# changelog

author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-22
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 17):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-25
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #2160355 - RA Separation by KeyType - Set Token Status
    [RHCS 9.7 bu 21] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-26
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 22):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 22):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-27
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 23):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 23):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.3-1
changelog:
  - Update to upstream version 2.3
  - Use apache-commons-compress for bzip2 (de)compression
  - Resolves: CVE-2012-2098


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.4.2-2
changelog:
  - Update to latest packaging guidelines
  - Remove MIT license (only applies to test cases not binary rpm)


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-17
changelog:
  - fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
  - Resolves: #1817743


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-18
changelog:
  - fix "CVE-2020-8945 proglottis/gpgme: Use-after-free in GPGME bindings during container image pull"
  - Resolves: #1806940


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-19
changelog:
  - fix "podman segfault upon doing buildah operations due to error handling message"
  - Resolves: #1853326


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-21
changelog:
  - fix "podman launches a container with systemd instance inside - bind mounts of systemd cgroup entries are being leaked in host mount namespace"
  - Resolves: #1860506


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-22
changelog:
  - revert regressions introduced by 0001-bump-github.com-containers-buildah-to-v1.11.5.patch
    regressed bugzilla list follows:
  - Related: #1817743, #1792243, #1784950


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-23
changelog:
  - fix "CVE-2020-14040 podman: golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash [rhel-7]"
  - Resolves: #1854715


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-25
changelog:
  - use proper patch to address "podman does not use $TMPDIR loading a tar file."
  - Resolves: #1877699


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-26
changelog:
  - fix "CVE-2020-14370 podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API [rhel-7]"
  - Resolves: #1881062


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-28
changelog:
  - fix "CVE-2021-20188 podman: container users permissions are not respected in privileged containers [rhel-7.9.z]"
  - Resolves: #1918282


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-30
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/c19e460)
  - Related: #2074089


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-32
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/aba15dd)


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-33
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/68af661)


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-35
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/e330751)


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-36
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/7667df8)


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
  - better autostart.patch, handle case were autospawn is disabled
    (or otherwise doesn't work, like for root user)
  - Resolves: #1269104


author: Wim Taymans <wtaymans@redhat.com> - 10.0-4
changelog:
  - Add support for usb audio in the Dell dock TB16
  - Add patches to improve default sinks
  - Resolves: #1457385


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: David Lehman <dlehman@redhat.com> - 0.61.15.67-1
changelog:
  - fcoe: remove /etc/fcoe dir if it exists before copying configuration
    (rvykydal)
    Resolves: rhbz#1482512
  - Find and remove stale LVM metadata immediately after creating md array.
    (dlehman)
    Resolves: rhbz#1223564
  - Add ability to specify vg by uuid for vgremove. (dlehman)
    Related: rhbz#1223564


author: David Lehman <dlehman@redhat.com> - 0.61.15.68-1
changelog:
  - Catch lvm metadata lookup failure in md post create. (dlehman)
    Related: rhbz#1223564
    Resolves: rhbz#1543579


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
  - Deactivate incomplete VGs along with everything else. (dlehman)
    Resolves: rhbz#1554224
  - Work around udev timing issues. (dlehman)
    Resolves: rhbz#1592253
    Resolves: rhbz#1592191
  - nvdimm: don't crash on non-block devices (rvykydal)
    Related: rhbz#1280500
  - Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
    Related: rhbz#1558942
  - Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a function for identifying NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a singleton for NVDIMM namespaces management (vtrefny)
    Resolves: rhbz#1558942
  - Backport DependencyGuard from master (vtrefny)
    Related: rhbz#1558942
  - Ignore nvdimm devices unless configured in kickstart (rvykydal)
    Related: rhbz#1280500
  - Do not ignore nvdimm (pmemX) devices (rvykydal)
    Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
  - Remove dependency on libblockdev-nvdimm (vtrefny)
    Resolves: rhbz#1601557
  - Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
    Related: rhbz#1601557
  - Add version to the LUKS format (vtrefny)
    Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
  - Install ndctl when NVDIMMs are used. (dlehman)
    Related: rhbz#1600496
  - Escape dots in lvm filter devices (vtrefny)
    Resolves: rhbz#1614039


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.73-1
changelog:
  - Use --yes when calling pvresize (vtrefny)
    Related: rhbz#1657000
  - Fix typo in partitioning test cleanup. (dlehman)
    Related: rhbz#1657000
  - Remove selinux test that doesn't do anything meaningful. (dlehman)
    Related: rhbz#1657000
  - Improve parsing of mdadm detail output. (dlehman)
    Related: rhbz#1657000
  - Update btrfs tests to use sufficiently large loop devices. (dlehman)
    Related: rhbz#1657000
  - vfat labels apparently cannot contain lower case characters. (dlehman)
    Related: rhbz#1657000
  - Check label format regardless of mechanism used to set it. (dlehman)
    Related: rhbz#1657000
  - Adapt to presence or absence of python-mock. (dlehman)
    Related: rhbz#1657000
  - Fixed KS forcing zerombr onto RO disk (japokorn)
    Resolves: rhbz#1544425
  - Tell LVM to wipe cachepool metadata when attaching the cachepool (vtrefny)
    Resolves: rhbz#1643531
  - Add dependency on python-six (vtrefny)
    Resolves: rhbz#1647173


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.1.13-1
changelog:
  - Fix "python2-s3transfer" from EPEL issue by adding it to Obsoletes
  - Rebase to v0.1.13 to fix missing "max_bandwidth" issue

    Resolves: rhbz#1576985
    Resolves: rhbz#1578083


author: Lumír Balhar <lbalhar@redhat.com> - 12.1.0-7
changelog:
  - Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
  Resolves: rhbz#1813439 rhbz#1813447
  - Remove useless macros definitions


author: Tomas Orsava <torsava@redhat.com> - 1.10.1-3
changelog:
  - Added a patch that shows a custom error message when a FILE passed to
    virtualenv to be used as 'home dir' already exists and is NOT a directory.
  Resolves: rhbz#1306513


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
  - Rebase to version 15.1.0
  - Disable automatic downloads from pypi on new venv creation
  Resolves: rhbz#1461154


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
  - Add three new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1643829


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
  - Security fix for CVE-2023-24329
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2173917


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-170.el7
changelog:
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749735]
  - kvm-target-i386-Merge-feature-filtering-checking-functio.patch [bz#1709971]
  - kvm-target-i386-Isolate-KVM-specific-code-on-CPU-feature.patch [bz#1709971]
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1709971]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1709971]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1709971]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1709971]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1709971]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1709971]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1709971]
  - kvm-Remove-arch-capabilities-deprecation.patch [bz#1709971]
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1714791]
  - Resolves: bz#1709971
    ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm)
  - Resolves: bz#1714791
    ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm)
  - Resolves: bz#1749735
    (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-171.el7
changelog:
  - kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638471]
  - kvm-Add-missing-brackets-to-CPUID-0x80000008-code.patch [bz#1760607]
  - Resolves: bz#1638471
    ([Intel 7.8 Feat] qemu-kvm Introduce Cascade Lake (CLX) cpu model)
  - Resolves: bz#1760607
    (Corrupted EAX values due to missing brackets at CPUID[0x800000008] code)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
  - Resolves: bz#1771961
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
  - Resolves: bz#1791560
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
  - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
  - kvm-slirp-disable-tcp_emu.patch [bz#1791679]
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
  - Resolves: bz#1791679
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
  - Resolves: bz#1800515
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
  - Resolves: bz#1802215
    (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
  - Resolves: bz#1810408
    (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
  - kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
  - Resolves: bz#1837565
    (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
  - Resolves: bz#1869693
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
  - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
  - kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
  - Resolves: bz#1842923
    (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
  - Resolves: bz#1860960
    (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
  - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
  - Resolves: bz#1884997
    (qemu-kvm FTBFS on rhel7.9)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.4
changelog:
  - kvm-ide-atapi-check-logical-block-address-and-read-size-.patch [bz#1917449]
  - Resolves: bz#1917449
    (CVE-2020-29443 qemu-kvm: QEMU: ide: atapi: OOB access while processing read commands [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.5
changelog:
  - kvm-dma-helpers-Initialize-DMAAIOCB-in_cancel-flag.patch [bz#2007036]
  - Resolves: bz#2007036
    (Memory leak when using dma_read/write with virtio-scsi)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.6
changelog:
  - kvm-rbd-avoid-qemu_rbd_snap_list-memory-leaks.patch [bz#2056725]
  - Resolves: bz#2056725
    (qemu-kvm leaks on qemu_rbd_snap_list)


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
  - Update to upstream v22.1 release with stable-v22 branch fixes
  - Add support for Broadcom 57500 RoCE adapter
  - Resolves: rhbz#1678274


author: Jarod Wilson <jarod@redhat.com> 22.4-1
changelog:
  - Update to v22.4 stable release
  - Support mlx5 scatter to CQE over DCT QP
  - Fix ibacm segfault on non-IB hardware
  - Resolves: rhbz#1715489
  - Resolves: rhbz#1712296


author: Sumit Bose <sbose@redhat.com> - 0.16.1-6
changelog:
  - Resolves: rhbz#1258745
  - Resolves: rhbz#1258488
  - Resolves: rhbz#1267563
  - Resolves: rhbz#1293390
  - Resolves: rhbz#1273924
  - Resolves: rhbz#1274368
  - Resolves: rhbz#1291924


author: Sumit Bose <sbose@redhat.com> - 0.16.1-10
changelog:
  Use current Samba options and read NetBIOS name from keytab
  - Resolves: rhbz#1484072
  - Resolves: rhbz#1370457


author: Sumit Bose <sbose@redhat.com> - 0.16.1-12
changelog:
  Fixes for RHEL-7.9
  - Resolves: rhbz#1625001
  - Resolves: rhbz#1625005
  - Resolves: rhbz#1638396
  - Resolves: rhbz#1714223
  - Resolves: rhbz#1832134


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-3
changelog:
  - Backport fixes for upstream bugs 1974 and 1975
  - Apply upstream PR1954 (record permanent MAC address for bond members)
  - Apply upstream PR2004 (support for custom network interface naming)
  - Backport fix for upstream bug 1926 (support for LACP bonding and teaming)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
  - Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
    Resolves: rhbz1631183
  - Apply upstream patch PR1885
    Partition information recorded is unexpected when disk has 4K block size
    Resolves: rhbz1610638
  - Apply upstream patch PR1887
    LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
    Resolves: rhbz1610647
  - Apply upstream patch PR1993
    Automatically exclude $BUILD_DIR from the backup
    Resolves: rhbz1655956
  - Require xorriso instead of genisoimage, it is now the preferred method
    and supports files over 4GB in size.
    Resolves: rhbz1462189


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
  - Backport fix for upstream issue 2187 (disklayout.conf file contains
    duplicate lines, breaking recovery in migration mode or when
    thin pools are used). PR2194, 2196.
    Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
  - Apply upstream PR2173 - Cannot restore using Bacula method
    due to "bconsole" not showing its prompt
    Resolves: rhbz1726982


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-11
changelog:
  - Apply upstream PR2122: add additional NBU library path to fix support for
    NetBackup 8.
    Resolves: rhbz1700807
  - Apply upstream PR212: Be safe against empty docker_root_dir (issue 1989)
    Resolves: rhbz1711123, where ReaR can not create a backup in rescue mode,
    because it thinks that the Docker daemon is running and hits the problem
    with empty docker_root_dir.
  - Apply upstream PR2223 and commit 36cf20e to avoid an empty string in the
    list of users to clone, which can lead to bash overflow with lots of users
    and groups per user and to wrong passwd/group files in the rescue system.
    Resolves: rhbz1692575
  - Backport of Upstream fix for issue 2035: /run is not mounted in the rescue
    chroot, which causes LVM to hang, especially if rebuilding initramfs.
    Resolves: rhbz1697815
  - Backport upstream PR 2218: avoid keeping build dir on errors
    by default when used noninteractively
    Resolves: rhbz1693608


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-15
changelog:
  - Backport PR2608:
    Fix setting boot path in case of UEFI partition (ESP) on MD RAID
    Resolves: rhbz1945869
  - Backport PR2625 & 2675
    Prevents accidental backup removal in case of errors
    Resolves: rhbz1843585
  - Fix rsync error and option handling
    Fixes metadata storage when rsync user is not root
    Resolves: rhbz1947064
  - Changes for NetBackup (NBU) support, upstream PR2544
    Resolves: rhbz2031833
  - On POWER add bootlist & ofpathname to the list of required programs
    conditionally (bootlist only if running under PowerVM, ofpathname
    always except on PowerNV) - upstream PR2665, add them to package
    dependencies
    Resolves: rhbz1983008
  - On POWER mount /sys in the chroot, otherwise ofpathname does not work
    and we risk ending up with not instlaling the bootloader properly
    Resolves: rhbz1983000


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.8
changelog:
  - gcp-vpc-move-route, gcp-vpc-move-vip: add project parameter and
    make vpc_network parameter optional

    Resolves: rhbz#1913936


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.13
changelog:
  - SAPHana: use actual_mode from global.ini and fallback to mode when
    it's not set

    Resolves: rhbz#1855888


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.15
changelog:
  - gcp-pd-move/gcp-vpc-move-route/gcp-vpc-move-vip: dont fail with
    configuration rc when it might be a network hickup

    Resolves: rhbz#2042070


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.18
changelog:
  - db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check

    Resolves: rhbz#2127477


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-54
changelog:
  - aws-vpc-route53: new resource agent for AWS
  - aws-vpc-move-ip: add "routing_table_role" parameter
  - aws-vpc-move-ip: delete remaining route entries

    Resolves: rhbz#1759113
    Resolves: rhbz#1810466
    Resolves: rhbz#1828895


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-56
changelog:
  - sap-hana-scaleout: set default timeouts based on recommendations
    and a couple of bugfixes

    Resolves: rhbz#1829081


author: Pavel Cahyna <pcahyna@redhat.com> - 0-0.1.20170504
changelog:
  - Initial release.
  - kdump r. fe8bb81966b60fa8979f3816a12b0c7120d71140
  - postfix r. 43eec5668425d295dce3801216c19b1916df1f9b
  - selinux r. 1e4a21f929455e5e76dda0b12867abaa63795ae7
  - timesync r. 33a1a8c349de10d6281ed83d4c791e9177d7a141
  - tuned r. 2e8bb068b9815bc84287e9b6dc6177295ffdf38b
  - network r. 03ff040df78a14409a0d89eba1235b8f3e50a750


author: Pavel Cahyna <pcahyna@redhat.com> - 0.1-1
changelog:
  - Update to 0.1 (first upstream release).
  - Remove the tuned role, it is not ready yet.
  - Move the example playbooks to /usr/share/doc/rhel-system-roles/$SUBSYSTEM
    directly to get rid of an extra directory.
  - Depend on ansible.


author: Pavel Cahyna <pcahyna@redhat.com> - 0.2-1
changelog:
  - Update the networking role to version 0.2 (#1459203)
  - Version every role and the package separately. They live in separate repos
    and upstream release tags are not coordinated.


author: Pavel Cahyna <pcahyna@redhat.com> - 0.2-2
changelog:
  - Leave a copy of README and COPYING in every role's directory, as suggested by T. Bowling.
  - Move the network example inventory to the documentation directory together.
    with the example playbooks and delete the now empty "examples" directory.
  - Use proper reserved (by RFC 7042) MAC addresses in the network examples.


author: Pavel Cahyna <pcahyna@redhat.com> - 0.3-1
changelog:
  - Change the prefix to linux-system-roles., keeping compatibility
    symlinks.
  - Update the network role to dace7654feb7b5629ded0734c598e087c2713265:
    adds InfiniBand support and other fixes.
  - Drop a patch included upstream.


author: Pavel Cahyna <pcahyna@redhat.com> - 0.3-2
changelog:
  - We can't change directories to symlinks (rpm bug #447156) so keep the old
    names and create the new names as symlinks.


author: Pavel Cahyna <pcahyna@redhat.com> - 0.4-1
changelog:
  - network: update to b9b6f0a7969e400d8d6ba0ac97f69593aa1e8fa5:
    ensure that state:absent followed by state:up works (bz#1478910), and change
    the example IP adresses to the IANA-assigned ones.
  - SELinux: fix the case when SELinux is disabled (bz#1479546).


author: Pavel Cahyna <pcahyna@redhat.com> - 0.5-1
changelog:
  - SELinux: fix policy reload when SELinux is disabled on CentOS/RHEL 6
    (bz#1493574)
  - network: update to b856c7481bf5274d419f71fb62029ea0044b3ec1 :
    makes the network role idempotent (bz#1476053) and fixes manual
    network provider selection (bz#1485074).


author: Pavel Cahyna <pcahyna@redhat.com> - 0.6-1
changelog:
  - Drop hard dependency on ansible (#1525655), patch from Yaakov Selkowitz
  - Update the network role to version 0.4, solves bz#1487747, bz#1478576


author: Pavel Cahyna <pcahyna@redhat.com> - 0.6-2
changelog:
  - Document network role options: static routes, ethernet, dns
    Upstream PR#36, bz1550128, documents bz1487747 and bz1478576


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-5
changelog:
  - spec file improvement: Unify the source macros with deftag() and defcommit()
  - Update to upstream released versions and drop unnecessary patches.
  - Unify the spec file with Fedora (no functional changes intended).
  - Misc spec file comments fixes (by Mike DePaulo)
  - Fix rpmlint error by escaping a previous changelog entry with a macro (by Mike DePaulo)
  - Comply with Fedora guidelines by always using "cp -p" in %install (by Mike DePaulo)
  - Rebase network role - doc improvements, Fedora 29 and Ansible 2.7 support
  - Regenerate network role patch to apply without offset
  - Rebase kdump role to fix a forgotten edit, rhbz#1645633
  - Update timesync examples: add var prefix (rhbz#1642152), correct role prefix


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-7
changelog:
  - kdump: copy the dump target's public host key to the managed node known_hosts
    PR #22, rhbz#1651342


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-8
changelog:
  - Rebase the selinux role, fixes typo in tests, uncovered by Ansible 2.7,
    (rhbz#1651285) and lists all input variables of the selinux role in defaults
    to make Satellite aware of them (rhbz#1674000, PR#43)
  - Rebase the kdump role to fix check mode problems: rhbz#1716689
  - Rebase the timesync role: fixes check mode problems (rhbz#1716689)
    and lists all input variables in defaults (rhbz#1674000)
  - Rebase the network role: keeps the interface up for state: up
    if persistent_state is absent and solves problems with defining
    VLAN and MACVLAN interface types (issue #19) (rhbz#1686866)


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-10
changelog:
  - Update tests for the network role
  - Fix typo in a test for the timesync role
  - Rebase the network role to add support for device features (PR#115,
    rhbz#1696703) and atomic changes (PR#119, rhbz#1695161)
  - Add the storage role
  - Depend on python-jmespath as Ansible>2.8 will not ship it, rhbz#1774096


author: Pavel Cahyna <pcahyna@redhat.com> - 1.0-12
changelog:
  - Rebase the network role
    Resolves rhbz#1767177, rhbz#1842605, rhbz#1789813, rhbz#1724280
  - Tag tests suitable for Tier1 testing, rhbz#1732085
    In network role, do not use the tier1 tags, won't be needed.
  - Fix or workaround test problems in network role,
    rhbz#1842614, rhbz#1842619, rhbz#1842621
  - Set _python_bytecompile_errors_terminate_build to 0, otherwise
    brp-python-bytecompile chokes on network/tests/ensure_provider_tests.py


author: Noriko Hosoi <nhosoi@redhat.com> - 1.0.1-1
changelog:
  - Synchronize roles with rhel-8.4.0.
    Update roles kdump, selinux, timesync, network, and storage.
    Add new roles metrics, tlog, kernel_settings, logging, nbde_server,
    nbde_client, certificate, crypto_policies, sshd, ssh, and ha_cluster.
  - Synchronize spec file with rawhide's up to commit 6218fe9.
    Related: rhbz#1970165


author: Noriko Hosoi <nhosoi@redhat.com> - 1.0.1-2
changelog:
  - Fix an invalid indentation in the spec file.
    Related: rhbz#1970165
  - Mention bz1854189 here as it was fixed in backporting rhel-8.4.0.
    Related: rhbz#1854189
  - Remove gating.yaml which was introduced in backporting rhel-8.4.0.
    Related: rhbz#197016


author: Rich Megginson <rmeggins@redhat.com> - 1.6.5-1
changelog:
  - kernel_settings - Disable bootloader testing on EL9
    (Resolves rhbz#1991017)
    Related: rhbz#2029621


author: Rich Megginson <rmeggins@redhat.com> - 1.6.6-1
changelog:
  - logging, certificate - Instead of the archive module, use "tar" command for backup.
    (Resolves rhbz#1984182 (EL9))
    (Resolves rhbz#1987096 (EL8))
  - logging - Add a support for list value to server_host in the elasticsearch output
    (Resolves rhbz#1986460 (EL9))
    (Resolves rhbz#1986463 (EL8))
  - logging - tests_relp.yml; Can't detect any of the required Python libraries cryptography (>= 1.2.3) or PyOpenSSL (>= 0.6)
    (Resolves rhbz#1989962 (EL9))
    (Resolves rhbz#1990142 (EL8))
    Related: rhbz#2029621


author: Rich Megginson <rmeggins@redhat.com> - 1.6.7-1
changelog:
  - storage - tests_create_lvmvdo_then_remove fails - Module dm-vdo not found
    (Resolves rhbz#1991141 (EL8))
    (Resolves rhbz#1991062 (EL9))
  - storage - Get syntax errors in tests_lvm_errors.yml
    (Resolves rhbz#1990793 (EL8))
    (Resolves rhbz#1991142 (EL9))
    Related: rhbz#2029621


author: Rich Megginson <rmeggins@redhat.com> - 1.7.0-1
changelog:
  - drop support for Ansible 2.8 - min_ansible_version is now 2.9
    (Resolves rhbz#1989197 (EL9))
    (Resolves rhbz#1989199 (EL8))
  - sshd - fix rhel6 support - failed to validate: error:Missing Match criteria for all Bad Match condition
    (Resolves rhbz#1991598 (EL9))
    (Resolves rhbz#1990947 (EL8))
    Related: rhbz#2029621


author: Rich Megginson <rmeggins@redhat.com> - 1.7.1-1
changelog:
  - metrics - the bpftrace role does not properly configure bpftrace agent
    (Resolves rhbz#1994180 (EL9))
    (Resolves rhbz#1993240 (EL8))
    Related: rhbz#2029621


author: Rich Megginson <rmeggins@redhat.com> - 1.7.2-1
changelog:
  - logging - Update the certificates copy tasks
    (Resolves rhbz#1996777 (EL9))
    (Resolves rhbz#1994580 (EL8))
    Related: rhbz#2029621


author: Rich Megginson <rmeggins@redhat.com> - 1.7.3-1
changelog:
  - storage - revert the dm-vdo workaround fix for vdo testing
    (Resolves rhbz#1978488 (EL9))
    (Resolves rhbz#1991141 (EL8))
    Related: rhbz#2029621


author: Rich Megginson <rmeggins@redhat.com> - 1.7.3-2
changelog:
  - selinux - tag tests_selinux_disabled.yml with tests::avc
    (Resolves rhbz#1996315 (EL9))
    (Resolves rhbz#1996317 (EL8))
    Related: rhbz#2029621


author: Noriko Hosoi <nhosoi@redhat.com> - 1.7.3-4
changelog:
  - certificate - certificate: error traceback /tmp/certificate-tests-venv/bin/certreader2json
    Resolves: rhbz#2051758


author: Than Ngo <than@redhat.com> - 0.7.2-5
changelog:
  - always use ansible_hostname + ansible_domain instead of ansible_fqdn
  - use {{ ansible_hostname }}.{{ ansible_domain }} instead of {{ ansible_fqdn }}
  - added LC_ALL=C before commands for which the outputs are to be evaluated


author: Michal Ruprich - 3.1.2-4
changelog:
  - Related: #1432899 - removing dependencies on perl
  - using the bundled zlib.h(#1491582)
  - turning on upstream tests


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
  - Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-46
changelog:
  RHEL 7.8 ERRATUM
  - Support Intermediate Certificate Chains in rsyslog
    resolves: rhbz#1627799
  - fixed WorAroundJournalBug patch to not cause leaks
    resolves: rhbz#1744617
  - added patch fixing possible segfault in rate-limiter
    resolves: rhbz#1744682


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-47
changelog:
  RHEL 7.8 ERRATUM
  - edited imfile truncation detection patch with reression fix
    resolves: rhbz#1744856


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
  RHEL 7.8 ERRATUM
  - added patch resolving crash on wrong MsgProperty
    resolves: rhbz#1549706
  - added patch resolving CVE in pmaixforward module
    resolves: rhbz#1768320
  - added patch resolving CVE in pmcisconames module
    resolves: rhbz#1768323
  - added patch implementing file ID for imfile
    resolves: rhbz#1763746
  - added patch fixing omelasticsearch with ES 6.X
    resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
  RHEL 7.8 ERRATUM
  - fixed fsync patch to actually revognize the new option
    resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
  RHEL 7.8 ERRATUM
  - edited patch file ID for imfile to not log useless errors
    also improved file-id behavior to adress newly found problems
    resolves: rhbz#1763746


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-53
changelog:
  RHEL 7.9 ERRATUM
  - one more fix for file ID patch to extend to offline behavior
    resolves: rhbz#1806493
  - added patch resoving race in serialization resulting in crash
    resolves: rhbz#1778841


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-55
changelog:
  RHEL 7.9 ERRATUM
  - edited imfile file-id patch to not segfault on selinux block
    resolves: rhbz#1843992


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-57
changelog:
  RHEL 7.9 ERRATUM
  - added patch resolving buffer overflows in select() function
    resolves: rhbz#1858297


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
  - Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
    failures with newest openssl.
    Resolves: rhbz#1416123
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Extend 'gem_' macros for pre-release version support.
    Resolves: rhbz#1397390
  - Make symlinks for json gem.
    Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
  - Kill bundled certificates.
  - Add macros to edit files lists in .gemspec
  - Fix buffer under-read in String#unpack
    Resolves: CVE-2018-8778
  - Fix HTTP response splitting in WEBrick
    Resolves: CVE-2017-17742
  - Fix DoS by large request in WEBrick
    Resolves: CVE-2018-8777
  - Fix directory traversal by poisoned NULL byte in Dir.
    Resolves: CVE-2018-8780
  - Fix file and directory creation with directory traversal.
    Resolves: CVE-2018-6914
  - Fix socket creation by poisoned NULL byte.
    Resolves: CVE-2018-8779
  - Fix: return default path with nonexistent home dir
  - Fix flags not propagated in Array#pack and String#unpack.
    Resolves: CVE-2018-16396
  - Fix strictly interpret octal fields in tar headers.
    Resolves: CVE-2018-1000075
  - Fix a security error for duplicate files in a package.
    Resolves: CVE-2018-1000076
  - Enforce URL validation on spec homepage attribute.
    Resolves: CVE-2018-1000077
  - Mitigate XSS vulnerability in homepage attribute.
    Resolves: CVE-2018-1000078
  - Prevent Path Traversal issue during gem installation.
    Resolves: CVE-2018-1000079
  - Fix unsafe Object Deserialization Vulnerability in gem owner.
    Resolves: CVE-2018-1000074
  - Refresh expired certificates.
  - Fix path traversal when writing to a symlinked basedir outside of the root
    Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
    Resolves: CVE-2019-8322
  - Fix escape sequence injection vulnerability in API response handling.
    Resolves: CVE-2019-8323
  - Prohibit arbitrary code execution when installing a malicious gem.
    Resolves: CVE-2019-8324
  - Fix escape sequence injection vulnerability in errors.
    Resolves: CVE-2019-8325
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc10
changelog:
  - fix "RHEL 7.8: cleaning up mounts of Kubernetes service account secrets of deleted pods failing"
  - Resolves: #1823374


author: Isaac Boukris <iboukris@redhat.com> - 4.10.16-2
changelog:
  - resolves: #1828354 - add additioanl hostnames to the keytab
  - resolves: #1836427 - add dnshostname option net-ads-join


author: Andreas Schneider <asn@redhat.com> - 4.10.16-8
changelog:
  - resolves: #1878205 - Fix restarting winbind on package upgrade
  - resolves: #1892632 - Fix CVE-2020-14318
  - resolves: #1891687 - Fix CVE-2020-14323
  - resolves: #1879834 - Fix CVE-2020-1472
  - resolves: #1892313 - Fix memory leak in winbindd (wbinfo -u)
  - resolves: #1868917 - Fix %U substitution for 'valid users' option
  - resolves: #1853272 - Fix 'require_membership_of' documentation in
                         pam_winbind{.conf} manpage


author: Andreas Schneider <asn@redhat.com> - 4.10.16-14
changelog:
  - resolves: #1937867 - Fix possible core dump with printing support
  - resolves: #1930747 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.10.16-16
changelog:
  - resolves: #2019661 - Fix CVE-2016-2124
  - resolves: #2019673 - Fix CVE-2020-25717
  - resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl


author: Andreas Schneider <asn@redhat.com> - 4.10.16-18
changelog:
  - resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717
  - resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717
  - resolves: #2046148 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.10.16-19
changelog:
  - resolves: #2081649 - Fix idmap_rfc2307 and idmap_nss returning wrong
                         mapping for uid/gid conflict


author: Andreas Schneider <asn@redhat.com> - 4.10.13-1
changelog:
  - resolves: #1785121 - Rebase to vesion 4.10.13
  - resolves: #1791208 - Fix CVE-2019-14907
  - resolves: #1737888 - Fix manual libwbclient alternative settings
  - resolves: #1634057 - Return correct stat for SMB1 with POSIX extensions


author: Andreas Schneider <asn@redhat.com> - 4.10.15-1
changelog:
  - related: #1785121 - Rebase to version 4.10.15
  - resolves: #1828924 - Fix typo in pam_winbind documentation about require_membership_of
  - resolves: #1801496 - Add missing ctdb directories


author: Jan Grulich <jgrulich@redhat.com> - 0.98-7
changelog:
  - Do not wait for input from keyboard and read from file instead
    Resolves: bz#1188233
  - Add information about sapconf version
    Resolves: bz#1205269
  - Remove unnecessary installed package groups
    Resolves: bz#1193983
  - Check whether 99-sap-limits.conf file exists to prevent an error
    Resolves: bz#1205229
  - Add force mode
    Resolves: bz#1205691
  - Add yum-utils as dependency
    Resolves: bz#1220471


author: Than Ngo <than@redhat.com> - 0.98-8
changelog:
  - consider ntp configured via ntp package
    Resolves: bz#1228550
  - add correct parameter for repoquery
    Resolves: bz#1235608


author: Than Ngo <than@redhat.com> - 0.98-12
changelog:
  - sapconf does not identify EUS SAP channel a s a SAP channel
    Resolves: bz#1470563

  - sapconf does not check if limits are set before adding it's own entires
    Resolves: bz#1474024


author: Watson Sato <wsato@redhat.com> - 0.1.49-7
changelog:
  - Bug fixes on CIS profile (RHBZ#1821633)
    Added Ansible remediations
    Fixed CIS references
    Fixed integration issues with CIS profile


author: Watson Sato <wsato@redhat.com> - 0.1.49-9
changelog:
  - CIS Profile fixes (RHBZ#1821633)
    - Fix Ansible mount_option template
    - Add Ansible for ensure_logrotate_activated
    - Add warnings to rpm_verify_permissions and ownership about findindings that may need further inspection


author: Watson Sato <wsato@redhat.com> - 0.1.49-10
changelog:
  - CIS Profile fixes (RHBZ#1821633)
    - Fix Ansible mount_option template
    - Re-order rpm_verify_permissions to avoid file permission conflicts


author: Watson Sato <wsato@redhat.com> - 0.1.49-11
changelog:
  - HIPAA Profile improvement (RHBZ#1513087)
    - Add Ansible remediation for audit_rules_system_shutdown


author: Watson Sato <wsato@redhat.com> - 0.1.49-12
changelog:
  - CIS Profile (RHBZ#1821633)
    - Make sure boot target is multi-user.target when xorg package is removed
    - Add CIS Profile content attribution to Center for Internet Security


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.52-1
changelog:
  - Update to the latest upstream release (RHBZ#1665233)
  - Update RHEL7 DISA STIG to V2R8 (RHBZ#1665233)


author: Watson Sato <wsato@redhat.com> - 0.1.54-1
changelog:
  - Rebase to incorporate ANSSI Profile (RHBZ#1497415)
  - Update RHEL7 STIG profile to V3R2 (RHBZ#1921643)
  - Add Minimal, Intermediary and Enhanced ANSSI Profiles (RHBZ#1497415)


author: Watson Sato <wsato@redhat.com> - 0.1.54-2
changelog:
  - Remove Kickstart for not shipped profile (RHBZ#1497415)
  - Fix STIG id reference format for sshd_x11_use_localhost (RHBZ#1921643)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.54-5
changelog:
  - Create subpackage to hold ansible playbooks per rule (RHBZ#1966589)
  - Fix Bash remediation of dconf_gnome_login_retries (RHBZ#1967566)


author: Jan Černý <jcerny@redhat.com> - 0.1.57-1
changelog:
  - Rebase to the 0.1.57 upstream release
  - Update RHEL7 DISA STIG profile to v3r4 (RHBZ#1996678)
  - Split CIS profile (RHBZ#1953787)


author: Watson Sato <wsato@redhat.com> - 0.1.57-7
changelog:
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix name of antivirus package in STIG profile (RHBZ#2066321)
  - Update RHEL7 DISA STIG profile to v3r7 (RHBZ#2079217)


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
  - Update to the latest upstream release (RHBZ#2116359)
  - Fix SSH Key permissions (RHBZ#2021258)
  - Remove PCI-DSS Benchmark(RHBZ2038165)
  - Updated source of CVE data feed(RHBZ#2028432)
  - Improved alignment with DISA's RHEL7 STIG(RHBZ#1967950)
  - Update RHEL7 STIG profile to v3r8 (RHBZ#2112939)
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix smartcard_auth rule for systems installed without authconfig (RHBZ#2116359)
  - Fix check of enable_fips_mode on s390x (RHBZ#2116359)
  - Fix applicability of pam_pkcs11 and grub2 rules on s390x (RHBZ#2116359)


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2158410)
  - Update RHEL7 STIG profile to V3R10 (RHBZ#2152657)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2123284)
  - Fix remediation of audit watch rules (RHBZ#2123367)
  - Fix check firewalld_sshd_port_enabled (RHBZ#2158410)
  - Fix accepted control flags for pam_pwhistory (RHBZ#2158410)
  - Unselect rule logind_session_timeout (RHBZ#2158410)
  - Add support rainer scripts in rsyslog rules (RHBZ#2170038)


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
  - Rebase to the latest upstream release (RHBZ#2221694)
  - Make IPv6 related rules applicable only in case IPv6 is actually enabled. (RHBZ#2210276)
  - update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155793)
  - Correct URL used to download CVE checks. (RHBZ#2223817)


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
  - Rebase to a new upstream release 0.1.72 (RHEL-25251)
  - Include filter to dracut files in audit_rules_privileged_commands rule (RHEL-11938)


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
  - Multiple packages are installing files under /etc/tmpfiles.d
  - comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
  - Resolves: rhbz#1121958


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Update sudo_role_template() to allow caller domain to read syslog pid files
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command
  Resolves: rhbz#1765063


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-4
changelog:
  - temporary disable s390x arch due to #1773504 causing fuse-overlayfs
    failing to build - skopeo/contaners-common requires it


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-7
changelog:
  - fix "CVE-2020-8945 proglottis/gpgme: Use-after-free in GPGME bindings during container image pull"
  - Resolves: #1806944


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-10
changelog:
  - fix "CVE-2020-1702 skopeo: containers/image: Container images read entire image manifest into memory"
  - Resolves: #1810613


author: Jindrich Novy <jnovy@redhat.com> - 1:0.1.40-12
changelog:
  - fix "CVE-2020-14040 skopeo: golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash [rhel-7]"
  - Resolves: #1854716


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-8
changelog:
  - Fixed: #1473572
  - Changes of ID overrides now force clearing of affected SSSD cache entries on IPA master
  - Related: #1473577
  - Synchronize timeout-enabled code with ipa-extdom-extop


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1820124 When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1820122 ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED
  - Resolves: rhbz#1819018 ipa slapi-nis stack traces review request for LDAP server deadlock
  - Resolves: rhbz#1830894 Memory leak during search of idview overrides


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
  - CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1942937


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1978748
    Release adds following fixes:
    - Fix ID views integration
    - Fix base scope lookups
    - Bump NIS max dgram size to 8KB by default instead of 1KB
    - Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
  - Ignore updates from non-tracked subtrees during modify/modrdn/update
    to avoid deadlocks with retro changelog
  - Resolves: RHEL-11869


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-4
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1567944


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
  - Don't mute Record channel on client reconnection
    Resolves: rhbz#1549132
  - Allow to configure TLS protocol versions and ciphers which SPICE will use for
    TLS communications
    Resolves: rhbz#1562213
  - Enable ECDH ciphers with OpenSSL 1.0
    Resolves: rhbz#1566597


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-7
changelog:
  - Fix off-by-one error during guest-to-host memory address conversion
    Resolves: CVE-2019-3813
  - Add patch for upstream commit 48179332d9da0. This should help with corrupted
    spice-html5 displays
    Resolves: rhbz#1573739
  - Add missing minimum openssl version Requires for patch #24
    Resolves: rhbz#1627693


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
  - Keepalive fix
    Resolves: rhbz#1719736
  - Fix hang on migration after password expired
    Resolves: rhbz#1761776


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-16
changelog:
  - Resolves: #1738582 - CVE-2019-12525 squid: parsing of header 
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
  - Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
    a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
  - Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
    code -- Remove support for Gopher protocol (CVE-2023-46728)
  - Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
    feature (CVE-2023-49285)
  - Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
    Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
    (CVE-2023-46724)
  - Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
    (CVE-2023-50269)
  - Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
    (CVE-2024-25617)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-2
changelog:
  - Resolves: rhbz#1513371 - [abrt] [faf] sssd: raise(): /usr/libexec/sssd/sssd_be[PROXY] killed by 6
  - Resolves: rhbz#1568083 - subdomain lookup fails when certmaprule contains DN
  - Resolves: rhbz#1781539 - PKINIT with KCM does not work
  - Resolves: rhbz#1786341 - SSSD doesn't honour the customized ID view created in IPA
  - Resolves: rhbz#1709818 - override_gid did not work for subdomain.
  - Resolves: rhbz#1719718 - Validator warning issue : Attribute 'dns_resolver_op_timeout' is not allowed in section 'domain/REMOVED'. Check for typos
  - Resolves: rhbz#1787067 - sssd (sssd_be) is consuming 100 CPU, partially due to failing mem-cache
  - Resolves: rhbz#1822461 - background refresh task does not refresh updated netgroup entries
  - Added missing 'Requires' to resolves some of rpmdiff tool warnings


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-3
changelog:
  - Resolves: rhbz#1683946 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working setup


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-4
changelog:
  - Resolves: rhbz#1829806 - [Bug] Reduce logging about flat names
  - Resolves: rhbz#1800564 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-6
changelog:
  - Resolves: rhbz#1819013 - pam_sss reports PAM_CRED_ERR when providing wrong password for an existing IPA user, but this error's description is misleading
  - Resolves: rhbz#1800571 - Multiples Kerberos ticket on RHEL 7.7 after lock and unlock screen


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-7
changelog:
  - Resolves: rhbz#1835813 - sssd boots offline if symlink for /etc/resolv.conf is broken/missing
  - Resolves: rhbz#1837545 - Users must be informed better when internal WATCHDOG terminates process.


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-8
changelog:
  - Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
  - Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
                             It is done in two steps (two different nsupdate messages).


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-10
changelog:
  - Resolves: rhbz#1804005 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.1
changelog:
  - Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.2
changelog:
  - Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
  - just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.3
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.4
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete (again))


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.5
changelog:
  - Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
    (Previous attempt to fix this issue was incomplete (again))
  - just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.6
changelog:
  - Resolves: rhbz#1899593 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr() [rhel-7.9.z]
  - Resolves: rhbz#1888409 - sssd component logging is now too generic in syslog/journal [rhel-7.9.z]
  - Resolves: rhbz#1852659 - sssd service is starting even though it is disabled state [rhel-7.9.z]
  - Resolves: rhbz#1893443 - User lookups over the InfoPipe responder fail intermittently [rhel-7.9.z]
  - Resolves: rhbz#1871288 - krb5_child denies ssh users when pki device detected [rhel-7.9.z]
  - Resolves: rhbz#1853703 - Unexpected behavior and issue with filter_users/filter_groups option [rhel-7.9.z]
  - Resolves: rhbz#1756240 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains [rhel-7.9.z]
  - Resolves: rhbz#1851112 - LDAP bind can fail due to unconfigurable DNS server timeouts that inhibit SSSD failover [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.7
changelog:
  - Resolves: rhbz#1875514 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [rhel-7.9.z]
  - Resolves: rhbz#1772513 - SSSD is generating lot of LDAP queries in a very large environment [rhel-7.9.z]
  - Resolves: rhbz#1736845 - [RFE] Backporting certificate matching rules for files, AD and LDAP provider [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.8
changelog:
  - Resolves: rhbz#1910131 - sssd throwing error " Unable to parse name test' [1432158283]: The internal name format cannot be parsed" at debug_level 2 [rhel-7.9.z]
  - Resolves: rhbz#1922244 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0. [rhel-7.9.z]
  - Resolves: rhbz#1935685 - SSSD not detecting subdomain from AD forest (7.9z)
  - Resolves: rhbz#1945552 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-7.9.z]
  - Resolves: rhbz#1839972 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.9
changelog:
  - Resolves: rhbz#1988463 - Missing search index for `originalADgidNumber` [rhel-7.9.z]
  - Resolves: rhbz#1968330 - id lookup is failing intermittently
  - Resolves: rhbz#1964415 - Memory leak in the simple access provider
  - Resolves: rhbz#1985457 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.11
changelog:
  - Resolves: rhbz#1968316 - SSSD: User authentication failing after server reboot.
  - Resolves: rhbz#2000238 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#1984591 - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication (due to discovery of unexpected AD domains)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.12
changelog:
  - Resolves: rhbz#2006382 - IPA Intermittence fetching groups
  - Resolves: rhbz#2006866 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2031729 - IPA clients fail to resolve override group names.
  - Resolves: rhbz#2032867 - AD Domain in the AD Forest Missing after sssd latest update


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.13
changelog:
  - Resolves: rhbz#2079441 - SSSD update prompts for smartcard pin twice - After update to 7.9 [rhel-7.9.z]
  - Resolves: rhbz#2073352 - Use right sdap_domain in ad_domain_info_send [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.14
changelog:
  - Resolves: rhbz#2097014 - SSSD -> sssd_be and sssd_ifp coredump [rhel-7.9.z]
  - Resolves: rhbz#2107380 - sssd timezone issues sudonotafter [rhel-7.9.z]
  - Resolves: rhbz#2116207 - SSSD starting offline after reboot [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.15
changelog:
  - Resolves: rhbz#2149703 - smartcards: special characters must be escaped when building search filter [rhel-7.9.z]
  - Resolves: rhbz#2149902 - EMBARGOED CVE-2022-4254 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters [rhel-7.9.z]


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> 1.16.5-10.16
changelog:
  - Resolves: RHEL-16003 - sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy [rhel-7.9.z]


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-2
changelog:
  - Copy over changes in tests/ioctl_evdev-success.c (from cdd8206a
    "tests: test evdev bitset decoding more thoroughly")
    to tests-m32/ioctl_evdev-success.c and tests-mx32/ioctl_evdev-success.c
  - Copy over changes in tests/ioctl_evdev.c (from 5ee385e2
    "evdev: fix decoding of EVIOCGBIT(0, ...)") to tests-m32/ioctl_evdev.c
    and tests-mx32/ioctl_evdev.c
  - Resolves: #1746478


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
  - Include upstream patches that fix issues reported by covscan:
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing", and
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register".
  - Resolves: #1747524


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-5
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790052):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Add commit v5.4~97 "xlat: use unsgined type for mount_flags fallback values"
    (A leftover for #1747524).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Fix expected alignment for IPC tests (#1795261):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix incorrect ifname printing buffer size (#2028146):
    e27b0677 "print_ifindex: fix IFNAME_QUOTED_SZ definition".


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
  - RHEL-7.6 erratum
    Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
    Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
    Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
  - RHEL-7.8 erratum
    Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
  - RHEL 7.9.Z ERRATUM
  - defaults use_pty plus SELinux ROLE in user specification breaks terminal
    Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
  RHEL 7.9.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161222


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
  - add -f flag to force fdatasync() after sa file update (#1662094)
  - don't call filesystem count functions when we are not collecting fs statistics (#1670060)
  - skip autofs when gathering filesystem statistics (#1670060)
  - fix use of incorrect preposition in sar man page (#1624410)
  - fix CPU usage reporting (#1618688)


author: Nils Philippsen <nils@redhat.com> - 1.3.4-1
changelog:
  - don't ask libuser to create a home directory over an existing one (#908852,
    patch by Miloslav Trmač)
  - correct check if SELinux is enabled


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
  - core: when restarting services, don't close fds (#1803802)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
  - tests: add basic journal test (#1803802)
  - tests: add regression test for `systemctl restart systemd-journald` (#1803802)
  - tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
  - sd-bus: bump message queue size again (#1770158)
  - unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
  - add test for ExecStopPost (#1733998)
  - core: when restarting services, don't close fds (#1757704)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
  - tests: add basic journal test (#1757704)
  - tests: add regression test for `systemctl restart systemd-journald` (#1757704)
  - tests: add test that journald keeps fds over termination by signal (#1757704)
  - nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
  - journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
  - mount: don't propagate errors from mount_setup_unit() further up (#1804757)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
  - fix the fix for #1691511 (#1804757)
  - v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
  - Consider smb3 as remote filesystem (#1811700)
  - mount: don't add Requires for tmp.mount (#1813270)
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
  - sd-journal: remove the dead code and actually fix #14695 (#1812889)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
  - core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
  - run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
  - core: clarify that the CollectMode bus property is constant (#1817576)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
  - logind: check PolicyKit before allowing VT switch (#1797672)
  - timer: don't use persietent file timestamps from the future (#6823) (#1769923)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798503)
  - journal-remote: split-mode=host, remove port from journal filename (#1244691)
  - core: downgrade log message about inability to propagate cgroup release message (#1679934)
  - units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
  - set kptr_restrict=1 (#1689344)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
  - device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
  - core: don't update unit description if it is already set to the same value (#1793527)
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
  - core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
  - test: add a test/reproducer for BZ#1989245 (#1989245)
  - strv: fix buffer size calculation in strv_join_quoted() (#1989245)
  - install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb46-4
changelog:
  - Properly detect errors when writing backup files. (Closes: #80) (#81)
  - Read number of backup files to keep from file
  - config: defend on '/etc/target/backup' directory
  - config: backup when current config is different from recent backup copy
  - config: rename key 'kept_backups' as 'max_backup_files'
  - backup: global option to tune max no. of backup conf files


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.4-1
changelog:
  - Upgrade 1.9.4 release
  - Fixed bad day-of-week of first entry in changelog
  - Do not install on systems with efi partition
    See https://access.redhat.com/articles/2217041
    Resolves: rhbz#1275031
    Resolves: rhbz#1293526
    Resolves: rhbz#1307176
    Resolves: rhbz#1313876
    Resolves: rhbz#1332691


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.4-2
changelog:
  - Test for UEFI system with /sys/firmware/efi, rather than looking in
    the boot directory for an efi directory.
  - Allow install on UEFI platform, but with warning message, in order to
    permit completion of provisioning.
    Resolves: rhbz#1356571


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.6-3
changelog:
  Apply patches from upstream since realease of 1.9.6
    Resolves: rhbz#1515081
    Resolves: rhbz#1511798


author: Tony Camuso <tcamuso@redhat.com> - 1:1.9.12-1
changelog:
  - Upgrade to 1.9.12.
  - Removed EFI warning, since grub has been updated to use multiboot.
  - Add patch to revert "Disable GCC9 address-of-packed-member warning"
    While it was able to build locally with 'rhpkg local', the brew
    build failed, because the compiler on the brew systems did not
    recognized the new GCC9 command line flag:
    -Wno-address-of-packed-member
    Resolves: rhbz#1876747


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-9
changelog:
  - 'if statement' parsing fixed when the space is missing after ')'. (#1273892)
  - Quote backslashes properly to preserve them in `...` expressions. (#1319816)
  - Fix for tcsh being interruptible while waiting for child process. (#1269370)
  - Fix of memory leak when using the 'source' built-in command.      (#1273513)
  - Print error message on stderr (instead of stdout).                (#1273498)
  - Use GLIBC's malloc instead of builtin malloc.                     (#1315713)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-12
changelog:
  - Fix another regression in tcsh-6.18.01-quote-backslashes-properly.patch
    Related: #1334751

  - Fix regression in tcsh-6.18.01-use-stderr-upon-error.patch
    Related: #1273498


author: Martin Sehnoutka <msehnout@redhat.com> - 1:0.17-60
changelog:
  - Introduce new -i switch
  - ip addresses will be logged into utmp instead of hostname
  - Resolves: #1323094


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - more clear formulation of man page note - previous note was a bit ambiguous


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-14
changelog:
  - Fix rendering on big endian system
    Resolves: bz#1618777

    Do not automatically kill sessions
    Resolves: bz#1646889


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-23
changelog:
  - Rebuild for xorg-x11-server CVEs
    Resolves: CVE-2022-4283 (bz#2154267)
    Resolves: CVE-2022-46340 (bz#2154261)
    Resolves: CVE-2022-46341 (bz#2154264)
    Resolves: CVE-2022-46342 (bz#2154262)
    Resolves: CVE-2022-46343 (bz#2154265)
    Resolves: CVE-2022-46344 (bz#2154266)


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-26
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15235
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15223


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-27
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415
  - CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18427


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-28
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-29
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20436
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20427
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20587
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21212


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-30
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20436


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-31
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20436
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20587


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-32
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-31006
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30976
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30993


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
  - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
  - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
  - Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
  - Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
  - Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
  - Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12
changelog:
  - Resolves: rhbz#1367492 harden package permissions
  - Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
  - Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
  - Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
  - Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
  - Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: rhbz#1643654
    - used dmidecode only on x86 architectures
      resolves: rhbz#1688371
    - recommend: fixed to work without tuned daemon running
      resolves: rhbz#1687397


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-7
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739418


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-9
changelog:
  - Fixed SIGHUP handling
    Resolves: rhbz#1702724
  - Tune irqbalance service
    Resolves: rhbz#1720042
  - Added netcat requirement
    Resolves: rhbz#1746436
  - sysctl: made reapply_sysctl ignore configs from /usr
    Resolves: rhbz#1776149
  - profiles: define variables before use
    Resolves: rhbz#1781664


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-10
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1852253


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-3
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021d-1
changelog:
  - Rebase to tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
  - Rebase to tzdata-2022d
    - Palestine's DST transition will be on October 29, 2022,
      not October 28, 2022.
    - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
  - Rebase to tzdata-2022e
    - Jordan and Syria cancelled the DST transition planned
      for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
  - Added patch for build option "-Werror=format-security"
  - Added support of non-unicode non-latin charset
  - Fix print of non-ascii filenames
  - Fix troubles with symlinks for archives with many files
    Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
  - rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
  - make linking flags configurable from the specc file
  - set linking flags to use relro hardening
    Related: #1531116


author: Jakub Martisko <jamartis@redhat.com> - 6.0-23
changelog:
  - Disable the zipbomb detection patches
  - There were too many false positives for now, will reenable this later with an option to opt-out
  - Resolves: rhbz#2020318


author: Jakub Martisko <jamartis@redhat.com> - 6.0-24
changelog:
  - Reenable the zipbomb detection patches
  - Add environment variable that disables the zipbomb detection
  - Resolves: rhbz#2020318


author: Karel Zak <kzak@redhat.com> 2.23.2-59
changelog:
  - fix #1618711 - exec option in mount unable to override the implicit noexec in user option
  - fix #1616264 - Login to emergency shell failed


author: Karel Zak <kzak@redhat.com> 2.23.2-60
changelog:
  - fix #1664752 - Bull (Atos) server lands up in invalid stty settings on the serial console after boot preventing login


author: Karel Zak <kzak@redhat.com> 2.23.2-61
changelog:
  - #1203378 - Cannot use swapon with fallocated XFS swapfile
  - #1632944 - blkid/lsblk does not recognize exfat filesystem without a label
  - #1633657 - mount -a always tries to mount CIFS share subdir despite being already mounted
  - #1639465 - Bad formatting in agetty.8 man page
  - #1667942 - libsmartcols: scols_print_table_to_string() doesn't work
  - #1678451 - Unable to mount to a directory that matches a dm device under /dev


author: Karel Zak <kzak@redhat.com> 2.23.2-62
changelog:
  - fix #1734545 - blkid_get_dev() leak file descriptor to underlying block device
  - fix #1712768 - lsmem segfaults on ppc64 wih -o
  - fix #1690102 - setarch(8) does not check error return values properly.
  - fix #1734261 - lscpu not showing Physical socket, chips information


author: Karel Zak <kzak@redhat.com> 2.23.2-64
changelog:
  - fix #1788896 - Internal testsuite: libmount tests failed
  - fix #1802240 - systemd-udev segmentation fault in crc32() at lib/crc32.c (libblkid)
  - fix #1816183 - "mount -a" should ignore already mounted bind mounts.
  - fix #1747710 - please backport the "uid=forget" and "gid=forget" UDF mount options to libmount
  - fix #1784579 - RHEL-7: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit


author: Karel Zak <kzak@redhat.com> 2.23.2-65
changelog:
  - fix #1826719 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir
  - fix #1745657 - mismatch between spec file and uuidd runtime directory


author: Karel Zak <kzak@redhat.com> 2.23.2-65.el7_9.1
changelog:
  - fix #1905956 - RHEL-7: chrt regression: unwanted 'nice' value reset on sched_setattr() [rhel-7.9.z]
  - fix #1905954 - RHEL-7: chrt regression: unexpected default scheduler [rhel-7.9.z]
  - fix #1883013 - RHEL-7: chrt command does not support the -R option [rhel-7.9.z]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
  - 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
  - 1267826 - Include c++11 syntax highlighting in vim
  - 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
  - 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
  - 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-7
changelog:
  - Add support for detecting POWER KVM and LPAR
    resolves: rhbz#1147876
  - Detect RHEV/oVirt
    resolves: rhbz#1249438
  - Detect ACPI boot aarch64 guest
    resolves: rhbz#1275349
  - Fix typo in manual page
    resolves: rhbz#1099289


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-2
changelog:
  - Rebase to Fedora Rawhide / upstream version.
  - Include upstream patches since 1.18 was released.
    resolves: rhbz#1476878


author: William Poteat <wpoteat@redhat.com> 0.22.2-1
changelog:
  - Correct date ordering in changelog (wpoteat@redhat.com)
  - 1575513: Re-add changelog entries that were merged out. (wpoteat@redhat.com)
  - 1560598: Pass hostname to M2Crypto in STOMP client (khowell@redhat.com)
  - Make vdsm respect RHSM_USE_M2CRYPTO var (khowell@redhat.com)
  - Set up Travis CI to use Python 3 (jhnidek@redhat.com)
  - Fixing python 2 -> 3 issue (wpoteat@redhat.com)
  - kubevirt support (piotr.kliczewski@gmail.com)


author: William Poteat <wpoteat@redhat.com>
changelog:
  - Add releaser for RHEL 7.6 (wpoteat@redhat.com)
  - Remove f26 releaser (f26 is EOL) (csnyder@redhat.com)


author: William Poteat <wpoteat@redhat.com>
changelog:
  - Correction to the spec file condition for python 3 (wpoteat@redhat.com)
  - Update to release tagger (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.22.2-4
changelog:
  - 1432140: Log when a duplicate hypervisor id is detected [ENT-568]
    (wpoteat@redhat.com)
  - 1368341: Warn that --sam/--satellite6 are unused & deprecated * Now logging a
    warning when --sam/--satellite6 are used. * man page and --help output
    updated to explaing that these options are unused and virt-who will report to
    either sam/satellite/stage candlepin regardless of their being there.
    (nmoumoul@redhat.com)
  - 1455062: Partial fix of high CPU usage, when many conf files used
    (jhnidek@redhat.com)
  - Correction to the spec file condition for python 3 (wpoteat@redhat.com)
  - ENT-554 Host reports for libvirt and rhevm include the system hardware uuid
    (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com>
changelog:
  - Automatic commit of package [virt-who] release [0.22.2-1].
    (wpoteat@redhat.com)
  - kubevirt: warn user that dependencies are missing
    (piotr.kliczewski@gmail.com)
  - 1369634: Dont log proxy html errors for hyperv: - When hyperv gets an HTML
    page as error response from a proxy, don't log the whole html, but try to
    scrape the title off of it. - If scraping the title doesn't work, only log
    the http error code. - Changed all variables named 'xml' to 'xml_doc' in
    hyperv.py to avoid conflict with the new python keyword.
    (nmoumoul@redhat.com)
  - 1599725: Handle job status report errors (nmoumoul@redhat.com)
  - 1557296: Warn of commented out lines prefixed with space/tab (ENT-606) - When
    reading config files in python2, warn the user if a line continuation (starts
    with space/tab) is followed by '#' (nmoumoul@redhat.com)
  - kubevirt: Ignore vmis in Scheduling (piotr.kliczewski@gmail.com)
  - kubevirt: Update config (piotr.kliczewski@gmail.com)
  - Print/log debug information about filtered hosts (jhnidek@redhat.com)
  - 1577954: Added config option filter_type; ENT-580 (jhnidek@redhat.com)
  - Changed info about how filter_host_parents/exclude_host_parents filters work
    (ktordeur@redhat.com)
  - 1387800: set name of ESX cluster properly; ENT-793 (jhnidek@redhat.com)
  - Add release entry for RHEL 8 (wpoteat@redhat.com)
  - template update (wpinheir@iroman.home)
  - template update (wpinheir@iroman.home)
  - 1596041: Make python libvirt required (wpoteat@redhat.com)
  - updating RHV/RHEV/XenServer information (wpinheir@iroman.home)
  - 1581021: Decode error from unicode passwords (wpoteat@redhat.com)
  - 1510920: Change the choreography for the job status check
    (wpoteat@redhat.com)
  - ENT-493: Add option to command line to return version
    (adarshvritant@gmail.com)
  - Update executor.py (all_bright@live.com)
  - kubevirt: rename virtual machine instance (piotr.kliczewski@gmail.com)
  - Update for build process (wpoteat@redhat.com)
  - Fixed hyperv wmi query. Invalid response (500)
    (njmiller@lakemichigancollege.edu)
  - 1432140: Log when a duplicate hypervisor id is detected [ENT-568]
    (wpoteat@redhat.com)
  - 1368341: Warn that --sam/--satellite6 are unused & deprecated * Now logging a
    warning when --sam/--satellite6 are used. * man page and --help output
    updated to explaing that these options are unused and virt-who will report to
    either sam/satellite/stage candlepin regardless of their being there.
    (nmoumoul@redhat.com)
  - 1455062: Partial fix of high CPU usage, when many conf files used
    (jhnidek@redhat.com)
  - Correction to the spec file condition for python 3 (wpoteat@redhat.com)
  - ENT-554 Host reports for libvirt and rhevm include the system hardware uuid
    (wpoteat@redhat.com)
  - Add releaser for RHEL 7.6 (wpoteat@redhat.com)
  - Remove f26 releaser (f26 is EOL) (csnyder@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.24.1-1
changelog:
  - Merge in changes from Fedora packaging (wpoteat@redhat.com)
  - ENT-826 Added correlation id to virt-who reports (nmoumoul@redhat.com)
  - Releaser addition for rhel-7.7 (wpoteat@redhat.com)
  - Install subscription-manager, not python-rhsm which is deprecated: - Removed
    python-rhsm from the requirements, and added subscription-manager as
    dependency. - Added some dependencies that travis requires to install
    subscription-manager. (nmoumoul@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.24.2-1
changelog:
  - 1657104: Remove references to removed command line options
    (wpoteat@redhat.com)
  - Fixing kubevirt config path argument (piotr.kliczewski@gmail.com)
  - fix travis run (wpoteat@redhat.com)
  - 1650133: setuptools naming change (wpoteat@redhat.com)
  - 1638250: Proxy issue when https not specified (wpoteat@redhat.com)
  - Update branch definition for RHEL 8.0 branch (wpoteat@redhat.com)
  - ENT-896: Disable deprecated configuration options in python 3
    (wpoteat@redhat.com)
  - 1637407: vCenter mapping info failure due to TypeError (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com>
changelog:
  - 1667522: Omit ESX host from report when no hostname is present
    (wpoteat@redhat.com)
  - 1693858: Send hardware uuid on every check in for system reconcilliation
    (wpoteat@redhat.com)
  - kubevirt: provide user authentication (piotr.kliczewski@gmail.com)
  - 1486270: pass no_proxy from config files (wpoteat@redhat.com)
  - kubevirt: drop kubernetes and kubevirt dependencies
    (piotr.kliczewski@gmail.com)
  - 1638250: Improved fix for http proxy issue (wpoteat@redhat.com)
  - Update releaser (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.24.5-1
changelog:
  - 1695538: Provide support for hypervisor_id option
    (piotr.kliczewski@gmail.com)
  - 1695519: use correct uuid in kubevirt report (piotr.kliczewski@gmail.com)


author: William Poteat <wpoteat@redhat.com> 0.24.6-1
changelog:
  - 1530290: Remove enviroment as an input variable for the hypervisor check in
    (wpoteat@redhat.com)
  - 1523482: 1519704: Interval value set to empty string will revert to default
    value (wpoteat@redhat.com)
  - 1522384: Log at debug level when config uses default entries
    (wpoteat@redhat.com)
  - 1708524: update man page with kubevirt backend information
    (piotr.kliczewski@gmail.com)
  - 1708534: add kubeconfig to template (piotr.kliczewski@gmail.com)
  - 1516209: Configuration should be deemed invalid when server is not specified
    (wpoteat@redhat.com)
  - 1506167: Ignore new SIGHUP signals during signal handling
    (jhnidek@redhat.com)
  - 1522661: Constrict is_hypervisor field to fake virt (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.24.7-1
changelog:
  - 1718304: Fix issue when instance["BIOSGUID"] returns None
    (phess@users.noreply.github.com)
  - 1472727: Log error, when encrypted password is missing; ENT-1344
    (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.26.0-1
changelog:
  - 1530254: Update checking on environment variables (wpoteat@redhat.com)
  - 1714456: Update description of 'print_' config option (wpoteat@redhat.com)
  - 1720051: Restore the entries marked as deprecated (wpoteat@redhat.com)
  - 1652549: Add heartbeat call to virt-who cycle (wpoteat@redhat.com)
  - 1720154: Provide SYSTEM_UUID_FACT (piotr.kliczewski@gmail.com)
  - 1516120: Handling for incorrect config section headers (wpoteat@redhat.com)
  - 1722560: Make heartbeat more robust (jhnidek@redhat.com)
  - 1416298: Use unique guest attribute for state tracking (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.26.3-1
changelog:
  - 1745768: Make message unicode safe (wpoteat@redhat.com)
  - 1516209: Proper handling for empty server entry (wpoteat@redhat.com)
  - 1712300: add connection/request timeout (piotr.kliczewski@gmail.com)
  - 1751122: Clear ENV refereces from files (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.26.4-1
changelog:
  - 1751441: remove strict need for kubeconfig (piotr.kliczewski@gmail.com)
  - 1751624: Allow unicode username only if python-requests allows it
    (wpoteat@redhat.com)
  - 1743589: Content type header null coverage (wpoteat@redhat.com)
  - 1727130: Correct man page for default interval (wpoteat@redhat.com)
  - 1519136: remove references to deprecated configuration (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.1-1
changelog:
  - 1780467: Validate rhevm password when unicode is not allowed
    (wpoteat@redhat.com)
  - 1751441: Add command line path parameter (piotr.kliczewski@gmail.com)
  - 1762780: fix bug, when reporter_id is empty; ENT-1706 (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.3-1
changelog:
  - 1775535: config option to override api version (piotr.kliczewski@gmail.com)
  - Update releasers for new version (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.4-1
changelog:
  - 1806572: virt-who using V3 APIs for communication with RHEVM which is
    deprecated (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.6-1
changelog:
  - 1806572: RHEVM should only use version 4 (wpoteat@redhat.com)
  - Update to tests to match changes in Subscription Manager (jhnidek@redhat.com)


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-20
changelog:
  - Resolves: #1147551 - Missing isolate_* options, incorrect default values of
    max_clients, max_per_ip in man vsftpd.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.0.2-22
changelog:
  - Resolves: #1432054 - secure ftp stopped working with default TLS settings in the new vsftpd package


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-23
changelog:
  - Redefine VSFTP_COMMAND_FD to 1
  - Resolves: rhbz#1443055
  - Document the relationship of text_userdb_names and chroot_local_user
  - Resolves: rhbz#1508021
  - Document allow_writeable_chroot in the man page
  - Resolves: rhbz#1508022
  - Improve documentation of ascii_* options
  - Resolves: rhbz#1517227
  - Add new filename generation algorithm for STOU command
  - Resolves: rhbz#1479237


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-25
changelog:
  - Add config option log_die allowing to pass error messages to syslog
  - Add config option bind_retries allowing to change the max number
  - of attempts to find a listening port for the PASV/EPSV command
  - Resolves: rhbz#1318198


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.2-29
changelog:
  - Enable support for wide-character strings in logs
  - Replace unprintables with HEX code, not question marks
  - Resolves: rhbz#1922809


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
  - Update to 2.20.4
  - Resolves: rhbz#1576544
  - WebKitWebProcess crashes when a11y is active
  - Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
  - webkitgtk4: Crash on Google login page when a11y is active
  - Resolves: rhbz#1503624
  - Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
  - Update to 2.20.5 - technically it was not necessary as the only difference
    between 2.20.4 and .5 was the revert of one change, that we already reverted
    while building 2.20.4. But it's better to stay with upstream.
  - Update the labels patch with the version that was pushed upstream.
  - Resolves: rhbz#1576544


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-7
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-10
changelog:
  - Fix memory leak when macsec MKA/PSK is used (rh #1500442)
  - Fix authentication failure when the MAC is updated externally (rh #1490885)
  - Let the kernel discard EAPOL if packet type is PACKET_OTHERHOST (rh #1434434)
  - Don't restart wpa_supplicant.service on package upgrade (rh #1505404)
  - Don't own a directory in /run/ (rh #1507919)


author: Parag Nemade <paragn AT fedoraproject DOT org> - 3.3.12ga11-5
changelog:
  - Remove vendor tag from desktop file as per https://fedorahosted.org/fesco/ticket/1077
  - Cleanup spec as per recently changed packaging guidelines


author: Samantha N. Bueno <sbueno[at]redhat.com> - 3.3.12ga12-1
changelog:
  - updated to 3.3.12ga12
  - fixes CVE-2012-5662 (#889373, #924228)
  - add support for aarch64 to build system (#926737)


author: Eric Sandeen <sandeen@redhat.com> 3.1.3-2
changelog:
  - Preserve xattrs on multi-part stream restores (#1034014)
  - Prevent segfault on multi-part stream restores (#1034015)


author: Eric Sandeen <sandeen@redhat.com> 3.1.7-1
changelog:
  - Rebase to build against current RHEL7 xfsprogs headers
  - Fix race condition between lseek() and read()/write() (#1086532)


author: Pavel Reichl <preichl@redhat.com> - 3.1.7-4
changelog:
  - Batch fixing several issues
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump
  -      issue, Related: RHEL-10529
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x,
  -      Related: RHEL-14912


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
  - New upstrema version with memleaks, crl checks and other fixes
  - enable make check during build
  - drop ecdsa patch as it has been included upstream


author: Tomas Halman <thalman@redhat.com> - 1.2.20-8
changelog:
  - xmlsec1 fails to validate XML signatures made using ECDSA algorithm in FIPS mode
  - Resolves: RHEL-3337


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
  - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
    CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2109031, rhbz#2109033


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
  - CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
    CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
    CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18416
    Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21205
    Resolves: https://issues.redhat.com/browse/RHEL-20578
    Resolves: https://issues.redhat.com/browse/RHEL-20426
    Resolves: https://issues.redhat.com/browse/RHEL-20437
    Resolves: https://issues.redhat.com/browse/RHEL-21192
    Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
    Resolves: https://issues.redhat.com/browse/RHEL-31003
    Resolves: https://issues.redhat.com/browse/RHEL-30989
    Resolves: https://issues.redhat.com/browse/RHEL-30973
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-13
changelog:
  - Fix remote code execution vulnerability
  - Resolves: CVE-2021-21344
  - Resolves: CVE-2021-21345
  - Resolves: CVE-2021-21346
  - Resolves: CVE-2021-21347
  - Resolves: CVE-2021-21350


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-15
changelog:
  - Fix remote code execution vulnerabilities
  - Resolves: CVE-2021-39139
  - Resolves: CVE-2021-39140
  - Resolves: CVE-2021-39141
  - Resolves: CVE-2021-39144
  - Resolves: CVE-2021-39145
  - Resolves: CVE-2021-39146
  - Resolves: CVE-2021-39147
  - Resolves: CVE-2021-39148
  - Resolves: CVE-2021-39149
  - Resolves: CVE-2021-39150
  - Resolves: CVE-2021-39151
  - Resolves: CVE-2021-39152
  - Resolves: CVE-2021-39153
  - Resolves: CVE-2021-39154


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
  - fix manual page inconsistencies with help output (private #948533)
  - enable/fix the 'xzgrep -h' (private #850898)


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.7-21
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


