file to make it easy to manage a single
    instance.


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
  - Keepalive fix
    Resolves: rhbz#1719736
  - Fix hang on migration after password expired
    Resolves: rhbz#1761776


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-4
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1567944


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
  - Don't mute Record channel on client reconnection
    Resolves: rhbz#1549132
  - Allow to configure TLS protocol versions and ciphers which SPICE will use for
    TLS communications
    Resolves: rhbz#1562213
  - Enable ECDH ciphers with OpenSSL 1.0
    Resolves: rhbz#1566597


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-7
changelog:
  - Fix off-by-one error during guest-to-host memory address conversion
    Resolves: CVE-2019-3813
  - Add patch for upstream commit 48179332d9da0. This should help with corrupted
    spice-html5 displays
    Resolves: rhbz#1573739
  - Add missing minimum openssl version Requires for patch #24
    Resolves: rhbz#1627693


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-16
changelog:
  - Resolves: #1738582 - CVE-2019-12525 squid: parsing of header 
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
  - Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
    a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
  - Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
    code -- Remove support for Gopher protocol (CVE-2023-46728)
  - Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
    feature (CVE-2023-49285)
  - Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
    Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
    (CVE-2023-46724)
  - Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
    (CVE-2023-50269)
  - Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
    (CVE-2024-25617)


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.11
changelog:
  - Resolves: RHEL-65070 - squid: Denial of Service processing ESI response
    content (CVE-2024-45802)


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.14
changelog:
  - Resolves: RHEL-107116 - squid: Buffer Overflow in URN Handling
    (CVE-2025-54574)
  - Resolves: RHEL-109917 - squid: denial of service in URN processing
    (CVE-2021-28651)
  - Related: RHEL-107116 - urn: Fix multiple bugs causing crashes and timeouts


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-2
changelog:
  - Copy over changes in tests/ioctl_evdev-success.c (from cdd8206a
    "tests: test evdev bitset decoding more thoroughly")
    to tests-m32/ioctl_evdev-success.c and tests-mx32/ioctl_evdev-success.c
  - Copy over changes in tests/ioctl_evdev.c (from 5ee385e2
    "evdev: fix decoding of EVIOCGBIT(0, ...)") to tests-m32/ioctl_evdev.c
    and tests-mx32/ioctl_evdev.c
  - Resolves: #1746478


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
  - Include upstream patches that fix issues reported by covscan:
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing", and
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register".
  - Resolves: #1747524


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-5
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790052):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Add commit v5.4~97 "xlat: use unsgined type for mount_flags fallback values"
    (A leftover for #1747524).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Fix expected alignment for IPC tests (#1795261):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix incorrect ifname printing buffer size (#2028146):
    e27b0677 "print_ifindex: fix IFNAME_QUOTED_SZ definition".


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
  - RHEL-7.6 erratum
    Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
    Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
    Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
  - RHEL 7.9.Z ERRATUM
  - defaults use_pty plus SELinux ROLE in user specification breaks terminal
    Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
  RHEL 7.9.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161222


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
  - add -f flag to force fdatasync() after sa file update (#1662094)
  - don't call filesystem count functions when we are not collecting fs statistics (#1670060)
  - skip autofs when gathering filesystem statistics (#1670060)
  - fix use of incorrect preposition in sar man page (#1624410)
  - fix CPU usage reporting (#1618688)


author: Nils Philippsen <nils@redhat.com> - 1.3.4-1
changelog:
  - don't ask libuser to create a home directory over an existing one (#908852,
    patch by Miloslav Trmač)
  - correct check if SELinux is enabled


author: Nathaniel McCallum <npmccallum@redhat.com> - 4-1
changelog:
  - Import SRPM from Fedora (tang-4-3.fc26)
  - Remove nagios dependency
  - Adjust http-parser version for RHEL


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb46-4
changelog:
  - Properly detect errors when writing backup files. (Closes: #80) (#81)
  - Read number of backup files to keep from file
  - config: defend on '/etc/target/backup' directory
  - config: backup when current config is different from recent backup copy
  - config: rename key 'kept_backups' as 'max_backup_files'
  - backup: global option to tune max no. of backup conf files


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-9
changelog:
  - 'if statement' parsing fixed when the space is missing after ')'. (#1273892)
  - Quote backslashes properly to preserve them in `...` expressions. (#1319816)
  - Fix for tcsh being interruptible while waiting for child process. (#1269370)
  - Fix of memory leak when using the 'source' built-in command.      (#1273513)
  - Print error message on stderr (instead of stdout).                (#1273498)
  - Use GLIBC's malloc instead of builtin malloc.                     (#1315713)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-12
changelog:
  - Fix another regression in tcsh-6.18.01-quote-backslashes-properly.patch
    Related: #1334751

  - Fix regression in tcsh-6.18.01-use-stderr-upon-error.patch
    Related: #1273498


author: Martin Sehnoutka <msehnout@redhat.com> - 1:0.17-60
changelog:
  - Introduce new -i switch
  - ip addresses will be logged into utmp instead of hostname
  - Resolves: #1323094


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - more clear formulation of man page note - previous note was a bit ambiguous


author: Like <like@kylinos.cn> - 102.11.0-1.ns7.01
changelog:
  - Type: NA
  - ID: NA
  - SUG: NA
  - DESC: change  ExcludeArch:  aarch64 s390 ppc to ExcludeArch: s390 ppc


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-14
changelog:
  - Fix rendering on big endian system
    Resolves: bz#1618777

    Do not automatically kill sessions
    Resolves: bz#1646889


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-23
changelog:
  - Rebuild for xorg-x11-server CVEs
    Resolves: CVE-2022-4283 (bz#2154267)
    Resolves: CVE-2022-46340 (bz#2154261)
    Resolves: CVE-2022-46341 (bz#2154264)
    Resolves: CVE-2022-46342 (bz#2154262)
    Resolves: CVE-2022-46343 (bz#2154265)
    Resolves: CVE-2022-46344 (bz#2154266)


author: Like <like@kylinos.cn> -1.8.0-25.ns7.01
changelog:
  - Type:CVE
  - ID: CVE-2023-5380 CVE-2023-6377 CVE-2023-6478
  - SUG:NA
  - DESC: Add Patch fix CVE-2023-5380 CVE-2023-6377 CVE-2023-6478


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-26
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15235
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15223


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-27
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415
  - CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18427


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-28
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-29
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20436
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20427
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20587
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21212


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-30
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20436


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-31
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20436
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20587


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-32
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-31006
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30976
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30993


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-34
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-62070


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-35
changelog:
  - Fix build against latest xorg-x11-server by dropping existing CVE fixes in Xorg
    Resolves: RHEL-70008


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-36
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-79396
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-79399
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79384
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-79379
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79368
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-79363
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-79359
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79347


author: Jun Arti Agrawal<artagraw@redhat.com> - 1.8.0-36.1
changelog:
  - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97140
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97133
  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97140
  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97152
  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97158
  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97426
  - Removed fixes done as part of changelog (1.8.0-36) as it has been already fixed in xorg-x11-server rhel-7.9
    Same Can be verfied through below link :
    https://pkgs.devel.redhat.com/cgit/rpms/xorg-x11-server/commit/?h=rhel-7.9&id=1941326a7968d706a13804a24027acfaac4f8797


author: Sucharita Viswanathan <suviswan@redhat.com> - 1.8.0-36.3
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119978

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-119999

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120256

  - Removed fixes done as part of changelog ( 1.8.0-36.1) as it has been already fixed in xorg-x11-server rhel-7.9
    Same Can be verfied through below link :
    https://pkgs.devel.redhat.com/cgit/rpms/xorg-x11-server/commit/?h=rhel-7.9&id=939b2d18e088d4fd29af64456c33e3a68843979e


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
  - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
  - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
  - Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
  - Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
  - Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
  - Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12
changelog:
  - Resolves: rhbz#1367492 harden package permissions
  - Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
  - Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
  - Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
  - Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
  - Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Matthew Harmsen <mharmsen@redhat.com> - 7.2.1-3
changelog:
  - Bugzilla Bug #1394416 - Rebase tomcatjss to 7.2.x in RHEL 7.4 (mharmsen)
  - ## 'tomcatjss-support-for-event-API.patch' resolves the following issues
    - tomcatjss Pagure Issue #4 - Support for Event API (edewata)


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.1-7
changelog:
  - Updated jss build and runtime dependencies
  - Bugzilla Bug #1596769 - Tomcatjss: Add support for TLS_*_SHA384
    ciphers (cfu)


author: Jack Magne <jmagne@redhat.com> 7.2.1-8
changelog:
  - Bugzilla Bug #1632618 - CC: tomcatjss: unable to enable OCSP checking
    from peer AIA extension [rhel-7.6.z] (jmagne)


author: Kamil Dudka <kdudka@redhat.com> - 1:3.2.5d-11
changelog:
  - install man pages using the correct file name suffix
  - provide the fig2ps2tex.sh man page as a symlink


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-7
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739418


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-9
changelog:
  - Fixed SIGHUP handling
    Resolves: rhbz#1702724
  - Tune irqbalance service
    Resolves: rhbz#1720042
  - Added netcat requirement
    Resolves: rhbz#1746436
  - sysctl: made reapply_sysctl ignore configs from /usr
    Resolves: rhbz#1776149
  - profiles: define variables before use
    Resolves: rhbz#1781664


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-10
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1852253


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018e-4
changelog:
  - Brazil moved the start of DST from the first Sunday in November
    to the third Sunday in November.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021d-1
changelog:
  - Rebase to tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.


author: Patsy Griffin <patsy@redhat.com> - 2025a-1
changelog:
  - Update to tzdata-2025a (RHEL-74311)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Patsy Griffin <patsy@redhat.com> - 2025b-1
changelog:
  - Update to tzdata-2025b (RHEL-84755)
    - Chile's Aysén Region moves from -04/-03
      to -03 year-round, diverging from America/Santiago and
      creating a new zone America/Coyhaique.


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
  - Rebase to 1.6.6
  - Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
  - Enable ipsecmod support


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
  - Do not search for DNSSEC info when domain-insecure is set
    for stub zone (#1678550)
  - Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839174 (CVE-2020-12662), rhbz#1840259 (CVE-2020-12663)


author: Bryan Mason <bmason@redhat.com>- 1.6.6-5.1
changelog:
  - Fix KeyTrap - Extreme CPU consumption in DNSSEC validator (CVE-2023-50387)
  - Fix Preparing an NSEC3 closest encloser proof can exhaust CPU resources (CVE-2023-50868)


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
  - Added patch for build option "-Werror=format-security"
  - Added support of non-unicode non-latin charset
  - Fix print of non-ascii filenames
  - Fix troubles with symlinks for archives with many files
    Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
  - rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
  - make linking flags configurable from the specc file
  - set linking flags to use relro hardening
    Related: #1531116


author: Jakub Martisko <jamartis@redhat.com> - 6.0-23
changelog:
  - Disable the zipbomb detection patches
  - There were too many false positives for now, will reenable this later with an option to opt-out
  - Resolves: rhbz#2020318


author: Jakub Martisko <jamartis@redhat.com> - 6.0-24
changelog:
  - Reenable the zipbomb detection patches
  - Add environment variable that disables the zipbomb detection
  - Resolves: rhbz#2020318


author: Rakesh Pandit <rakesh@fedoraproject.org> 0.7.5-1
changelog:
  - Upgrade to 0.7.5:
  -  Improved docs
  -  Test suite
  - 0.7.4
  -  Cleaned up code and fixed memory leaks
  - 0.7.3
  -  Builds for Cygwin, minor bug fix
  -  Changes in build system.
  -  Added: Qt Assistant documentation output
  - 0.7.2
  -  Improved and cleaned API


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 20170801-1
changelog:
  - rebase to 20170801 version
  - removed urw-* string from subpackages
  - fontconfig priority value updated to 35
  - error messages from 'xset fp rehash' suppressed (bug #1466254)
  - AppStream files added into (sub)packages
  - fontconfig files added into (sub)packages
  - fixed fonts path during %install
  - source location updated to point at github.com


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 20170801-2
changelog:
  - urw-base35-fonts-20170801-000-split-urw-fallback.patch added
  - decrease the fontconfig priority/ordering value to 60 (bug #1494850)
  - set same priority value for urw-fallback.conf as for other files (bug #1495199)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> 20170801-3
changelog:
  - *-devel subpackage added
  - typos & syntax fixed for AppStream files
  - NimbusSansNarrow-BdOblique.* renamed to *-BoldOblique
  - *-nimbus-sans-narrow subpackage dropped
  - priority/ordering decreased [60->61]
  - ship *.otf format files as well


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
  - 1267826 - Include c++11 syntax highlighting in vim
  - 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
  - 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
  - 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
  - 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Marek Kasik <mkasik@redhat.com> - 3.22.0-14
changelog:
  - Rebuild due to new version of FreeRDP
  - Fix an issue when RDP connection shows just black screen
  - Resolves: #1839745


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-7
changelog:
  - Add support for detecting POWER KVM and LPAR
    resolves: rhbz#1147876
  - Detect RHEV/oVirt
    resolves: rhbz#1249438
  - Detect ACPI boot aarch64 guest
    resolves: rhbz#1275349
  - Fix typo in manual page
    resolves: rhbz#1099289


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-2
changelog:
  - Rebase to Fedora Rawhide / upstream version.
  - Include upstream patches since 1.18 was released.
    resolves: rhbz#1476878


author: William Poteat <wpoteat@redhat.com> 0.28.3-1
changelog:
  - 1775535: config option to override api version (piotr.kliczewski@gmail.com)
  - Update releasers for new version (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.4-1
changelog:
  - 1806572: virt-who using V3 APIs for communication with RHEVM which is
    deprecated (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.6-1
changelog:
  - 1806572: RHEVM should only use version 4 (wpoteat@redhat.com)
  - Update to tests to match changes in Subscription Manager (jhnidek@redhat.com)


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-20
changelog:
  - Resolves: #1147551 - Missing isolate_* options, incorrect default values of
    max_clients, max_per_ip in man vsftpd.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.0.2-22
changelog:
  - Resolves: #1432054 - secure ftp stopped working with default TLS settings in the new vsftpd package


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-23
changelog:
  - Redefine VSFTP_COMMAND_FD to 1
  - Resolves: rhbz#1443055
  - Document the relationship of text_userdb_names and chroot_local_user
  - Resolves: rhbz#1508021
  - Document allow_writeable_chroot in the man page
  - Resolves: rhbz#1508022
  - Improve documentation of ascii_* options
  - Resolves: rhbz#1517227
  - Add new filename generation algorithm for STOU command
  - Resolves: rhbz#1479237


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-25
changelog:
  - Add config option log_die allowing to pass error messages to syslog
  - Add config option bind_retries allowing to change the max number
  - of attempts to find a listening port for the PASV/EPSV command
  - Resolves: rhbz#1318198


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.2-29
changelog:
  - Enable support for wide-character strings in logs
  - Replace unprintables with HEX code, not question marks
  - Resolves: rhbz#1922809


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
  - Update to 2.20.4
  - Resolves: rhbz#1576544
  - WebKitWebProcess crashes when a11y is active
  - Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
  - webkitgtk4: Crash on Google login page when a11y is active
  - Resolves: rhbz#1503624
  - Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
  - Update to 2.20.5 - technically it was not necessary as the only difference
    between 2.20.4 and .5 was the revert of one change, that we already reverted
    while building 2.20.4. But it's better to stay with upstream.
  - Update the labels patch with the version that was pushed upstream.
  - Resolves: rhbz#1576544


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-7
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-10
changelog:
  - Fix memory leak when macsec MKA/PSK is used (rh #1500442)
  - Fix authentication failure when the MAC is updated externally (rh #1490885)
  - Let the kernel discard EAPOL if packet type is PACKET_OTHERHOST (rh #1434434)
  - Don't restart wpa_supplicant.service on package upgrade (rh #1505404)
  - Don't own a directory in /run/ (rh #1507919)


author: Parag Nemade <paragn AT fedoraproject DOT org> - 3.3.12ga11-5
changelog:
  - Remove vendor tag from desktop file as per https://fedorahosted.org/fesco/ticket/1077
  - Cleanup spec as per recently changed packaging guidelines


author: Samantha N. Bueno <sbueno[at]redhat.com> - 3.3.12ga12-1
changelog:
  - updated to 3.3.12ga12
  - fixes CVE-2012-5662 (#889373, #924228)
  - add support for aarch64 to build system (#926737)


author: Debarshi Ray <rishi@fedoraproject.org> - 1:2.8.8-19
changelog:
  - Use XDG_CONFIG_HOME instead of home for config files
    (http://sourceforge.net/p/xchat/bugs/1506/)
  - Use name and generic name correctly in desktop file
    (http://sourceforge.net/p/xchat/bugs/1397/)


author: Eric Sandeen <sandeen@redhat.com> 3.1.3-2
changelog:
  - Preserve xattrs on multi-part stream restores (#1034014)
  - Prevent segfault on multi-part stream restores (#1034015)


author: Eric Sandeen <sandeen@redhat.com> 3.1.7-1
changelog:
  - Rebase to build against current RHEL7 xfsprogs headers
  - Fix race condition between lseek() and read()/write() (#1086532)


author: Pavel Reichl <preichl@redhat.com> - 3.1.7-4
changelog:
  - Batch fixing several issues
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump
  -      issue, Related: RHEL-10529
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x,
  -      Related: RHEL-14912


author: Alexander Kurtakov <akurtako@redhat.com> 1:3.1.3-5
changelog:
  - Remove javax.xml.bind from osgi imports - it's part of the JVM now.
  - Drop the ws-jaxme dependency for the same reason.


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
  - New upstrema version with memleaks, crl checks and other fixes
  - enable make check during build
  - drop ecdsa patch as it has been included upstream


author: Tomas Halman <thalman@redhat.com> - 1.2.20-8
changelog:
  - xmlsec1 fails to validate XML signatures made using ECDSA algorithm in FIPS mode
  - Resolves: RHEL-3337


author: Hans de Goede <hdegoede@redhat.com> 7.7.1-1
changelog:
  - Update to latest git, this is the equivalent of 7.7.1 + fixes for use
    with xserver-1.19 (rhbz#1325613)
  - Rebuild against xserver-1.19


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
  - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
    CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2109031, rhbz#2109033


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
  - CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
    CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
    CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18416
    Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21205
    Resolves: https://issues.redhat.com/browse/RHEL-20578
    Resolves: https://issues.redhat.com/browse/RHEL-20426
    Resolves: https://issues.redhat.com/browse/RHEL-20437
    Resolves: https://issues.redhat.com/browse/RHEL-21192
    Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
    Resolves: https://issues.redhat.com/browse/RHEL-31003
    Resolves: https://issues.redhat.com/browse/RHEL-30989
    Resolves: https://issues.redhat.com/browse/RHEL-30973
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-30
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79124), CVE-2025-26595 (RHEL-79128),
                 CVE-2025-26596 (RHEL-79132), CVE-2025-26597 (RHEL-79135),
                 CVE-2025-26598 (RHEL-79136), CVE-2025-26599 (RHEL-79139),
                 CVE-2025-26600 (RHEL-79152), CVE-2025-26601 (RHEL-79148)


author: Kashyap Ekbote <kekbote@redhat.com> - 1.20.4-31
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97266), CVE-2025-49176 (RHEL-97292),
                 CVE-2025-49178 (RHEL-97362), CVE-2025-49179 (RHEL-97394),
                 CVE-2025-49180 (RHEL-97230)


author: Kashyap Ekbote <kekbote@redhat.com> - 1.20.4-32
changelog:
  - Version Bump up for CVE fix for: CVE-2025-49175 (RHEL-97266), CVE-2025-49176 (RHEL-97292),
                 	    CVE-2025-49178 (RHEL-97362), CVE-2025-49179 (RHEL-97394),
                 	    CVE-2025-49180 (RHEL-97230)


author: Kashyap Ekbote <kekbote@redhat.com> - 1.20.4-32
changelog:
  - Version Bump up for CVE fix for: CVE-2025-49175 (RHEL-97266), CVE-2025-49176 (RHEL-97292),
                      CVE-2025-49178 (RHEL-97362), CVE-2025-49179 (RHEL-97394),
                      CVE-2025-49180 (RHEL-97230)


author: Abhishek Mishra <abhmishr@redhat.com> - 1.20.4-33
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119952), CVE-2025-62230 (RHEL-120026),
                 CVE-2025-62231 (RHEL-120255)


author: Pavel Cahyna <pcahyna@redhat.com> - 1.4.8-3
changelog:
  - Disable libjte to make the build more similar to the libisofs builds
  - Remove unneeded files from sources


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-13
changelog:
  - Fix remote code execution vulnerability
  - Resolves: CVE-2021-21344
  - Resolves: CVE-2021-21345
  - Resolves: CVE-2021-21346
  - Resolves: CVE-2021-21347
  - Resolves: CVE-2021-21350


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-15
changelog:
  - Fix remote code execution vulnerabilities
  - Resolves: CVE-2021-39139
  - Resolves: CVE-2021-39140
  - Resolves: CVE-2021-39141
  - Resolves: CVE-2021-39144
  - Resolves: CVE-2021-39145
  - Resolves: CVE-2021-39146
  - Resolves: CVE-2021-39147
  - Resolves: CVE-2021-39148
  - Resolves: CVE-2021-39149
  - Resolves: CVE-2021-39150
  - Resolves: CVE-2021-39151
  - Resolves: CVE-2021-39152
  - Resolves: CVE-2021-39153
  - Resolves: CVE-2021-39154


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
  - fix manual page inconsistencies with help output (private #948533)
  - enable/fix the 'xzgrep -h' (private #850898)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-30
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix NULL dereference in cd (CVE-2017-18205)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
  - fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-34
changelog:
  - make the chaselinks option work again (#1729997)
  - fix off-by-one error in buffer allocation to avoid stack smashing (#1722486)


author: wanglixing <wanglixing@kylinos.cn> - 5.0.2-34.el7_8.2.ns.01
changelog:
  - Type:update
  - ID:NA
  - SUG:NA
  - DESC:Add  mv "Y*.ztst V07pcre.ztst A05execution.ztst skipped" for all arch in %check by neokylin


