# changelog

author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826589):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.1
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893261, #1893249, #1893229):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
      0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
      to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
      to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
      to 0xde;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
      up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
      up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
      to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
      to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
      to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
      up to 0xa0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
      up to 0xe0.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.20
changelog:
  - Update Intel CPU microcode to microcode-20231009 release, addresses
    CVE-2023-23583 (RHEL-3920):
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xac up to 0xb4;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003a5
      up to 0xd0003b9;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000230
      up to 0x1000268;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xbc
      up to 0xc2;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2c up
      to 0x34;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x46 up
      to 0x4e;
    - Update of 06-8f-04/0x10 microcode from revision 0x2c000271 up to
      0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0004b1
      up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c000271 up to
      0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0004b1
      up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000271 up to 0x2c000290;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000271 up to 0x2c000290;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b0004b1 up to 0x2b0004d0;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x2e up to 0x32;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2e
      up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x2e up to 0x32;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x42c up to 0x430;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x42c up to 0x430;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x42c up to 0x430;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42c
      up to 0x430;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x4 up
      to 0x5;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x59 up
      to 0x5d;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x119 up
      to 0x11d;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4119 up to 0x411c;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4119 up to 0x411c;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4119 up to 0x411c;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4119
      up to 0x411c;
    - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x11 up
      to 0x12;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2e up
      to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x2e up to 0x32;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x2e up to 0x32;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2e up
      to 0x32.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.8
changelog:
  - Update Intel CPU microcode to microcode-20210216 release (#1905111):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a08 up
      to 0x2006a0a;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003003
      up to 0x4003006;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003003 up to 0x5003006.


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.7-21
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-2.2
changelog:
  - Resolves: rhbz#1697487 - mod_auth_mellon Cert files name wrong when
                             hostname contains a number


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-2.3
changelog:
  - Resolves: rhbz#1697488 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7] [rhel-7.6.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-2.4
changelog:
  - Actually apply the patch in the previous build
  - Resolves: rhbz#1697488 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
changelog:
  - Apply the patch from the previous commit
  - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
changelog:
  - Resolves: rhbz#1727789 - mod_auth_mellon fix for AJAX header name
                             X-Requested-With


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-8
changelog:
  - Resolves: rhbz#1731052 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via
                             the login?ReturnTo= substring which could facilitate
                             information theft [rhel-7]


author: John Dennis <jdennis@redhat.com> - 1.8.8-3
changelog:
  - fix unit test failure caused by apr_jwe_decrypt_content_aesgcm()
    failing to null terminate decrypted string
    Resolves: bug#1292561 New package: mod_auth_openidc


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-4
changelog:
  - Resolves: rhbz#1626299 - CVE-2017-6059 mod_auth_openidc: Shows
                             user-supplied content on error pages [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
changelog:
  - Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
                             OIDCAuthNHeader not skipped in an "AuthType oauth20"
                             configuration [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
changelog:
  - Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                             issue exists in URLs with slash and backslash [rhel-7]
  - Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
                             in logout url when using URLs with leading slashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
changelog:
  - Fix a regression in the previous patches
  - Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                            issue exists in URLs with slash and backslash [rhel-7]


author: Joe Orton <jorton@redhat.com> - 1.7.14-13
changelog:
  - fix mod_authz_svn regression with mod_auth_kerb (#1306431)
  - fix "svn diff" property handling (#1378178)
  - fix permissions of /run/svnserve to match tmpfiles (#1496243)


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Replaced Source: redhatsecureboot501.cer
  -->  Use the FNAL SL signing certificate
  - Replaced Source: redhatsecurebootca5.cer
  -->  Use the FNAL SL cert's CA
  - Replaced shims with SL shims


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.21-27
changelog:
  - Resolves #1388511 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1388512 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.21-29
changelog:
  - Fix IMAP header caching path traversal vulnerability
  - Resolves: #1608011
  - Resolves: CVE-2018-14355


author: Florian Müllner <fmuellner@redhat.com> - 3.24.3-11
changelog:
  - Prevent crash when removing workspace with on-all-workspaces windows
    present (like desktop icons)
  - Resolves: #1453065


author: Richard W.M. Jones <rjones@redhat.com> - 1.8.0-3
changelog:
  - Fix for CVE-2019-14850 denial of service due to premature opening
    of back-end connection
    resolves: rhbz#1757261


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: nbdkit.ini
  -->  Config file for automated patch script
  - Added Patch: 0001-Rebase-off-of-https-github.com-libguestfs-nbdkit.patch
  -->  Fix use of write -u


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
  - add missing part of memory leak patch (#1794168)
  - fix if_inet6 messages floood (#1765449)
  - revert bz#1486733 (#1771050)
  - fix issue for process status when process name contains whitespace (#1782180)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.48
changelog:
  - exportfs: fix path comparison in unexportfs_parsed() (bz 1389046)
  - Correctly set the minor version when set in nfsmount.conf (1458504)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.4
changelog:
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Build with support for SSLKEYLOGFILE
  - Disable the use of RSA-PSS with SSL/TLS


author: Daiki Ueno <dueno@redhat.com> - 3.28.2-1.6
changelog:
  - Restore ssl-server-min-key-sizes.patch
  - Disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256 by default
  - Enable 4 AES_256_GCM_SHA384 ciphersuites, enabled by the downstream
    patch in the previous release
  - Fix crash with tstclnt -W


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-7
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-2
changelog:
  - Skip sysinit gtests properly
  - Fix shell syntax error in tests/ssl/ssl.sh
  - Regenerate manual pages


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-6
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
  - Explicitly enable upgradedb/sharedb test cycles


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - revert sql default language in man pages
  - fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-14
changelog:
  - Resolves: rhbz#1288429 - /etc/tmpfiles.d/nss-pam-ldapd.conf shipped when
                             /etc/tmpfiles.d is reserved for the local
                             administrator


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-15
changelog:
  - Resolves: rhbz#1204202 - fix doc to describe actual uri format in
                             nslcd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-16
changelog:
  - Resolves: rhbz#1151675 - NSLCD WRAPS LDAP USER UIDNUMBER > 2^31 SO UID
                             IS WRONG (AND A NEGATIVE NUMBER)


author: Bob Relyea <rrelyea@redhat.com> - 3.28.3-4
changelog:
  - include new PKCS12 NSS specific mechanisms.
  - alias CKM_TLS_KDF to CKM_TLS_MAC to preserve ABI
  - add RSA PSS oid to decrypting PKCS #5 key blobs.
  - move ec public key check from softokn to freebl so apps like Java can benefit.


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-5
changelog:
  - fix login handling for FIPS slots, patch from rhbz#1390154
  - backport upstream fix for CVE-2017-5462 (DRBG leak)


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - Include softoken specific patches required by the NSS 3.67
    release including:
  -  sdb timeout fixes.
  -  coverity patch.
  -  fixing private key macing


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-4
changelog:
  - Manual merge from the rhel-7.2 branch
  - Fix one alias for naming compatibility with prior release
  - Remove an unused patch


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25.el7_3.1
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29.el7_8.2
changelog:
  - don't update transmission time on invalid response (CVE-2020-11868)
  - randomize transmit timestamp in client requests (CVE-?, #1813787)


author: Dogtag Team <pki-devel@redhat.com> 1.0.5-1
changelog:
  - Resolves: rhbz #1509040 - nuxwdog spec file has outdated
    source for tarballs (dmoluguw)
  - Rebase to upstream nuxwdog 1.0.5-1


author: Richard W.M. Jones <rjones@redhat.com> - 4.05.0-4
changelog:
  - Rebase to 4.05.0 (same as Fedora Rawhide).
  - Adds support for POWER, z/VM.
  - Improves support for aarch64.
    resolves: rhbz#1447988


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.2
changelog:
  - ovt-Rectify-a-log-spew-in-vmsvc-logging-vmware-vmsvc-roo.patch [bz#1911853]
  - Resolves: bz#1911853
    ([ESXi][RHEL7.9][ warning] [guestinfo] GuestInfoGetDiskDevice: Missing disk device name; VMDK mapping unavailable for "/", fsName: "/dev/sda2")


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.3
changelog:
  - ovt-Fix-memory-leaks-in-guestInfo-diskInfo.c.patch [bz#1937420]
  - Resolves: bz#1937420
    ([ESXi][RHEL7.9] Memory leak in vmtoolsd when disable-query-diskinfo is set to false [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.4
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119310]
  - Resolves: bz#2119310
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-7.9.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.5
changelog:
  - ovt-Track-Linux-filesystem-id-FSID-for-quiesced-frozen-f.patch [bz#1880404 bz#1994590]
  - Resolves: bz#1880404
    ([ESXi] [RHEL7] vmtoolsd task is blocked in the uninterruptible state while attempting to delete (unlink) the file 'quiesce_manifest.xml')
  - Resolves: bz#1994590
    ([ESXi][RHEL7.9][open-vm-tools] Snapshot of the RHEL7 guest on the VMWare ESXi hypervisor failed vm hangs)


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.6
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2215562]
  - Resolves: bz#2215562
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.7
changelog:
  - ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [RHEL-2413]
  - Resolves: RHEL-2413
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.8
changelog:
  - ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [bz#2226921]
  - Resolves: bz#2226921
    ([RHEL7.9][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.9
changelog:
  - ovt-Don-t-accept-tokens-with-unrelated-certs.patch [RHEL-14642]
  - ovt-File-descriptor-vulnerability-in-the-open-vm-tools-v.patch [RHEL-14676]
  - Resolves: RHEL-14642
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-7.9.z])
  - Resolves: RHEL-14676
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-7.9.z])


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
  - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
  - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
  - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-5
changelog:
  - fix CVE-2017-9287 openldap: Double free vulnerability in servers/slapd/back-mdb/search.c (#1458210)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
  - Rebase to new upstream release (#1656791)
    - Add Support for HID Crescendo 144K (#1612372)
    - Add Support for CAC Alt tokens (#1645581)
    - Fix usage detection from certificates (#1672898)
    - Fix security issues:
      - CVE-2018-16391
      - CVE-2018-16392
      - CVE-2018-16393
      - CVE-2018-16418
      - CVE-2018-16419
      - CVE-2018-16420
      - CVE-2018-16421
      - CVE-2018-16422
      - CVE-2018-16423
      - CVE-2018-16426
      - CVE-2018-16427


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
  - Fix segfault in systemdunitdependency probe (RHBZ#1478285)
  - Build and ship HTML manual (RHBZ#1465661)
  - Fix oscap-ssh with --sudo (RHBZ#1803114)
  - Change category of verbose message (RHBZ#1640522)
  - Fix segfault in CVRF module (RHBZ#1642283)


author: Marcus Burghardt <maburgha@redhat.com> - 1.2.17-14
changelog:
  - Fix memory leaks in probe-api (RHBZ#1861793)
  - Prevent duplicate variables in Ansible Playbooks (RHBZ#1944683)
  - Fix trailing whitespace in Ansible Playbooks
  - Fix inconsistent result from security_patches_up_to_date (RHBZ#1858502)
  - Fix multiple segfaults and broken test (RHBZ#1911999)
  - Improve --stig-viewer output when there is no 1:1 connection between rules
  - Lower memory limits and improve their checking (RHBZ#1932833)


author: Jan Černý <jcerny@redhat.com> - 1.2.17-3
changelog:
  - Fix unwanted recursion into mounted remote filesystems (#1655943)
  - Evaluate SCAP 1.3 datastreams without downloading remote data (#1709423)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1:2.0.0-8
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1781701


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-60.1
changelog:
  - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher
  - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16.1
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 - EC signature local timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: Wim Taymans <wtaymans@redhat.com> - 0.4.22-5
changelog:
  - Run backup functions on s390x instead of emulation
  - Fix load of parameters smaller than 64 bits
  - Related: rhbz#1249506


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-1
changelog:
  - Resolves: rhbz#1737367 - Update to latest upstream release
  - Resolves: rhbz#1737369 - Add 7.8 to the osinfo-db which will be used on 7.8


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-2
changelog:
  - Resolves: rhbz#1750807 - Fedora/RHEL/CentOS JeOS kickstart files for
                             unattended installation are broken


author: Daiki Ueno <dueno@redhat.com> - 0.23.5-3
changelog:
  - Avoid reference to thread-unsafe strerror rhbz#1378947
  - Fix PKCS#11 OAEP interface rhbz#1191209
  - Update documentation to follow RFC7512 rhbz#1165977


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.15-11
changelog:
  - Sanitize readable CIB output collected by crm_report
  - Document crm_report --sos-mode option
  - Speed up crm_report on Pacemaker Remote nodes
  - Avoid sbd fencing when upgrading pacemaker_remote package
  - Resolves: rhbz#1219188
  - Resolves: rhbz#1235434
  - Resolves: rhbz#1323544
  - Resolves: rhbz#1372009


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.3
changelog:
  - Fix regression in crm_resource --refresh
  - Order resource moves after remote connection starts
  - Resolves: rhbz#1664242
  - Resolves: rhbz#1664243


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.5
changelog:
  - Improve clients' authentication of IPC servers (CVE-2018-16877)
  - Fix use-after-free with potential information disclosure (CVE-2019-3885)
  - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
  - Resolves: rhbz#1694555
  - Resolves: rhbz#1700704
  - Resolves: rhbz#1700705


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
  - Improve help for clean-up option
  - Avoid pending DC fencing getting "stuck" in status display
  - Rebase on upstream 1.1.23-rc1
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1787749
  - Resolves: rhbz#1792492


author: Than Ngo <than@redhat.com> - 2.7.1-11
changelog:
  - Fixed CVE-2016-10713 - Out-of-bounds access in pch_write_line function 
  - Fixed CVE-2018-6952 - Double free of memory
  - Resolves: #1626473, honor new file mode 100755 when applying patches
  - Resolves: #1653294, Added virtual provides for bundled gnulib library


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
  - Fix hugepage metrics in pmdalinux (BZ 1730107)
  - Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
  - Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
  - Fix pcp-atopsar sample count command line argument (BZ 1764748)
  - Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
  - Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
  - Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
  - Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Petr Pisar <ppisar@redhat.com> - 10.23-2
changelog:
  - Handle memmory allocation failures in pcre2test tool
  - Fix a crash when finding a Unicode property for a character with a code
    point greater than 0x10ffff in UTF-32 library while UTF mode is disabled
    (upstream bug #2052)


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
  - Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
  - Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
  - Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Removed Source: HAM-logo.png
  -->  Remove TUV's branding logo
  - Added Source: pcs.ini
  -->  Config file for automated patch script
  - Added Patch: 99999-Use-SL-Favicon.patch
  -->  Remove TUV's branding logo
  - Added Source: HAM-logo.png
  -->  Add SL branding


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3.el7_3.1
changelog:
  - Explicitly close libcurl connections to prevent stalled TCP connections in CLOSE-WAIT state
  - Added support for loading DH keys from a file
  - Resolves: rhbz#1870551 rhbz#1888479


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Replaced Source: HAM-logo.png
  -->  Remove TUV's branding logo and use SL
  - Added Source: pcs.ini
  -->  Config file for automated patch script


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
  - Add SSL support to Net::SMTP (bug #1557574)
  - Do not overload ".." in Math::BigInt (bug #1497734)
  - Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Remi Collet <rcollet@redhat.com> - 5.4.16-43
changelog:
  - gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167
  - gd: Signed Integer Overflow gd_io.c CVE-2016-10168


author: Remi Collet <rcollet@redhat.com> - 5.4.16-41
changelog:
  - gd: fix integer overflow in _gd2GetHeader() resulting in
    heap overflow CVE-2016-5766
  - gd: fix integer overflow in gdImagePaletteToTrueColor()
    resulting in heap overflow CVE-2016-5767
  - mbstring: fix double free in _php_mb_regex_ereg_replace_exec
    CVE-2016-5768


author: Remi Collet <rcollet@redhat.com> - 5.4.16-47
changelog:
  - fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584
  - fix out-of-bounds read in base64_decode_xmlrpc CVE-2019-9024
  - fix reflected XSS in phar 404 page CVE-2018-5712
  - fix reflected XSS in phar 403 and 404 error pages CVE-2018-10547


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-15
changelog:
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404173 - user-cert-add --serial CLI request to secure port
    with remote CA shows authentication failure (edewata)
  - Bugzilla Bug #1404175 -  pki ca-cert-request-submit fails presumably because
    of missing authentication even if it should not require any (edewata)
  - Bugzilla Bug #1404178 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-base] (edewata)
  - Bugzilla Bug #1404172 - Unable to install subordinate CA with HSM in FIPS
    mode (edewata)
  - Bugzilla Bug #1403689 - pkispawn does not change default ecc key size from
    nistp256 when nistp384 is specified in spawn config (jmagne)
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1386257 - Changes to target.agent.approve.list parameter is
    not reflected in the TPS Web UI [pki-tps] (edewata)
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - Bugzilla Bug #1395479 -  TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-16
changelog:
  - Separate original patches into RHEL and RHCS portions
  - ## RHEL 7.3.z Batch Update 2
  - Bugzilla Bug #1404176 - logging properties and man pages (edewata)
  - Bugzilla Bug #1405328 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - ## RHCS 9.1.z Batch Update 2
  - Bugzilla Bug #1395479 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1404900 - RHCS logging properties (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.3.3-17
changelog:
  - ## RHCS 9.1.z Batch Update 3
  - Bugzilla Bug #1391207 - Automatic recovery of encryption cert - CA and TPS
    tokendb shows different certificate status (cfu)
  - ## RHEL 7.3.z Batch Update 3
  - Bugzilla Bug #1417063 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field. (cfu)
  - Bugzilla Bug #1417064 - Unable to search certificate requests using the
    latest request ID (edewata)
  - Bugzilla Bug #1417065 - CA Certificate Issuance Date displayed on CA website
    incorrect (alee)
  - Bugzilla Bug #1417066 - update to 7.3 IPA with otpd bugfixes, tomcat will
    not finish start, hangs (ftweedal)
  - Bugzilla Bug #1417067 - pki-tomcat for 10+ minutes before generating cert
    (edewata)
  - Bugzilla Bug #1417190 - Problem with default AJP hostname in IPv6
    environment. (edewata)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-9
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1393633 - Creating symmetric key (sharedSecret)
    using tkstool is failing when RHEL 7.3 is in FIPS mode. (jmagne)
  - Bugzilla Bug #1419756 - CC: allow CA to process pre-signed CMC
    non-signing certificate requests (cfu)
  - Bugzilla Bug #1419777 - CC: allow CA to process pre-signed CMC
     revocation non-signing cert requests (cfu)
  - Bugzilla Bug #1458047 - change the way aes clients refer to
    aes keysets (alee)
  - Bugzilla Bug #1458055 - dont reuse IVs in the CMC code
    (alee)
  - Bugzilla Bug #1460028 - In keywrap mode, key recovery on
    KRA with HSM causes KRA to crash (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-10
changelog:
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1458043 - Key recovery on token fails with
    invalid public key error on KRA (alee)
  - Bugzilla Bug #1460764 - CC: CMC: check HTTPS client
    authentication cert against CMC signer (cfu)
  - Bugzilla Bug #1461533 - Unable to find keys in the p12 file after
    deleting the any of the subsystem certs from it (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 10.4.1-11
changelog:
  - Resolves: rhbz #1469432
  - ##########################################################################
  - RHEL 7.4:
  - ##########################################################################
  - Bugzilla Bug #1469432 - CMC plugin default change
  - Resolves CVE-2017-7537
  - Fixes BZ #1470948


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) 
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-2
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing
    Certificate Request [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.16 in RHCS 9.5


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
    per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
    Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
    the CA is Down [cfu]
  - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
    Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-21
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 15):
  - ##########################################################################
  - Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
    debug level set to maximum [RHEL 7.9.z] (cfu)
  - Bugzilla Bug #2082717 - SCEP manual approval failure (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-22
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
  - setfiles: Mention customizable types in restorecon man page (#1260238)
  - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
  - semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
  - semanage: Fix fcontext help message (#1499259)
  - semanage: Improve semanage-user.8 man page (#1079946)
  - semodule: Improve man page (#1337192)


author: Petr Lautrbach <plautrba@redhat.com> 2.5-7
changelog:
  - fixfiles: Pass -n to restorecon for fixfiles check
  - sepolicy: Check get_rpm_nvr_list() return value
  - Don't use subprocess.getstatusoutput() in Python 2 code
  - semanage: Add auditing of changes in records
  - Remove unused 'q' from semodule getopt string


author: Petr Lautrbach <plautrba@redhat.com> 2.5-8
changelog:
  - audit2allow: tests should use local copy not system
  - audit2allow: remove audit2why so that it gets symlinked
  - semanage: fix man page and help message for import option
  - semanage: fix error message for fcontext -m
  - semanage: Fix semanage fcontext -D
  - semanage: Correct fcontext auditing
  - semanage: Default serange to "s0" for port modify
  - semanage: Use socket.getprotobyname for protocol
  - semanage: fix modify action in node and interface


author: Petr Lautrbach <plautrba@redhat.com> 2.5-9
changelog:
  - sandbox: create a new session for sandboxed processes - CVE-2016-7545
  - sandbox: do not try to setup directories without -X or -M


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Petr Kubat <pkubat@redhat.com> - 9.2.18-1
changelog:
  - update to 9.2.18 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-18.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-17.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-16.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Chris Lumens <clumens@redhat.com> - 1.99.66.18-1
changelog:
  - Add tests for the new firewall option. (clumens)
    Related: rhbz#1526486
  - Use RHEL7_Firewall instead of F28_Firewall. (clumens)
    Related: rhbz#1526486
  - Port the F20 firewall test from master. (clumens)
    Related: rhbz#1526486
  - firewall: add --use-system-defaults arg to command (dusty)
    Resolves: rhbz#1526486


author: David Cantrell <dcantrell@redhat.com> - 1.99.66.19-1
changelog:
  - Add use action to nvdimm command. (rvykydal)
    Resolves: rhbz#1590319
  - Add nvdimm command (rvykydal)
    Resolves: rhbz#1590319


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-57
changelog:
  - Fix implicit declaration warnings of functions added by patches 147 and 265
  Resolves: rhbz#1441237


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
  - Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
    a one-to-one Pid -> process mapping
  Resolves: rhbz#1579432


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 2.0.0-2
changelog:
  - Use python2- prefix for Fedora dependencies if possible
  - Use parallel make to build documentation


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.0.0-3
changelog:
  - Remove examples-directory from Source tarball due to possible
    licensing issues
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511222


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
  - Deactivate incomplete VGs along with everything else. (dlehman)
    Resolves: rhbz#1554224
  - Work around udev timing issues. (dlehman)
    Resolves: rhbz#1592253
    Resolves: rhbz#1592191
  - nvdimm: don't crash on non-block devices (rvykydal)
    Related: rhbz#1280500
  - Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
    Related: rhbz#1558942
  - Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a function for identifying NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a singleton for NVDIMM namespaces management (vtrefny)
    Resolves: rhbz#1558942
  - Backport DependencyGuard from master (vtrefny)
    Related: rhbz#1558942
  - Ignore nvdimm devices unless configured in kickstart (rvykydal)
    Related: rhbz#1280500
  - Do not ignore nvdimm (pmemX) devices (rvykydal)
    Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
  - Remove dependency on libblockdev-nvdimm (vtrefny)
    Resolves: rhbz#1601557
  - Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
    Related: rhbz#1601557
  - Add version to the LUKS format (vtrefny)
    Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
  - Install ndctl when NVDIMMs are used. (dlehman)
    Related: rhbz#1600496
  - Escape dots in lvm filter devices (vtrefny)
    Resolves: rhbz#1614039


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.4.6-4
changelog:
  - Append python-botocore and python-jmespath bundled directories to
    search path where needed

    Resolves: rhbz#1509439


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
  - Reverted flawed patch for #1051427 (this reintroduces #1052102).
  - Spec cleanup (removed rhel < 7 specific stuff).
  - Update to 2.7.2.
  Resolves: rhbz#1052777


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.4.16-3
changelog:
  - Bundle python-keyring
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511228


author: Pavel Vomacka <pvomacka@redhat.com> - 0.7.5-8
changelog:
  - Resolves: #1438668 DNS forwarder address added during IPA installation
    shouldn't add IP-Address '0.0.0.0'


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-4
changelog:
  - Add a dependency on python2-pyasn1. It used to be a dependency
    of python2-cryptography, but it is not the case with newer versions.
    (RHBZ #1559133)


author: Jake Hunsaker <jhunsake@redhat.com> - 2.1.1-9
changelog:
  - Fix a security flaw (CVE-2018-1000805) in Paramiko's server
    mode (does not effect client mode).
    Backported from 2.1.6
    Resolves rhbz#1637366


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Lumír Balhar <lbalhar@redhat.com> - 3-31
changelog:
  - Converting specfile from F28 to RHEL7
  - Move the macros to the standard RHEL7 macro location at /etc/rpm/,
    instead of Fedora's location at /usr/lib/rpm/macros.d/
  - Import the macros.python{,2} files from the python-devel package where they
    resided until now, and Conflict with that old version of python-devel
  - Import the macros.pybytecompile from Fedora rawhide / RHEL8
  Resolves: rhbz#1660579


author: Miro Hrončok <mhroncok@redhat.com> - 3-32
changelog:
  - %python_provide: Obsolete and provide python36- from python3-
  - %python_provide: Provide python3- from python36-
  Resolves: rhbz#1702719


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.1.13-1
changelog:
  - Fix "python2-s3transfer" from EPEL issue by adding it to Obsoletes
  - Rebase to v0.1.13 to fix missing "max_bandwidth" issue

    Resolves: rhbz#1576985
    Resolves: rhbz#1578083


author: Pino Toscano <ptoscano@redhat.com> 1.24.52-1
changelog:
  - tito: update rhel-7.9 releaser (ptoscano@redhat.com)
  - managercli: fix RestlibException reporting for get_current_owner()
    (ptoscano@redhat.com)
  - refresh: avoid ExceptionMapper in case of RestlibException
    (ptoscano@redhat.com)
  - tests: repair attach cases in SCA mode (ptoscano@redhat.com)
  - 2097672: Fixed expected message for manual attach case (jajerome@redhat.com)
  - 2097672: [1.28] Improve warning message (auto-attach in SCA mode)
    (jhnidek@redhat.com)
  - 2097672: [RFE][1.28] Improve the message, when SCA is enabled
    (jhnidek@redhat.com)
  - Reverting disabling AutoAttach() and PoolAttach() in SCA mode
    (jhnidek@redhat.com)
  - cache: fix typo in debug message (ptoscano@redhat.com)
  - 2182768: Disallowed attaching using D-Bus in SCA mode (jhnidek@redhat.com)
  - 2182768: Disallowed attaching pool in SCA mode: (jhnidek@redhat.com)
  - 1928072: Print warning message and don't do auto-attach (jhnidek@redhat.com)
  - managercli: add a local get_current_owner() helper (ptoscano@redhat.com)
  - [1.24] Fix issue with locale and D-Bus method GetStatus; (jhnidek@redhat.com)
  - Make code Python 2 compatible. (jhnidek@redhat.com)
  - 2060101: [1.24] Print correct status, when access mode has changed
    (jhnidek@redhat.com)
  - ENT-5542: Build package using GitHub Actions (mhorky@redhat.com)
  - Fix failing tests (mhorky@redhat.com)
  - tests: drop test_po_files.py (ptoscano@redhat.com)
  - Ignore failing tests (mhorky@redhat.com)
  - ENT-3759: Test on GitHub Actions (mhorky@redhat.com)
  - Alter import of rhsm.config functions (mhorky@redhat.com)
  - Add dependency constraints (mhorky@redhat.com)
  - Handle tests in containers better (mhorky@redhat.com)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: subscription-manager_spec-dont-run-rhsm.patch
  -->  Since we don't provide rhsm, don't bother running it
  - Added Source: subscription-manager.ini
  -->  Config file for automated patch script


author: Lumír Balhar <lbalhar@redhat.com> - 12.1.0-7
changelog:
  - Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
  Resolves: rhbz#1813439 rhbz#1813447
  - Remove useless macros definitions


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
  - Rebase to version 15.1.0
  - Disable automatic downloads from pypi on new venv creation
  Resolves: rhbz#1461154


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
  - Add three new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1643829


author: Christian Heimes <cheimes@redhat.com> - 1.7.2-1
changelog:
  - Update to 1.7.2
  - Disable pytest.deprecated_call() tests
  - Remove versioned pytest
  - Add build requirements pytz


author: John Dennis <jdennis@redhat.com> - 2.0.1-8
changelog:
  - add missing Obsoletes for prior python-oauthlib package,
    replaced by python2-oauthlib
    Resolves: rhbz#1401784


author: John Dennis <jdennis@redhat.com> - 0.8.0-5
changelog:
  - BuildRequires had python-requests but the Requires was still referencing
    python2-requests which is not yet provided in RHEL 7.4.,
    also add the missing version dependency on python-requests.
    Resolves: rhbz#1401783


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.2.6-10
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
  - Security fix for CVE-2023-24329
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2173917


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-3
changelog:
  - Converting pip specfile from F28 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled building of docs, because we don't ship its build dependencies in
    RHEL7
  - Updated to a newer version of tests to match the package version
  - Backported Patch3 and Patch4 from Fedora
  Resolves: rhbz#1660573


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 6-2
changelog:
  - Modifying python-rpm-generators from F29 to be used in RHEL7
  - The regex in pythondist.attr has been modified to only match Python 3
    modules, so that we do not affect the building of python2 files in RHEL7 at
    this late stage
  - Removed python.attr and pythondeps.sh files, because they are contained in
    rpm-build in RHEL7 and we do not want to modify them
  - the pythondist.attr and pythondistdeps.py are completely new, therefore we
    don't need to conflict with anything in RHEL7
  Resolves: rhbz#1660578


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
  - SRPM renamed from python-setuptools to python3-setuptools
  - Package prepared to contain only Python 3 version
  Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 0.31.1-4
changelog:
  - Converting specfile from F29 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled tests (by setting the bootstrap on - see note)
  - Removed python-wheel-wheel package with the wheel of wheel
  Resolves: rhbz#1660574


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.8
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.9
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.10
changelog:
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1460179]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1460179]
  - Resolves: bz#1460179
    (CVE-2017-9524 qemu-kvm: Qemu: nbd: segmentation fault due to client non-negotiation [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.1
changelog:
  - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1393042]
  - kvm-hw-i386-regenerate-checked-in-AML-payload-RHEL-only.patch [bz#1392027]
  - kvm-SPEC-file-flip-the-build-from-IASL-to-checked-in-AML.patch [bz#1392027]
  - Resolves: bz#1392027
    (shutdown rhel 5.11 guest failed and stop at "system halted")
  - Resolves: bz#1393042
    (system_reset should clear pending request for error (IDE))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.2
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1393484]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1393484]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1393484]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1393484]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1393484]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1393484]
  - kvm-virtio-add-virtqueue_rewind.patch [bz#1393484]
  - kvm-virtio-balloon-fix-stats-vq-migration.patch [bz#1393484]
  - Resolves: bz#1393484
    ([RHEL7.3] KVM guest shuts itself down after 128th reboot)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.3
changelog:
  - kvm-net-check-packet-payload-length.patch [bz#1398217]
  - Resolves: bz#1398217
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.4
changelog:
  - kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1420049]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418232]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418232]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418232]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418232]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418232]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418232]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418232]
  - Resolves: bz#1418232
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-7.3.z])
  - Resolves: bz#1420049
    (system_reset should clear pending request for error (virtio-blk))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.5
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420490]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420490]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420490]
  - Resolves: bz#1420490
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.6
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1430059]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1430059]
  - kvm-cirrus-add-option-to-disable-blitter.patch [bz#1430059]
  - kvm-cirrus-fix-cirrus_invalidate_region.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1430059]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1430059]
  - Resolves: bz#1430059
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-7.3.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-126.el7_3.7
changelog:
  - kvm-char-serial-cosmetic-fixes.patch [bz#1452332]
  - kvm-char-serial-Use-generic-Fifo8.patch [bz#1452332]
  - kvm-char-serial-serial_ioport_write-Factor-out-common-co.patch [bz#1452332]
  - kvm-char-serial-fix-copy-paste-error-fifo8_is_full-vs-em.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-check.patch [bz#1452332]
  - kvm-char-serial-Fix-emptyness-handling.patch [bz#1452332]
  - kvm-serial-poll-the-serial-console-with-G_IO_HUP.patch [bz#1452332]
  - kvm-serial-change-retry-logic-to-avoid-concurrency.patch [bz#1452332]
  - kvm-qemu-char-ignore-flow-control-if-a-PTY-s-slave-is-no.patch [bz#1452332]
  - kvm-serial-check-if-backed-by-a-physical-serial-port-at-.patch [bz#1452332]
  - kvm-serial-reset-thri_pending-on-IER-writes-with-THRI-0.patch [bz#1452332]
  - kvm-serial-clean-up-THRE-TEMT-handling.patch [bz#1452332]
  - kvm-serial-update-LSR-on-enabling-disabling-FIFOs.patch [bz#1452332]
  - kvm-serial-only-resample-THR-interrupt-on-rising-edge-of.patch [bz#1452332]
  - kvm-serial-make-tsr_retry-unsigned.patch [bz#1452332]
  - kvm-serial-simplify-tsr_retry-reset.patch [bz#1452332]
  - kvm-serial-separate-serial_xmit-and-serial_watch_cb.patch [bz#1452332]
  - kvm-serial-remove-watch-on-reset.patch [bz#1452332]
  - Resolves: bz#1452332
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-139.el7
changelog:
  - kvm-char-change-qemu_chr_fe_add_watch-to-return-unsigned.patch [bz#1451470]
  - Resolves: bz#1451470
    (RHEL 7.2 based VM (Virtual Machine) hung for several hours apparently waiting for lock held by main_loop)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-140.el7
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1456983]
  - Resolves: bz#1456983
    (Character device regression due to missing patch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7
changelog:
  - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745]
  - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]
  - kvm-serial-fixing-vmstate-for-save-restore.patch [bz#1452067]
  - kvm-serial-reinstate-watch-after-migration.patch [bz#1452067]
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1451614]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1451614]
  - Resolves: bz#1451614
    (CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4])
  - Resolves: bz#1452067
    (migration can confuse serial port user)
  - Resolves: bz#1455745
    (Backport fix for broken logic that's supposed to ensure memory slots are page aligned)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.1
changelog:
  - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107]
  - Resolves: bz#1468107
    (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.2
changelog:
  - kvm-virtio-net-dynamic-network-offloads-configuration.patch [bz#1482468]
  - kvm-Workaround-rhel6-ctrl_guest_offloads-machine-type-mi.patch [bz#1482468]
  - Resolves: bz#1482468
    (KVM: windows guest migration from EL6 to EL7 fails. [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.3
changelog:
  - kvm-bswap.h-Remove-cpu_to_32wu.patch [bz#1501294]
  - kvm-hw-use-ld_p-st_p-instead-of-ld_raw-st_raw.patch [bz#1501294]
  - kvm-vga-Start-cutting-out-non-32bpp-conversion-support.patch [bz#1501294]
  - kvm-vga-Remove-remainder-of-old-conversion-cruft.patch [bz#1501294]
  - kvm-vga-Separate-LE-and-BE-conversion-functions.patch [bz#1501294]
  - kvm-vga-Rename-vga_template.h-to-vga-helpers.h.patch [bz#1501294]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1501294]
  - kvm-vga-drop-line_offset-variable.patch [bz#1501294]
  - kvm-vga-Add-mechanism-to-force-the-use-of-a-shadow-surfa.patch [bz#1501294]
  - kvm-vga-handle-cirrus-vbe-mode-wraparounds.patch [bz#1501294]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501294]
  - Resolves: bz#1501294
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.4
changelog:
  - kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501120]
  - Resolves: bz#1501120
    (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.5
changelog:
  - kvm-vfio-pci-Only-mmap-TARGET_PAGE_SIZE-regions.patch [bz#1515110]
  - Resolves: bz#1515110
    (Regression in QEMU handling for sub-page MMIO BARs for vfio-pci devices [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-154.el7
changelog:
  - kvm-virtio-net-validate-backend-queue-numbers-against-bu.patch [bz#1460872]
  - kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1411490]
  - kvm-qxl-add-migration-blocker-to-avoid-pre-save-assert.patch [bz#1536883]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
  - Resolves: bz#1460872
    (Aborted(core dumped) when booting guest with "-netdev tap....vhost=on,queues=32")
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-155.el7
changelog:
  - kvm-qdev-Fix-assert-in-PCI-address-property-when-used-by.patch [bz#1538866]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534691]
  - kvm-savevm-Improve-error-message-for-blocked-migration.patch [bz#1536883]
  - kvm-savevm-fail-if-migration-blockers-are-present.patch [bz#1536883]
  - Resolves: bz#1534691
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)
  - Resolves: bz#1538866
    (qemu will coredump after executing info qtree)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7
changelog:
  - kvm-vnc-Fix-qemu-crashed-when-vnc-client-disconnect-sudd.patch [bz#1527405]
  - kvm-fix-full-frame-updates-for-VNC-clients.patch [bz#1527405]
  - kvm-vnc-update-fix.patch [bz#1527405]
  - kvm-vnc-return-directly-if-no-vnc-client-connected.patch [bz#1527405]
  - kvm-buffer-add-buffer_move_empty.patch [bz#1527405]
  - kvm-buffer-add-buffer_move.patch [bz#1527405]
  - kvm-vnc-kill-jobs-queue-buffer.patch [bz#1527405]
  - kvm-vnc-jobs-move-buffer-reset-use-new-buffer-move.patch [bz#1527405]
  - kvm-vnc-zap-dead-code.patch [bz#1527405]
  - kvm-vnc-add-vnc_width-vnc_height-helpers.patch [bz#1527405]
  - kvm-vnc-factor-out-vnc_update_server_surface.patch [bz#1527405]
  - kvm-vnc-use-vnc_-width-height-in-vnc_set_area_dirty.patch [bz#1527405]
  - kvm-vnc-only-alloc-server-surface-with-clients-connected.patch [bz#1527405]
  - kvm-ui-fix-refresh-of-VNC-server-surface.patch [bz#1527405]
  - kvm-ui-move-disconnecting-check-to-start-of-vnc_update_c.patch [bz#1527405]
  - kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527405]
  - kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527405]
  - kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527405]
  - kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527405]
  - kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527405]
  - kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527405]
  - kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527405]
  - kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527405]
  - kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527405]
  - kvm-io-skip-updates-to-client-if-websocket-output-buffer.patch [bz#1518711]
  - Resolves: bz#1518711
    (CVE-2017-15268 qemu-kvm: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
  - Resolves: bz#1527405
    (CVE-2017-15124 qemu-kvm: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.1
changelog:
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1567913]
  - kvm-vga-fix-region-calculation.patch [bz#1567913]
  - Resolves: bz#1567913
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.2
changelog:
  - kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574075]
  - Resolves: bz#1574075
    (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.3
changelog:
  - kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1584363]
  - kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1584363]
  - Resolves: bz#1584363
    (CVE-2018-3639 qemu-kvm: hw: cpu: AMD: speculative store bypass [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.4
changelog:
  - kvm-target-i386-introduce-kvm_put_one_msr.patch [bz#1596302]
  - kvm-apic-fix-2.2-2.1-migration.patch [bz#1596302]
  - kvm-x86-lapic-Load-LAPIC-state-at-post_load.patch [bz#1596302]
  - kvm-apic-drop-debugging.patch [bz#1596302]
  - kvm-apic-set-APIC-base-as-part-of-kvm_apic_put.patch [bz#1596302]
  - Resolves: bz#1596302
    (Windows 2012 Guest hangs after live migration with RTC clock stopped. [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.5
changelog:
  - kvm-multiboot-bss_end_addr-can-be-zero.patch [bz#1549824]
  - kvm-multiboot-Remove-unused-variables-from-multiboot.c.patch [bz#1549824]
  - kvm-multiboot-Use-header-names-when-displaying-fields.patch [bz#1549824]
  - kvm-multiboot-fprintf-stderr.-error_report.patch [bz#1549824]
  - kvm-multiboot-Reject-kernels-exceeding-the-address-space.patch [bz#1549824]
  - kvm-multiboot-Check-validity-of-mh_header_addr.patch [bz#1549824]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586248]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586248]
  - Resolves: bz#1549824
    (CVE-2018-7550 qemu-kvm: Qemu: i386:  multiboot OOB access while loading kernel image [rhel-7.5.z])
  - Resolves: bz#1586248
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7
changelog:
  - kvm-scsi-disk-support-reporting-of-rotation-rate.patch [bz#1583807]
  - kvm-ide-support-reporting-of-rotation-rate.patch [bz#1583807]
  - kvm-ide-avoid-referencing-NULL-dev-in-rotational-rate-se.patch [bz#1583807]
  - kvm-slirp-Correct-size-check-in-m_inc.patch [bz#1586253]
  - Resolves: bz#1583807
    ([DELL EMC 7.6 FEAT] option to mark virtual block device as rotational/non-rotational)
  - Resolves: bz#1586253
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7_6.1
changelog:
  - kvm-i386-Deprecate-arch-facilities-and-make-it-block-liv.patch [bz#1664792]
  - Resolves: bz#1664792
    (mode="host-model" VMs include broken "arch-facilities" flag name [qemu-kvm] [rhel-7.6.z])


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 1.5.3-160.el7_6.2
changelog:
  - kvm-target-i386-define-md-clear-bit-rhel.patch
  - Resolves: bz#1693216
    (qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7_6.3
changelog:
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1669067]
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669067]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669067]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669067]
  - Resolves: bz#1669067
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-165.el7
changelog:
  - kvm-Fix-eax-for-cpuid-leaf-0x40000000.patch [bz#1709495]
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669068]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669068]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669068]
  - Resolves: bz#1669068
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-7.7])
  - Resolves: bz#1709495
    (Change CPUID[0x40000000].EAX from 0 to KVM_CPUID_FE...ATURES (0x40000001))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-166.el7
changelog:
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7
changelog:
  - Reverting kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.1
changelog:
  - kvm-qxl-check-release-info-object.patch [bz#1732337]
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734748]
  - Resolves: bz#1732337
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7] [rhel-7.7.z])
  - Resolves: bz#1734748
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.2
changelog:
  - kvm-target-i386-Merge-feature-filtering-checking-functio.patch [bz#1730606]
  - kvm-target-i386-Isolate-KVM-specific-code-on-CPU-feature.patch [bz#1730606]
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1730606]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1730606]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1730606]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1730606]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1730606]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1730606]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1730606]
  - kvm-Remove-arch-capabilities-deprecation.patch [bz#1730606]
  - Resolves: bz#1730606
    ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.3
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771960]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771960]
  - Resolves: bz#1771960
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.4
changelog:
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1755333]
  - Resolves: bz#1755333
    ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-171.el7
changelog:
  - kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638471]
  - kvm-Add-missing-brackets-to-CPUID-0x80000008-code.patch [bz#1760607]
  - Resolves: bz#1638471
    ([Intel 7.8 Feat] qemu-kvm Introduce Cascade Lake (CLX) cpu model)
  - Resolves: bz#1760607
    (Corrupted EAX values due to missing brackets at CPUID[0x800000008] code)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
  - Resolves: bz#1771961
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
  - Resolves: bz#1791560
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7_8.1
changelog:
  - kvm-util-add-slirp_fmt-helpers.patch [bz#1798970]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798970]
  - Resolves: bz#1798970
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.8.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
  - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
  - kvm-slirp-disable-tcp_emu.patch [bz#1791679]
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
  - Resolves: bz#1791679
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
  - Resolves: bz#1800515
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
  - Resolves: bz#1802215
    (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
  - Resolves: bz#1810408
    (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
  - kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
  - Resolves: bz#1837565
    (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
  - Resolves: bz#1869693
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
  - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
  - kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
  - Resolves: bz#1842923
    (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
  - Resolves: bz#1860960
    (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
  - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
  - Resolves: bz#1884997
    (qemu-kvm FTBFS on rhel7.9)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.4
changelog:
  - kvm-ide-atapi-check-logical-block-address-and-read-size-.patch [bz#1917449]
  - Resolves: bz#1917449
    (CVE-2020-29443 qemu-kvm: QEMU: ide: atapi: OOB access while processing read commands [rhel-7.9.z])


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-14
changelog:
  * Mon May 02 2016 Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-13
  - Prefer adwaita-qt theme over gtk
    Resolves: bz#1332094


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-1
changelog:
  - Update to 4.8.7 (+ sync with Fedora)
    Resolves: bz#1484361

  - Don't close Qt apps in Gnome on shutdown dialog
    Resolves: bz#1378865


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: redhat-rpm-config.ini
  -->  Config file for automated patch script
  - Added Patch: redhat-rpm-config-recognize-scientific-linux.patch
  -->  Scientific Linux is an Enterprise Linux, modify the script to know this


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.18
changelog:
  - db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check

    Resolves: rhbz#2127477


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.3-31
changelog:
  - Backport missing infra for --noconfig option (#1406611)
  - As a side-effect, this also makes --noghost work as intended


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
  - Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-36
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing mmkubernetes halt after pod deletition
    resolves: rhbz#1622767


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-37
changelog:
  RHEL 7.7 ERRATUM
  - edited patch fixing mmkubernetes halt after pod deletition
    (covscan found an issue in previous version)
    resolves: rhbz#1622767
  - added patch stopping flooding logs with journald errors
    resolves: rhbz#1632211
  - added patch stopping flooding logs with symlink false-positives
    resolves: rhbz#1685901
  - added patch stopping memory leak when processing internal msgs
    resolves: rhbz#1666365
  - added documentation patch with info about CRI-O to mmkubernetes
    resolves: rhbz#1625935


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-38
changelog:
  RHEL 7.7 ERRATUM
  - added patch increasing max path size preventing buffer overflow
    with too long paths
    resolves: rhbz#1656860


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
  RHEL 7.8 ERRATUM
  - added patch resolving crash on wrong MsgProperty
    resolves: rhbz#1549706
  - added patch resolving CVE in pmaixforward module
    resolves: rhbz#1768320
  - added patch resolving CVE in pmcisconames module
    resolves: rhbz#1768323
  - added patch implementing file ID for imfile
    resolves: rhbz#1763746
  - added patch fixing omelasticsearch with ES 6.X
    resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
  RHEL 7.8 ERRATUM
  - fixed fsync patch to actually revognize the new option
    resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
  RHEL 7.8 ERRATUM
  - edited patch file ID for imfile to not log useless errors
    also improved file-id behavior to adress newly found problems
    resolves: rhbz#1763746


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-35
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
  - Fix escape sequence injection vulnerability in API response handling.
  - Prohibit arbitrary code execution when installing a malicious gem.
  - Fix escape sequence injection vulnerability in errors.
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch
    Resolves: rhbz#1699283


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
  - Kill bundled certificates.
  - Add macros to edit files lists in .gemspec
  - Fix buffer under-read in String#unpack
    Resolves: CVE-2018-8778
  - Fix HTTP response splitting in WEBrick
    Resolves: CVE-2017-17742
  - Fix DoS by large request in WEBrick
    Resolves: CVE-2018-8777
  - Fix directory traversal by poisoned NULL byte in Dir.
    Resolves: CVE-2018-8780
  - Fix file and directory creation with directory traversal.
    Resolves: CVE-2018-6914
  - Fix socket creation by poisoned NULL byte.
    Resolves: CVE-2018-8779
  - Fix: return default path with nonexistent home dir
  - Fix flags not propagated in Array#pack and String#unpack.
    Resolves: CVE-2018-16396
  - Fix strictly interpret octal fields in tar headers.
    Resolves: CVE-2018-1000075
  - Fix a security error for duplicate files in a package.
    Resolves: CVE-2018-1000076
  - Enforce URL validation on spec homepage attribute.
    Resolves: CVE-2018-1000077
  - Mitigate XSS vulnerability in homepage attribute.
    Resolves: CVE-2018-1000078
  - Prevent Path Traversal issue during gem installation.
    Resolves: CVE-2018-1000079
  - Fix unsafe Object Deserialization Vulnerability in gem owner.
    Resolves: CVE-2018-1000074
  - Refresh expired certificates.
  - Fix path traversal when writing to a symlinked basedir outside of the root
    Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
    Resolves: CVE-2019-8322
  - Fix escape sequence injection vulnerability in API response handling.
    Resolves: CVE-2019-8323
  - Prohibit arbitrary code execution when installing a malicious gem.
    Resolves: CVE-2019-8324
  - Fix escape sequence injection vulnerability in errors.
    Resolves: CVE-2019-8325
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Jan Černý <jcerny@redhat.com> - 0.1.43-12
changelog:
  - Make aide and smart card rules not applicable to containers (RHBZ#1711893)
  - Added rule dconf_db_up_to_date to ensure dconf databases are up-to-date (RHBZ#1631378)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: scap-security-guide_spec-add-all-el-stigs.patch
  -->  Package all EL scap guidelines, not just TUV
  - Added Source: scap-security-guide.ini
  -->  Config file for automated patch script
  - Added Patch: 0004-revert-drop-rebuilds.patch
  -->  Upstream droped rebuilds, put them back in


author: Watson Sato <wsato@redhat.com> - 0.1.49-12
changelog:
  - CIS Profile (RHBZ#1821633)
    - Make sure boot target is multi-user.target when xorg package is removed
    - Add CIS Profile content attribution to Center for Internet Security


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: scap-security-guide_spec-add-all-el-stigs.patch
  -->  Package all EL scap guidelines, not just TUV
  - Added Source: scap-security-guide.ini
  -->  Config file for automated patch script
  - Added Patch: 0005-rename-in-new-location.patch
  -->  Make sure the branding is right


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.52-1
changelog:
  - Update to the latest upstream release (RHBZ#1665233)
  - Update RHEL7 DISA STIG to V2R8 (RHBZ#1665233)


author: Watson Sato <wsato@redhat.com> - 0.1.54-2
changelog:
  - Remove Kickstart for not shipped profile (RHBZ#1497415)
  - Fix STIG id reference format for sshd_x11_use_localhost (RHBZ#1921643)


author: Watson Sato <wsato@redhat.com> - 0.1.57-7
changelog:
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix name of antivirus package in STIG profile (RHBZ#2066321)
  - Update RHEL7 DISA STIG profile to v3r7 (RHBZ#2079217)


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
  - Update to the latest upstream release (RHBZ#2116359)
  - Fix SSH Key permissions (RHBZ#2021258)
  - Remove PCI-DSS Benchmark(RHBZ2038165)
  - Updated source of CVE data feed(RHBZ#2028432)
  - Improved alignment with DISA's RHEL7 STIG(RHBZ#1967950)
  - Update RHEL7 STIG profile to v3r8 (RHBZ#2112939)
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix smartcard_auth rule for systems installed without authconfig (RHBZ#2116359)
  - Fix check of enable_fips_mode on s390x (RHBZ#2116359)
  - Fix applicability of pam_pkcs11 and grub2 rules on s390x (RHBZ#2116359)


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2158410)
  - Update RHEL7 STIG profile to V3R10 (RHBZ#2152657)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2123284)
  - Fix remediation of audit watch rules (RHBZ#2123367)
  - Fix check firewalld_sshd_port_enabled (RHBZ#2158410)
  - Fix accepted control flags for pam_pwhistory (RHBZ#2158410)
  - Unselect rule logind_session_timeout (RHBZ#2158410)
  - Add support rainer scripts in rsyslog rules (RHBZ#2170038)


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
  - Rebase to the latest upstream release (RHBZ#2221694)
  - Make IPv6 related rules applicable only in case IPv6 is actually enabled. (RHBZ#2210276)
  - update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155793)
  - Correct URL used to download CVE checks. (RHBZ#2223817)


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
  - Rebase to a new upstream release 0.1.72 (RHEL-25251)
  - Include filter to dracut files in audit_rules_privileged_commands rule (RHEL-11938)


author: Rui Matos <rmatos@redhat.com> - 3.8.0-5
changelog:
  - Fix for "seahorse-nautilus broken by glib2 regression related to
    SIGCHLD warnings"
  - Resolves: #1093123


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.13
changelog:
  - Allow systemd container to read/write usermodehelperstate
  Resolves: rhbz#1408126
  - Allow glusterd_t to bind on glusterd_port_t udp ports.
  Resolves: rhbz#1408128


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.16
changelog:
  - Allow openvswitch read script state.
  - Allow openvswitch exec hostname and readinitrc_t files
  Resolves: rhbz#1430751


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-102.1
changelog:
  - Allow sssd_selinux_manager_t to manage also dir class.
  Resolves: rhbz#1380687
  - Add interface seutil_manage_default_contexts_dirs()
  Resolves: rhbz#1380687


author: Petr Lautrbach <plautrba@redhat.com> - 3.13.1-102.3
changelog:
  - Use selinux-policy-migrate-local-changes.sh instead of migrateStore* macros
  Resolves: rhbz#1383450
  - Add selinux-policy-migrate-local-changes service
  Resolves: rhbz#1383450


author: Miroslav Grepl <mgrepl@redhat.com> - 3.13.1-102.4
changelog:
  - Allow GlusterFS with RDMA transport to be started correctly. It requires ipc_lock capability together with rw permission on rdma_cm device.
  Resolves:#1386620
  - Allow glusterd to get attributes on /sys/kernel/config directory.
  Resolves:#1386621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-164
changelog:
  - Allow couple rules needed to start targetd daemon with SELinux in enforcing mode
  Resolves: rhbz#1424621
  - Add interface lvm_manage_metadata
  Resolves: rhbz#1424621


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166
changelog:
  - Add new boolean gluster_use_execmem
  Resolves: rhbz#1469027
  - Allow cluster_t and glusterd_t domains to dbus chat with ganesha service
  Resolves: rhbz#1468581


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.6
changelog:
  - Allow tomcat domain to connect to mssql port
  Resolves: rhbz#1500697
  - Add keepalived domain setpgid capability
  Resolves: rhbz#1500813


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.7
changelog:
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  Resolves: rhbz:#1513075


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Add interface apache_read_tmp_dirs()
  - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs
  Resolves: rhbz#1622602


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Allow tomcat_domain to read /dev/random
  Resolves: rhbz#1631666
  - Allow neutron_t domain to use pam
  Resolves: rhbz#1630318


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.3
changelog:
  - Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.4
changelog:
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1638427


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.5
changelog:
  - Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.6
changelog:
  - Allow nova_t domain to use pam
  Resolves: rhbz:#1645270
  - sysstat: grant sysstat_t the search_dir_perms set
  Resolves: rhbz#1645271


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-252.4
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1766095


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-8
changelog:
  - fix group id for tape in /etc/group (should be 33) (#1433020)
  - provide a way how to override set envvars through sh.local file(#1344007)
  - provide a way how to override set ennvars through csh.local file


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-10
changelog:
  - fix crudp name in /etc/protocols (#1566469)
  - do not list /sbin/nologin and /usr/sbin/nologin in /etc/shells
    (#1571104)


author: Bastien Nocera <bnocera@redhat.com> - 1.8-3
changelog:
  + shared-mime-info-1.8-3
  - Remove triggers, they're not supported in RHEL 7.4's RPM
  Resolves: #1433916


author: Bastien Nocera <bnocera@redhat.com> - 1.8-4
changelog:
  + shared-mime-info-1.8-4
  - Fix CSV files being associated with LibreOffice Math instead
    of LibreOffice Calc
  - Resolves: #1438589


author: Peter Jones <pjones@redhat.com> - 15-6
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: shim-spec_efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: securebootca.cer
  -->  Use the FNAL SL signing certificate
  - Added Source: shim.ini
  -->  Config file for automated patch script


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Peter Jones <pjones@redhat.com> - 15.6-3.el7
changelog:
  - Patch to work around upstream issue #533
    Related: CVE-2020-14372
  - Run the test suite during the build, to be sure.


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: shim-spec_efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: securebootca.cer
  -->  Use the FNAL SL signing certificate
  -->  SECURE-BOOT-KEY-fnal-sl7-exp-2025-06-09
  - Added Source: shim.ini
  -->  Config file for automated patch script


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
  - CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1942937


author: Jake Hunsaker <jhunsake@redhat.com> - 1.5-3
changelog:
  - Resolve race condition in cluster profile loading
  - Quote all options globally
  - RHBZ#1633515
  - RHBZ#1647955


author: Jiri Kucera <jkucera@redhat.com> - 14.4.1-7
changelog:
  - Fix CVE-2017-18189
    Upstream patch: https://sourceforge.net/p/sox/code/ci/09d7388c8ad5701ed9c59d1d600ff6154b066397/
    Resolves: #1553590


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-3
changelog:
  - Fix CVE-2018-11781 - Local user code injection in the meta rule syntax
  - Fix CVE-2017-15705 - Certain unclosed tags in crafted emails allow for
  - scan timeouts and resulting denial of service
  - Resolves: rhbz#1632998


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632998


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632999


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
  - Make connection error message more clear
    Resolves: rhbz#1365736
  - Improve audio debug
    Resolves: rhbz#1436249
  - Fix wrong encoding of transferred files
    Resolves: rhbz#1440206


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
  - Keepalive fix
    Resolves: rhbz#1719736
  - Fix hang on migration after password expired
    Resolves: rhbz#1761776


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-18
changelog:
  - Fix crash when connecting to VM using smartcard passthrough
    Resolves: rhbz#1340899
  - Fix hang after unredirecting a USB device
    Resolves: rhbz#1338752
  - Backport spice_qxl_set_max_monitors()
    Resolves: rhbz#1283202


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-20
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-1
changelog:
  - Rebase to spice-server 0.12.8
    Resolves: rhbz#1388947
    Resolves: rhbz#1377551
    Resolves: rhbz#1283202


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-2.3
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1572489


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
  - Don't mute Record channel on client reconnection
    Resolves: rhbz#1549132
  - Allow to configure TLS protocol versions and ciphers which SPICE will use for
    TLS communications
    Resolves: rhbz#1562213
  - Enable ECDH ciphers with OpenSSL 1.0
    Resolves: rhbz#1566597


author: Victor Toso <victortoso@redhat.com> - 0.14.0-17
changelog:
  - Fix 'Dependency failed for Activation socket' message
    Resolves: rhbz#1545212
  - Fix socket leak
    Resolves: rhbz#1650596


author: Victor Toso <victortoso@redhat.com> - 0.14.0-18
changelog:
  - Fix clipboard logs on requests for targets on grab from client
    Resolves: rhbz#1594876
  - Make some clipboard logs debug instead of error
    Resolves: rhbz#1686008


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15.1
changelog:
  - Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow
  - Resolves: #1829772 - CVE-2019-12525 squid: parsing of header
    Proxy-Authentication leads to memory corruption


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
  - Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
    code -- Remove support for Gopher protocol (CVE-2023-46728)
  - Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
    feature (CVE-2023-49285)
  - Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
    Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
    (CVE-2023-46724)
  - Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
    (CVE-2023-50269)
  - Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
    (CVE-2024-25617)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
  - Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
    a trusted client to perform HTTP Request Smuggling


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
  - RHEL 7.9.Z ERRATUM
  - defaults use_pty plus SELinux ROLE in user specification breaks terminal
    Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
  RHEL 7.9.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161222


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-19
changelog:
  - RHEL 7.3 erratum
    - removed INPUTRC from env_keep to prevent a potential info leak
    Resolves: rhbz#1340700


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p7-22
changelog:
  - Fixes CVE-2017-1000367 sudo: Privilege escalation in via improper get_process_ttyname() parsing [rhel-7.3.z]
    Resolves: rhbz#1455401


author: Martin Sehnoutka <msehnout@redhat.com> - 14:4.9.0-4
changelog:
  - Drop downstream patch (drop root privileges)
  - Add libcap-ng as a new build dependency
  - Related: #1262283


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Resolves: #1664648 - tcpdump post creates user and groups unconditionally, raising alerts in corporate environment


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - more clear formulation of man page note - previous note was a bit ambiguous


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-23
changelog:
  - Rebuild for xorg-x11-server CVEs
    Resolves: CVE-2022-4283 (bz#2154267)
    Resolves: CVE-2022-46340 (bz#2154261)
    Resolves: CVE-2022-46341 (bz#2154264)
    Resolves: CVE-2022-46342 (bz#2154262)
    Resolves: CVE-2022-46343 (bz#2154265)
    Resolves: CVE-2022-46344 (bz#2154266)


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-26
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15235
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15223


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-27
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415
  - CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18427


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-28
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-29
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20436
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20427
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20587
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21212


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-30
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20436


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-31
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20436
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20587


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-32
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-31006
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30976
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30993


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-9
changelog:
  - Resolves: rhbz#1362213 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368122


author: Coty Sutherland <csutherl@redhat.com> - 0:7.0.69-11
changelog:
  - Resolves: rhbz#1413591 CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402662 CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.69-12
changelog:
  - Resolves: rhbz#1441487 CVE-2017-5648 tomcat: Calls to application listeners did not use the appropriate facade object
  - Resolves: rhbz#1441480 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used
  - Resolves: rhbz#1459746 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
  - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
  - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
  - Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
  - Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
  - Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
  - Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2
changelog:
  - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
  - Resolves: rhbz#1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
  - Resolves: rhbz#1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
  - Resolves: rhbz#1470596 CVE-2017-5647 Add follow up revision


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.1-7
changelog:
  - Updated jss build and runtime dependencies
  - Bugzilla Bug #1596769 - Tomcatjss: Add support for TLS_*_SHA384
    ciphers (cfu)


author: Jack Magne <jmagne@redhat.com> 7.2.1-8
changelog:
  - Bugzilla Bug #1632618 - CC: tomcatjss: unable to enable OCSP checking
    from peer AIA extension [rhel-7.6.z] (jmagne)


author: Ray Strode <rstrode@redhat.com> 3.14.3-5
changelog:
  - Add more goo to the compat desktop file to prevent them
    from exposing in control-center
  Related: #1259292


author: Felipe Borges <feborges@redhat.com> -1.10.5-3
changelog:
  - Add osinfo ontology to the default TrackerNamespace
  - Whitelist "openat" sys call in seccomp
  - Resolves: #1435340


author: Carlos Garnacho <cgarnach@redhat.com> - 1.10.5-4
changelog:
  - Remove WITHOUT ROWID optimizations from fts5 to preserve compat with sqlite 3.7.x
  - Resolves: #1451669


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a.
    - Mongolia no longer observes DST. (BZ #1425214)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1414829)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018. 
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds. 
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018e-4
changelog:
  - Brazil moved the start of DST from the first Sunday in November
    to the third Sunday in November.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-3
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021d-1
changelog:
  - Rebase to tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
  - Do not search for DNSSEC info when domain-insecure is set
    for stub zone (#1678550)
  - Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
  - rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
  - make linking flags configurable from the specc file
  - set linking flags to use relro hardening
    Related: #1531116


author: Bastien Nocera <bnocera@redhat.com> - 0.99.7-1
changelog:
  - Update to 0.99.7
  - Add Bluetooth LE battery support
  - Fix critical action after resume from hibernate
    Resolves: #1584245


author: Victor Toso <victortoso@redhat.com> - 0.6-8
changelog:
  - Fix migration due lack of capabilities from source host
    Resolves: rhbz#1185167
  - New callback to drop isoc packets in order to avoid high memory
    consumption in the client
    Resolves: rhbz#1312913


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.111-3
changelog:
  - Added support for issuing fullness warnings via dmeventd
  - rhbz#1519307
  - Provided missing error code to text translation for vdoDumpConfig.
  - Resolves: rhbz#1595129
  - Improved error reporting when using pvcreate in the vdo script to check
    for pre-existing devices when creating a VDO volume.
  - Resolves: rhbz#1557464


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.120-3
changelog:
  - Improved error messages in the vdo script when failing to stop a device.
  - Resolves: rhbz#1511106
  - Improved man pages.
  - Resolves: rhbz#1572640
  - Modified vdo script to ignore (but preserve) unrecognised parameters in
    the vdo config file so that config files are compatible across versions.
  - Resolves: rhbz#1604060
  - Updated Ansible module to change block map cache size on existing volumes
  - Resolves: rhbz#1541170


author: - Andy Walsh <awalsh@redhat.com> - 6.1.2.38-3
changelog:
  - Fixed more error path memory leaks.
    - Resolves: rhbz#1609426
  - Improved man pages.
    - Resolves: rhbz#1636047
  - Improved checking for existing LVM physical volumes when formatting a new
    VDO volume.
    - Resolves: rhbz#1687797
  - Fixed a bug which would cause the default logical size to be 480 KB
    smaller than it could be without causing over-provisioning.
    - Resolves: rhbz#1532697
  - Removed extraneous man pages.
    - Resolves: rhbz#1643284
  - Allowed VDO backing devices to be specified by major:minor device number.
    - Resolves: rhbz#1637762
  - Improved behavior when attempting to create a VDO volume whose name conflicts
    with an existing dm target.
    - Resolves: rhbz#1588140
  - Modified vdo script to report fewer errors when removing a VDO which
    sits atop a missing device.
    - Resolves: rhbz#1535476


author: - Andy Walsh <awalsh@redhat.com> - 6.1.2.41-4
changelog:
  - Removed the VDO Ansible module and associated examples from this package.
    - Resolves: rhbz#1536515
  - Improved error messages from the vdo script.
    - Resolves: rhbz#1688481


author: - Andy Walsh <awalsh@redhat.com> - 6.1.3.4-4
changelog:
  - Added UUID filtering of underlying devices when running vdo create with
    the --force flag as this failed when run on certain PVs.
    - Resolves: rhbz#1707481


author: Ondrej Holy <oholy@redhat.com> - 3.22.0-6
changelog:
  - Do not restart service after unclean exit code
  - Do not listen all if invalid interface is provided
  - Resolves: #1546043, #1580577


author: Debarshi Ray <rishi@fedoraproject.org> - 0.46.1-1
changelog:
  - Update to 0.46.1
  - Drop upstreamed patches
  - Drop workaround for old GTK+ bug (#1238315)
  - Rebase downstream patches
  Resolves: #1387056


author: Debarshi Ray <rishi@fedoraproject.org> - 0.46.1-2
changelog:
  - Restore gnome-pty-helper
  - Add git.mk and other dependencies to regenerate the build scripts
  Resolves: #1443504


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-1
changelog:
  - Update to 2.14.7
  - Backport more of a11y fixes from upstream
  - Fix JSC crashes on big endian arches
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.14.7-2
changelog:
  - Fix a CLoop patch that was not correctly backported from upstream, causing
    crashes on big endian machines
  - Resolves: rhbz#1442160


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
  - Update to 2.20.4
  - Resolves: rhbz#1576544
  - WebKitWebProcess crashes when a11y is active
  - Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
  - webkitgtk4: Crash on Google login page when a11y is active
  - Resolves: rhbz#1503624
  - Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
  - Update to 2.20.5 - technically it was not necessary as the only difference
    between 2.20.4 and .5 was the revert of one change, that we already reverted
    while building 2.20.4. But it's better to stay with upstream.
  - Update the labels patch with the version that was pushed upstream.
  - Resolves: rhbz#1576544


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
  - Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
  - Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-10
changelog:
  - Fix memory leak when macsec MKA/PSK is used (rh #1500442)
  - Fix authentication failure when the MAC is updated externally (rh #1490885)
  - Let the kernel discard EAPOL if packet type is PACKET_OTHERHOST (rh #1434434)
  - Don't restart wpa_supplicant.service on package upgrade (rh #1505404)
  - Don't own a directory in /run/ (rh #1507919)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5.1
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Peter Hutterer <peter.hutterer@redhat.com> 2.24-1
changelog:
  - xkeyboard-config 2.24 (#1564615)
  - Revert the high-keycode patches to avoid conflicts with xkbcomp < 1.4


author: Ben Crocker <bcrocker@redhat.com> - 7.7-7
changelog:
  - Resolves: #1401684
  - (Rebase for RHEL 7.4)
  - Update the following tarballs:
  - x11perf	1.5.4	=>	1.6.0
  - xclipboard	1.1.2	=>	1.1.3
  - xclock	1.0.6	=>	1.0.7
  - xconsole	1.0.5	=>	1.0.6
  - xcursorgen	1.0.5	=>	1.0.6
  - xfd		1.1.1	=>	1.1.2
  - xfontsel	1.0.4	=>	1.0.5
  - xload		1.1.1	=>	1.1.2
  - xmag		1.0.5	=>	1.0.6
  - xwd		1.0.4	=>	1.0.6
  - xwud		1.0.3	=>	1.0.4


author: Hans de Goede <hdegoede@redhat.com> 7.7.1-1
changelog:
  - Update to latest git, this is the equivalent of 7.7.1 + fixes for use
    with xserver-1.19 (rhbz#1325613)
  - Rebuild against xserver-1.19


author: Peter Hutterer <peter.hutterer@redhat.com> 0.25.0-2
changelog:
  - Don't provide xorg-x11-drv-synaptics (#1413811)
  - Don't reassign libinput to wacom touchpads, that's left to the user
  - Don't assign to wacom tablets, tablets behave differently on RHEL7.4


author: Lyude Paul <lyude@redhat.com> 1.0.13-2
changelog:
  - nouveau-1.0.13-fix-pageflipping-with-atomic.patch:
    Fix broken pageflipping with RHEL 7.4 DRM backport kernel (#1428214)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: xorg-x11-server.ini
  -->  Config file for automated patch script
  - Replaced Source: 0001-linux-Make-platform-device-probe-less-fragile.patch
  -->  Resolve BZ1650634


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
  - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
    CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2109031, rhbz#2109033


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
  - CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
    CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
    CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18416
    Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21205
    Resolves: https://issues.redhat.com/browse/RHEL-20578
    Resolves: https://issues.redhat.com/browse/RHEL-20426
    Resolves: https://issues.redhat.com/browse/RHEL-20437
    Resolves: https://issues.redhat.com/browse/RHEL-21192
    Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
    Resolves: https://issues.redhat.com/browse/RHEL-31003
    Resolves: https://issues.redhat.com/browse/RHEL-30989
    Resolves: https://issues.redhat.com/browse/RHEL-30973
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Adam Jackson <ajax@redhat.com> - 7.5-21
changelog:
  - Sync with F25: xdpyinfo 1.3.2, xev 1.2.2, xlsatoms 1.1.2, xlsclients 1.1.3,
    xlsfonts 1.0.5, xvinfo 1.1.3


author: Hans de Goede <hdegoede@redhat.com> - 1.3.2-14
changelog:
  - Xclients: only try to start gnome classic session if installed
  - Resolves: rhbz#1078948
  - startx: Only specify vt argument automatically when run from a vt
  - Resolves: rhbz#1083188


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-1
changelog:
  - xinit 1.3.4
  - Drop xorg-x11-xinit-1.3.2-systemd-logind.patch (included upstream in 1.3.4)
  - Add patches from Fedora to fix automatically finding a free display-number
  - Resolves: rhbz#1194894


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-13
changelog:
  - Fix remote code execution vulnerability
  - Resolves: CVE-2021-21344
  - Resolves: CVE-2021-21345
  - Resolves: CVE-2021-21346
  - Resolves: CVE-2021-21347
  - Resolves: CVE-2021-21350


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-15
changelog:
  - Fix remote code execution vulnerabilities
  - Resolves: CVE-2021-39139
  - Resolves: CVE-2021-39140
  - Resolves: CVE-2021-39141
  - Resolves: CVE-2021-39144
  - Resolves: CVE-2021-39145
  - Resolves: CVE-2021-39146
  - Resolves: CVE-2021-39147
  - Resolves: CVE-2021-39148
  - Resolves: CVE-2021-39149
  - Resolves: CVE-2021-39150
  - Resolves: CVE-2021-39151
  - Resolves: CVE-2021-39152
  - Resolves: CVE-2021-39153
  - Resolves: CVE-2021-39154


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-44
changelog:
  - Add pre-transaction-actions plugin.
  - Resolves: bug#1470647
  - yum-builddep: add --define option.
  - Resolves: bug#1437636
  - verifytree: handle no @core group gracefully.
  - Resolves: bug#1349433
  - verifytree: fix handling of missing comps.
  - Resolves: bug#1333353


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-30
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix NULL dereference in cd (CVE-2017-18205)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
  - fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-9
changelog:
  - Fix covscan warning
  - "Variable "file" going out of scope leaks the storage it points to."
    has been introduced by the original version of 0001-fix-CVE-2018-7725.patch
  - Related: 1558596


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-11
changelog:
  - Fix CVE-2018-6541
  - Part of the original patch has already been applied in the past (CVE-2018-7726),
    so the bug should not be reproducible in a way described in the github 
    issue, even without this commit. Applying the rest of the original patch anyway.
  - https://github.com/gdraheim/zziplib/issues/16
  - Related: CVE-2018-6541


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-12
changelog:
  - Fix a directory traversal bug
  - unzip-mem should now strip all "../" prefixes from the archived files
  - Resolves: CVE-2018-17828


