# changelog

author: Lubomir Rintel <lrintel@redhat.com> - 1.2.0-0.1.beta3
changelog:
  - Update to 1.2-beta3:
  - Added support for main exchange type (rh #1292912)
  - A device libreswan is unable listen on no longer aborts connection (rh #1285367)
  - Added import/export support (rh #1129878)
  - Replace NetworkManager-openswan (rh #1264552)


author: Thomas Haller <thaller@redhat.com> - 1.2.4-1
changelog:
  - Update to 1.2.4 release
  - Move base VPN plugin library to base libreswan package
  - Don't require nm-connection-editor anymore


author: Steve Grubb <sgrubb@redhat.com> 2.8.4-1
changelog:
  resolves: #1559032 - Rebase audit package to 2.8.4 to pick up bug fixes
  resolves: #1573889 - auditd busy loop in rotate_logs() with num_logs < 2
  resolves: #1534748 - incorrect addr field when using IPv6 for remote logging
  resolves: #1515903 - ausearch-expression man page missing \timestamp_ex
  resolves: #1511606 - aureport AVC report header is incomplete
  resolves: #1504251 - make auditd dump internal state for log writing status


author: Steve Grubb <sgrubb@redhat.com> 2.8.5-1
changelog:
  resolves: #1651761 - Rebase audit package to 2.8.5 to pick up bug fixes
  resolves: #1462178 - audit rule arch changed from b32 to b64 on ppc64le
  resolves: #1614833 - audispd loops reloading config 
  resolves: #1622194 - audisp-remote memory leak when using krb5 
  resolves: #1625156 - audisp-remote wont connect if remote ending action not reconnect
  resolves: #1628626 - aureport -a --failed does not display user_avc events 
  resolves: #1648005 - tcp listener socket fails when ipv6.disable=1 boot command
  resolves: #1650670 - space left in auditd.conf expressed as a percentage 
  resolves: #1663285 - ausearch device/inode missing when using a single file 
  resolves: #1672287 - max_log_file_action "keep_logs" doesn't behave as described


author: Stepan Broz <sbroz@redhat.com> 2.8.5-4.1
changelog:
  - Fix a couple resource leaks so that shutdown is clean
  - In auditd, check if log_file is valid before closing handle (RHEL-5184)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.10
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Stepan Broz <sbroz@redhat.com> - 32:9.11.4-26.P2.16
changelog:
  - Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
    CVE-2023-50868)
  - Add missing design by contract tests to dns_catz*
  - Speed up parsing of DNS messages with many different names (CVE-2023-4408)
  - Do not use header_prev in expire_lru_headers


author: David Shea <dshea@redhat.com> - 32:9.11.4-26.P2.17
changelog:
  - Resolve CVE-2024-1975
  - Resolve CVE-2024-1737
  - Add ability to change runtime limits for max types and records per name


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.13.1.el8_5]
changelog:
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034864 2034865] {CVE-2021-4155}
  - af_unix: fix garbage collect vs MSG_PEEK (Patrick Talbert) [2031974 2031975] {CVE-2021-0920}
  - cgroup: verify that source is a string (Waiman Long) [2034608 2034609] {CVE-2021-4154}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.14.1.el8_5]
changelog:
  - tcp: fix page frag corruption on page fault (Paolo Abeni) [2041529 1996074]
  - net: fix sk_page_frag() recursion from memory reclaim (Paolo Abeni) [2041529 1996074]
  - KVM: s390: index kvm->arch.idle_mask by vcpu_idx (Thomas Huth) [2040769 2026230]
  - redhat: set LC_ALL=C before sorting config content (Frantisek Hrbata)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.15.1.el8_5]
changelog:
  - net/mlx5: DR, Use FW API when updating FW-owned flow table (Michal Schmidt) [2042663 2042651]
  - KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall (Vitaly Kuznetsov) [2043237 1868572]
  - drm/mgag200: Select clock in PLL update functions (Bruno Meneguele) [2034949 1953926]
  - drm/i915: Fix HAS_LSPCON macro for platforms between GEN9 and GEN10 (Bruno Meneguele) [2027335 2005586]
  - crypto: qat - power up 4xxx device (Vladis Dronov) [2016437 1960307]
  - RDMA/core: Fix a double free in add_port error flow (Kamal Heib) [2038724 2008555]
  - powerpc/iommu: Report the correct most efficient DMA mask for PCI devices (Steve Best) [2018928 2007425]
  - powerpc/dma: Fix dma_map_ops::get_required_mask (Steve Best) [2018928 2007425]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.16.1.el8_5]
changelog:
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047601 2047602] {CVE-2022-22942}
  - net: openvswitch: Fix ct_state nat flags for conns arriving from tc (Marcelo Ricardo Leitner) [2043548 2040334]
  - net: openvswitch: Fix matching zone id for invalid conns arriving from tc (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: flow_dissector: Fix matching on zone id for invalid conns (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: Extend qdisc control block with tc control block (Marcelo Ricardo Leitner) [2043550 2040452]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.17.1.el8_5]
changelog:
  - vfs: check dentry is still valid in get_link() (Ian Kent) [2052558 2014846]
  - xfs: don't expose internal symlink metadata buffers to the vfs (Brian Foster) [2052558 2014846]
  - CI: Use appropriate zstream builder (Veronika Kabatova)
  - CI: Enable baseline realtime checks (Veronika Kabatova)
  - CI: Rename pipelines to include release names (Veronika Kabatova)
  - cgroup-v1: Require capabilities to set release_agent (Waiman Long) [2052166 2052167] {CVE-2022-0492}
  - ice: Remove boolean vlan_promisc flag from function (Jonathan Toppins) [2051951 2030400]
  - ceph: put the requests/sessions when it fails to alloc memory (Jeffrey Layton) [2053725 2017796]
  - ceph: fix off by one bugs in unsafe_request_wait() (Jeffrey Layton) [2053725 2017796]
  - ceph: flush the mdlog before waiting on unsafe reqs (Jeffrey Layton) [2053725 2017796]
  - ceph: flush mdlog before umounting (Jeffrey Layton) [2053725 2017796]
  - ceph: make iterate_sessions a global symbol (Jeffrey Layton) [2053725 2017796]
  - ceph: make ceph_create_session_msg a global symbol (Jeffrey Layton) [2053725 2017796]
  - xfs: check sb_meta_uuid for dabuf buffer recovery (Bill O'Donnell) [2049292 2020764]
  - drm/i915: Flush TLBs before releasing backing store (Patrick Talbert) [2044328 2044329] {CVE-2022-0330}
  - hugetlb: fix hugetlb cgroup refcounting during vma split (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb: change hugetlb_reserve_pages() to type bool (Waiman Long) [2039015 2032811]
  - hugetlb: fix an error code in hugetlb_reserve_pages() (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix offline of hugetlb cgroup with reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix reservation accounting (Waiman Long) [2039015 2032811]
  - mm/hugetlb: narrow the hugetlb_lock protection area during preparing huge page (Waiman Long) [2039015 2032811]
  - mm/hugetlb: a page from buddy is not on any list (Waiman Long) [2039015 2032811]
  - mm/hugetlb: not necessary to coalesce regions recursively (Waiman Long) [2039015 2032811]
  - selftests/vm/write_to_hugetlbfs.c: fix unused variable warning (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation tests (Waiman Long) [2039015 2032811]
  - hugetlb: support file_region coalescing again (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: support noreserve mappings (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add accounting for shared mappings (Waiman Long) [2039015 2032811]
  - hugetlb: disable region_add file_region coalescing (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add reservation accounting for private mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb_cgroup: fix hugetlb_cgroup migration (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add interface for charge/uncharge hugetlb reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation counter (Waiman Long) [2039015 2032811]
  - hugetlb: remove duplicated code (Waiman Long) [2039015 2032811]
  - hugetlb: region_chg provides only cache entry (Waiman Long) [2039015 2032811]
  - hugetlbfs: always use address space in inode for resv_map pointer (Waiman Long) [2039015 2032811]
  - hugetlbfs: fix potential over/underflow setting node specific nr_hugepages (Waiman Long) [2039015 2032811]
  - hugetlb: allow to free gigantic pages regardless of the configuration (Waiman Long) [2039015 2032811]
  - powerpc/pseries: Fix update of LPAR security flavor after LPM (Steve Best) [2027448 1997294]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.18.1.el8_5]
changelog:
  - selftests: kvm: Check whether SIDA memop fails for normal guests (Thomas Huth) [2050806 2050807] {CVE-2022-0516}
  - KVM: s390: Return error on SIDA memop on normal guest (Thomas Huth) [2050806 2050807] {CVE-2022-0516}
  - iommu/amd: Remove iommu_init_ga() (Jerry Snitselaar) [2030854 1998265]
  - iommu/amd: Relocate GAMSup check to early_enable_iommus (Jerry Snitselaar) [2030854 1998265]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.19.1.el8_5]
changelog:
  - tipc: improve size validations for received domain records (Xin Long) [2048970 2048971] {CVE-2022-0435}
  - smb3: do not error on fsync when readonly (Ronnie Sahlberg) [2055824 2037811]
  - security: implement sctp_assoc_established hook in selinux (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: add sctp_assoc_established hook (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: pass asoc to sctp_assoc_request and sctp_sk_clone (Bruno Meneguele) [2054112 2054117 2015525 2048251]
  - net: sctp: Fix some typos (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - RDMA/bnxt_re: Fix stats counters (Selvin Xavier) [2049684 2001893]
  - net: check skb sec_path when re-initializing slow_gro in gro_list_prepare (Xin Long) [2047427 2030476]
  - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (David Arcari) [2036888 2003695]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.20.1.el8_5]
changelog:
  - lib/iov_iter: initialize "flags" in new pipe_buffer (Jan Stancek) [2060874 2060875] {CVE-2022-0847}


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.35-28
changelog:
  - 1816109 - Queues are not cleaned up after stopping cups-browsed
  - 1811190 - cups-browsed leaks memory


author: Bryan Mason <bmason@redhat.com> - 1.0.35-29.1
changelog:
  - CVE-2024-47176 - cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source
  - CVE-2024-47076 'cfGetPrinterAttributes' API does not perform sanitization on returned IPP attributes
  - CVE-2024-47175 remote command injection via attacker controlled data in PPD file


author: Debarshi Ray <rishi@fedoraproject.org> - 3.12.12-4
changelog:
  - Fix certificate validation (use reference identities, handle validation
    failures correctly, fixed the test suite)
  - Resolves: #1386616


author: Milan Crha <mcrha@redhat.com> - 3.28.5-11
changelog:
  - Resolves: RHEL-62699 (Backport evolution changes from RHEL 8 to RHEL 7)
  - Resolves: RHEL-62686 (WebKitGTK 2.46.1: Middle mouse button inserts primary clipboard twice)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469408 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469412 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469416 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469419 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469422 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
  - Fix double free in rlm_sql acct_redundant
    Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                          unknown value" when using module sql rlm_sql


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-10
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699414 authentication bypass with an invalid curve attack
    Resolves: bz#1699419 fake authentication using reflection


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-11
changelog:
  - Fixes logrotate, EAP-PWD vulnerability
    Resolves: bz#1719368 privilege escalation due to insecure logrotate configuration
    Resolves: bz#1751796 eap-pwd: Information leak due to aborting when needing more than 10 iterations


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-15
changelog:
  - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
    Resolves: bz#1818808

    * Fri Feb 7 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.13-14
  - Fixes receiving of multiple RADIUS packets under load
    Resolves: bz#1630684


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29
changelog:
  - Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)
  - Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-31
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621158)
    - CVE-2018-15910 (bug #1621160)
    - CVE-2018-16542 (bug #1621382)


author: Martin Osvald <mosvald@redhat.com> - 9.07-32
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621385 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649722 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621162 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621384 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)
  - Resolves: #1652902 - CVE-2018-16863 ghostscript: incomplete fix for
    CVE-2018-16509
  - Resolves: #1654045 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage)
  - Resolves: #1651150 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650061 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652936 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1654622 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650211 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645517 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648892 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643117 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655939 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1657694 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)
  - Resolves: #1661210 pdf2ps reports an error when reading from stdin
  - Resolves: #1657334 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660570 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660829 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661279 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1667443 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata


author: Martin Osvald <mosvald@redhat.com> - 9.25-1
changelog:
  - Rebase to latest upstream version (bug #1636115)
  - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678172 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680026 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-3
changelog:
  - Resolves: #1737339 - CVE-2019-10216 ghostscript: -dSAFER escape via .buildfont1 (701394)
  - Resolves: #1744009 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744013 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744004 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744229 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.4
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
  - Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
    corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
  - Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
    mod_rewrite and mod_proxy


author: Bryan Mason <bmason@redhat.com> - 2.4.6-99.2
changelog:
  - Fix CVE-2024-38484 - httpd: Substitution encoding issue in mod_rewrite
  - and CVE-2024-38475 - httpd: Improper escaping of output in mod_rewrite
  - Fix CVE-2024-38477 - httpd: null pointer dereference in mod_proxy


author: Bryan Mason <bmason@redhat.com> - 2.4.6-99.3
changelog:
  - CVE-2024-38476 httpd:2.4/httpd: Security issues via backend
    applications whose response headers are malicious or exploitable
  - Fix regression introduced by CVE-2024-38474 fix


author: Jan Stancek <jstancek@redhat.com> - 20191203-75.gite8a0f4c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update qed zipped/unzipped firmware to latest upstream (rhbz 1720385)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-81.git78c0348
changelog:
  - Cross-Process Information Leak (RHEL-8938)
  - Return Address Predictor velunerability leading to information disclosure (RHEL-9250)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-82.git78c0348
changelog:
  - AMD: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem (RHEL-13985)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20200421-83.git78c0348
changelog:
  - hw: intel: Fix protection mechanism failure for some Intel(R) PROSet/Wireless WiFi
  Resolves: RHEL-4010, RHEL-4013, RHEL-4016, RHEL-4018, RHEL-4021


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u402-b01 (EA)
  - Update release notes for shenandoah-8u402-b01.
  - Switch to EA mode.
  - Sync NEWS with vanilla branch version.
  - Related: RHEL-17914


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-1
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Drop local copy of JDK-8312489 which is now included upstream
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17914
  - Resolves: RHEL-20965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b01 (EA)
  - Update release notes for shenandoah-8u412-b01.
  - Switch to EA mode.
  - Related: RHEL-30926


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Remove -T0 argument from systemtap tar invocation
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Normalise whitespace
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - jconsole.desktop.in: Restored by running icedtea_sync.sh
  - policytool.desktop.in: Likewise.
  - Restore IcedTea sources correctly in spec file
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.1.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Update release notes for shenandoah-8u412-b07.
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Resolves: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-1
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u422-b01 (EA)
  - Update release notes for shenandoah-8u422-b01.
  - Switch to EA mode.
  - Related: RHEL-46862


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
changelog:
  - Update to shenandoah-jdk8u422-b05 (GA)
  - Update release notes for shenandoah-8u422-b05.
  - Rebase PR2462 patch following patched hunk being removed by JDK-8322106
  - Switch to GA mode.
  - Limit Java only tests to one architecture using jdk_test_arch
  - Remove redundant prefix from remove-intree-libraries.sh to match portable
  - Document policy repacking script and rename to correct spelling and style
  - Sync README.md with RHEL 8
  - Add missing build dependency on zlib-devel
  - Add missing bundled Provides for LCMS
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-46862
  - Resolves: RHEL-47083


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-1
changelog:
  - Update to shenandoah-jdk8u432-b06 (GA)
  - Update release notes for shenandoah-8u432-b06.
  - Regenerate JDK-8199936/PR3533 patch following JDK-828109{6,7,8} integration
  - Add build dependency on make
  - Remove redundant build dependency on gtk2-devel
  - Reorganise build dependencies to retain alphabetical order for unconditional deps
  - Include backport of JDK-8328999 to update giflib to 5.2.2
  - Use bundled giflib as RHEL 7 version is very old (4.1.6)
  - Remove lcms2 and giflib removal from remove-intree-libraries.sh as we use bundled
  - List version of bundled giflib as 5.2.2 following JDK-8328999
  - Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
  - Add missing build requirements for libXext-devel and libXrender-devel, previously masked by Gtk2+ dependency.
  - fontconfig build requirement should be fontconfig-devel, previously masked by Gtk2+ dependency
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
  - Resolves: RHEL-58787
  - Resolves: RHEL-62293
  - Resolves: RHEL-62274
  - Resolves: RHEL-61279


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
  - Update to jdk-11.0.23+9 (GA)
  - Update release notes to 11.0.23+9
  - Switch to GA mode for release
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-30914


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-2
changelog:
  - Fix 11.0.22 release date in NEWS
  - Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.24.0.8-1
changelog:
  - Update to jdk-11.0.24+8 (GA)
  - Update release notes to 11.0.24+8
  - Adjusted DTLS & RPATH NEWS entries to match OpenJDK 17 & 21 release notes
  - Switch to GA mode for release
  - Add zlib to build required
  - Resolves: RHEL-45205
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.6-0.1.ea
changelog:
  - Update to jdk-11.0.25+6 (EA)
  - Update release notes to 11.0.25+6
  - Switch to EA mode
  - Related: RHEL-58768


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.9-1
changelog:
  - Update to jdk-11.0.25+9 (GA)
  - Update release notes to 11.0.25+9
  - Switch to GA mode for release
  - Related: RHEL-58768
  - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.4-3
changelog:
  - Bugzilla #1534772 - org.mozilla.jss.pkix.primitive.AlgorithmIdentifier
    decode/encode process alters original data (cfu)
  - Bugzilla #1554056 - JSS: Add support for TLS_*_SHA384 ciphers (cfu)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-2
changelog:
  - Bugzilla #1747967 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.7-3
changelog:
  - Bugzilla #1710105 - JSS: add RSA PSS support (jmagne)
  - Bugzilla #1796642 - JSS -- remove hardcoded native library
    /usr/lib{64}/jss/libjss4.so (ascheel)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.9-4
changelog:
  - Updated nspr-devel and nss-devel build requirements as well as nss runtime
    requirements [mharmsen]
  - RHEL-18401 - JSS - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHEL 7.9.z] [jmagne]
  - JSS: add RSA PSS support
    Add PSS cases to algorithm name translating method [jmagne]
  - Add GitLab synchronization job [edewata]
  - Add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z]
    Back port AES KWP wrap alg support only for JSS in this branch to allow for
    the TMS bug referenced above to work. [jmagne]
  - Empty commit to fix commit msg from previous commit
    JSS- add AES support for TMS server-side keygen on latest HSM / FIPS
    environment [RHCS 9.7.z]
    Back port AES KWP wrap alg support only for JSS in this branch to allow for
    the TMS bug referenced above to work. [jmagne]
  - RHEL-23935 - JSS - PrettyPrintCert does not properly translate AIA
    information into a readable format [RHEL 7.9.z] [mfargett]
  - Fix AIA extension print
    The "Authority Info Access" extension was not included in the oid
    extension  map so it was not correctly printed.
    This add AIA extension to the oid map. [mfargett]
  - Fix SIA extension
    The "Subject Info Access" extension was not included in the oid
    extension  map so it was not correctly printed.
    This add SIA extension to the oid map. [mfargett]


author: Prasad Kalanke <pkalanke@redhat.com> - 1.15.1-55.1
changelog:
  - CVE-2024-37370 CVE-2024-37371
  - Fix vulnerabilities in GSS message token handling
  - Resolves: RHEL-45381 RHEL-45393


author: Prasad Kalanke <pkalanke@redhat.com> - 1.15.1-55.2
changelog:
  - CVE-2024-37370 CVE-2024-37371
  - Updated the previous commit patches
  - Resolves: RHEL-45381 RHEL-45393


author: Julien Rische <jrische@redhat.com> - 1.15.1-55.3
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55453
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-56071


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
  - core: don't update unit description if it is already set to the same value (#1793527)
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
  - core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
  - test: add a test/reproducer for BZ#1989245 (#1989245)
  - strv: fix buffer size calculation in strv_join_quoted() (#1989245)
  - install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.10
changelog:
  - fstab-generator: Chase symlinks where possible (#6293) (RHEL-17394)
  - call chase_symlinks without the /sysroot prefix (#6411) (RHEL-17394)
  - fstab-generator: downgrade message when we can't canonicalize fstab entries (#8281) (RHEL-17394)
  - Add $SYSTEMD_IN_INITRD=yes|no override for debugging (RHEL-17394)
  - escape: call unit_name_is_valid() with correct flags (RHEL-17394)
  - fstab-generator: fix ordering of /sysroot/usr mount (RHEL-17394)
  - test: backport TEST-81-GENERATORS (fstab-generator only) (RHEL-17394)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.11
changelog:
  - pager: set $LESSSECURE whenver we invoke a pager (RHEL-35665)
  - pager: make pager secure when under euid is changed or explicitly requested (RHEL-35665)


author: Jiri Pirko <jpirko@redhat.com> - 1.2-1
changelog:
  - Update to 1.2
  - libndp: silently ignore packets with optlen 0 [1016064]
  - libndp: fix processing for larger options [1016064]
  - libndp: do not fail on receiving non-ndp packets [1016078]


author: Jiri Pirko <jpirko@redhat.com> - 1.2-3
changelog:
  - libndp: fix [cppcheck] Undefined behavior: Variable 'buf' is used as parameter and destination in s[n]printf() [1044084]


author: Lubomir Rintel <lrintel@redhat.com> - 1.2-5
changelog:
  - libndp: validate the IPv6 hop limit [CVE-2016-3698]
  - libndb: reject redirect and router advertisements from non-link-local [CVE-2016-3698]


author: Eric Garver <egarver@redhat.com> - 1.2-7
changelog:
  - libndp: add option flags to send messages
  - ndptool: add option to send messages types
  - libndp: fix type of field "na" in "struct ndp_msgna"
  - libndp: revert API change for ndp_msg_send() and add


author: Milan Crha <mcrha@redhat.com> - 2.62.2-2
changelog:
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty hostnames
  - Resolves: #1598838


author: Tomas Popela <tpopela@redhat.com> - 2.62.2-3
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Resolves: RHEL-67071


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
  - invalidate supplemental group cache used by temporarily_use_uid()
    when the target uid differs (#1583735)


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 18):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)
  - Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
    caServerKeygen_DirUserCert profile, user can get certificates for other
    UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 19):
  - ##########################################################################
  - Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
    entities when parsing XML can lead to XXE [certificate_system_9.7.z]
    (ckelley, mharmsen)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-25
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #2160355 - RA Separation by KeyType - Set Token Status
    [RHCS 9.7 bu 21] (cfu, ckelley)
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 21):
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-26
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 22):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 22):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-27
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 23):
  - ##########################################################################
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 23):
  - ##########################################################################
  - Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
    a list of tokens [RHCS 9.7] (ckelley)
  - Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
  - Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
    Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-28
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-29
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.1):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-30
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.2):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-31
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.3):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-32
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Updated nspr-devel and nss-devel build requirements as well as nss and
    nss-tools runtime requirements (mharmsen)
  - Updated jss dependencies (mharmsen)
  - Added git build dependency (mharmsen)
  - Additional trivial fix (jmagne)
  - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
    token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  - RHEL-24339 - pki-core - PrettyPrintCert does not properly
    translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  - RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  - ##########################################################################
  - # RHCS 9.7 (Async Security Update CY24Q2.4):
  - ##########################################################################
  - Bug 2047831 - Coolkey Hardcoded RSA Max Key Size
    [RHCS 9.7.z] (jmagne)
  - Bug 2121463 - Add Secure Channel Support for AES-256 Keys
    [RHCS 9.7.z] (jmagne)
  - Bug 2177785 - TPS missing Host header field in HTTP/1.1 request
    message [RHCS 9.7.z] (mfargett)
  - Bug 2180920 - add AES support for TMS server-side keygen on latest
    HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  - Bug 2233158 - Make key wrapping algorithm configurable
    between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  - Bug 2253682 - pkidestroy log keeps HSM token password
    [RHCS 9.7.z] (mfargett, jmagne)
  - Bug 2265180 - Add Support for Symmetric Key Rollover
    [RHCS 9.7.z] (jmagne)
  - Bug 2280722 - Shared token is not generated for TPS and TKS
    during install despite adding pki_import_shared_secret=True param
    at install [RHCS 9.7.z] (jmagne)


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-7
changelog:
  - Converting specfile from F28 to RHEL7
  - Tests disabled because the minimal RHEL7 Python 3 stack does not contain test
    dependencies
  - Disabled building of the Python 2 subpackage
  Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
  - SRPM renamed from python-setuptools to python3-setuptools
  - Package prepared to contain only Python 3 version
  Resolves: rhbz#1660563


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
  - Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
    failures with newest openssl.
    Resolves: rhbz#1416123
  - Add gemspec_add_dep and gemspec_remove_dep macros.
  - Extend 'gem_' macros for pre-release version support.
    Resolves: rhbz#1397390
  - Make symlinks for json gem.
    Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
  - Kill bundled certificates.
  - Add macros to edit files lists in .gemspec
  - Fix buffer under-read in String#unpack
    Resolves: CVE-2018-8778
  - Fix HTTP response splitting in WEBrick
    Resolves: CVE-2017-17742
  - Fix DoS by large request in WEBrick
    Resolves: CVE-2018-8777
  - Fix directory traversal by poisoned NULL byte in Dir.
    Resolves: CVE-2018-8780
  - Fix file and directory creation with directory traversal.
    Resolves: CVE-2018-6914
  - Fix socket creation by poisoned NULL byte.
    Resolves: CVE-2018-8779
  - Fix: return default path with nonexistent home dir
  - Fix flags not propagated in Array#pack and String#unpack.
    Resolves: CVE-2018-16396
  - Fix strictly interpret octal fields in tar headers.
    Resolves: CVE-2018-1000075
  - Fix a security error for duplicate files in a package.
    Resolves: CVE-2018-1000076
  - Enforce URL validation on spec homepage attribute.
    Resolves: CVE-2018-1000077
  - Mitigate XSS vulnerability in homepage attribute.
    Resolves: CVE-2018-1000078
  - Prevent Path Traversal issue during gem installation.
    Resolves: CVE-2018-1000079
  - Fix unsafe Object Deserialization Vulnerability in gem owner.
    Resolves: CVE-2018-1000074
  - Refresh expired certificates.
  - Fix path traversal when writing to a symlinked basedir outside of the root
    Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
    Resolves: CVE-2019-8322
  - Fix escape sequence injection vulnerability in API response handling.
    Resolves: CVE-2019-8323
  - Prohibit arbitrary code execution when installing a malicious gem.
    Resolves: CVE-2019-8324
  - Fix escape sequence injection vulnerability in errors.
    Resolves: CVE-2019-8325
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
  - Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
    a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
  - Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
    code -- Remove support for Gopher protocol (CVE-2023-46728)
  - Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
    feature (CVE-2023-49285)
  - Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
    Helper Process management (CVE-2023-49286)
  - Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
    (CVE-2023-46724)
  - Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
    (CVE-2023-50269)
  - Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
    (CVE-2024-25617)


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.11
changelog:
  - Resolves: RHEL-65070 - squid: Denial of Service processing ESI response
    content (CVE-2024-45802)


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-26
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
    Resolves: RHEL-15235
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15223


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-27
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415
  - CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18427


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-28
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18415


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-29
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20436
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20427
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20587
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21212


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-30
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20436


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-31
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20436
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20587


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-32
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-31006
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30976
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30993


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-34
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-62070


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-7
changelog:
  - plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
    are used with sysctl and the current sysctl value is the same as
    the new value
    Resolves: rhbz#1739418


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-9
changelog:
  - Fixed SIGHUP handling
    Resolves: rhbz#1702724
  - Tune irqbalance service
    Resolves: rhbz#1720042
  - Added netcat requirement
    Resolves: rhbz#1746436
  - sysctl: made reapply_sysctl ignore configs from /usr
    Resolves: rhbz#1776149
  - profiles: define variables before use
    Resolves: rhbz#1781664


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-10
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1852253


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
  - Rebase to tzdata-2023d
    - Include time zone changes for Ittoqqortoormiit, Greenland
      and Vostok, Antarctica.
    - Update the expiration date for the leap-seconds.list file.
      No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
  - Rebase to tzdata-2024a
    - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
    - Palestine will spring forward a week later than previously
      predicted.


author: Patsy Griffin <patsy@redhat.com> - 2024a-2
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-26860)


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.


