# changelog

author: Mihai Ibanescu <misa@redhat.com> 2.4.1-10
changelog:
- Fixed bug #169159 (don't let python core dump if no arguments are passed in)
  Reworked the patch from -8 a bit more.


author: Peter Jones <pjones@redhat.com> 2.4.1-12
changelog:
- Fixed bug #169159 (check for argc>0 and argv[0] == NULL, not just
    argv[0][0]='\0')
  Reworked the patch from -8 a bit more.


author: Mihai Ibanescu <misa@redhat.com> - 2.4.3-6
changelog:
- Fixed bug #192592 (too aggressive assertion fails) - SF#1257960
- Fixed bug #167468 (Doc/tools not included) - added in the python-tools package


author: Mihai Ibanescu <misa@redhat.com> - 2.4.99.c1
changelog:
- Updated to 2.5c1. Merged fixes from FC6 too:
- Fixed bug #199373 (on some platforms CFLAGS is needed when linking)
- Fixed bug #198971 (case conversion not locale safe in logging library)
- Verified bug #201434 (distutils.sysconfig is confused by the change to make
  python-devel multilib friendly) is fixed upstream


author: Jeremy Katz <katzj@redhat.com>
changelog:
- fix _md5 and _sha modules (Robert Sheck)
- no longer provide optik compat; it's been a couple of years now
- no longer provide the old shm module; if this is still needed, let's 
  build it separately
- no longer provide japanese codecs; should be a separate package


author: Jeremy Katz <katzj@redhat.com>
changelog:
- support db 4.5
- obsolete python-elementtree; since it requires some code tweaks, don't 
  provide it
- obsolete old python-sqlite; provide the version that's actually included


author: Jeremy Katz <katzj@redhat.com> - 2.5.3-3
changelog:
- fix atexit traceback with failed syslog logger (#218214)
- split libpython into python-libs subpackage for multilib apps 
  embedding python interpreters


author: Jeremy Katz <katzj@redhat.com> - 2.5.3-8
changelog:
- fix extensions to use shared libpython (#219564)
- all 64bit platforms need the regex fix (#122304)


author: Jeremy Katz <katzj@redhat.com> - 2.5.1-4
changelog:
- fix _elementtree.so build (#245703)
- ensure that extension modules we expect are actually built rather than 
  having them silently fall out of the package


author: James Antill <jantill@redhat.com> - 2.5.1-13
changelog:
- Add tix buildprereq
- Add tkinter patch
- Resolves: #281751
- Fix ctypes loading of libraries, add requires on binutils
- Resolves: #307221
- Possible fix for CVE-2007-4965 possible exploitable integer overflow
- Resolves: #295971


author: James Antill <jantill@redhat.com> - 2.5.1-15
changelog:
- Do codec lowercase in C Locale.
- Resolves: 207134 191096
- Fix stupid namespacing in pysqlite, minimal upgrade to 2.3.3 pysqlite
- Resolves: 263221


author: James Antill <jantill@redhat.com> - 2.5.1-16
changelog:
- Fix pyconfig.h comment typo.
- Add back test_support.py and the __init__.py file.
- Resolves: rhbz#387401


author: James Antill <jantill@redhat.com> - 2.5.1-18
changelog:
- Create a python-test sub-module, over 3MB of stuff noone wants.
- Don't remove egginfo files, try this see what happens ... may revert.
- Resolves: rhbz#414711


author: James Antill <jantill@redhat.com> - 2.5.1-20
changelog:
- Add valgrind support files, as doc, to python-devel
- Relates: rhbz#418621
- Add new API from 2.6, set_wakeup_fd ... use at own risk, presumably won't
- change but I have no control to guarantee that.
- Resolves: rhbz#427794
- Add gdbinit support file, as doc, to python-devel


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-2
changelog:
- "Makefile" and the config-32/64.h file are needed by distutils/sysconfig.py
_init_posix(), so we include them in the core package, along with their parent
directories (bug 531901)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-3
changelog:
- fixup the build when __python_ver is set (Zach Sadecki; bug 533989); use
pybasever in the files section


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-4
changelog:
- automatically disable arena allocator when run under valgrind (upstream
issue 2422; patch 52)
- add patch from Josh Boyer containing diff against upstream PyBSDDB to make
the bsddb module compile against db-4.8 (patch 53, #544275); bump the necessary
version of db4-devel to 4.8
- patch setup.py so that it searches for db-4.8, and enable debug output for
said search; make Setup.dist use db-4.8 (patch 54)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-5
changelog:
- replace usage of %define with %global
- use the %{_isa} macro to ensure that the python-devel dependency on python
is for the correct multilib arch (#555943)
- delete bundled copy of libffi to make sure we use the system one
- replace references to /usr with %{_prefix}; replace references to
/usr/include with %{_includedir}


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-6
changelog:
- patch Makefile.pre.in to avoid building static library (patch111, bug 556092)
- split up the "configure" invocation flags onto individual lines


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-9
changelog:
- change python-2.6.2-config.patch to remove our downstream change to curses
configuration in Modules/Setup.dist, so that the curses modules are built using
setup.py with the downstream default (linking against libncursesw.so, rather
than libncurses.so), rather than within the Makefile; add a test to %install
to verify the dso files that the curses module is linked against the correct
DSO (bug 539917; changes _cursesmodule.so -> _curses.so)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-10
changelog:
- introduce macros for 3 directories, replacing expanded references throughout:
%{pylibdir}, %{dynload_dir}, %{site_packages}
- explicitly list all lib-dynload files, rather than dynamically gathering the
payload into a temporary text file, so that we can be sure what we are
shipping; remove now-redundant testing for presence of certain .so files
- remove embedded copy of zlib from source tree before building


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-11
changelog:
- update python-2.6.2-config.patch to remove downstream customization of build
of pyexpat and elementtree modules
- add patch adapted from upstream (patch 3) to add support for building against
system expat; add --with-system-expat to "configure" invocation
- remove embedded copy of expat from source tree during "prep"


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-12
changelog:
- Address some of the issues identified in package review (bug 226342):
  - update libs requirement on base package to use %{name} for consistency's
sake
  - convert from backticks to $() syntax throughout
  - wrap value of LD_LIBRARY_PATH in quotes
  - convert "/usr/bin/find" requirement to "findutils"
  - remove trailing periods from summaries of -devel and -tools subpackages
  - fix spelling mistake in description of -test subpackage
  - convert usage of $$RPM_BUILD_ROOT to %{buildroot} throughout, for
stylistic consistency
  - supply dirmode arguments to defattr directives


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-15
changelog:
- work around bug 562906 by supplying a fixed version of pythondeps.sh
- set %{_python_bytecompile_errors_terminate_build} to 0 to prevent the broken
test files from killing the build on buildroots where python is installed


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-16
changelog:
- move the -gdb.py file from %{_libdir}/INSTSONAME-gdb.py to
%{_prefix}/lib/debug/%{_libdir}/INSTSONAME.debug-gdb.py to avoid noise from
ldconfig (bug 562980), and which should also ensure it becomes part of the
debuginfo subpackage, rather than the libs subpackage
- introduce %{py_SOVERSION} and %{py_INSTSONAME} to reflect the upstream
configure script, and to avoid fragile scripts that try to figure this out
dynamically (e.g. for the -gdb.py change)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-17
changelog:
- add systemtap static probes (wcohen; patch 55; rh bug #545179)
- update some comments in specfile relating to gdb work
- manually byte-compile the gdb.py file with the freshly-built python to ensure
that .pyx and .pyo files make it into the debuginfo manifest if they are later
byte-compiled after find-debuginfo.sh is run


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-18
changelog:
- add a systemtap tapset defining "python.function.entry" and
"python.function.return" to make it easy to use the static probepoint within
Python; add an example of using the tapset to the docs


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-19
changelog:
- revise the systemtap patch (patch 55:python-2.6.4-dtrace.patch) to the
new version by mjw in attachment 390110 of rhbz:545179, as this should
eliminate the performance penalty for the case where the probes aren't in
use, and eliminate all architecture-specific code (rhbz:563541; except on
sparc)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-20
changelog:
- avoid having the "test" subdirectory and the files within it that are in the
core subpackage also be owned by the test subpackage (rhbz:467588)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-22
changelog:
- add pyfuntop.stp; allow systemtap support to be disabled
- remove trailing period from tkinter summary
- don't own /usr/bin/python-config if you're not the main python


author: David Malcolm <dmalcolm@redhat.com> - 2.6.4-23
changelog:
- fixup distutils/unixccompiler.py to remove standard library path from
rpath (patch 17)
- delete DOS batch files


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-1
changelog:
- update to 2.6.5: http://www.python.org/download/releases/2.6.5/
- replace our patch to compile against db4.8 with a patch from
upstream (patch 53, from r78974); update patch 54 since part of it is now in
that upstream patch
- update patch 110 so that it still applies in the face of upstream r78380


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-4
changelog:
- update python-gdb.py from v3 to v4 (fixing infinite recursion on reference
cycles and tracebacks on bytes 0x80-0xff in strings, adding handlers for sets
and exceptions)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-6
changelog:
- move the "bdist_wininst" command's template .exe files from the core package
to the devel subpackage, to save space (rhbz:525469)
- fix stray doublelisting of config directory wildcard in devel subpackage


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-9
changelog:
- build and install two different configurations of Python: debug and standard,
packaging the debug build in a new "python-debug" subpackage (patch 112)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-10
changelog:
- add configure-time support for COUNT_ALLOCS and CALL_PROFILE debug options
(patch 113); enable them and the WITH_TSC option within the debug build


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-13
changelog:
- ensure that the compiler is invoked with "-fwrapv" (rhbz#594819)
- CVE-2010-1634: fix various integer overflow checks in the audioop
module (patch 116)
- CVE-2010-2089: further checks within the audioop module (patch 117)
- CVE-2008-5983: the new PySys_SetArgvEx entry point from r81399 (patch 118)


author: Dan Horák <dan[at]danny.cz> - 2.6.5-14
changelog:
- reading the timestamp counter is available only on some arches (see Python/ceval.c)
- disable --with-valgrind on s390(x) arches


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-16
changelog:
- Fix an incompatibility between pyexpat and the system expat-2.0.1 that led to
a segfault running test_pyexpat.py (patch 119; upstream issue 9054)


author: David Malcolm <dmalcolm@redhat.com> - 2.6.5-17
changelog:
- Stop python bailing out with an assertion failure when UnicodeDecodeErrors
occur on very large buffers (patch 120, upstream issue 9058)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-0.1.rc1
changelog:
- 2.7rc1:
  - rework patches to apply against 2.7 (which among other changes has had a
whitespace cleanup of the .c code): .rhconfig (patch0), .binutils-no-dep
(patch10), .ascii-tolower (patch11), .socketmodule (patch13), .socketmodule2
(patch14), .systemtap (patch55), .lib64 (patch102), .selinux (patch110),
.no-static-lib (patch111), .debug-build (patch112), .statvfs-f-flag-constants
(patch114), ..CVE-2010-2089 (patch117)
  - drop upstream patches: .expat (patch3), .brprpm (patch51), .valgrind
(patch52), .db48 (patch53), .CVE-2010-1634 (patch 116), .CVE-2008-5983 (patch
118)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-0.1.rc2
changelog:
- 2.7rc2
- revert r79310 (patch 121)
- remove modulator: upstream removed it in r78338
- rename mathmodule(_d).so to math(_d).so in manifests (appears to be changed
by r76861)
- _bytesio(_d).so and _filesio(_d).so were consolidated into _io(_d).so in
r73394 (upstream issue 6215)
- use the gdb hooks from the upstream tarball, rather than keeping our own
copy. The upstream version has some whitespace changes, a new write_repr for
unicode objects, and various bulletproofings for being run on older gdbs


author: David Malcolm <dmalcolm@redhat.com> - 2.7-1
changelog:
- 2.7 final; drop alphatag
- drop patch 117 (upstream), patch 120 (upstreamed)
- fix the commented-out __python_ver from 26 to 27


author: David Malcolm <dmalcolm@redhat.com> - 2.7-2
changelog:
- add machinery for regenerating the "configure" script in the face of
mismatching autoconf versions (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-4
changelog:
- fix reference to pyconfig.h in sysconfig that led to failure on startup if
python-devel was not installed


author: David Malcolm <dmalcolm@redhat.com> - 2.7-5
changelog:
- disable systemtap for now (dtrace is failing on startup due to the bug
mentioned in 2.7-4)
- provide relative path to python binary when running pathfix.py
- fix parallel make (patch 122)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-6
changelog:
- re-enable systemtap
- cherrypick upstream patch to 2to3 for "from itertools import *"
traceback (patch 123)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-8
changelog:
- add %check section
- update lib64 patch (patch 102) to fix expected output in test_site.py on
64-bit systems
- patch test_commands.py to work with SELinux (patch 124)
- patch the debug build's usage of COUNT_ALLOCS to be less verbose (patch 125)


author: David Malcolm <dmalcolm@redhat.com> - 2.7-9
changelog:
- move most of the payload of the core package to the libs subpackage, given
that the libs aren't meaningfully usable without the standard libraries


author: David Malcolm <dmalcolm@redhat.com> - 2.7.1-1
changelog:
- 2.7.1, reworking patch 0 (config), patch 102 (lib64); drop upstream
patch 56 (cfgparse), patch 110 (ctypes/SELinux/noexecmem), patch 119 (expat
compat), patch 123 (2to3 on "from itertools import *")
- fix test_abc's test_cache_leak in the debug build (patch 128)
- drop _weakref.so from manifest (_weakref became a core module in r84230)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.1-4
changelog:
- for now, drop "obsoletes" of python-argparse, since it interracts badly with
multilib (rhbz#667984)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-1
changelog:
- 2.7.2; drop upstreamed patches: patch 122 (parallel make fix), patch 124
(test_commands and SELinux), patch 130 (ppc preprocessor macro in debug
build); patch 131 (decimal in Turkish locale); regenerate the autotool
intermediates patch (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-3
changelog:
- reorganize test exclusions (test_openpty and test_pty seem to be failing on
every arch, not just the explicitly-listed ones)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-7
changelog:
- re-enable and fix the --with-tsc option on ppc64, and rework it on 32-bit
ppc to avoid aliasing violations (patch 129; rhbz#698726)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-10
changelog:
- rewrite of "check", introducing downstream-only hooks for skipping specific
cases in an rpmbuild (patch 132), and fixing/skipping failing tests in a more
fine-grained manner than before (patches 104, 133-142)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-11
changelog:
- rename and renumber patches for consistency with python3.spec (55, 111, 113,
114, 125, 131, 129 to 143)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.2-14
changelog:
- support OpenSSL FIPS mode in _hashlib and hashlib; don't build the _md5 and
_sha* modules, relying on _hashlib in hashlib, and thus within md5 etc
(rhbz#563986; patch 146)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-1
changelog:
- 2.7.3: refresh patch 102 (lib64); drop upstream patches 11 (ascii-to-lower),
115 (pydoc robustness), 145 (linux2), 148 (gdbm magic values), 151 (deadlock
in fork); refresh patch 112 (debug build); revise patch 127
(test_structmember); fix test_gdb (patch 153); refresh patch 137 (distutils
tests); add python2.pc to python-devel; regenerate the autotool intermediates
patch (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-4
changelog:
- avoid allocating thunks in ctypes unless absolutely necessary, to avoid
generating SELinux denials on "import ctypes" and "import uuid" when embedding
Python within httpd (patch 155; rhbz#814391)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-8
changelog:
- update uid/gid handling to avoid int overflows seen with uid/gid
values >= 2^31 on 32-bit architectures (patch 157; rhbz#697470)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.3-11
changelog:
- fix memory leak in module _hashlib (patch 158, rhbz#836285)
- fix db4 include path for libdb4 package (f18 and above) (patch 159)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-17
changelog:
- remove "_default_patch_fuzz" directive to avoid patches being silently
misapplied (refresh patch 1, patch 101, patch 102, patch 111, patch 121,
patch 158; rename patch 1, patch 101, patch 121; apply patch 54 before the
lib64 patches to avoid fuzz problems caused by the conditional application
of the lib64 patches)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-19
changelog:
- bulletproof the gdb debugging hooks against a failure seen in ARM builds
(patch 166; rhbz#912025)
- re-enable make check on ARM (rhbz#912025)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-22
changelog:
- fix a problem with distutils.sysconfig when CFLAGS is defined in the
environment (patch 168; rhbz#849994)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-23
changelog:
- use SHA-256 rather than implicitly using MD5 within the challenge handling
in multiprocessing.connection (patch 169; rhbz#879695)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-25
changelog:
- in debug builds, try to print repr() when a C-level assert fails in the
garbage collector (typically indicating a reference-counting error somewhere
else e.g in an extension module) (patch 170; rhbz#850013)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-27
changelog:
- port _multiprocessing.Connection.poll() to use the "poll" syscall, rather
than "select", allowing large numbers of subprocesses (patch 172;
rhbz#849992)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-34
changelog:
- restrict scope of workaround for cmpi-bindings issue to avoid breaking
in-tree running of test_sys and test_subprocess (rhbz#817554)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.4-1
changelog:
- Updated to Python 2.7.4.
- Refreshed patches: 0 (config), 7 (sqlite encoding), 16 (rpath in config),
55 (systemtap), 111 (no static lib), 112 (debug build), 113 (more
configuration flags), 130 (add extension to python config), 134 (fix
COUNT_ALLOCS in test_sys), 146 (haslib FIPS), 147 (add debug malloc stats),
153 (fix gdb test noise), 157 (uid, gid overflow - fixed upstream, just
keeping few more downstream tests), 165 (crypt module salt backport),
175 (fix configure Wformat), 5000 (regenerated autotooling patch)
- Dropped patches: 101 (lib64 regex; merged upstream), 171 (exception on
missing /dev/urandom; merged upstream), 172 (poll for multiprocessing socket
connection; merged upstream)


author: Kalev Lember <kalevlember@gmail.com> - 2.7.4-2
changelog:
- Build with libdb 5.3 instead of libdb4
- Refreshed patches: 0 (config), 102 (lib64)
- Dropped patches: 54 (db4 version), 159 (db4 include path adjustment)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.5-1
changelog:
- Updated to Python 2.7.5.
- Refreshed patches: 0 (config), 102 (lib64), 121 (add Modules to build path),
153 (gdb test noise)
- Dropped patches: 126, 127 (big endian issues, both fixed upstream),
175 (configure -Wformat, fixed upstream)
- Synced patch numbers with python3.spec.


author: Matej Stuchlik <mstuchli@redhat.com> - 2.7.5-2
changelog:
- Pulled patch fixing build with libffi containing multilib wrapper for ffi.h
    from Fedora (rhbz#979696)


author: Matej Stuchlik <mstuchli@redhat.com> - 2.7.5-23
changelog:
- Fixed CVE-2013-1753, CVE-2013-1752, CVE-2014-4616, CVE-2014-4650, CVE-2014-7185
Resolves: rhbz#1206574


author: Robert Kuska <rkuska@redhat.com> - 2.7.5-32
changelog:
- Backport SSLSocket.version function
- Temporary disable test_gdb on ppc64le rhbz#1260558
Resolves: rhbz#1259421


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-38
changelog:
- Fix hashlib algorithms breaking by initializing OpenSSL_add_all_digests
function in _hashlib library
Resolves: rhbz#1295459


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-39
changelog:
- Removal of the '$Date$' placeholder on the python(1) man page footer,
which does not expand during build
Resolves: rhbz#1268310


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-45
changelog:
- Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
  Raise an error when STARTTLS fails (upstream patch)
- Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
  Disabled HTTP header injections in httplib (upstream patch)
Resolves: rhbz#1346357


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-46
changelog:
- Drop patch 221 that backported sslwrap function since it was introducing regressions
- Refactor patch 227
Resolves: rhbz#1331425


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-47
changelog:
- Fix for CVE-2016-5636: possible integer overflow and heap corruption in zipimporter.get_data()
Resolves: rhbz#1356364


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-49
changelog:
- Fix ssl module's parsing of GEN_RID subject alternative name fields in X.509 certs
Resolves: rhbz#1364444


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-52
changelog:
- Workaround Python's threading library issue with non returning wait, for signals with timeout
Resolves: rhbz#1368076


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-57
changelog:
- Fix implicit declaration warnings of functions added by patches 147 and 265
Resolves: rhbz#1441237


author: Petr Viktorin <pviktori@redhat.com> - 2.7.5-63
changelog:
- Make it more likely for the system allocator to release free()d memory arenas
Resolves: rhbz#1468410


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-65
changelog:
- Fix hanging of all threads when trying to access an inaccessible NFS server.
Resolves: rhbz#1520068


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
- Add Conflicts tag with old virtualenv versions due to new behaviour of
  httplib (patch 295)
Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-71
changelog:
- Limit the number of CPU cores when building the package on power architectures
Resolves: rhbz#1568974


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-72
changelog:
- Fix CVE-2018-1060 and CVE-2018-1061
Resolves: rhbz#1563454 and rhbz#1549192
- Provide python2-libs from the python-libs subpackage
Resolves: rhbz#1557460


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
- Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
  a one-to-one Pid -> process mapping
Resolves: rhbz#1579432


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-79
changelog:
- Moved the macros.python/2 files into their own packages python/2-rpm-macros
Resolves: rhbz#1679221


author: Victor Stinner <vstinner@redhat.com> - 2.7.5-80
changelog:
- Security fix for CVE-2019-5010: crash on parsing a specially crafted X509 certificate
  (resolves: rhbz#1666788)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
- Disallow control chars in http URLs
- Fixes CVE-2019-9740 and CVE-2019-9947
Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
- Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
- Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
- Test fixes for the latest expat security release
- Update the certificates utilized in the test suite
Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 2.7.5-92.tuxcare.els3
changelog:
- CVE-2022-45061: fix quadratic time idna decoding
- CVE-2021-3737: fix http client infinite line reading (DoS) after a HTTP 100
  Continue


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.7.5-94.tuxcare.els1
changelog:
- Moved tuxcare patches from 2.7.5-92
- CVE-2022-48565: Reject XML entity declarations in plist files
- CVE-2022-48566: Make compare_digest more constant-time
- CVE-2022-45061: fix quadratic time idna decoding
- CVE-2021-3737: fix http client infinite line reading (DoS) after a HTTP 100
  Continue
- CVE-2022-48560: Fix SIGSEGV in Python via heappushpop in heapq


author: Dmitriy Popov <dpopov@cloudlinux.com> - 2.7.5-94.tuxcare.els3
changelog:
- Bugfix for CVE-2023-27043, use str instead of unicode, adjust tests
  according to python2 specification.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.7.5-94.tuxcare.els4
changelog:
- CVE-2024-6232: fixed regular expressions that allowed excessive
  backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS
  via specifically-crafted tar archives.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.7.5-94.tuxcare.els5
changelog:
- CVE-2024-7592: fix algorithm with quadratic complexity to avoid using excess
  CPU resources while parsing the cookie value.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2.7.5-94.0.1.tuxcare.els6
changelog:
- CVE-2025-15367: reject control characters in POP3 commands to prevent
  command injection via newlines


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 2.7.5-94.0.1.tuxcare.els7
changelog:
- CVE-2026-4519: reject leading dashes in webbrowser URLs that could be
  treated as command-line options by external browsers; also close a
  %action-substitution bypass of the check in UnixBrowser.open()


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 2.4-1.tuxcare.els1
changelog:
- CVE-2024-3651: more efficient resolution of joiner contexts in idna
  library to avoid quadratic complexity that leads to a DoS condition


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
- Reverted flawed patch for #1051427 (this reintroduces #1052102).
- Spec cleanup (removed rhel < 7 specific stuff).
- Update to 2.7.2.
Resolves: rhbz#1052777


author: Miro Hrončok <mhroncok@redhat.com> - 2.7.2-3
changelog:
- Replace lambda for 'dict' with dict itself to support all dict constructors
Resolves: rhbz#1697237


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2.7.2-4.tuxcare.els1
changelog:
- CVE-2024-56326: fix format string vulnerability impacting users
  of applications which execute untrusted template


author: Jeffrey Ollie <jeff@ocjtech.us> - 2.3.5-1
changelog:
- Bugs fixed
-
-  * Crash when merging text nodes in element.remove().
-  * Crash in sax/target parser when reporting empty doctype.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0-1
changelog:
- 3.0 (2012-10-08)
- ================
-
- Features added
- --------------
-
- Bugs fixed
- ----------
-
- * End-of-file handling was incorrect in iterparse() when reading from
-   a low-level C file stream and failed in libxml2 2.9.0 due to its
-   improved consistency checks.
-
- Other changes
- -------------
-
- * The build no longer uses Cython by default unless the generated C files
-   are missing.  To use Cython, pass the option "--with-cython".  To ignore
-   the fatal build error when Cython is required but not available (e.g. to
-   run special setup.py commands that do not actually run a build), pass
-   "--without-cython".
-
-
- 3.0beta1 (2012-09-26)
- =====================
-
- Features added
- --------------
-
- * Python level access to (optional) libxml2 memory debugging features
-   to simplify debugging of memory leaks etc.
-
- Bugs fixed
- ----------
-
- * Fix a memory leak in XPath by switching to Cython 0.17.1.
-
- * Some tests were adapted to work with PyPy.
-
- Other changes
- -------------
-
- * The code was adapted to work with the upcoming libxml2 2.9.0 release.
-
-
- 3.0alpha2 (2012-08-23)
- ======================
-
- Features added
- --------------
-
- * The .iter() method of elements now accepts tag arguments like "{*}name"
-   to search for elements with a given local name in any namespace.  With
-   this addition, all combinations of wildcards now work as expected:
-   "{ns}name", "{}name", "{*}name", "{ns}*", "{}*" and "{*}*".  Note that
-   "name" is equivalent to "{}name", but "*" is "{*}*".  The same change
-   applies to the .getiterator(), .itersiblings(), .iterancestors(),
-   .iterdescendants(), .iterchildren() and .itertext() methods,  the
-   strip_attributes(), strip_elements() and strip_tags() functions as well
-   as the iterparse() function.
-
- * C14N allows specifying the inclusive prefixes to be promoted to
-   top-level during exclusive serialisation.
-
- Bugs fixed
- ----------
-
- * Passing long Unicode strings into the feed() parser interface failed to
-   read the entire string.
-
- Other changes
- -------------
-
-
- 3.0alpha1 (2012-07-31)
- ======================
-
- Features added
- --------------
-
- * Initial support for building in PyPy (through cpyext).
-
- * DTD objects gained an API that allows read access to their
-   declarations.
-
- * xpathgrep.py gained support for parsing line-by-line (e.g.
-   from grep output) and for surrounding the output with a new root
-   tag.
-
- * E-factory in lxml.builder accepts subtypes of known data
-   types (such as string subtypes) when building elements around them.
-
- * Tree iteration and iterparse() with a selective tag
-   argument supports passing a set of tags.  Tree nodes will be
-   returned by the iterators if they match any of the tags.
-
- Bugs fixed
- ----------
-
- * The .find*() methods in lxml.objectify no longer use XPath
-   internally, which makes them faster in many cases (especially when
-   short circuiting after a single or couple of elements) and fixes
-   some behavioural differences compared to lxml.etree.  Note that
-   this means that they no longer support arbitrary XPath expressions
-   but only the subset that the ElementPath language supports.
-   The previous implementation was also redundant with the normal
-   XPath support, which can be used as a replacement.
-
- * el.find('*') could accidentally return a comment or processing
-   instruction that happened to be in the wrong spot.  (Same for the
-   other .find*() methods.)
-
- * The error logging is less intrusive and avoids a global setup where
-   possible.
-
- * Fixed undefined names in html5lib parser.
-
- * xpathgrep.py did not work in Python 3.
-
- * Element.attrib.update() did not accept an attrib of
-   another Element as parameter.
-
- * For subtypes of ElementBase that make the .text or .tail
-   properties immutable (as in objectify, for example), inserting text
-   when creating Elements through the E-Factory feature of the class
-   constructor would fail with an exception, stating that the text
-   cannot be modified.
-
- Other changes
- --------------
-
- * The code base was overhauled to properly use 'const' where the API
-   of libxml2 and libxslt requests it.  This also has an impact on the
-   public C-API of lxml itself, as defined in etreepublic.pxd, as
-   well as the provided declarations in the lxml/includes/ directory.
-   Code that uses these declarations may have to be adapted.  On the
-   plus side, this fixes several C compiler warnings, also for user
-   code, thus making it easier to spot real problems again.
-
- * The functionality of "lxml.cssselect" was moved into a separate PyPI
-   package called "cssselect".  To continue using it, you must install
-   that package separately.  The "lxml.cssselect" module is still
-   available and provides the same interface, provided the "cssselect"
-   package can be imported at runtime.
-
- * Element attributes passed in as an attrib dict or as keyword
-   arguments are now sorted by (namespaced) name before being created
-   to make their order predictable for serialisation and iteration.
-   Note that adding or deleting attributes afterwards does not take
-   that order into account, i.e. setting a new attribute appends it
-   after the existing ones.
-
- * Several classes that are for internal use only were removed
-   from the lxml.etree module dict:
-   _InputDocument, _ResolverRegistry, _ResolverContext, _BaseContext,
-   _ExsltRegExp, _IterparseContext, _TempStore, _ExceptionContext,
-   __ContentOnlyElement, _AttribIterator, _NamespaceRegistry,
-   _ClassNamespaceRegistry, _FunctionNamespaceRegistry,
-   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
-   _FileReaderContext, _ParserContext, _PythonSaxParserTarget,
-   _TargetParserContext, _ReadOnlyProxy, _ReadOnlyPIProxy,
-   _ReadOnlyEntityProxy, _ReadOnlyElementProxy, _OpaqueNodeWrapper,
-   _OpaqueDocumentWrapper, _ModifyContentOnlyProxy,
-   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
-   _AppendOnlyElementProxy, _SaxParserContext, _FilelikeWriter,
-   _ParserSchemaValidationContext, _XPathContext,
-   _XSLTResolverContext, _XSLTContext, _XSLTQuotedStringParam
-
- * Several internal classes can no longer be inherited from:
-   _InputDocument, _ResolverRegistry, _ExsltRegExp, _ElementUnicodeResult,
-   _IterparseContext, _TempStore, _AttribIterator, _ClassNamespaceRegistry,
-   _XPathFunctionNamespaceRegistry, _ParserDictionaryContext,
-   _FileReaderContext, _PythonSaxParserTarget, _TargetParserContext,
-   _ReadOnlyPIProxy, _ReadOnlyEntityProxy, _OpaqueDocumentWrapper,
-   _ModifyContentOnlyPIProxy, _ModifyContentOnlyEntityProxy,
-   _AppendOnlyElementProxy, _FilelikeWriter, _ParserSchemaValidationContext,
-   _XPathContext, _XSLTResolverContext, _XSLTContext,
-   _XSLTQuotedStringParam, _XSLTResultTree, _XSLTProcessingInstruction


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.0.1-1
changelog:
- 3.0.1 (2012-10-14)
- Bugs fixed
-
-  * LP#1065924: Element proxies could disappear during garbage collection
-    in PyPy without proper cleanup.
-  * GH#71: Failure to work with libxml2 2.6.x.
-  * LP#1065139: static MacOS-X build failed in Py3.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.1.0-1
changelog:
- 3.1.0 (2013-02-10)
- ==================
-
- Features added
- --------------
-
- * GH#89: lxml.html.clean allows overriding the set of attributes that it
-   considers 'safe'.  Patch by Francis Devereux.
-
- Bugs fixed
- ----------
-
- * LP#1104370: ``copy.copy(el.attrib)`` raised an exception.  It now returns
-   a copy of the attributes as a plain Python dict.
-
- * GH#95: When used with namespace prefixes, the  ``el.find*()`` methods
-   always used the first namespace mapping that was provided for each
-   path expression instead of using the one that was actually passed
-   in for the current run.
-
- * LP#1092521, GH#91: Fix undefined C symbol in Python runtimes compiled
-   without threading support.  Patch by Ulrich Seidl.
-
- Other changes
- -------------
-
-
- 3.1beta1 (2012-12-21)
- =====================
-
- Features added
- --------------
-
- * New build-time option ``--with-unicode-strings`` for Python 2 that
-   makes the API always return Unicode strings for names and text
-   instead of byte strings for plain ASCII content.
-
- * New incremental XML file writing API ``etree.xmlfile()``.
-
- * E factory in lxml.objectify is callable to simplify the creation of
-   tags with non-identifier names without having to resort to getattr().
-
- Bugs fixed
- ----------
-
- * When starting from a non-namespaced element in lxml.objectify, searching
-   for a child without explicitly specifying a namespace incorrectly found
-   namespaced elements with the requested local name, instead of restricting
-   the search to non-namespaced children.
-
- * GH#85: Deprecation warnings were fixed for Python 3.x.
-
- * GH#33: lxml.html.fromstring() failed to accept bytes input in Py3.
-
- * LP#1080792: Static build of libxml2 2.9.0 failed due to missing file.
-
- Other changes
- -------------
-
- * The externally useless class ``_ObjectifyElementMakerCaller`` was
-   removed from the module API of lxml.objectify.
-
- * LP#1075622: lxml.builder is faster for adding text to elements with
-   many children.  Patch by Anders Hammarquist.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.0-1
changelog:
- 3.2.0 (2013-04-28)
- ==================
-
- Features added
- --------------
-
- Bugs fixed
- ----------
-
- * LP#690319: Leading whitespace could change the behaviour of the string
-   parsing functions in ``lxml.html``.
-
- * LP#599318: The string parsing functions in ``lxml.html`` are more robust
-   in the face of uncommon HTML content like framesets or missing body tags.
-   Patch by Stefan Seelmann.
-
- * LP#712941: I/O errors while trying to access files with paths that
-   contain non-ASCII characters could raise ``UnicodeDecodeError`` instead
-   of properly reporting the ``IOError``.
-
- * LP#673205: Parsing from in-memory strings disabled network access in the
-   default parser and made subsequent attempts to parse from a URL fail.
-
- * LP#971754: lxml.html.clean appends 'nofollow' to 'rel' attributes instead
-   of overwriting the current value.
-
- * LP#715687: lxml.html.clean no longer discards scripts that are explicitly
-   allowed by the user provided whitelist.  Patch by Christine Koppelt.
-
- 3.1.2 (2013-04-12)
- ==================
-
- Bugs fixed
- ----------
-
- * LP#1136509: Passing attributes through the namespace-unaware API of
-   the sax bridge (i.e. the ``handler.startElement()`` method) failed
-   with a ``TypeError``.  Patch by Mike Bayer.
-
- * LP#1123074: Fix serialisation error in XSLT output when converting
-   the result tree to a Unicode string.
-
- * GH#105: Replace illegal usage of ``xmlBufLength()`` in libxml2 2.9.0
-   by properly exported API function ``xmlBufUse()``.
-
- 3.1.1 (2013-03-29)
- ==================
-
- Features added
- --------------
-
- Bugs fixed
- ----------
-
- * LP#1160386: Write access to ``lxml.html.FormElement.fields`` raised
-   an AttributeError in Py3.
-
- * Illegal memory access during cleanup in incremental xmlfile writer.
-
- Other changes
- -------------
-
- * The externally useless class ``lxml.etree._BaseParser`` was removed
-   from the module dict.


author: Jeffrey Ollie <jeff@ocjtech.us> - 3.2.1-1
changelog:
- 3.2.1 (2013-05-11)
- ==================
-
- Features added
- --------------
-
- * The methods ``apply_templates()`` and ``process_children()`` of XSLT
-   extension elements have gained two new boolean options ``elements_only``
-   and ``remove_blank_text`` that discard either all strings or
-   whitespace-only strings from the result list.
-
- Bugs fixed
- ----------
-
- * When moving Elements to another tree, the namespace cleanup mechanism
-   no longer drops namespace prefixes from attributes for which it finds
-   a default namespace declaration, to prevent them from appearing as
-   unnamespaced attributes after serialisation.
-
- * Returning non-type objects from a custom class lookup method could lead
-   to a crash.
-
- * Instantiating and using subtypes of Comments and ProcessingInstructions
-   crashed.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 0.8-1
changelog:
- Switch source from distribute to setuptools, that are now uptodate and supported.
- Update to setuptools 0.8.0.
- Specfile cleanup (unnecessary Python 3 logic, old RPM stuff, bogus changelog dates)


author: Ralph Bean <rbean@redhat.com> - 1.5-3
changelog:
- Renamed patches to python-urllib3-*
- Fixed ssl check patch to use the correct cert path for Fedora.
- Included dependency on ca-certificates
- Cosmetic indentation changes to the .spec file.


author: Ralph Bean <rbean@redhat.com> - 1.5-4
changelog:
- Upstream patch to fix Accept header when behind a proxy.
- Reorganize patch numbers to more clearly distinguish them.


author: bkabrda <bkabrda@redhat.com> - 1.10.2-2
changelog:
- Fix the way we unbundle six to make ovirt work even when they remove .py files
Resolves: rhbz#1247093


author: Tomas Orsava <torsava@redhat.com> - 1.10.1-3
changelog:
- Added a patch that shows a custom error message when a FILE passed to
  virtualenv to be used as 'home dir' already exists and is NOT a directory.
Resolves: rhbz#1306513


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
- Rebase to version 15.1.0
- Disable automatic downloads from pypi on new venv creation
Resolves: rhbz#1461154


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
- Add three new patches for CVEs in bundled urllib3 and requests
CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
Resolves: rhbz#1649153
Resolves: rhbz#1700824
Resolves: rhbz#1643829


author: Jamie Nguyen <jamielinux@fedoraproject.org> - 0.1.6-1
changelog:
- update to upstream release 0.1.6
- update modules to 0.0.4
- update description
- add python3-pyasn1 subpackage
- add versioned Requires for the module subpackages
- add %check section


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-2
changelog:
- disable invocation of brp-python-bytecompile in postprocessing, since
it would be with the wrong version of python (adapted from ivazquez'
python3000 specfile)
- use a custom implementation of __find_provides in order to filter out bogus
provides lines for the various .so modules
- fixup distutils/unixccompiler.py to remove standard library path from rpath
(patch 1, was Patch0 in ivazquez' python3000 specfile)
- split out libraries into a -libs subpackage
- update summaries and descriptions, basing content on ivazquez' specfile
- fixup executable permissions on .py, .xpm and .xbm files, based on work in
ivazquez's specfile
- get rid of DOS batch files
- fixup permissions for shared libraries from non-standard 555 to standard 755
- move /usr/bin/python*-config to the -devel subpackage
- mark various directories as being documentation


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-3
changelog:
- remove executable flag from various files that shouldn't have it
- fix end-of-line encodings
- fix a character encoding


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-4
changelog:
- update patch0's setup of the crypt module to link it against libcrypt
- update patch0 to comment "datetimemodule" back out, so that it is built
using setup.py (see Setup, option 3), thus linking it statically against
timemodule.c and thus avoiding a run-time "undefined symbol:
_PyTime_DoubleToTimet" failure on "import datetime"


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-5
changelog:
- fixup importlib/_bootstrap.py so that it correctly handles being unable to
open .pyc files for writing (patch 2, upstream issue 7187)
- actually apply the rpath patch (patch 1)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-6
changelog:
- reword description, based on suggestion by amcnabb
- fix the test_email and test_imp selftests (patch 3 and patch 4 respectively)
- fix the test_tk and test_ttk_* selftests (patch 5)
- fix up the specfile's handling of shebang/perms to avoid corrupting
test_httpservers.py (sed command suggested by amcnabb)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-7
changelog:
- remove commented-away patch 51 (python-2.6-distutils_rpm.patch): the -O1
flag is used by default in the upstream code
- "Makefile" and the config-32/64.h file are needed by distutils/sysconfig.py
_init_posix(), so we include them in the core package, along with their parent
directories (bug 531901)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-8
changelog:
- add a provides of "python(abi)" (see bug 532118)
- fix issues identified by a.badger in package review (bug 526126, comment 39):
  - use "3" thoughout metadata, rather than "3.*"
  - remove conditional around "pkg-config openssl"
  - use standard cleanup of RPM_BUILD_ROOT
  - replace hardcoded references to /usr with _prefix macro
  - stop removing egg-info files
  - use /usr/bin/python3.1 rather than /use/bin/env python3.1 when fixing
up shebang lines
  - stop attempting to remove no-longer-present .cvsignore files
  - move the post/postun sections above the "files" sections


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-9
changelog:
- add macros.python3 to the -devel subpackage, containing common macros for use
when packaging python3 modules


author: Andrew McNabb <amcnabb@mcnabbs.org> - 3.1.1-10
changelog:
- switched a few instances of "find |xargs" to "find -exec" for consistency.
- made the description of __os_install_post more accurate.


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-11
changelog:
- add %check section (thanks to Thomas Spura)
- update patch 4 to use correct shebang line
- get rid of stray patch file from buildroot


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-12
changelog:
- remove build-time requirements on tix and tk, since we already have
build-time requirements on the -devel subpackages for each of these (Thomas
Spura)
- replace usage of %define with %global (Thomas Spura)
- remove forcing of CC=gcc as this old workaround for bug 109268 appears to
longer be necessary
- move various test files from the "tools"/"tkinter" subpackages to the "test"
subpackage


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-14
changelog:
- replace references to /usr with %{_prefix}; replace references to
/usr/include with %{_includedir} (Toshio)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-15
changelog:
- fix the URLs output by pydoc so they point at python.org's 3.1 build of the
docs, rather than the 2.6 build


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-16
changelog:
- use the %{_isa} macro to ensure that the python-devel dependency on python
is for the correct multilib arch (#555943)
- delete bundled copy of libffi to make sure we use the system one


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-19
changelog:
- add %py3dir macro to macros.python3 (to be used during unified python 2/3
builds for setting up the python3 copy of the source tree)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-20
changelog:
- change python-3.1.1-config.patch to remove our downstream change to curses
configuration in Modules/Setup.dist, so that the curses modules are built using
setup.py with the downstream default (linking against libncursesw.so, rather
than libncurses.so), rather than within the Makefile; add a test to %install
to verify the dso files that the curses module is linked against the correct
DSO (bug 539917; changes _cursesmodule.so -> _curses.so)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-21
changelog:
- introduce %{dynload_dir} macro
- explicitly list all lib-dynload files, rather than dynamically gathering the
payload into a temporary text file, so that we can be sure what we are
shipping
- introduce a macros.pybytecompile source file, to help with packaging python3
modules (Source3; written by Toshio)
- rename "2to3-3" to "python3-2to3" to better reflect python 3 module packaging
plans


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-22
changelog:
- update python-3.1.1-config.patch to remove downstream customization of build
of pyexpat and elementtree modules
- add patch adapted from upstream (patch 7) to add support for building against
system expat; add --with-system-expat to "configure" invocation
- remove embedded copies of expat and zlib from source tree during "prep"


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-25
changelog:
- split configure options into multiple lines for easy of editing
- add systemtap static markers (wcohen, mjw, dmalcolm; patch 8), a systemtap
tapset defining "python.function.entry" and "python.function.return" to make
the markers easy to use (dmalcolm; source 5), and an example of using the
tapset to the docs (dmalcolm; source 6) (rhbz:545179)


author: Thomas Spura <tomspur@fedoraproject.org> - 3.1.1-26
changelog:
- rebuild for new package of redhat-rpm-config (rhbz:564527)
- use 'install -p' when running 'make install'


author: David Malcolm <dmalcolm@redhat.com> - 3.1.1-27
changelog:
- add pyfuntop.stp example (source 7)
- convert usage of $$RPM_BUILD_ROOT to %{buildroot} throughout, for
consistency with python.spec


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-1
changelog:
- update to 3.1.2: http://www.python.org/download/releases/3.1.2/
- drop upstreamed patch 2 (.pyc permissions handling)
- drop upstream patch 5 (fix for the test_tk and test_ttk_* selftests)
- drop upstreamed patch 200 (path-fixing script)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-5
changelog:
- exclude test_http_cookies when running selftests, due to hang seen on
http://koji.fedoraproject.org/koji/taskinfo?taskID=2088463 (cancelled after
11 hours)
- update python-gdb.py from v5 to py3k version submitted upstream


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-6
changelog:
- build and install two different configurations of Python 3: debug and
standard, packaging the debug build in a new "python3-debug" subpackage
(patch 103)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-7
changelog:
- add configure-time support for COUNT_ALLOCS and CALL_PROFILE debug options
(patch 104); enable them and the WITH_TSC option within the debug build


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-10
changelog:
- ensure that the compiler is invoked with "-fwrapv" (rhbz#594819)
- reformat whitespace in audioop.c (patch 106)
- CVE-2010-1634: fix various integer overflow checks in the audioop
module (patch 107)
- CVE-2010-2089: further checks within the audioop module (patch 108)
- CVE-2008-5983: the new PySys_SetArgvEx entry point from r81399 (patch 109)


author: David Malcolm <dmalcolm@redhat.com> - 3.1.2-11
changelog:
- Fix an incompatibility between pyexpat and the system expat-2.0.1 that led to
a segfault running test_pyexpat.py (patch 110; upstream issue 9054; rhbz#610312)


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.0.a1
changelog:
- 3.2a1; add alphatag
- rework %files in the light of PEP 3147 (__pycache__)
- drop our configuration patch to Setup.dist (patch 0): setup.py should do a
better job of things, and the %files explicitly lists our modules (r82746
appears to break the old way of doing things).  This leads to various modules
changing from "foomodule.so" to "foo.so".  It also leads to the optimized build
dropping the _sha1, _sha256 and _sha512 modules, but these are provided by
_hashlib; _weakref becomes a builtin module; xxsubtype goes away (it's only for
testing/devel purposes)
- fixup patches 3, 4, 6, 8, 102, 103, 105, 111 for the rebase
- remove upstream patches: 7 (system expat), 106, 107, 108 (audioop reformat
plus CVE-2010-1634 and CVE-2010-2089), 109 (CVE-2008-5983)
- add machinery for rebuilding "configure" and friends, using the correct
version of autoconf (patch 300)
- patch the debug build's usage of COUNT_ALLOCS to be less verbose (patch 125)
- "modulator" was removed upstream
- drop "-b" from patch applications affecting .py files to avoid littering the
installation tree


author: Thomas Spura <tomspur@fedoraproject.org> - 3.2-0.1.a1
changelog:
- on 64bit "stdlib" was still "/usr/lib/python*" (modify *lib64.patch)
- make find-provides-without-python-sonames.sh 64bit aware


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.3.a1
changelog:
- Move test.support to core package (rhbz#596258)
- Add various missing __pycache__ directories to payload


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.4.a1
changelog:
- move most of the content of the core package to the libs subpackage, given
that the libs aren't meaningfully usable without the standard libraries


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.5.b2
changelog:
- 3.2b2
- rework patch 3 (removal of mimeaudio tests), patch 6 (no static libs),
patch 8 (systemtap), patch 102 (lib64)
- remove patch 4 (rendered redundant by upstream r85537), patch 103 (PEP 3149),
patch 110 (upstreamed expat fix), patch 111 (parallel build fix for grammar
fixed upstream)
- regenerate patch 300 (autotool intermediates)
- workaround COUNT_ALLOCS weakref issues in test suite (patch 126, patch 127,
patch 128)
- stop using runtest.sh in %check (dropped by upstream), replacing with
regrtest; fixup list of failing tests
- introduce "pyshortver", "SOABI_optimized" and "SOABI_debug" macros
- rework manifests of shared libraries to use "SOABI_" macros, reflecting
PEP 3149
- drop itertools, operator and _collections modules from the manifests as py3k
commit r84058 moved these inside libpython; json/tests moved to test/json_tests
- move turtle code into the tkinter subpackage


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.8.b2
changelog:
- set EXTRA_CFLAGS to our CFLAGS, rather than overriding OPT, fixing a linker
error with dynamic annotations (when configured using --with-valgrind)
- fix the ppc build of the debug configuration (patch 130; rhbz#661510)


author: David Malcolm <dmalcolm@redhat.com> - 3.2-0.9.rc1
changelog:
- 3.2rc1
- rework patch 6 (static lib removal)
- remove upstreamed patch 130 (ppc debug build)
- regenerate patch 300 (autotool intermediates)
- updated packaging to reflect upstream rewrite of "Demo" (issue 7962)
- added libpython3.so and 2to3-3.2


author: David Malcolm <dmalcolm@redhat.com> - 3.2.1-1
changelog:
- 3.2.1; refresh lib64 patch (102), subprocess unit test patch (129), disabling
of static library build (due to Modules/_testembed; patch 6), autotool
intermediates (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.1-5
changelog:
- re-enable and fix the --with-tsc option on ppc64, and rework it on 32-bit
ppc to avoid aliasing violations (patch 130; rhbz#698726)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.2-2
changelog:
- rewrite of "check", introducing downstream-only hooks for skipping specific
cases in an rpmbuild (patch 132), and fixing/skipping failing tests in a more
fine-grained manner than before; (patches 106, 133-142 sparsely, moving
patches for consistency with python.spec: 128 to 134, 126 to 135, 127 to 141)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.2-3
changelog:
- renumber and rename patches for consistency with python.spec (8 to 55, 106
to 104, 6 to 111, 104 to 113, 105 to 114, 125, 131, 130 to 143)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.2-5
changelog:
- support OpenSSL FIPS mode in _hashlib and hashlib; don't build the _md5 and
_sha* modules, relying on _hashlib in hashlib (rhbz#563986; patch 146)


author: David Malcolm <dmalcolm@redhat.com> - 3.2.3-1
changelog:
- 3.2.3; refresh patch 102 (lib64); drop upstream patches 148 (gdbm magic
values), 149 (__pycache__ fix); add patch 152 (test_gdb regex)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.1.b1
changelog:
* Fri Jun 22 2012 David Malcolm <dmalcolm@redhat.com> - 3.2.3-10
- use macro for power64 (rhbz#834653)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.1.b1
changelog:
- 3.2 -> 3.3: https://fedoraproject.org/wiki/Features/Python_3.3
- 3.3.0b1: refresh patches 3, 55, 102, 111, 113, 114, 134, 157; drop upstream
patch 147; regenenerate autotools patch; drop "--with-wide-unicode" from
configure (PEP 393); "plat-linux2" -> "plat-linux" (upstream issue 12326);
"bz2" -> "_bz2" and "crypt" -> "_crypt"; egg-info files are no longer shipped
for stdlib (upstream issues 10645 and 12218); email/test moved to
test/test_email; add /usr/bin/pyvenv[-3.3] and venv module (PEP 405); add
_decimal and _lzma modules; make collections modules explicit in payload again
(upstream issue 11085); add _testbuffer module to tests subpackage (added in
upstream commit 3f9b3b6f7ff0); fix test failures (patches 160 and 161);
workaround erroneously shared _sysconfigdata.py upstream issue #14774; fix
distutils.sysconfig traceback (patch 162); add BuildRequires: xz-devel (for
_lzma module); skip some tests within test_socket (patch 163)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.3.b2
changelog:
- 3.3b1 -> 3.3b2; drop upstreamed patch 152; refresh patches 3, 102, 111,
134, 153, 160; regenenerate autotools patch; rework systemtap patch to work
correctly when LANG=C (patch 55); importlib.test was moved to
test.test_importlib upstream


author: Toshio Kuratomi <toshio@fedoraproject.org> - 3.3.0-8
changelog:
- Fix error in platform.platform() when non-ascii byte strings are decoded to
  unicode (rhbz#922149)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.3.1-1
changelog:
- Updated to Python 3.3.1.
- Refreshed patches: 55 (systemtap), 111 (no static lib), 146 (hashlib fips),
153 (fix test_gdb noise), 157 (uid, gid overflow - fixed upstream, just
keeping few more downstream tests)
- Removed patches: 3 (audiotest.au made it to upstream tarball)
- Removed workaround for http://bugs.python.org/issue14774, discussed in
http://bugs.python.org/issue15298 and fixed in revision 24d52d3060e8.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.3.1-3
changelog:
- Add patch that enables building on ppc64p7 (replace the sed, so that
we get consistent with python2 spec and it's more obvious that we're doing it.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.3.2-1
changelog:
- Updated to Python 3.3.2.
- Refreshed patches: 153 (gdb test noise)
- Dropped patches: 175 (configure -Wformat, fixed upstream), 182 (gdb
test threads)
- Synced patch numbers with python.spec.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.4.0-0.1.a4
changelog:
- Update to Python 3.4 alpha 4.
- Refreshed patches: 55 (systemtap), 102 (lib64), 111 (no static lib),
114 (statvfs flags), 132 (unittest rpmbuild hooks), 134 (fix COUNT_ALLOCS in
test_sys), 143 (tsc on ppc64), 146 (hashlib fips), 153 (test gdb noise),
157 (UID+GID overflows), 173 (ENOPROTOOPT in bind_port), 186 (dont raise
from py_compile)
- Removed patches: 129 (test_subprocess nonreadable dir - no longer fails in
Koji), 142 (the mock issue that caused this is fixed)
- Added patch 187 (remove thread atfork) - will be in next version
- Refreshed script for checking pyc and pyo timestamps with new ignored files.
- The fips patch is disabled for now until upstream makes a final decision
what to do with sha3 implementation for 3.4.0.


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.4.0-0.1.b1
changelog:
- Update to Python 3.4 beta 1.
- Refreshed patches: 102 (lib64), 111 (no static lib), 125 (less verbose COUNT
ALLOCS), 141 (fix COUNT_ALLOCS in test_module), 146 (hashlib fips),
157 (UID+GID overflows), 173 (ENOPROTOOPT in bind_port)
- Removed patch 00187 (remove pthread atfork; upstreamed)


author: Bohuslav Kabrda <bkabrda@redhat.com> - 3.4.0-0.1.b2
changelog:
- Update to Python 3.4 beta 2.
- Refreshed patches: 55 (systemtap), 146 (hashlib-fips), 154 (test_gdb noise)
- Dropped patches: 114 (statvfs constants), 177 (platform unicode)


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.0-5
changelog:
- Don't add Werror=declaration-after-statement for extension
  modules through setup.py (PyBT#21121)


author: Dan Horák <dan[at]danny.cz> - 3.4.1-7
changelog:
- update the arch list where valgrind exists - %power64 includes also
    ppc64le which is not supported yet


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.2-1
changelog:
- Update to 3.4.2
- Refreshed patches: 156 (gdb autoload)
- Removed: 195 (Werror declaration), 197 (CVE-2014-4650)


author: Till Maas <opensource@till.name> - 3.4.2-6
changelog:
- Rebuilt for Fedora 23 Change
  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.2-7
changelog:
- Fixed undefined behaviour in faulthandler which caused test to hang on x86_64
  (http://bugs.python.org/issue23433)


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.3-1
changelog:
- Updated to 3.4.3
- BuildPython now accepts additional build options
- Temporarily disabled test_gdb on arm (rhbz#1196181)


author: Matej Stuchlik <mstuchli@redhat.com> - 3.4.3-4
changelog:
- Use 1024bit DH key in test_ssl
- Use -O0 when compiling -debug build
- Update pip version variable to the version we actually ship


author: Thomas Spura <tomspur@fedoraproject.org> - 3.4.3-4
changelog:
- python3-devel: Require python-macros for version independant macros such as
  python_provide. See fpc#281 and fpc#534.


author: Tomas Orsava <torsava@redhat.com> - 3.5.1-9
changelog:
- Fix for: CVE-2016-0772 python: smtplib StartTLS stripping attack
- Raise an error when STARTTLS fails
- rhbz#1303647: https://bugzilla.redhat.com/show_bug.cgi?id=1303647
- rhbz#1346345: https://bugzilla.redhat.com/show_bug.cgi?id=1346345
- Fixed upstream: https://hg.python.org/cpython/rev/d590114c2394


author: Tomas Orsava <torsava@redhat.com> - 3.5.2-1
changelog:
- Rebased to version 3.5.2
- Set to work with pip version 8.1.2
- Removed patches 207, 237, 241 as fixes are already contained in Python 3.5.2
- Removed arch or environment specific patches 194, 196, 203, and 208
  as test builds indicate they are no longer needed
- Updated patches 102, 146, and 242 to work with the new Python codebase
- Removed patches 200, 201, 5000 which weren't even being applied


author: Tomas Orsava <torsava@redhat.com> - 3.5.2-2
changelog:
- Updated .pyc 'bytecompilation with the newly installed interpreter' to also
  recompile optimized .pyc files
- Removed .pyo 'bytecompilation with the newly installed interpreter', as .pyo
  files are no more
- Resolves rhbz#1373635


author: Charalampos Stratakis <cstratak@redhat.com> - 3.5.2-6
changelog:
- Use proper patch numbering and base upstream branch for
porting ssl and hashlib modules to OpenSSL 1.1.0
- Drop hashlib patch for now
- Add riscv64 arch to 64bit and no-valgrind arches


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-7
changelog:
- Fix error check, so that Random.seed actually uses OS randomness (rhbz#1412275)
- Skip test_aead_aes_gcm during rpmbuild


author: Tomas Orsava <torsava@redhat.com> - 3.6.0-8
changelog:
- Modify the runtime dependency of python3-libs on system-python-libs to use
  just the version and release number, but not the dist tag due to Modularity


author: Tomas Orsava <torsava@redhat.com> - 3.6.0-9
changelog:
- Modify the runtime dependency of python3-libs on system-python-libs again,
  because previous attempt didn't work properly with dnf resolving mechanism


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-12
changelog:
- BuildRequire the new dependencies of setuptools when rewheel mode is enabled
in order for the virtualenvs to work properly


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.0-18
changelog:
- Set values of prefix and exec_prefix to /usr/local for
  /usr/bin/python* executables
- Use new %_module_build macro


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.0-19
changelog:
- Revert "Set values of prefix and exec_prefix to /usr/local for
  /usr/bin/python* executables..." to prevent build failures
  of packages using alternate build tools


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-21
changelog:
- Use proper command line parsing in _testembed
- Backport of PEP 538: Coercing the legacy C locale to a UTF-8 based locale
  https://fedoraproject.org/wiki/Changes/python3_c.utf-8_locale


author: Iryna Shcherbina <ishcherb@redaht.com> - 3.6.1-0.1.rc1
changelog:
- Update to Python 3.6.1 release candidate 1
- Add patch 264 to skip a known test failure on aarch64


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.1-6
changelog:
- Enable profile guided optimizations for x86_64 and i686 architectures
- Update to a newer implementation of PEP 538
- Update description to reflect that Python 3 is now the default Python


author: Tomas Orsava <torsava@redhat.com> - 3.6.1-7
changelog:
- Added a dependency to the devel subpackage on python3-rpm-generators which
  have been excised out of rpm-build
- Updated notes on bootstrapping Python on top of this specfile accordingly
- Involves: rhbz#1410631, rhbz#1444925


author: Florian Weimer <fweimer@redhat.com> - 3.6.2-4
changelog:
- Do not generate debuginfo subpackages (#1476593)
- Rebuild with binutils fix for ppc64le (#1475636)


author: Tomas Orsava <torsava@redhat.com> - 3.6.2-5
changelog:
- Dropped BuildRequires on db4-devel which was useful for Python 2 (module
  bsddb), however, no longer needod for Python 3
- Tested building Python 3 with and without the dependency, all tests pass and
  filelists of resulting RPMs are identical


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.2-7
changelog:
- Revert "Add --executable option to install.py command"
  This enhancement is currently not needed and it can possibly
  collide with `pip --editable`option


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-8
changelog:
- Have /usr/bin/2to3 (rhbz#1111275)
- Provide 2to3 and idle3, list them in summary and description (rhbz#1076401)


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-11
changelog:
- Add bcond for --without optimizations
- Reword package descriptions
- Remove Group declarations
- Skip failing test_float_with_comma


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.2-12
changelog:
- Use python3 style of calling super() without arguments in rpath
  patch to prevent recursion in UnixCCompiler subclasses
Resolves: rhbz#1458122


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-13
changelog:
- Rename patch files to be consistent
- Run autotools to generate the configure script before building
- Merge lib64 patches (104 into 102)
- Skip test_bdist_rpm using test config rather than a patch (removes patch 137)
- Remove patches 157 and 186, which had test changes left over after upstreaming
- Remove patch 188, a temporary workaround for hashlib tests
- Merge patches 180, 206, 243, 5001 (architecture naming) into new patch 274
- Move python2-tools conflicts to tools subpackage (it was wrongly in tkinter)


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-14
changelog:
- Expat >= 2.1.0 is everywhere, remove explicit requires
- Conditionalize systemtap-devel BuildRequires
- For consistency, require /usr/sbin/ifconfig instead of net-tools


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-16
changelog:
- Specfile cleanup
- Make the main description also applicable to the SRPM
- Add audiotest.au to the test package


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-19
changelog:
- Move pathfix.py to bindir, https://github.com/fedora-python/python-rpm-porting/issues/24
- Make the -devel package require redhat-rpm-config
Resolves: rhbz#1496757


author: Björn Esser <besser82@fedoraproject.org> - 3.6.4-8
changelog:
- Add patch to explicitly link _ctypes module with -ldl (#1537489)
- Refactored patch for libxcrypt
- Re-enable strict symbol checks in the link editor


author: Tomas Orsava <torsava@redhat.com> - 3.6.4-10
changelog:
- Disable test_gdb for all arches and test_buffer for ppc64le in anticipation
  of the F28 mass rebuild
- Re-enable these tests after the mass rebuild when they can be properly
  addressed


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.6.4-14
changelog:
- Remove the python3-tools package (#rhbz 1312030)
- Move /usr/bin/2to3 to python3-devel
- Move /usr/bin/idle and idlelib to python3-idle
- Provide python3-tools from python3-idle


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.4-15
changelog:
- Filter out automatic /usr/bin/python3.X requirement,
  recommend the main package from libs instead
Resolves: rhbz#1547131


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.4-18
changelog:
- Fix the py_byte_compile macro to work on Python 2
- Remove the pybytecompile macro file from the flat package
Resolves: rhbz#1484993


author: Tomas Orsava <torsava@redhat.com> - 3.6.5-2
changelog:
- Fix %py_byte_compile macro: when invoked with a Python 2 binary it also
  mistakenly ran py3_byte_compile


author: Lumir Balhar & Tomas Orsava <lbalhar@redhat.com> - 3.6.8-2
changelog:
- Converting F28 python3 specfile to RHEL7
- Updated the bootstrapping sequence
- Disabled LTO because of buggy support for it in gcc on RHEL7
- Removed deprecated system-python and platform-python tags and files
- Removed a tag from `python3-libs` that recommended the `python3` package,
  because the Recommends tag doesn't work in RHEL7
- Remove unnecessary unversioned requires on glibc and gdbm
- Changes from RHEL8:
  - Move macros.pybytecompile to python-rpm-macros
  - Enable test_gdb, test_faulthandler
- Changes from Fedora:
  - Security fix for CVE-2019-5010 (#1666519, #1666522)
  - Make sure we don't ship any exe files (not needed an prebuilt)
Resolves: rhbz#1597718


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-4
changelog:
- Add explicit conflicts with python34 < 3.4.9-3, which was the main python3
  package in EPEL before that version and contained conflicting files,
  e.g. /usr/bin/python3
Resolves: rhbz#1597718


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
- Disallow control chars in http URLs
- Fixes CVE-2019-9740 and CVE-2019-9947
Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
- Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
Resolves: rhbz#1856481
- Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
- Security fix for CVE-2023-24329
- Fix the test suite support for Expat >= 2.4.5
Resolves: rhbz#2173917


author: Dmitriy Popov <dpopov@cloudlinux.com> - 3.6.8-19.tuxcare.els1
changelog:
- CVE-2021-3177: Replace snprintf to prevent buffer overflow
- CVE-2022-48565: Reject XML entity declarations in plist files


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 3.6.8-19.tuxcare.els2
changelog:
- CVE-2021-3737: Fix http client infinite line reading (DoS) after a
  HTTP 100 Continue
- CVE-2021-28861: Fix an open redirection vulnerability in http.server
- CVE-2022-0391: Make urllib.parse sanitize urls containing ASCII newline and
  tabs
- CVE-2022-45061: Fix quadratic time idna decoding


author: EL Errata <el-errata_ww@oracle.com> - 3.6.8-21.0.1
changelog:
- Remove the "getfile" feature of pydoc for oracle7 builds only
  [Orabug: 33182027][CVE-2021-3426]
- Add Oracle Linux distribution in platform.py [Orabug: 20812544]


author: Dmitriy Popov <dpopov@cloudlinux.com> - 3.6.8-21.tuxcare.els1
changelog:
- Moved tuxcare patches from 3.6.8-19
- CVE-2021-3177: Replace snprintf to prevent buffer overflow
- CVE-2022-48565: Reject XML entity declarations in plist files
- CVE-2021-3737: Fix http client infinite line reading (DoS) after a
  HTTP 100 Continue
- CVE-2021-28861: Fix an open redirection vulnerability in http.server
- CVE-2022-0391: Make urllib.parse sanitize urls containing ASCII newline and
  tabs
- CVE-2022-45061: Fix quadratic time idna decoding
- CVE-2022-48560: fix posible crash in heapq with custom comparison operators
- CVE-2020-26116: prevent header injection in http methods


author: Dmitriy Popov <dpopov@cloudlinux.com> - 3.6.8-21.tuxcare.els4
changelog:
- CVE-2024-6232: remove backtracking when parsing tarfile headers
- CVE-2024-7592: fix quadratic complexity in parsing "-quoted cookie values
  with backslashes


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 3.6.8-21.0.1.tuxcare.els2
changelog:
- CVE-2024-9287: fix path names quoting to prevent command injection in virtual
  environment activation scripts


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 3.6.8-21.0.1.tuxcare.els3
changelog:
- CVE-2007-4559: implement PEP 706 - a filter in the tarfile module to
  prevent directory traversal vulnerability


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 3.6.8-21.0.5.tuxcare.els1
changelog:
- Bump package Release to 21.0.5
- CVE-2025-8194: tarfile: validate archives to ensure member offsets are
  non-negative


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 3.6.8-21.0.5.tuxcare.els2
changelog:
- CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517:
  fix multiple tarfile extraction filter bypasses (filter="tar"/filter="data")


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 3.6.8-21.0.5.tuxcare.els6
changelog:
- CVE-2026-1299: reject newline injection in email module's BytesGenerator when serializing headers
- Skip test.test_xml_etree.XMLPullParserTest.test_simple_xml during RPM build;
  unrelated expat-2.1.0-15.0.7.tuxcare.els1 regression breaks XMLPullParser
  chunked-feed semantics in TuxCare ELS el7 build chroots


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 3.6.8-21.0.5.tuxcare.els7
changelog:
- CVE-2022-37454: fix buffer overflow in _sha3 module
- CVE-2021-23336: reject semicolon as query-string separator in urllib.parse
- CVE-2021-3733: fix ReDoS in urllib.request AbstractBasicAuthHandler
- CVE-2021-4189: stop trusting PASV response address in ftplib
- CVE-2022-48566: make hmac.compare_digest more constant-time
- CVE-2023-27043: reject malformed addresses in email.utils.parseaddr


author: Bartosz Staszewski <bstaszewski@cloudlinux.com> - 3.6.8-21.0.5.tuxcare.els9
changelog:
- CVE-2026-4519: reject leading dashes in webbrowser URLs to prevent CLI option injection in pydoc/subprocess


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-2
changelog:
- Allow to import pip10's main from pip9's /usr/bin/pip
- Do not show the "new version of pip" warning outside of venv
Resolves: rhbz#1569488
Resolves: rhbz#1571650
Resolves: rhbz#1573755


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-3
changelog:
- Converting pip specfile from F28 to RHEL7
- Disabled building of the Python 2 subpackage
- Disabled building of docs, because we don't ship its build dependencies in
  RHEL7
- Updated to a newer version of tests to match the package version
- Backported Patch3 and Patch4 from Fedora
Resolves: rhbz#1660573


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
- Add four new patches for CVEs in bundled urllib3 and requests
CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
Resolves: rhbz#1649153
Resolves: rhbz#1700824
Resolves: rhbz#1702473
Resolves: rhbz#1643829


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 9.0.3-8.tuxcare.els2
changelog:
- CVE-2025-66471: add decompression size limit to bundled urllib3
- CVE-2026-21441: skip decompression when draining redirect responses
  in bundled urllib3


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-7
changelog:
- Converting specfile from F28 to RHEL7
- Tests disabled because the minimal RHEL7 Python 3 stack does not contain test
  dependencies
- Disabled building of the Python 2 subpackage
Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
- SRPM renamed from python-setuptools to python3-setuptools
- Package prepared to contain only Python 3 version
Resolves: rhbz#1660563


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 39.2.0-10.0.5.tuxcare.els1
changelog:
- CVE-2022-40897: fix Regular Expression Denial of Service (ReDoS) in package_index.py
- CVE-2024-6345: fix remote code execution in package_index module


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
- Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 3.1.2-12.tuxcare.els1
changelog:
- CVE-2018-25032: fix a bug that can crash deflate on some input when using
  Z_FIXED
- CVE-2022-37434: fix zlib bug with a large gzip header extra field


author: Jai S <jsathyapalan@cloudlinux.com> - 3.1.2-12.tuxcare.els3
changelog:
- CVE-2024-12087: fix path traversal vulnerability in rsync enabled by the '--inc-recursive' option
- CVE-2024-12088: make --safe-links stricter


author: Rustam Mustafin <rmustafin@cloudlinux.com> - 3.1.2-12.0.1.tuxcare.els3
changelog:
- CVE-2024-12086: prevent server from reading arbitrary client files via
  path traversal
- CVE-2025-10158: fix invalid access to files array in sender
- Add upstream stability fix (RsyncProject/rsync PR #706):
  use-after-free in generator
- Enable Amazon Linux 2 ELS


author: John A. Martin <jam@jamux.com>
changelog:
- Built 1.6.3-2 after finding no rsync-1.6.3-1.src.rpm although there
  was an ftp://ftp.redhat.com/pub/contrib/alpha/rsync-1.6.3-1.alpha.rpm
  showing no packager nor signature but giving 
  "Source RPM: rsync-1.6.3-1.src.rpm".
- Changes from 1.6.2-1 packaging: added '$RPM_OPT_FLAGS' to make, strip
  to '%build', removed '%prefix'.


author: Bill Nottingham <notting@redhat.com>
changelog:
- fix some signed/unsigned issues (<krahmer@suse.de>)
- tweak ipv6 patch (#55337, <john.l.villalovos@intel.com>)
- make xinetd file %config(noreplace)


author: Bill Nottingham <notting@redhat.com> 2.5.4-2
changelog:
- upstream patches: fix accidental use of --whole-file, fix
  minor memory leak, and bad worst-case child kill behavior
- make passing -e to rsync:// URLs not cause an error exit (#62489)


author: Hardy Merrill <hmerrill@redhat.com> 2.5.6-6
changelog:
- removed patch rsync-2.5.4-maxdel.patch
- removed patch rsync-2.4.6-segv.patch
   - current 2.5.6 properly handles (no segfault) the situation
     (rsync '[a]') that caused a need for this patch.
- added patch rsync-2.5.6-sign.patch, which is a working
  subset of patches (that still apply) included in the original
  rsync-2.5.4-moresignage.patch


author: Hardy Merrill <hmerrill@redhat.com> 2.5.6-15
changelog:
- add rsync-2.5.6-signal.patch to fix kernel warnings that
  appear because socket.c sets SIGCHLD to SIG_IGN and then
  calls wait.  This is in response to bug#98740.  This patch
  *has* been committed to CVS upstream and will be in
  upstream rsync-2.5.7.


author: Jay Fenlason <fenlason@redhat.com> 2.6.1-1
changelog:
- Rsync 2.6.1 final.
- Add a patch from Wayne Davison <wayned@samba.org> that fixes a
  use of uninitilized memory in the map_uid and map_gid functions.
- Add another patch from Wayne Davidson that fixes the -R option.
- Add a patch (extracted from a patch by Sami Farin
  <safari-rsync@safari.iki.fi>) to not ignore the return value
  of close().


author: Jay Fenlason <fenlason@redhat.com> 2.6.2-0
changelog:
- New upstream version to correct the problems with 2.6.1.
  This obsoletes all the patches to 2.6.1


author: Jay Fenlason <fenlason@redhat.com> 2.6.3-0.pre1
changelog:
- New upstream version with security fix for CAN-2004-0792
- This obsoletes the -lastdir-corruption patch.


author: Jay Fenlason <fenlason@redhat.com> 2.6.4-3
changelog:
- Include the -address patch from upstream, to close
  bz#154752 Unable to use --address in client mode


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-2
changelog:
- New upstream release
- Use the upstream xattr patch instead of mine.  This closes
  bz#190208 CVE-2006-2083 rsync buffer overflow issue


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-3
changelog:
- Add my xattrs_bug patch to fix a bug where xattrs don't get sent correctly.
- Add BuildRequires to make sure libattr-devel and libacl-devel are avaliable
- replace --with... with --enable... so they actually work
- Add make, autoconf and gcc to BuildRequires


author: Simo Sorce <ssorce@redhat.com> 3.0.0-0.pre8.fc9
changelog:
- Eight prerelease
- Add second source, now patches are in a separate file
- Add temporary fix to the xattrs.diff patch line as, in this version
  the patch contains one extra humk already contained in acls.diff


author: Michal Luscon <mluscon@redhat.com> 3.0.9-4
changelog:
- Fixed: #823088 - rsync loses track of files with different directory prefixes
- Fixed: #495310 - rsync contains forked copy of zlib


author: Pavel Šimerda <psimerda@redhat.com> - 3.0.9-14
changelog:
- Resolves: #1052814 - rsync command is terminated with SIGSEGV
- Resolves: #1052814 - add missing patch file


author: Luboš Uhliarik <luhliari@redhat.com> - 3.0.9-17
changelog:
- Resolves: #1082496 - socket activation for rsync doesn't work (added missing
  rsyncd@.service file)


author: Michal Ruprich - 3.1.2-4
changelog:
- Related: #1432899 - removing dependencies on perl
- using the bundled zlib.h(#1491582)
- turning on upstream tests


author: Dmitrii Zudin <dzudin@cloudlinux.com> - 2.0.0.648-39.tuxcare.els1
changelog:
- test/net/imap/test_imap.rb: fix test failures due to expired certs
- test/ruby/test_time_tz.rb: fix timezone test


author: Dmitrii Zudin <dzudin@cloudlinux.com> - 2.0.0.648-39.tuxcare.els4
changelog:
- CVE-2021-41817: add length limit option for methods that parses date strings
  The default limit is 128. You can configure the limit by giving `limit` keyword
  arguments like `Date.parse(str, limit: 1000)`. If you pass `limit: nil`,
  the limit is disabled.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.0.0.648-39.tuxcare.els6
changelog:
- CVE-2024-49761: fix ReDoS vulnerability in parsing XML with hex numeric
  character reference in REXML gem


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.0.0.648-39.tuxcare.els7
changelog:
- CVE-2025-27219: fix a potential Denial of Service (DoS) vulnerability in
  cookie parsing
- CVE-2025-27220: fix ReDoS vulnerability exists in the escapeElement
  method
- CVE-2025-27221: fix he URI handling methods (URI.join, URI#merge, URI#+)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.0.0.648-39.tuxcare.els8
changelog:
- CVE-2017-9226: fix a heap out-of-bounds write or read occurs in
  next_state_val() during regular expression compilation.


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 2.0.0.648-39.tuxcare.els11
changelog:
- CVE-2016-2337: Fix type confusion in _cancel_eval Ruby's TclTkIp class method
  to prevent arbitrary code execution
- CVE-2017-9224: Fix stack out-of-bounds read in match_at() during regular
  expression searching
- CVE-2017-9227: Fix stack out-of-bounds read in mbc_enc_len() and invalid
  pointer dereference in  forward_search_range()
- CVE-2017-9228: Fix heap out-of-bounds write in bitset_set_range() and
  parse_char_class() by initializing critical local variable


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 2.0.0.648-39.tuxcare.els12
changelog:
- CVE-2021-28965: fix REXML XML round-trip vulnerability
- CVE-2022-28739: fix buffer over-read in String-to-Float conversion


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
- Add Psych.safe_load
  * ruby-2.1.0-there-should-be-only-one-exception.patch
  * ruby-2.1.0-Adding-Psych.safe_load.patch
  Related: CVE-2017-0903
- Disable Tokyo TZ tests broken by recen tzdata update.
  * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
  Related: CVE-2017-0903


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
- Kill bundled certificates.
- Add macros to edit files lists in .gemspec
- Fix buffer under-read in String#unpack
  Resolves: CVE-2018-8778
- Fix HTTP response splitting in WEBrick
  Resolves: CVE-2017-17742
- Fix DoS by large request in WEBrick
  Resolves: CVE-2018-8777
- Fix directory traversal by poisoned NULL byte in Dir.
  Resolves: CVE-2018-8780
- Fix file and directory creation with directory traversal.
  Resolves: CVE-2018-6914
- Fix socket creation by poisoned NULL byte.
  Resolves: CVE-2018-8779
- Fix: return default path with nonexistent home dir
- Fix flags not propagated in Array#pack and String#unpack.
  Resolves: CVE-2018-16396
- Fix strictly interpret octal fields in tar headers.
  Resolves: CVE-2018-1000075
- Fix a security error for duplicate files in a package.
  Resolves: CVE-2018-1000076
- Enforce URL validation on spec homepage attribute.
  Resolves: CVE-2018-1000077
- Mitigate XSS vulnerability in homepage attribute.
  Resolves: CVE-2018-1000078
- Prevent Path Traversal issue during gem installation.
  Resolves: CVE-2018-1000079
- Fix unsafe Object Deserialization Vulnerability in gem owner.
  Resolves: CVE-2018-1000074
- Refresh expired certificates.
- Fix path traversal when writing to a symlinked basedir outside of the root
  Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
- Introduce `Gem::UserInteraction#verbose` method as precondition to fix
  CVE-2019-8321.
  * rubygems-2.3.0-refactor-checking-really_verbose.patch
- Fix escape sequence injection vulnerability in verbose.
- Fix escape sequence injection vulnerability in gem owner.
  Resolves: CVE-2019-8322
- Fix escape sequence injection vulnerability in API response handling.
  Resolves: CVE-2019-8323
- Prohibit arbitrary code execution when installing a malicious gem.
  Resolves: CVE-2019-8324
- Fix escape sequence injection vulnerability in errors.
  Resolves: CVE-2019-8325
  * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
- Multiple packages are installing files under /etc/tmpfiles.d
- comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
- Resolves: rhbz#1121958


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.1.5.1-25
changelog:
- prevent creating users ".." or "." or with all numeric usernames (#1373645)
- raise limit for passwd and shadow entry length but also prevent
  writing longer entries (#1422497)
- consider also supplementary group membership in newgrp (#1425078)


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-1
changelog:
- rebase to current upstream release to bring newuidmap and newgidmap
- re-allow all numeric usernames when SHADOW_ALLOW_ALL_NUMERIC_USER
  environment variable is set


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-2
changelog:
- ignore LOGIN_PLAIN_PROMPT variable in login.defs
- correct wrong SUB_UID/GID_COUNT default in manual page (#1690522)


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.3
changelog:
- [candlepin/foreman] psql with --no-password
  Resolves: bz1932772
- [foreman] proxy_password scrub in installer logs
  Resolves: bz1785813


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.4
changelog:
- [candlepin/foreman] psql with --no-password
  Resolves: bz1932772
- [pacemaker] password scrub fix
  Resolves: bz1903144
- [filesys] never collect panfs
  Resolves: bz1886784
- [openstack_ceilometer] backend_url protected
  Resolves: bz1892692


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.5
changelog:
- [sssd] Add individual SSSD log files
  Resolves: bz1938932
- [sssd] sssd plugin when sssd-common
  Resolves: bz1946641
- [foreman] fix unmatched group in scrubbing installer logs
  Resolves: bz1956817
- [foreman] Sizelimit foreman-maintain and installer logs
  Resolves: bz1964000
- [pulpcore] add plugin for pulp-3
  Resolves: bz1956672


author: Barbora Vassova <bvassova@redhat.com> = 3.9-5.12
changelog:
- [redhat] Change authentication method for RHEL
  Resolves: RHEL-21176
- [rpm] Capture the output of 'rpm --showrc'
  Resolves: RHEL-2357
- [candlepin] collect information about SCA
  Resolves: RHEL-22263
- [foreman] scrub admin init password in installer logs
  Resolves: RHEL-22264


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-4
changelog:
- Revert back to spice 0.12 behaviour where QXL guest resources for cursor
  commands are only released when the current cursor is replaced. This avoids
  a QEMU regression causing crashes during migration
  Resolves: rhbz#1567944


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
- Don't mute Record channel on client reconnection
  Resolves: rhbz#1549132
- Allow to configure TLS protocol versions and ciphers which SPICE will use for
  TLS communications
  Resolves: rhbz#1562213
- Enable ECDH ciphers with OpenSSL 1.0
  Resolves: rhbz#1566597


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-7
changelog:
- Fix off-by-one error during guest-to-host memory address conversion
  Resolves: CVE-2019-3813
- Add patch for upstream commit 48179332d9da0. This should help with corrupted
  spice-html5 displays
  Resolves: rhbz#1573739
- Add missing minimum openssl version Requires for patch #24
  Resolves: rhbz#1627693


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 0.14.0-9.1.tuxcare.els1
changelog:
- CVE-2021-20201: fix DoS via uncontrolled TLS renegotiation by disabling client-initiated renegotiation


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.17.git5c6f0024
changelog:
- Latest pre 4.3 snapshot
- Includes fix for mksquashfs hangs
- Switch to get pre-release updates from the stable branch at kernel.org


author: Bruno Wolff III <bruno@wolff.to> - 4.3-0.18.gitaae0aff4
changelog:
- Latest pre 4.3 stable snapshot
- A few minor bug fixes
- Improvements in getting status info while running unsquashfs


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
- Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
  a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
- Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
  code -- Remove support for Gopher protocol (CVE-2023-46728)
- Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
  feature (CVE-2023-49285)
- Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
  Helper Process management (CVE-2023-49286)
- Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
  (CVE-2023-46724)
- Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
  (CVE-2023-50269)
- Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
  (CVE-2024-25617)


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7:3.5.20-17.0.3.10.tuxcare.els1
changelog:
- CVE-2021-28651: fix memory leak in RFC 2169 response parsing
- CVE-2021-28652: fix broken cache manager URL parsing
- CVE-2021-31806: fix memory management bug
- CVE-2021-31807: fix integer overflow problem
- CVE-2021-31808: fix input validation bug
- CVE-2021-33620: handle more partial responses


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els2
changelog:
- CVE-2025-62168: fix failure to redact HTTP authentication credentials in error
  handling to prevent information disclosure
- email_err_data directive now defaults to 'off' for security (previously 'on')


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els4
changelog:
- CVE-2026-33526: fix heap use-after-free due to double rfc1738_escape in ICP error handling
- CVE-2026-33515: fix validation of ICP packet sizes and URLs to prevent out-of-bounds reads
- CVE-2026-32748: fix HttpRequest use-after-free in ICP v3 query handling


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els5
changelog:
- CVE-2021-28116: fix out-of-bounds read in WCCPv2 message parsing via
  stricter bounds validation of security, service, router, view, and
  capability items


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els6
changelog:
- CVE-2023-49288: fix use-after-free in store_client lifetime by locking
  StoreEntry for the duration of the store_client object


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
changelog:
- remove absolute path names from the PAM configuration, ensuring that the
  right modules get used for whichever arch we're built for
- don't try to install the FAQ, which isn't there any more


author: Colin Walters <walters@redhat.com> 1.6.7p5-24
changelog:
- Enhance sesh.c to fork/exec children itself, to avoid
  having sudo reap all domains.
- Only reinstall default signal handlers immediately before
  exec of child with SELinux patch


author: Karel Zak <kzak@redhat.com> 1.6.8p9-1
changelog:
- new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)


author: Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
changelog:
- Remove selinux patch.  It has been decided that the SELinux patch for sudo is
- no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
- We require the person using sudo to execute newrole before using sudo.


author: Karel Zak <kzak@redhat.com> 1.6.8p12-7
changelog:
- fix #198755 - make login processes (sudo -i) initialise session keyring
  (thanks for PAM config files to David Howells)
- add IPv6 support (patch by Milan Zazrivec)


author: Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
changelog:
- adjust audit patch, do not scream when kernel is
  compiled without audit netlink support (#401201)


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
changelog:
- fixed building with new libtool
- fix for incorrect handling of groups in Runas_User
- added /usr/local/sbin to secure-path


author: Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
changelog:
- moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
- epoch number sync


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
changelog:
- new upstream version 1.7.2p2-1
- commented out unused aliases in sudoers to make visudo happy (#550239)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
changelog:
- Add /etc/sudoers.d dir and use it in default config (#551470).
- Drop *.pod man page duplicates from docs.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
changelog:
- audit related Makefile.in and configure.in corrections
- added --with-audit configure option
- removed call to libtoolize


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
changelog:
- update to new upstream version
- merged .audit and .libaudit patch
- added sudoers.ldap.5* to files


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
changelog:
- update to new upstream version
- new command available: sudoreplay
- use native audit support
- corrected license field value: BSD -> ISC


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
changelog:
- anybody in the wheel group has now root access (using password) (rhbz#656873)
- sync configuration paths with the nss_ldap package (rhbz#652687)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
changelog:
- rebase to 1.8.1p2
- removed .sudoi patch
- fixed typo: RELPRO -> RELRO
- added -devel subpackage for the sudo_plugin.h header file
- use default ldap configuration files again


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
changelog:
- added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
- re-enabled SSSD support
- removed libsss_sudo dependency


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
changelog:
- added upstream patch for a regression
- don't include arch specific files in the -devel subpackage
- ship only one sample plugin in the -devel subpackage


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
changelog:
- update to 1.8.6p7
- fixes CVE-2013-1775 and CVE-2013-1776
- fixed several packaging issues (thanks to ville.skytta@iki.fi)
  - build with system zlib.
  - let rpmbuild strip libexecdir/*.so.
  - own the %{_docdir}/sudo-* dir.
  - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
  - fix bogus %changelog dates.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-3
changelog:
- synced sudoers, configure options & configuration files with
  expected RHEL configuration
  Resolves: rhbz#969373
  Resolves: rhbz#971009
  Resolves: rhbz#965124
  Resolves: rhbz#971013
  Resolves: rhbz#839705


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-5
changelog:
- added standalone manpage for sudo.conf and sudo-ldap.conf
- spec file cleanup
  Resolves: rhbz#881258


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-6
changelog:
- fixed alias cycle detection code
- added debug messages for tracing of netgroup matching
- fixed aborting on realloc when displaying allowed commands
- sssd: filter netgroups in the sudoUser attribute
- parse uids/gids more strictly
- added debug messages to trace netgroup matching
  Resolves: rhbz#1026904
  Resolves: rhbz#1026890
  Resolves: rhbz#1007014
  Resolves: rhbz#1026894
  Resolves: rhbz#1000389
  Resolves: rhbz#994566


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-11
changelog:
- Fixed incorrect login shell path construction in sesh
  (thanks fkrska@redhat.com for the patch)
  Resolves: rhbz#1065418


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-12
changelog:
- RHEL 7.1 erratum
  - don't retry authentication when ctrl-c pressed
  - fix double-quote processing in Defaults options
  - handle the "(none)" hostname correctly
  - SSSD: fix sudoUser netgroup specification filtering
  - SSSD: list correct user when -U <user> -l specified
  - SSSD: show rule names on long listing (-ll)
  - fix infinite loop when duplicate entries are specified on the
    sudoers nsswitch.conf line
  Resolves: rhbz#1084488
  Resolves: rhbz#1088464
  Resolves: rhbz#1088825
  Resolves: rhbz#1092499
  Resolves: rhbz#1093099
  Resolves: rhbz#1096813
  Resolves: rhbz#1147497
  Resolves: rhbz#1147557


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-14
changelog:
- RHEL 7.2 erratum
  - backported command digest specification
  - fixed CVE-2014-9680 sudo: unsafe handling of TZ environment variable
  - fixed typos in sudoers.ldap man page
  - fixed handling of double-quoted sudoOption values in ldap, sssd sources
  - fixed numeric uid specification support in ldap source
  - fixed authentication flag logic in ldap source
  - added the systemctl command to the SERVICES alias in the default sudoers file
  Resolves: rhbz#1144446
  Resolves: rhbz#1235570
  Resolves: rhbz#1138259
  Resolves: rhbz#1183818
  Resolves: rhbz#1233607
  Resolves: rhbz#1144419
  Resolves: rhbz#1135539
  Resolves: rhbz#1215400


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-15
changelog:
- RHEL 7.2 erratum
  - fixed compilation of testing binaries during make check
  - added legacy group processing patch
  - replaced buggy base64 decoder with a public domain implementation
  Resolves: rhbz#1254621
  Resolves: rhbz#1183818
  Resolves: rhbz#1247591


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-18
changelog:
- RHEL 7.3 erratum
  - removed requiretty flag from the default sudoers policy
  - backported pam_service and pam_login_service defaults options
  - implemented netgroup_tuple defaults option for changing netgroup
    processing semantics
  - fixed user matching logic in the LDAP nss backend
  - don't allow visudo to accept an invalid sudoers file
  - fixed a bug causing that non-root users can list privileges of
    other users
  - modified digest check documentation to mention the raciness of
    the checking mechanism
  Resolves: rhbz#1196451
  Resolves: rhbz#1247230
  Resolves: rhbz#1334331
  Resolves: rhbz#1334360
  Resolves: rhbz#1261998
  Resolves: rhbz#1313364
  Resolves: rhbz#1312486
  Resolves: rhbz#1268958
  Resolves: rhbz#1335039
  Resolves: rhbz#1335042
  Resolves: rhbz#1335045
  Resolves: rhbz#1273243
  Resolves: rhbz#1299883


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-19
changelog:
- RHEL 7.3 erratum
  - removed INPUTRC from env_keep to prevent a potential info leak
  Resolves: rhbz#1340700


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-1
changelog:
- RHEL 7.4 erratum
  - Resolves: rhbz#1360687 - rebase to 1.8.19p2
  - Resolves: rhbz#1123526 - performance improvement
  - Resolves: rhbz#1308789 - add MAIL and NOMAIL tags
  - Resolves: rhbz#1348504 - sudo now parses sudoers with sudoers locale
  - Resolves: rhbz#1374417 - "sudo -l command" indicated that the command
    was runnable even if denied by sudoers when using LDAP or SSSD backend.
  - Resolves: rhbz#1387303 - add ignore_iolog_errors option
  - Resolves: rhbz#1389360 - wrong log file group ownership
  - Resolves: rhbz#1389735 - add iolog_group, iolog_mode, iolog_user options
  - Resolves: rhbz#1397169 - maxseq and ignore_iolog_errors options
  - Resolves: rhbz#1403051 - add support for querying netgroups directly via LDAP
  - Resolves: rhbz#1410086 - race condition while creating /var/log/sudo-io dir
  - Resolves: rhbz#1413160 - add ignore_unknown_defaults flag
  - Resolves: rhbz#1254772 - ability to export sudoers in json format
  - Resolves: rhbz#1417187 - wrong reference to config file in systax error message
  - Resolves: rhbz#1424575 - visudo was not printing severity of error/warning message


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
changelog:
- RHEL 7.4 erratum
- Fixes coverity scan issues created by our patches:
  - fixed resource leaks and a compiler warning in digest backport patch
  - removed needless code from cmnd_no_wait patch causing clang warning
  - format of the last changelog message causes problems to rhpkg push,
    so don't use that as a commit message
  Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-3
changelog:
- RHEL 7.4 eratum
- Fixes semicolon typo in digest backport patch from the previous build
  Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
- RHEL 7.4 erratum
- fixed cmnd_no_wait patch
- backported iolog_flush sudoers default
  Resolves: rhbz#1369856
  Resolves: rhbz#1425853


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
- RHEL 7.4 erratum
- added doc patch about sudo lookup issue
  Resolves: rhbz#1293306
- added test suite patch
  Resolves: rhbz#1360687
- fixed use after free fqdn problem
  Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
- RHEL 7.4 erratum
- added patch to fix output truncation (in some cases) when log_output
  option is enabled
  Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
- RHEL 7.4 erratum
- Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
  Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
- RHEL 7.4 erratum
- removed patch for output truncation (1454571) which introduced regression
  Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
- RHEL 7.5 erratum
- Fixed exit codes for `sudo -l -U <user>`
- Fixed truncated output when log_output is enabled
- Updated use_pty and IO logging manpage

  Resolves: rhbz#1458696
  Resolves: rhbz#1454571
  Resolves: rhbz#1490358

- Fixed second pass LDAP filter expression in the sudoers ldap backend
  - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
- RHEL 7.5 erratum
- Fixed sudo -l checking results whether user should be authenticated
- Enabled LDAP filter patch
- Fixed double free in sssd

  Resolves: rhbz#1505409
  Resolves: rhbz#1511850
  Resolves: rhbz#1518104


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-1
changelog:
- RHEL-7.6 erratum
  Resolves: rhbz#1547974 - Rebase sudo to latest stable upstream version (1.8.23)
  Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets
  Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
  Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
  Resolves: rhbz#1548380 - RFE: Create flag to filter to sudo -l output
  Resolves: rhbz#1510002 - Ensure that the command input (stdin) eating behaviour of Default log_input is documented
  Resolves: rhbz#1596032 - Why does sudo package depend on vim-minimal?


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
- RHEL-7.6 erratum
  Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
  Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
  Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
- RHEL-7.7 erratum
  Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
  Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
- RHEL-7.8 erratum
  Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
- RHEL-7.8 erratum
  Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
- RHEL 7.9.Z ERRATUM
- defaults use_pty plus SELinux ROLE in user specification breaks terminal
  Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
- RHEL 7.9.Z ERRATUM
- CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161222


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.8.23-10.3.tuxcare.els3
changelog:
- CVE-2025-32462: fix privilege escalation vulnerability by restricting
  unauthorized users from gaining elevated system privileges via the Sudo host
  option


author: Preston Brown <pbrown@redhat.com>
changelog:
- packaged for Winston
- change va patch to indicate kernel is not patched for iostat accounting.
  re-enable if our stock kernel gets this patch.
- upgrade to 3.2.
- install crontab entry.


author: Preston Brown <pbrown@redhat.com>
changelog:
- make sure disk accounting is enabled to fix iostat -l, -p (#16268)
- crontab entries were missing the user (root) to run as (#18212)


author: Preston Brown <pbrown@redhat.com>
changelog:
- Summarize previous day's activity with sa2, not current day (which is only 4 hours of data when it gets run) (#24820)
- upgrade to 3.3.4 for full 2.4 compatibility and improved iostat


author: Trond Eivind Glomsrød <teg@redhat.com> 4.0.2-1
changelog:
- 4.0.2
- the kernel patch for extended statistics is in, don't say it needs
  applying in the man page


author: Trond Eivind Glomsrød <teg@redhat.com> 4.0.3-2
changelog:
- Do the daily sa2 run just before midnight, not at 4AM... you'd 
  only get 4 hours worth of data that way (#63132)


author: Nils Philippsen <nphilipp@redhat.com> 5.0.0-0.4
changelog:
- fix insecure tmp files in scripts (#78212)
- require tools needed in scripts
- use IFNAMSIZ from {_includedir}/linux/if.h for maximum interface length


author: Nils Philippsen <nphilipp@redhat.com> 5.0.0-0.6
changelog:
- let user configure how long to keep logs through /etc/sysconfig/sysstat
  (#81294)
- reset stats at system boot (#102445)


author: Alan Cox <alan@redhat.com>
changelog:
- Fix spew of crap to console at startup
- Fix order of startup (#124035)
- Fix array overrun (#117182)
- Fix interrupt buffer sizing (caused bogus irq info)


author: Nils Philippsen <nphilipp@redhat.com>
changelog:
- version 5.0.5
- remove some obsolete patches
- update statreset, overrun, lib64init patches
- renumber patches


author: Charles Bennett <ccb@redhat.com> 5.0.5-5.fc
changelog:
- bring in filename and append-msg patch
- append-msg adds verbose text for when saNN data file cpu count
-  does not match cpu count on the currently running system


author: Ivana Varekova <varekova@redhat.com> - 8.0.1-1
changelog:
- update to 8.0.1
- remove useless patches
- spec file cleanup
- remove smp build flag (ar problem)
- add libdir flags


author: Ivana Varekova <varekova@redhat.com> - 8.0.2-2
changelog:
- change license tag
- remove sysstat.crond source (add -d)
- remove obsolete sysconfig file
- spec file cleanup


author: Ivana Varekova <varekova@redhat.com> - 9.0.4-3
changelog:
- fix init script - add INIT INFO flags (#522740)
  and add condrestart, try-restart and force-reload (#522743)


author: Ivana Hutarova Varekova <varekova@redhat.com> - 9.0.6.1-7
changelog:
- remove needless DOCDIR setting
- remove needless INIT_DIR setting
- fix the problem with --disable-man-group option


author: Ivana Hutarova Varekova <varekova@redhat.com> - 10.0.0-4
changelog:
- close the file descriptor in a special situation in read_uoptime function
- fix the number on open files in cifsiostat output


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.1-1
changelog:
- resolves: #844387
  update to 10.1.1
- keep log files for 28 days instead of 7
- collect all aditional statistics


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-1
changelog:
- resolves: #863791
  updated to 10.1.2
- resolves: #850333
  migrated to the new systemd-rpm macros
- cleaned .spec file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-2
changelog:
- added new -y option to iostat command to skip first since boot report if
  displaying multiple reports


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-5
changelog:
- resolves: #1100365
  fixed issue when sa data files weren't correctly overwritten in some cases
- resolves: #1097294
  count with xz compressed files as well in sa2 script
- resolves: #1097292
  fix file mode of sysstat cron file
- resolves: #1128569
  added workaround for dyn-tick kernel feature which makes /proc/stat file
  unreliable under certain circumstances
- resolves: #1110852
  added better explanation of HISTORY setting to sysstat(5) man page
- resolves: #1102610
  added possibility to set compress method in /etc/sysconfig/sysstat file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-6
changelog:
- resolves: #1146081
  fixed issue when cifsiostat and nfsiostat were reporting incorrect statistics
  on a single CPU machines


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-8
changelog:
- resolves: #846699
  renamed nfsiostat to nfsiostat-sysstat, as nfsiostat is also provided
  by the nfs-utils package
- resolves: #1224882
  fixed bug when pidstat could run out of pre-allocated space for PIDs
- resolves: #1258990
  added support for more CPUs
- resolves: #1267972
  fixed bug when iostat didn't display the full device name if it's too long
- resolves: #1328490
  fixed bug, when sadc could forward SIGINIT to init process and couse reboot


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-9
changelog:
- related: #846699
  do the renaming of nfsiostat properly, with patch
- resolves: #1332662
  added tapestat utility for monitoring tape drives


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
- add -f flag to force fdatasync() after sa file update (#1662094)
- don't call filesystem count functions when we are not collecting fs statistics (#1670060)
- skip autofs when gathering filesystem statistics (#1670060)
- fix use of incorrect preposition in sar man page (#1624410)
- fix CPU usage reporting (#1618688)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 10.1.5-20.tuxcare.els1
changelog:
- CVE-2022-39377: check an overflow and exit if it be
- CVE-2023-33204: fix possible buffer overflow in an incomplete fix for
  CVE-2022-39377


author: Rex Dieter <rdieter@fedoraproject.org> 1.8-1
changelog:
- taglib-1.8

-* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.7.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1.8-8.20130218git.tuxcare.els1
changelog:
- CVE-2023-47466: fix segmentation violation and application crash during tag
  writing via crafted WAV file in which an id3 chunk is the only valid chunk


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
- Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
- Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
- Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
- Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
- Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
- Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
- Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
- Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12
changelog:
- Resolves: rhbz#1367492 harden package permissions
- Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
- Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
- Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
- Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
- Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
- Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
- Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
- Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
- Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 0:7.0.76-16.tuxcare.els3
changelog:
- CVE-2025-24813: fix path equivalence vulnerability leading to remote code
  execution and information disclosure


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 0:7.0.76-16.tuxcare.els4
changelog:
- CVE-2026-43514: fix observable timing discrepancy when comparing AJP secret (Low)
- CVE-2026-43512: fix authentication bypass in DIGEST authentication when password is null (Moderate)
- CVE-2026-43515: fix improper authorization when multiple method constraints apply to the same extension pattern (Moderate)
- CVE-2026-43513: fix LockOutRealm bypass via case-variant usernames against case-insensitive realms (Low)


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
- Rebase to tzdata-2022d
  - Palestine's DST transition will be on October 29, 2022,
    not October 28, 2022.
  - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
- Rebase to tzdata-2022e
  - Jordan and Syria cancelled the DST transition planned
    for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
- Rebase to tzdata-2022f
  - Mexico will stop observing DST except near the US border.
  - Chihuahua moved to -06 year round starting on 2022-10-30.
  - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
- Rebase to tzdata-2022g
  - The northern edge of the Mexican state of Chihuahua will
    change time zone to agree with nearby US locations on
    2022-11-30.
  - Added a new Zone America/Ciudad_Juarez that splits from
    America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
- Rebase to tzdata-2023a
  - Egypt reintroduced DST, from April through October.
  - Morocco springs forward April 23, not April 30.
  - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
- Rebase to tzdata-2023d
  - Include time zone changes for Ittoqqortoormiit, Greenland
    and Vostok, Antarctica.
  - Update the expiration date for the leap-seconds.list file.
    No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
- Rebase to tzdata-2024a
  - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
  - Palestine will spring forward a week later than previously
    predicted.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2025b-1.tuxcare.els1
changelog:
- Upgrade to tzdata-2025b
  - New zone for Aysén Region in Chile which moves from -04/-03 to -03.
  - Paraguay adopted permanent -03 starting spring 2024.
  - Improve pre-1991 data for the Philippines.
  - Etc/Unknown is now reserved.
  - Improve historical data for Mexico, Mongolia, and Portugal.
  - System V names are now obsolescent.
  - The main data form now uses %z.
  - The code now conforms to RFC 8536 for early timestamps.
  - Support POSIX.1-2024, which removes asctime_r and ctime_r.
  - Assume POSIX.2-1992 or later for shell scripts.
  - SUPPORT_C89 now defaults to 1.
- Include leap-seconds.list in tzdata install.


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
- Rebase to 1.6.6
- Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
- Enable ipsecmod support


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
- Do not search for DNSSEC info when domain-insecure is set
  for stub zone (#1678550)
- Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
- Fix amplifying an incoming query into a large number of queries directed to a target
- Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: Nikita Maliutin <nmaliutin@cloudlinux.com> - 1.6.6-5.tuxcare.els1
changelog:
- CVE-2023-50387: enhanced DNS resolver performance and stability by optimizing
  the handling of DNSSEC responses, reducing the potential for resource exhaustion


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1.6.6-5.tuxcare.els3
changelog:
- CVE-2023-50868: avoid availabiluty of the remote attackers to cause a
  denial of service using DNSSEC


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1.6.6-5.tuxcare.els4
changelog:
- CVE-2024-8508: limit number of name compression calculations per packet to
  prevent denial of service attacks.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
- Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
  Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
- Added patch for build option "-Werror=format-security"
- Added support of non-unicode non-latin charset
- Fix print of non-ascii filenames
- Fix troubles with symlinks for archives with many files
  Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
- rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
- make linking flags configurable from the specc file
- set linking flags to use relro hardening
  Related: #1531116


author: Jakub Martisko <jamartis@redhat.com> - 6.0-23
changelog:
- Disable the zipbomb detection patches
- There were too many false positives for now, will reenable this later with an option to opt-out
- Resolves: rhbz#2020318


author: Jakub Martisko <jamartis@redhat.com> - 6.0-24
changelog:
- Reenable the zipbomb detection patches
- Add environment variable that disables the zipbomb detection
- Resolves: rhbz#2020318


author: Jai S <jsathyapalan@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els2
changelog:
- CVE-2026-26269: fix stack-based buffer overflow in NetBeans integration that
  could lead to a crash or arbitrary code execution via a malicious server.


author: Viktor Borzov <vborzov@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els3
changelog:
- CVE-2026-28417: fix OS command injection in netrw plugin via crafted
  scp:// URIs by adding strict RFC1123 hostname validation and using
  shellescape() for hostname and port values.
- CVE-2026-28421: fix heap-buffer-overflow and SEGV in swap file recovery
  by adding bounds checks on pe_page_count, pe_bnum, pe_old_lnum and
  pe_line_count before descending into the block tree.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els4
changelog:
- CVE-2021-3903: do not set VALID_BOTLINE in w_valid when the screen is
  not valid, preventing invalid memory access while scrolling.
- CVE-2021-4069: copy the current line before regexec in ex_open() so the
  match is not using freed memory when searching for a mark flushes it.
- CVE-2022-0351: limit eval7() recursion to 1000 levels to prevent a stack
  overflow from many nested "(" in an expression.
- CVE-2022-2129: disallow switching buffers in a substitute expression by
  extending the do_exedit() lock check to cover textlock as well.
- CVE-2022-2183: avoid reading past the NUL terminator in get_lisp_indent().
- CVE-2022-2287: reject words containing control characters or a trailing
  slash before adding them to the internal spell word list.
- CVE-2022-3234: guard PBYTE against the cursor landing past the NUL in
  op_replace() with virtualedit, and skip the virtualedit coladd branch
  when a replacement has already happened.
- CVE-2022-3520: clamp b_op_end.col to zero in do_put() to prevent a
  negative column with Visual block put.
- CVE-2022-3591: disallow navigating to a dummy buffer in do_buffer() to
  prevent use-after-free.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els5
changelog:
- CVE-2021-3872: use vim_snprintf with MAXPATHL bound in win_redr_status()
  to prevent out-of-bounds write when the buffer name is very long.
- CVE-2021-4166: lock the argument list during do_arg_all() and refuse
  recursive alist_clear() to prevent crash when autocmds clear the
  arglist while :all is iterating.
- CVE-2022-0359: allocate indent + 50 bytes in init_ccline() instead of
  a fixed 250 in Ex mode, so a large tabstop cannot overflow cmdbuff.
- CVE-2022-1154: re-fetch regline/reginput after getmark_buf() in the
  RE_MARK branch of regmatch() so autocmds that free the buffer line
  cannot leave dangling pointers.
- CVE-2022-2581: in cstrchr() reject illegal lead bytes so that 0xff does
  not match the UTF-8 sequence 0xc3 0xbf and read past the pattern end.
- CVE-2022-2845: clamp col to zero in display_dollar() to prevent a
  negative column read before the start of the line.
- CVE-2023-5441: skip gui_do_scroll() while exmode_active to prevent
  segfault on scrollbar redraw when LineOffset is invalid.
- CVE-2023-48233: reject :s count values >= INT_MAX in do_sub() to
  prevent signed overflow of eap->line2.
- CVE-2026-25749: cap the copy in get_tagfname() with vim_strncpy so a
  huge 'helpfile' value cannot overflow the MAXPATHL buffer.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els6
changelog:
- CVE-2021-3927: call check_cursor_col() before do_put() in ex_put() so
  ":0put" cannot read a character past the end of the line.
- CVE-2022-1619: guard the CTRL-W backwards scan in cmdline against
  p == ccline.cmdbuff so vim_iswordc(p[-1]) cannot read before the
  start of the command line under latin1 encoding.
- CVE-2022-2284: call reset_VIsual_and_resel() in win_close() when
  closing a window for a different buffer, to prevent OOB access via
  a stale Visual selection.
- CVE-2022-2344: guard the completion de-dup check with
  STRLEN(match->cp_str) <= len so cp_str[len] is not read past end
  of the completion string.
- CVE-2022-2598: clamp df_lnum[i] >= 1 in diff_mark_adjust_tp() and
  check ml_delete() return value in ex_diffgetput() so a diff underflow
  or a failed ml_delete cannot corrupt the diff state.
- CVE-2022-2980: skip the tab-page-line click/drag handling in
  do_mouse() when TabPageIdxs is still NULL to prevent a crash on early
  mouse events.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els7
changelog:
- CVE-2021-4019: replace the unbounded STRCPY pair in find_help_tags()
  with vim_snprintf bounded by IOSIZE to prevent heap buffer overflow
  with long :help arguments starting with "\%_z@".
- CVE-2021-4192: re-fetch regline/reginput via reg_getline() after
  getvvcol() in reg_match_visual() so the cached line pointer cannot
  become a use-after-free when getvvcol flushes the line buffer.
- CVE-2021-4193: clamp pos->col to the first NUL in getvcol() so
  /\%V searches cannot read past the end of the line.
- CVE-2022-1720: in get_visual_text(), drop a trailing NUL from
  non-mbyte selection length and guard the mbyte correction with
  *lenp > 0 so "gf" in Visual block mode does not read past the line.
- CVE-2022-2126: also require sp->ts_fidx > 0 before decrementing
  ts_fidx in the DIFF_INSERT branch of suggest_trie_walk() so spell
  suggestion cannot read before the start of the bad-word buffer.
- CVE-2022-2210: initialise off = 0 at the top of the deleted > 0
  branch of diff_mark_adjust_tp() and only compute the real offset in
  the "5. delete lines at or just before top of diff" case, so a
  diff-block full-delete does not use a stale offset.
- CVE-2022-2285: place a NUL terminator at tp[len] before key-name
  matching in check_termcode() so crafted typeahead cannot be read
  past the end of the buffer.
- CVE-2022-2345: always vim_strsave(newsub) into reg_prev_sub in
  regtilde() and track an allocated regtilde result in sub_copy in
  do_sub() so a recursive :s cannot use freed memory.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els8
changelog:
- CVE-2021-3928: in suggest_trie_walk() only credit a non-word-char
  boundary with SCORE_NONWORD when preword is non-empty, so spell
  suggestions do not read uninitialized memory behind preword.
- CVE-2021-3974: in nfa_regmatch() NFA_MARK / NFA_MARK_GT /
  NFA_MARK_LT, save reginput - regline and re-fetch regline via
  reg_getline() after getmark_buf() so use-after-free cannot occur
  when getmark_buf flushes the current line.
- CVE-2022-0368: call check_pos(curbuf, &VIsual) at the end of
  u_undo_end() when Visual mode is active, so an undo that shortens
  the buffer cannot leave VIsual pointing past end-of-line / end-
  of-buffer. Adds a check_pos() helper in misc2.c.
- CVE-2022-0696: in win_new_tabpage() and goto_tabpage_tp(),
  refuse to switch/create a tabpage while cmdwin_type != 0,
  emitting e_cmdwin instead of crashing on cmdline-window re-entry.
- CVE-2022-1629: in find_next_quote(), after advancing past an
  escape character return -1 if the next byte is NUL so a trailing
  backslash cannot be read past end-of-line.
- CVE-2022-1735: call new check_visual_pos() helper from
  changed_common() (misc1.c) and stop_insert() (edit.c) whenever
  Visual mode is active so a change that shrinks the buffer cannot
  leave VIsual pointing past end-of-line / end-of-buffer.
- CVE-2022-1771: cap getcmdline() recursion at 50 via a static
  depth counter, emitting E169 "Command too recursive" on overflow
  to prevent crash from self-recursive cmdline input (e.g. the "=@"
  register loop).
- CVE-2022-1898: in nv_brackets(), copy the identifier under the
  cursor with vim_strnsave() before calling find_pattern_in_path()
  for "]d"/"[d", so that a match in a modified/freed line cannot
  cause a use-after-free on ptr.
- CVE-2022-1968: add get_line_and_copy() helper in search.c and
  use it instead of ml_get() in find_pattern_in_path(), so the
  regexp cannot leave line pointing into freed buffer memory when
  a mark invalidates the current line.
- CVE-2022-2124: in current_quote() (search.c), break out of the
  selection-scan loop when line[i] is NUL so a changed line does
  not cause a read past end-of-line while iterating up to col_end.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els9
changelog:
- CVE-2022-2182: in do_one_cmd(), after ";" sets curwin->w_cursor.lnum
  to ea.line2, call check_cursor() instead of check_cursor_lnum() so
  the column is validated too, and fall back to check_cursor_col()
  when ea.line2 is zero, preventing read past end-of-line on ":0;'{".
- CVE-2022-2206: in check_shellsize(), clamp cmdline_row and msg_row
  to Rows - 1 after limit_screen_size() so a shrinking terminal
  cannot leave those values referencing freed screen rows.
- CVE-2022-2257: in str2special(), when the byte is single-byte set
  *sp = str + (*str == NUL ? 0 : 1) so the caller cannot walk past
  the terminating NUL when a menu item ends in a modifier-only key.
- CVE-2022-2849: in latin_ptr2len()/dbcs_ptr2len(), return 0 when
  *p == NUL so loops that advance by mb_ptr2len() cannot walk past
  the NUL terminator (matches the contract documented in
  src/globals.h).
- CVE-2022-3352: in spell_load_lang(), snapshot curbuf before the
  SpellFileMissing autocommand and break out of the retry loop if
  the autocommand deleted/replaced curbuf, preventing a
  use-after-free on the cached "lang"/"curbuf" pointer. Uses
  sl.sl_lang (stack copy) for the apply_autocmds pattern to survive
  buffer deletion.
- CVE-2023-2609: in get_register() (ops.c), treat y_current->y_array
  == NULL the same as y_size == 0 and set reg->y_array to NULL, so
  an invalid/NULL register contents cannot be walked as a valid
  string vector.
- CVE-2021-3778: in find_match_text() (regexp_nfa.c), advance by
  utf_ptr2len(regline + col + len2) under enc_utf8 instead of
  MB_CHAR2LEN(c2), so an invalid UTF-8 byte cannot cause a read
  past the end of the line.
- CVE-2022-1616: in append_command() (ex_docmd.c), change the
  buffer-space check to "d - IObuff + 5 < IOSIZE" and skip copying
  a multibyte character whose length would overrun IObuff, so an
  invalid command with composing chars cannot overflow the error-
  message buffer.
- CVE-2022-1897: in undo_time() (undo.c), call text_locked() /
  text_locked_msg() and return early, so :undo / :earlier / g-
  cannot run while the text is locked (e.g. inside a :substitute
  callback) and free a buffer the caller is still walking.
- CVE-2022-2125: in get_lisp_indent() (misc1.c), after the
  double-quoted-string skip loop break out of the outer scan loop
  when *that is NUL so lisp indenting cannot walk past end-of-line
  on an unterminated quote.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els10
changelog:
- CVE-2022-2175: in the CTRL-R branch of getcmdline() (ex_getln.c),
  save/restore new_cmdpos around the expression-register insertion
  so a <C-R>= handler that leaves new_cmdpos at a negative value
  cannot drive ccline.cmdpos negative on the next registered insert.
- CVE-2022-2208: in diff_redraw() (diff.c), also require
  buf_valid(wp->w_buffer) before marking a diff window for redraw
  so a window whose buffer was just wiped is skipped instead of
  dereferenced.
- CVE-2022-2264: in do_put() (ops.c), when the block-paste
  trailing-spaces branch is skipped, subtract the unused "spaces"
  from totlen so the end mark does not reference bytes past the
  end of the new line.
- CVE-2022-2286: in the CTRL-E branch of ins_complete_main()
  (edit.c), derive a separate "p" and length from compl_leader /
  compl_orig_text and only call ins_bytes_len() when len >
  compl_len, so aborting completion cannot read past the end of
  the leader string.
- CVE-2022-2289: in ex_diffgetput() (diff.c), add a local
  valid_diff() helper and, after mark_adjust() reports added !=
  0, break out of the loop when dp no longer appears in the
  current tab's diff list — prevents using freed diff_T via dp.
- CVE-2022-2343: in ins_compl_add_infercase() (edit.c), after the
  wide-char to encoding-specific conversion cap "len" to the
  actual bytes written into IObuff so ins_compl_add()'s STRNCMP
  cannot walk past the truncated buffer on very long lines.
- CVE-2022-2923: in sug_filltree() (spell.c), bail out with FAIL
  when slang->sl_fbyts or slang->sl_fidxs is NULL so :mkspell on
  an empty .dic file does not dereference a null word tree.
- CVE-2022-3278: in movemark() (mark.c), copy the xfmark_T jump
  entry into a stack-local fmark before calling
  buflist_findnr()/buflist_getfile() so autocommands cannot leave
  us dereferencing a freed jmp pointer.
- CVE-2022-4292: in did_set_spelllang() (spell.c), also check
  win_valid(wp) alongside buf_valid(wp->w_buffer) after
  spell_load_lang(), so a SpellFileMissing autocommand that
  closes the window (not just wipes the buffer) cannot leave us
  dereferencing a freed win_T.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els11
changelog:
- CVE-2021-3796: fix use-after-free in nv_replace by getting the
  line pointer again after ins_copychar may have released it
- CVE-2021-3973: fix heap buffer overflow in
  find_file_in_path_option by rejecting len == 0 inputs
- CVE-2022-0413: fix use-after-free in do_sub when the substitute
  string is a "\=" expression by copying the string before eval
- CVE-2022-0943: fix heap overflow in spell_suggest when "z=" in
  Visual mode by clamping badlen to the remaining line length
- CVE-2022-1620: fix NULL pointer access by guarding both
  vim_regexec calls in fname_match and the second fname_match
  call in buflist_match against rmp->regprog becoming NULL after
  the AUTOMATIC_ENGINE fallback fails to recompile the pattern
- CVE-2022-1796: fix use-after-free in find_pattern_in_path by
  making a copy of the identifier pointer before the call
- CVE-2022-2207: fix read-before-start-of-line in ins_bs by
  requiring w_cursor.col > 0 in the whitespace back-step loop
- CVE-2022-3235: fix use-after-free in cmdline input-method
  handling by tracking the owning buffer and checking buf_valid
- CVE-2022-3296: fix buffer underflow in ex_finally by searching
  for a valid CSF_TRY frame before accessing cs_flags
- CVE-2023-46246: fix integer overflow in :history by clamping
  long values to INT_MAX before casting to int
- CVE-2023-48231: fix use-after-free in win_close by returning
  early when the window is no longer valid after BufLeave
- CVE-2023-48706: fix use-after-free in ex_substitute by always
  allocating sub and freeing it on every exit path
- CVE-2026-33412: fix command injection via newline in glob() by
  adding '\n' to the SHELL_SPECIAL escape set


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els12
changelog:
- CVE-2023-1170: at the end of do_put() (ops.c), clamp the cursor column
  back to the line length (and recompute coladd under virtualedit=all)
  so a Visual block put past the new NUL no longer leaves the cursor
  pointing past end-of-line.
- CVE-2023-1175: in op_yank() (ops.c), when the yank starts inside a
  multi-cell tab under virtual editing, clamp bd.startspaces to 0
  before incrementing startcol so a negative width can't drive the
  later block-yank copy out of bounds.
- CVE-2023-1264: in vgetorpeek() (getchar.c), guard the dead-character
  putcmdline()/unputcmdline() paths with cmdline_has_buffer() (new
  ex_getln.c helper) so a nested :open command with a NULL ccline.cmdbuff
  no longer dereferences it.


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els13
changelog:
- CVE-2021-3984: in find_start_brace() (misc1.c), when a found '{' lies
  inside a comment, restore the full cursor position (line and column)
  instead of only the line so subsequent C-indent lookups stay within
  the line bounds.
- CVE-2022-2571: in ins_compl_get_exp() (edit.c), when CONT_ADDING is
  active, only advance tmp_ptr by compl_length if compl_length does not
  exceed the remaining line length, so insert-mode completion no longer
  reads past the end of the line.


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> 2:7.4.629-8.0.1.tuxcare.els14
changelog:
- CVE-2026-39881: fix netbeans defineAnnoType command injection by validating
  typeName, fg and bg against an allowlist before passing them to coloncmd();
  also restrict specialKeys tokens to alphanumeric characters to prevent map
  command injection


author: Viktor Borzov <vborzov@cloudlinux.com> - 2:7.4.629-8.0.1.tuxcare.els15
changelog:
- CVE-2022-3037: fix crash on empty error list handling in qf_fill_buffer
- CVE-2023-48236: fix integer overflow in get_number for z= command
- CVE-2023-48237: fix integer overflow in shift_line for operator pending mode


author: Andrija Jokanovic <ajokanovic@cloudlinux.com> - 2:7.4.629-8.0.1.tuxcare.els16
changelog:
- CVE-2026-42307: fix OS command injection in netrw plugin via crafted sftp://
  URLs by hardening the tempfile suffix regex and escaping the tempfile
  argument before passing it to the sftp command


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
- 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
- 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> 2:7.4.629-8.tuxcare.els1
changelog:
- CVE-2023-0054: check the return value of vim_regsub()
- CVE-2023-0049: avoid going over the NUL at the end
- CVE-2023-0288: prevent the cursor from moving to line zero
- CVE-2023-0433: check for not going over the end of the line
- CVE-2023-2610: limit the text length to MAXCOL
- CVE-2023-4750: check buffer is valid before accessing it
- CVE-2023-4733: verify oldwin pointer after reset_VIsual()
- CVE-2023-4751: stop Visual mode when using :ball
- CVE-2023-5344: add NULL at end of buffer
- CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
- 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
- 1267826 - Include c++11 syntax highlighting in vim
- 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
- Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
- Run internal test suite during build (#1295846)
- Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
- Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
- Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
- CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
  CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
  CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
- CVE fix for: CVE-2023-6377, CVE-2023-6478
  Resolves: https://issues.redhat.com/browse/RHEL-18416
  Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
- CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
  CVE-2024-0408 and CVE-2024-0409
  Resolves: https://issues.redhat.com/browse/RHEL-21205
  Resolves: https://issues.redhat.com/browse/RHEL-20578
  Resolves: https://issues.redhat.com/browse/RHEL-20426
  Resolves: https://issues.redhat.com/browse/RHEL-20437
  Resolves: https://issues.redhat.com/browse/RHEL-21192
  Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
- CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
  CVE-2024-31083
  Resolves: https://issues.redhat.com/browse/RHEL-31003
  Resolves: https://issues.redhat.com/browse/RHEL-30989
  Resolves: https://issues.redhat.com/browse/RHEL-30973
- Add util-linux as a dependency of Xvfb
- Fix compilation error on i686


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.20.4-99.tuxcare.els1
changelog:
- CVE-2025-26594: refuse to free the root cursor and keep its ref
- CVE-2025-26595: fix buffer overflow in XkbVModMaskText()
- CVE-2025-26596: xkb: fix computation of XkbSizeKeySyms
- CVE-2025-26597: xkb: fix buffer overflow in XkbChangeTypesOfKey()
- CVE-2025-26598: Xi: Fix barrier device search
- CVE-2025-26599: always initialize the border clip in compAllocPixmap()
- CVE-2025-26600: dix: Dequeue pending events on frozen device on removal
- CVE-2025-26601: postpone actual changes in SyncChangeAlarmAttributes()


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 1.20.4-99.tuxcare.els2
changelog:
- CVE-2025-49176: fix integer overflow in BigRequest size check that could
  bypass the maximum request size limit


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 1.20.4-99.tuxcare.els3
changelog:
- CVE-2025-49179: fix integer overflow in the RecordSanityCheckRegisterClients
  function of the X Record extension


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 1.20.4-99.tuxcare.els4
changelog:
- CVE-2025-49180: fix integer overflow in the RandR extension affecting the
  RRChangeProviderProperty function


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 1.20.4-99.tuxcare.els8
changelog:
- CVE-2025-9632: fix buffer overflow in _XkbSetCompatMap()
- CVE-2025-62229: fix use-after-free condition due improper error handling
  during notification creation leading to DoS
- CVE-2025-62230: fix use-after-free condition due freeing certain data
  structures without properly detaching related resources
- CVE-2025-62231: fix unsigned short overflow in XkbSetCompatMap() function


