# changelog

author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-8
changelog:
- Backport fix for upstream issue 2187 (disklayout.conf file contains
  duplicate lines, breaking recovery in migration mode or when
  thin pools are used). PR2194, 2196.
  Resolves: rhbz1732328


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-9
changelog:
- Apply upstream PR2173 - Cannot restore using Bacula method
  due to "bconsole" not showing its prompt
  Resolves: rhbz1726982


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-11
changelog:
- Apply upstream PR2122: add additional NBU library path to fix support for
  NetBackup 8.
  Resolves: rhbz1700807
- Apply upstream PR212: Be safe against empty docker_root_dir (issue 1989)
  Resolves: rhbz1711123, where ReaR can not create a backup in rescue mode,
  because it thinks that the Docker daemon is running and hits the problem
  with empty docker_root_dir.
- Apply upstream PR2223 and commit 36cf20e to avoid an empty string in the
  list of users to clone, which can lead to bash overflow with lots of users
  and groups per user and to wrong passwd/group files in the rescue system.
  Resolves: rhbz1692575
- Backport of Upstream fix for issue 2035: /run is not mounted in the rescue
  chroot, which causes LVM to hang, especially if rebuilding initramfs.
  Resolves: rhbz1697815
- Backport upstream PR 2218: avoid keeping build dir on errors
  by default when used noninteractively
  Resolves: rhbz1693608


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-15
changelog:
- Backport PR2608:
  Fix setting boot path in case of UEFI partition (ESP) on MD RAID
  Resolves: rhbz1945869
- Backport PR2625 & 2675
  Prevents accidental backup removal in case of errors
  Resolves: rhbz1843585
- Fix rsync error and option handling
  Fixes metadata storage when rsync user is not root
  Resolves: rhbz1947064
- Changes for NetBackup (NBU) support, upstream PR2544
  Resolves: rhbz2031833
- On POWER add bootlist & ofpathname to the list of required programs
  conditionally (bootlist only if running under PowerVM, ofpathname
  always except on PowerNV) - upstream PR2665, add them to package
  dependencies
  Resolves: rhbz1983008
- On POWER mount /sys in the chroot, otherwise ofpathname does not work
  and we risk ending up with not instlaling the bootloader properly
  Resolves: rhbz1983000


author: Mark Huth <mhuth@redhat.com> - 0.9.7-6
changelog:
- Resolves: rhbz#1314606 - show progress with addattachment
- Resolves: rhbz#1314607 - problem with addattachment -s switch


author: Pranita Ghole <pghole@redhat.com> - 0.13.0-0
changelog:
- Resolves: rhbz#1653574- Add support for handling JSON response from API's
- Resolves: rhbz#1765391- Add support to upload to and download from S3
- Resolves: rhbz#2030066- RHST should use new Red Hat Secure FTP instead of dropbox for attachments


author: Mark Huth <mhuth@redhat.com> - 0.9.7-3
changelog:
- Resolves: rhbz#1168414 - rhel7 vmcore offset
- Resolves: rhbz#1174461 - skip already downloaded attachments
- Resolves: rhbz#1176473 - fix addattachment via FTP and proxy
- Make debug_repos configurable via config option


author: Mark Huth <mhuth@redhat.com> - 0.9.7-4
changelog:
- Resolves: rhbz#1196297 - typos in opencase
- Resolves: rhbz#1196316 - change menus when closing a case
- Fallback to ownerSSOName if associateSSOName filter gets 404 error in listcases
- Other small fixes


author: Mark Huth <mhuth@redhat.com> - 0.9.8-6
changelog:
- Resolves: rhbz#1104344 - add soscleaner
- Resolves: rhbz#1273976 - caches bad password
- Resolves: rhbz#1284306 - improve ? help
- Resolves: rhbz#1284308 - show attachment sizes
- Resolves: rhbz#1284309 - show attachment full path
- Resolves: rhbz#1284314 - differentiate diagnose and analyze
- Resolves: rhbz#1290909 - change case internal status
- Resolves: rhbz#1351141 - reverse severity list


author: Vikas Rathee <vrathee@redhat.com> - 0.9.9-1
changelog:
- Resolves: rhbz#1380109 - Include creation date and last modified date in Solution title details.
- Resolves: rhbz#1342628 - When opening a new case, offer a default product.
- Resolves: rhbz#1342632 - When opening a new case, offer to use the default case group of that user.


author: Vikas Rathee <vrathee@redhat.com> - 0.9.10-1
changelog:
- Resolves: rhbz#1342627 - List cases by group.
- Resolves: rhbz#1379619 - Inform when http_proxy environment variable is used.


author: Pranita Ghole <pghole@redhat.com> - 0.9.11-1
changelog:
- Resolves: rhbz#1418701 - [RFE] Add functionality to generate and send sosreport after selecting the case
- Resolves: rhbz#1592850 - [RFE] Generate and upload sosreport to case from cli
- Resolves: rhbz#1678347 - Update redhat-support-tool to use latest soscleaner
- Resolves: rhbz#1670033 - redhat-support-tool env var http_proxy does not work with user and password
- Resolves: rhbz#1457436 -  [RFE][RHEL7] Include Reason in cases of failed proxy


author: Pranita Ghole <pghole@redhat.com> - 0.12.2-1
changelog:
- Resolves: rhbz#1547763 - redhat-support-tool: UnboundLocalError: local variable 'timer' referenced before assignment


author: Pranita Ghole <pghole@redhat.com> - 0.13.0-0
changelog:
- Resolves: rhbz#2030063- Add support for handling JSON response from API's 
- Resolves: rhbz#1765392- Add support to upload to and download from S3
- Resolves: rhbz#2030065- RHST should use new Red Hat Secure FTP instead of dropbox for attachments


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
- gcp-vpc-move-vip: add support for multiple alias IPs
- sybaseASE: run verify action during start action only
- azure-events: handle exceptions in urlopen

  Resolves: rhbz#1846732
  Resolves: rhbz#1848673
  Resolves: rhbz#1862121


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.8
changelog:
- gcp-vpc-move-route, gcp-vpc-move-vip: add project parameter and
  make vpc_network parameter optional

  Resolves: rhbz#1913936


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.13
changelog:
- SAPHana: use actual_mode from global.ini and fallback to mode when
  it's not set

  Resolves: rhbz#1855888


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.15
changelog:
- gcp-pd-move/gcp-vpc-move-route/gcp-vpc-move-vip: dont fail with
  configuration rc when it might be a network hickup

  Resolves: rhbz#2042070


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.18
changelog:
- db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check

  Resolves: rhbz#2127477


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-54
changelog:
- aws-vpc-route53: new resource agent for AWS
- aws-vpc-move-ip: add "routing_table_role" parameter
- aws-vpc-move-ip: delete remaining route entries

  Resolves: rhbz#1759113
  Resolves: rhbz#1810466
  Resolves: rhbz#1828895


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-56
changelog:
- sap-hana-scaleout: set default timeouts based on recommendations
  and a couple of bugfixes

  Resolves: rhbz#1829081


author: Michal Ruprich - 3.1.2-4
changelog:
- Related: #1432899 - removing dependencies on perl
- using the bundled zlib.h(#1491582)
- turning on upstream tests


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
- Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-46
changelog:
RHEL 7.8 ERRATUM
- Support Intermediate Certificate Chains in rsyslog
  resolves: rhbz#1627799
- fixed WorAroundJournalBug patch to not cause leaks
  resolves: rhbz#1744617
- added patch fixing possible segfault in rate-limiter
  resolves: rhbz#1744682


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-47
changelog:
RHEL 7.8 ERRATUM
- edited imfile truncation detection patch with reression fix
  resolves: rhbz#1744856


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
RHEL 7.8 ERRATUM
- added patch resolving crash on wrong MsgProperty
  resolves: rhbz#1549706
- added patch resolving CVE in pmaixforward module
  resolves: rhbz#1768320
- added patch resolving CVE in pmcisconames module
  resolves: rhbz#1768323
- added patch implementing file ID for imfile
  resolves: rhbz#1763746
- added patch fixing omelasticsearch with ES 6.X
  resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
RHEL 7.8 ERRATUM
- fixed fsync patch to actually revognize the new option
  resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
RHEL 7.8 ERRATUM
- edited patch file ID for imfile to not log useless errors
  also improved file-id behavior to adress newly found problems
  resolves: rhbz#1763746


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-53
changelog:
RHEL 7.9 ERRATUM
- one more fix for file ID patch to extend to offline behavior
  resolves: rhbz#1806493
- added patch resoving race in serialization resulting in crash
  resolves: rhbz#1778841


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-55
changelog:
RHEL 7.9 ERRATUM
- edited imfile file-id patch to not segfault on selinux block
  resolves: rhbz#1843992


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-57
changelog:
RHEL 7.9 ERRATUM
- added patch resolving buffer overflows in select() function
  resolves: rhbz#1858297


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-30
changelog:
- Fix test_npn_protocol_selection_ary and test_npn_protocol_selection_enum
  failures with newest openssl.
  Resolves: rhbz#1416123
- Add gemspec_add_dep and gemspec_remove_dep macros.
- Extend 'gem_' macros for pre-release version support.
  Resolves: rhbz#1397390
- Make symlinks for json gem.
  Resolves: rhbz#1308992


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
- Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
  * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
      -vulnerability.patch
  Resolves: CVE-2017-0903
- Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
  Resolves: CVE-2017-0899
- Fix a DOS vulernerability in the query command (CVE-2017-0900).
  Resolves: CVE-2017-0900
- Fix a vulnerability in the gem installer that allowed a malicious gem
    to overwrite arbitrary files (CVE-2017-0901).
  Resolves: CVE-2017-0901
- Fix a DNS request hijacking vulnerability (CVE-2017-0902).
  * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
  Resolves: CVE-2017-0902
- Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
  * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
  Resolves: CVE-2017-0898
- Escape sequence injection vulnerability in the Basic
    authentication of WEBrick (CVE-2017-10784).
  * ruby-2.2.8-sanitize-any-type-of-logs.patch
  Resolves: CVE-2017-10784
- Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
  * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
  Resolves: CVE-2017-14064
- Command injection vulnerability in Net::FTP (CVE-2017-17405).
  * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
  Resolves: CVE-2017-17405
- Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
  * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
  Resolves: CVE-2017-14033
- Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
    execution(CVE-2017-17790).
  * ruby-2.5.0-Fixed-command-Injection.patch
  Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
- Add Psych.safe_load
  * ruby-2.1.0-there-should-be-only-one-exception.patch
  * ruby-2.1.0-Adding-Psych.safe_load.patch
  Related: CVE-2017-0903
- Disable Tokyo TZ tests broken by recen tzdata update.
  * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
  Related: CVE-2017-0903


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
- Kill bundled certificates.
- Add macros to edit files lists in .gemspec
- Fix buffer under-read in String#unpack
  Resolves: CVE-2018-8778
- Fix HTTP response splitting in WEBrick
  Resolves: CVE-2017-17742
- Fix DoS by large request in WEBrick
  Resolves: CVE-2018-8777
- Fix directory traversal by poisoned NULL byte in Dir.
  Resolves: CVE-2018-8780
- Fix file and directory creation with directory traversal.
  Resolves: CVE-2018-6914
- Fix socket creation by poisoned NULL byte.
  Resolves: CVE-2018-8779
- Fix: return default path with nonexistent home dir
- Fix flags not propagated in Array#pack and String#unpack.
  Resolves: CVE-2018-16396
- Fix strictly interpret octal fields in tar headers.
  Resolves: CVE-2018-1000075
- Fix a security error for duplicate files in a package.
  Resolves: CVE-2018-1000076
- Enforce URL validation on spec homepage attribute.
  Resolves: CVE-2018-1000077
- Mitigate XSS vulnerability in homepage attribute.
  Resolves: CVE-2018-1000078
- Prevent Path Traversal issue during gem installation.
  Resolves: CVE-2018-1000079
- Fix unsafe Object Deserialization Vulnerability in gem owner.
  Resolves: CVE-2018-1000074
- Refresh expired certificates.
- Fix path traversal when writing to a symlinked basedir outside of the root
  Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
- Introduce `Gem::UserInteraction#verbose` method as precondition to fix
  CVE-2019-8321.
  * rubygems-2.3.0-refactor-checking-really_verbose.patch
- Fix escape sequence injection vulnerability in verbose.
- Fix escape sequence injection vulnerability in gem owner.
  Resolves: CVE-2019-8322
- Fix escape sequence injection vulnerability in API response handling.
  Resolves: CVE-2019-8323
- Prohibit arbitrary code execution when installing a malicious gem.
  Resolves: CVE-2019-8324
- Fix escape sequence injection vulnerability in errors.
  Resolves: CVE-2019-8325
  * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Watson Sato <wsato@redhat.com> - 0.1.49-7
changelog:
- Bug fixes on CIS profile (RHBZ#1821633)
  Added Ansible remediations
  Fixed CIS references
  Fixed integration issues with CIS profile


author: Watson Sato <wsato@redhat.com> - 0.1.49-9
changelog:
- CIS Profile fixes (RHBZ#1821633)
  - Fix Ansible mount_option template
  - Add Ansible for ensure_logrotate_activated
  - Add warnings to rpm_verify_permissions and ownership about findindings that may need further inspection


author: Watson Sato <wsato@redhat.com> - 0.1.49-10
changelog:
- CIS Profile fixes (RHBZ#1821633)
  - Fix Ansible mount_option template
  - Re-order rpm_verify_permissions to avoid file permission conflicts


author: Watson Sato <wsato@redhat.com> - 0.1.49-11
changelog:
- HIPAA Profile improvement (RHBZ#1513087)
  - Add Ansible remediation for audit_rules_system_shutdown


author: Watson Sato <wsato@redhat.com> - 0.1.49-12
changelog:
- CIS Profile (RHBZ#1821633)
  - Make sure boot target is multi-user.target when xorg package is removed
  - Add CIS Profile content attribution to Center for Internet Security


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.52-1
changelog:
- Update to the latest upstream release (RHBZ#1665233)
- Update RHEL7 DISA STIG to V2R8 (RHBZ#1665233)


author: Watson Sato <wsato@redhat.com> - 0.1.54-1
changelog:
- Rebase to incorporate ANSSI Profile (RHBZ#1497415)
- Update RHEL7 STIG profile to V3R2 (RHBZ#1921643)
- Add Minimal, Intermediary and Enhanced ANSSI Profiles (RHBZ#1497415)


author: Watson Sato <wsato@redhat.com> - 0.1.54-2
changelog:
- Remove Kickstart for not shipped profile (RHBZ#1497415)
- Fix STIG id reference format for sshd_x11_use_localhost (RHBZ#1921643)


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.54-5
changelog:
- Create subpackage to hold ansible playbooks per rule (RHBZ#1966589)
- Fix Bash remediation of dconf_gnome_login_retries (RHBZ#1967566)


author: Jan Černý <jcerny@redhat.com> - 0.1.57-1
changelog:
- Rebase to the 0.1.57 upstream release
- Update RHEL7 DISA STIG profile to v3r4 (RHBZ#1996678)
- Split CIS profile (RHBZ#1953787)


author: Watson Sato <wsato@redhat.com> - 0.1.57-7
changelog:
- Add warning how to override audit buffer (RHBZ#1993822)
- Fix name of antivirus package in STIG profile (RHBZ#2066321)
- Update RHEL7 DISA STIG profile to v3r7 (RHBZ#2079217)


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
- Update to the latest upstream release (RHBZ#2116359)
- Fix SSH Key permissions (RHBZ#2021258)
- Remove PCI-DSS Benchmark(RHBZ2038165)
- Updated source of CVE data feed(RHBZ#2028432)
- Improved alignment with DISA's RHEL7 STIG(RHBZ#1967950)
- Update RHEL7 STIG profile to v3r8 (RHBZ#2112939)
- Add warning how to override audit buffer (RHBZ#1993822)
- Fix smartcard_auth rule for systems installed without authconfig (RHBZ#2116359)
- Fix check of enable_fips_mode on s390x (RHBZ#2116359)
- Fix applicability of pam_pkcs11 and grub2 rules on s390x (RHBZ#2116359)


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
- Rebase to a new upstream release 0.1.66 (RHBZ#2158410)
- Update RHEL7 STIG profile to V3R10 (RHBZ#2152657)
- Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2123284)
- Fix remediation of audit watch rules (RHBZ#2123367)
- Fix check firewalld_sshd_port_enabled (RHBZ#2158410)
- Fix accepted control flags for pam_pwhistory (RHBZ#2158410)
- Unselect rule logind_session_timeout (RHBZ#2158410)
- Add support rainer scripts in rsyslog rules (RHBZ#2170038)


author: Jan Černý <jcerny@redhat.com> - 0.1.69-1
changelog:
- Rebase to the latest upstream release (RHBZ#2221694)
- Make IPv6 related rules applicable only in case IPv6 is actually enabled. (RHBZ#2210276)
- update ANSSI BP-028 profiles to be aligned with version 2.0 (RHBZ#2155793)
- Correct URL used to download CVE checks. (RHBZ#2223817)


author: Marcus Burghardt <maburgha@redhat.com> - 0.1.72-1
changelog:
- Rebase to a new upstream release 0.1.72 (RHEL-25251)
- Include filter to dracut files in audit_rules_privileged_commands rule (RHEL-11938)


author: Petr Hracek <phracek> - 4.1.0-0.20.20120314git3c2946
changelog:
- Multiple packages are installing files under /etc/tmpfiles.d
- comply http://fedoraproject.org/wiki/Packaging:Guidelines#Tmpfiles.d
- Resolves: rhbz#1121958


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
- Update sudo_role_template() to allow caller domain to read syslog pid files
Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
changelog:
- Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command
Resolves: rhbz#1765063


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
- Allow chronyd_t domain to exec shell
Resolves: rhbz#1775573
- Allow pmie daemon to send signal pcmd daemon
Resolves: rhbz#1770123
- Allow auditd poweroff or switch to single mode
Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
- Allow rhsmd read process state of all domains and kernel threads
Resolves: rhbz#1837461
- Allow ipa-adtrust-install restart sssd and dirsrv services
Resolves: rhbz#1820298
- Allow nagios_plugin_domain execute programs in bin directories
Resolves: rhbz#1824625
- selinux policy: add the right context for org.freeipa.server.trust-enable-agent
Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
- Allow certmonger add new entries in a generic certificates directory
Resolves: rhbz#1879496
- Allow slapd add new entries in ldap certificates directory
Resolves: rhbz#1879496
- Add miscfiles_add_entry_generic_cert_dirs() interface
Resolves: rhbz#1879496


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.0-8
changelog:
- Fixed: #1473572
- Changes of ID overrides now force clearing of affected SSSD cache entries on IPA master
- Related: #1473577
- Synchronize timeout-enabled code with ipa-extdom-extop


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
- Upstream release 0.56.5
- Resolves: rhbz#1820124 When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
- Resolves: rhbz#1820122 ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED
- Resolves: rhbz#1819018 ipa slapi-nis stack traces review request for LDAP server deadlock
- Resolves: rhbz#1830894 Memory leak during search of idview overrides


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
- CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
- Resolves: rhbz#1942937


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
- upstream release 0.60.0
- Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
- Resolves: rhbz#1978748
  Release adds following fixes:
  - Fix ID views integration
  - Fix base scope lookups
  - Bump NIS max dgram size to 8KB by default instead of 1KB
  - Allow to rebuild the compat tree


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-4
changelog:
- Ignore updates from non-tracked subtrees during modify/modrdn/update
  to avoid deadlocks with retro changelog
- Resolves: RHEL-11869


author: Jan Jansky <jjansky@redhat.com> = 3.8-8
changelog:
- Added Obsolete for leapp-repository-sos-plugin to solve
  conflicts during install/upgrade/downgrade of RPM.


author: Jan Jansky <jjansky@redhat.com> = 3.9-3
changelog:
- [gluster] fix gluster volume splitlines iteration
  Resolves: bz1843520
- [block] proper parsing of luks partition on self device
  Resolves: bz1850544
- [pci] Update gating for lspci commands
  Resolves: bz1853701
- [foreman] collects stats of some tables from foreman DB
  Resolves: bz1853235
- [logs] collect also non-persistent journal logs
  Resolves: bz1850925


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.3
changelog:
- [candlepin/foreman] psql with --no-password
  Resolves: bz1932772
- [foreman] proxy_password scrub in installer logs
  Resolves: bz1785813


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.4
changelog:
- [candlepin/foreman] psql with --no-password
  Resolves: bz1932772
- [pacemaker] password scrub fix
  Resolves: bz1903144
- [filesys] never collect panfs
  Resolves: bz1886784
- [openstack_ceilometer] backend_url protected
  Resolves: bz1892692


author: Jan Jansky <jjansky@redhat.com> = 3.9-5.5
changelog:
- [sssd] Add individual SSSD log files
  Resolves: bz1938932
- [sssd] sssd plugin when sssd-common
  Resolves: bz1946641
- [foreman] fix unmatched group in scrubbing installer logs
  Resolves: bz1956817
- [foreman] Sizelimit foreman-maintain and installer logs
  Resolves: bz1964000
- [pulpcore] add plugin for pulp-3
  Resolves: bz1956672


author: Barbora Vassova <bvassova@redhat.com> = 3.9-5.12
changelog:
- [redhat] Change authentication method for RHEL
  Resolves: RHEL-21176
- [rpm] Capture the output of 'rpm --showrc'
  Resolves: RHEL-2357
- [candlepin] collect information about SCA
  Resolves: RHEL-22263
- [foreman] scrub admin init password in installer logs
  Resolves: RHEL-22264


author: Jan Jansky <jjansky@redhat.com> = 3.9-5
changelog:
- [gluster] remove generated state files
  Resolves: bz1857697
- [kubernetes] ignore blank+empty lines
  Resolves: bz1859885
- [networking] remove 'ethtool -e' option for bnx2x NICs
  Resolves: bz1870379
- [auditd] collect /etc/audisp
  Resolves: bz1871207
- [policy] Fix several failure conditions with upload
  Resolves: bz1886432
- [postgresql] reorganize postgres from SCL
  Resolves: bz1897903


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
- Keepalive fix
  Resolves: rhbz#1719736
- Fix hang on migration after password expired
  Resolves: rhbz#1761776


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-4
changelog:
- Revert back to spice 0.12 behaviour where QXL guest resources for cursor
  commands are only released when the current cursor is replaced. This avoids
  a QEMU regression causing crashes during migration
  Resolves: rhbz#1567944


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
- Don't mute Record channel on client reconnection
  Resolves: rhbz#1549132
- Allow to configure TLS protocol versions and ciphers which SPICE will use for
  TLS communications
  Resolves: rhbz#1562213
- Enable ECDH ciphers with OpenSSL 1.0
  Resolves: rhbz#1566597


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-7
changelog:
- Fix off-by-one error during guest-to-host memory address conversion
  Resolves: CVE-2019-3813
- Add patch for upstream commit 48179332d9da0. This should help with corrupted
  spice-html5 displays
  Resolves: rhbz#1573739
- Add missing minimum openssl version Requires for patch #24
  Resolves: rhbz#1627693


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-16
changelog:
- Resolves: #1738582 - CVE-2019-12525 squid: parsing of header 
  Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
- Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
  Digest Authentication nonce replay could lead to remote code execution
- Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
  ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
- Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
  in HTTP Request processing
- Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
  as reverse-proxy
- Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
  attack against the HTTP cache
- Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
  FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
- Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
  result in a DoS
- Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
  result in cache poisoning
- Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
  result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
- Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
  a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
- Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
  code -- Remove support for Gopher protocol (CVE-2023-46728)
- Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
  feature (CVE-2023-49285)
- Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
  Helper Process management (CVE-2023-49286)
- Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
  (CVE-2023-46724)
- Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
  (CVE-2023-50269)
- Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
  (CVE-2024-25617)


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
- Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
  case
- Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
  sites
- Resolves: #1717430 - Excessive memory usage when running out of descriptors
- Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
- Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
  in cachemgr.cgi
- Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-2
changelog:
- Copy over changes in tests/ioctl_evdev-success.c (from cdd8206a
  "tests: test evdev bitset decoding more thoroughly")
  to tests-m32/ioctl_evdev-success.c and tests-mx32/ioctl_evdev-success.c
- Copy over changes in tests/ioctl_evdev.c (from 5ee385e2
  "evdev: fix decoding of EVIOCGBIT(0, ...)") to tests-m32/ioctl_evdev.c
  and tests-mx32/ioctl_evdev.c
- Resolves: #1746478


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-4
changelog:
- Include upstream patches that fix issues reported by covscan:
  91281fec "v4l2: avoid shifting left a signed number by 31 bit",
  522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing", and
  9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register".
- Resolves: #1747524


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-5
changelog:
- Fix printing stack traces for early syscalls on process attach (#1790052):
  69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
  8e515c74 "tests: add strace-k-p test".
- Add commit v5.4~97 "xlat: use unsgined type for mount_flags fallback values"
  (A leftover for #1747524).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
- Fix expected alignment for IPC tests (#1795261):
  4377e3a1 "tests: fix expected output for some ipc tests", and
  a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
- Fix incorrect ifname printing buffer size (#2028146):
  e27b0677 "print_ifindex: fix IFNAME_QUOTED_SZ definition".


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
- RHEL-7.6 erratum
  Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
  Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
  Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
- RHEL-7.7 erratum
  Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
  Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
- RHEL-7.8 erratum
  Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
- RHEL-7.8 erratum
  Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
- RHEL 7.9.Z ERRATUM
- defaults use_pty plus SELinux ROLE in user specification breaks terminal
  Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
RHEL 7.9.Z ERRATUM
- CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
Resolves: rhbz#2161222


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
- add -f flag to force fdatasync() after sa file update (#1662094)
- don't call filesystem count functions when we are not collecting fs statistics (#1670060)
- skip autofs when gathering filesystem statistics (#1670060)
- fix use of incorrect preposition in sar man page (#1624410)
- fix CPU usage reporting (#1618688)


author: Nils Philippsen <nils@redhat.com> - 1.3.4-1
changelog:
- don't ask libuser to create a home directory over an existing one (#908852,
  patch by Miloslav Trmač)
- correct check if SELinux is enabled


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb46-4
changelog:
- Properly detect errors when writing backup files. (Closes: #80) (#81)
- Read number of backup files to keep from file
- config: defend on '/etc/target/backup' directory
- config: backup when current config is different from recent backup copy
- config: rename key 'kept_backups' as 'max_backup_files'
- backup: global option to tune max no. of backup conf files


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-9
changelog:
- 'if statement' parsing fixed when the space is missing after ')'. (#1273892)
- Quote backslashes properly to preserve them in `...` expressions. (#1319816)
- Fix for tcsh being interruptible while waiting for child process. (#1269370)
- Fix of memory leak when using the 'source' built-in command.      (#1273513)
- Print error message on stderr (instead of stdout).                (#1273498)
- Use GLIBC's malloc instead of builtin malloc.                     (#1315713)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.18.01-12
changelog:
- Fix another regression in tcsh-6.18.01-quote-backslashes-properly.patch
  Related: #1334751

- Fix regression in tcsh-6.18.01-use-stderr-upon-error.patch
  Related: #1273498


author: Martin Sehnoutka <msehnout@redhat.com> - 1:0.17-60
changelog:
- Introduce new -i switch
- ip addresses will be logged into utmp instead of hostname
- Resolves: #1323094


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
- Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                    - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
- Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                    - more clear formulation of man page note - previous note was a bit ambiguous


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-14
changelog:
- Fix rendering on big endian system
  Resolves: bz#1618777

  Do not automatically kill sessions
  Resolves: bz#1646889


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
- Fix stack buffer overflow in CMsgReader::readSetCursor
  Resolves: bz#1791773

- Fix heap buffer overflow in DecodeManager::decodeRect
  Resolves: bz#1791768

- Fix heap buffer overflow in TightDecoder::FilterGradient
  Resolves: bz#1791763

- Fix heap-based buffer overflow triggered from CopyRectDecoder
  Resolves: bz#1791747

- Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
  Resolves: bz#1791759

- Add option to fallback to empty port when the specified one is taken
  Resolves: bz#1791996


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-23
changelog:
- Rebuild for xorg-x11-server CVEs
  Resolves: CVE-2022-4283 (bz#2154267)
  Resolves: CVE-2022-46340 (bz#2154261)
  Resolves: CVE-2022-46341 (bz#2154264)
  Resolves: CVE-2022-46342 (bz#2154262)
  Resolves: CVE-2022-46343 (bz#2154265)
  Resolves: CVE-2022-46344 (bz#2154266)


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-26
changelog:
- Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
  Resolves: RHEL-15235
- Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
  Resolves: RHEL-15223


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-27
changelog:
- Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
  Resolves: RHEL-18415
- CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
  Resolves: RHEL-18427


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-28
changelog:
- Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
  Resolves: RHEL-18415


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-29
changelog:
- Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
  Resolves: RHEL-20436
- Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
  Resolves: RHEL-20427
- Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
  Resolves: RHEL-20587
- Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
  Resolves: RHEL-21212


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-30
changelog:
- Don't try to get pointer position when the pointer becomes a floating device
  Resolves: RHEL-20436


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-31
changelog:
- Fix use after free related to CVE-2024-21886
  Resolves: RHEL-20436
- Fix copy/paste error in the DeviceStateNotify
  Resolves: RHEL-20587


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-32
changelog:
- Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
  Resolves: RHEL-31006
- Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
  Resolves: RHEL-30976
- Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
  Resolves: RHEL-30993


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
- Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
- Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
- Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
- Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
- Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
- Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
- Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
- Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12
changelog:
- Resolves: rhbz#1367492 harden package permissions
- Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
- Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
- Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
- Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
- Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
- Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
- Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
- Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
- Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-1
changelog:
- new release
  - rebased tuned to latest upstream
    related: rhbz#1643654
  - used dmidecode only on x86 architectures
    resolves: rhbz#1688371
  - recommend: fixed to work without tuned daemon running
    resolves: rhbz#1687397


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-7
changelog:
- plugin_sysctl: fixed traceback when assignments modifiers ('<', '>')
  are used with sysctl and the current sysctl value is the same as
  the new value
  Resolves: rhbz#1739418


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-9
changelog:
- Fixed SIGHUP handling
  Resolves: rhbz#1702724
- Tune irqbalance service
  Resolves: rhbz#1720042
- Added netcat requirement
  Resolves: rhbz#1746436
- sysctl: made reapply_sysctl ignore configs from /usr
  Resolves: rhbz#1776149
- profiles: define variables before use
  Resolves: rhbz#1781664


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.11.0-10
changelog:
- realtime-virtual-host: remove lapic advancement calculation and
  related qemu-kvm-tools-rhev requirement
  Resolves: rhbz#1852253


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
- Rebase to tzdata-2019a
  - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
    previously predicted.
  - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
    of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
- Rebase to tzdata-2019b
  - Brazil will no longer observe DST going forward.
  - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
- Rebase to tzdata-2019c
  - Fiji will observe DST from 2019-11-10 to 2020-01-12.
  - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
- Rebase to tzdata-2020a
  - Morocco will spring forward on 2020-05-31 rather than
    previously predicted 2020-05-24.
  - Canada's Yukon region changed to year round UTC -07
    effective 2020-03-08.
  - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
- Rebase to tzdata-2020b
  - Yukon timezones represented by America/Whitehorse and
    America/Dawson will change time zone rules from -08/-07 to
    permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
  - The most recent winter(+08)/summer(+11) transition for Casey Station,
    Antarctica was 2020-10-04 00:01.
  - Remove obsolete files pacificnew, systemv, and yearistype.sh
    from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-3
changelog:
- Include the upstream patch to support pacificnew for java tzupdater.
- Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
- Rebase to tzdata-2020c
  - Fiji starts DST later than usual, on 2020-12-20.
  - Rearguard now provides an empty file pacificnew to support
    downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
- Rebase to tzdata-2020d
 - Palestine will end summer time on 2020-10-24 rather than the
   predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
- Rebase to tzdata-2020f including changes for tzdata-2020e
  - tzdata-2020f fixes a bug in tzdata-2020e that caused an
    invalid zi file in rearguard format
  - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
  - Australia/Currie is identical to Australia/Hobart for all
    timestamps since 1970 and was therefore created by mistake,
    now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
- Rebase to tzdata-2021b
  - Innclude patch for Mayen
  - Jordan now starts DST on February's last Thursday.
  - Samoa no longer observes DST.
  - Merge more location-based Zones whose timestamps agree since 1970.
  - Move some backward-compatibility links to 'backward'.
  - Rename Pacific/Enderbury to Pacific/Kanton.
  - Correct many pre-1993 transitions in Malawi, Portugal, etc.
  - zic now creates each output file or link atomically.
  - zic -L no longer omits the POSIX TZ string in its output.
  - zic fixes for truncation and leap second table expiration.
  - zic now follows POSIX for TZ strings using all-year DST.
  - Fix some localtime crashes and bugs in obscure cases.
  - zdump -v now outputs more-useful boundary cases.
  - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
- Rebase to tzdata-2021c
  - Revert most of 2021b changes to 'backward'.
  - Fix 'zic -b fat' bug in pre-1970 32-bit data.
  - Fix two Link line typos.
  - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021d-1
changelog:
- Rebase to tzdata-2021d
  - Pacific/Fiji suspended DST for the 2021/2022 season.
  - 'zic -r' now marks unspecified timestamps with "-00".


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
- Rebase to tzdata-2021e - supersedes tzdata-2021d
  - Pacific/Fiji suspended DST for the 2021/2022 season.
  - 'zic -r' now marks unspecified timestamps with "-00".
  - Palestine will fall back 2021-10-29 at 01:00, rather
    than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
- Rebase to tzdata-2022a
  - Palestine springs forward on 2022-03-27, not -03-26.
  - zdump -v now outputs better failure information
  - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
- Rebase to tzdata-2022b
  - Chile transitions to DST on 2022-09-11, not 2022-09-04
  - 'make install' now defaults LOCALTIME to Factory rather than GMT
  - More zones that are the same since 1970 have been moved to backzone.
  - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
- Rebase to tzdata-2022c - supersedes tzdata-2022b
  - Add a work-around for an awk bug in FreeBSD, macOS, etc.
  - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
- Rebase to tzdata-2022d
  - Palestine's DST transition will be on October 29, 2022,
    not October 28, 2022.
  - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
- Rebase to tzdata-2022e
  - Jordan and Syria cancelled the DST transition planned
    for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
- Rebase to tzdata-2022f
  - Mexico will stop observing DST except near the US border.
  - Chihuahua moved to -06 year round starting on 2022-10-30.
  - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
- Rebase to tzdata-2022g
  - The northern edge of the Mexican state of Chihuahua will
    change time zone to agree with nearby US locations on
    2022-11-30.
  - Added a new Zone America/Ciudad_Juarez that splits from
    America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
- Rebase to tzdata-2023a
  - Egypt reintroduced DST, from April through October.
  - Morocco springs forward April 23, not April 30.
  - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
- Rebase to tzdata-2023d
  - Include time zone changes for Ittoqqortoormiit, Greenland
    and Vostok, Antarctica.
  - Update the expiration date for the leap-seconds.list file.
    No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
- Rebase to tzdata-2024a
  - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
  - Palestine will spring forward a week later than previously
    predicted.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
- Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
  Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
- Added patch for build option "-Werror=format-security"
- Added support of non-unicode non-latin charset
- Fix print of non-ascii filenames
- Fix troubles with symlinks for archives with many files
  Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
- rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
- make linking flags configurable from the specc file
- set linking flags to use relro hardening
  Related: #1531116


author: Jakub Martisko <jamartis@redhat.com> - 6.0-23
changelog:
- Disable the zipbomb detection patches
- There were too many false positives for now, will reenable this later with an option to opt-out
- Resolves: rhbz#2020318


author: Jakub Martisko <jamartis@redhat.com> - 6.0-24
changelog:
- Reenable the zipbomb detection patches
- Add environment variable that disables the zipbomb detection
- Resolves: rhbz#2020318


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
- 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
- 1267826 - Include c++11 syntax highlighting in vim
- 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
- 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
- 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Richard W.M. Jones <rjones@redhat.com> - 1.13-7
changelog:
- Add support for detecting POWER KVM and LPAR
  resolves: rhbz#1147876
- Detect RHEV/oVirt
  resolves: rhbz#1249438
- Detect ACPI boot aarch64 guest
  resolves: rhbz#1275349
- Fix typo in manual page
  resolves: rhbz#1099289


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-2
changelog:
- Rebase to Fedora Rawhide / upstream version.
- Include upstream patches since 1.18 was released.
  resolves: rhbz#1476878


author: William Poteat <wpoteat@redhat.com> 0.28.1-1
changelog:
- 1780467: Validate rhevm password when unicode is not allowed
  (wpoteat@redhat.com)
- 1751441: Add command line path parameter (piotr.kliczewski@gmail.com)
- 1762780: fix bug, when reporter_id is empty; ENT-1706 (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.3-1
changelog:
- 1775535: config option to override api version (piotr.kliczewski@gmail.com)
- Update releasers for new version (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.4-1
changelog:
- 1806572: virt-who using V3 APIs for communication with RHEVM which is
  deprecated (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 0.28.6-1
changelog:
- 1806572: RHEVM should only use version 4 (wpoteat@redhat.com)
- Update to tests to match changes in Subscription Manager (jhnidek@redhat.com)


author: Martin Sehnoutka <msehnout@redhat.com> - 3.0.2-20
changelog:
- Resolves: #1147551 - Missing isolate_* options, incorrect default values of
  max_clients, max_per_ip in man vsftpd.conf


author: Zdenek Dohnal <zdohnal@redhat.com> - 3.0.2-22
changelog:
- Resolves: #1432054 - secure ftp stopped working with default TLS settings in the new vsftpd package


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-23
changelog:
- Redefine VSFTP_COMMAND_FD to 1
- Resolves: rhbz#1443055
- Document the relationship of text_userdb_names and chroot_local_user
- Resolves: rhbz#1508021
- Document allow_writeable_chroot in the man page
- Resolves: rhbz#1508022
- Improve documentation of ascii_* options
- Resolves: rhbz#1517227
- Add new filename generation algorithm for STOU command
- Resolves: rhbz#1479237


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.0.2-25
changelog:
- Add config option log_die allowing to pass error messages to syslog
- Add config option bind_retries allowing to change the max number
- of attempts to find a listening port for the PASV/EPSV command
- Resolves: rhbz#1318198


author: Artem Egorenkov <aegorenk@redhat.com> - 3.0.2-29
changelog:
- Enable support for wide-character strings in logs
- Replace unprintables with HEX code, not question marks
- Resolves: rhbz#1922809


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
- Update to 2.20.4
- Resolves: rhbz#1576544
- WebKitWebProcess crashes when a11y is active
- Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
- webkitgtk4: Crash on Google login page when a11y is active
- Resolves: rhbz#1503624
- Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
- Update to 2.20.5 - technically it was not necessary as the only difference
  between 2.20.4 and .5 was the revert of one change, that we already reverted
  while building 2.20.4. But it's better to stay with upstream.
- Update the labels patch with the version that was pushed upstream.
- Resolves: rhbz#1576544


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
- macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
- nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-7
changelog:
- avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
  CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
  CVE-2017-13087, CVE-2017-13088)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-10
changelog:
- Fix memory leak when macsec MKA/PSK is used (rh #1500442)
- Fix authentication failure when the MAC is updated externally (rh #1490885)
- Let the kernel discard EAPOL if packet type is PACKET_OTHERHOST (rh #1434434)
- Don't restart wpa_supplicant.service on package upgrade (rh #1505404)
- Don't own a directory in /run/ (rh #1507919)


author: Parag Nemade <paragn AT fedoraproject DOT org> - 3.3.12ga11-5
changelog:
- Remove vendor tag from desktop file as per https://fedorahosted.org/fesco/ticket/1077
- Cleanup spec as per recently changed packaging guidelines


author: Samantha N. Bueno <sbueno[at]redhat.com> - 3.3.12ga12-1
changelog:
- updated to 3.3.12ga12
- fixes CVE-2012-5662 (#889373, #924228)
- add support for aarch64 to build system (#926737)


author: Eric Sandeen <sandeen@redhat.com> 3.1.3-2
changelog:
- Preserve xattrs on multi-part stream restores (#1034014)
- Prevent segfault on multi-part stream restores (#1034015)


author: Eric Sandeen <sandeen@redhat.com> 3.1.7-1
changelog:
- Rebase to build against current RHEL7 xfsprogs headers
- Fix race condition between lseek() and read()/write() (#1086532)


author: Pavel Reichl <preichl@redhat.com> - 3.1.7-4
changelog:
- Batch fixing several issues
- xfsrestore: Files from the backup go to orphanage dir because of xfsdump
-      issue, Related: RHEL-10529
- xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x,
-      Related: RHEL-14912


author: Simo Sorce <simo@redhat.com> - 1.2.20-1
changelog:
- New upstrema version with memleaks, crl checks and other fixes
- enable make check during build
- drop ecdsa patch as it has been included upstream


author: Tomas Halman <thalman@redhat.com> - 1.2.20-8
changelog:
- xmlsec1 fails to validate XML signatures made using ECDSA algorithm in FIPS mode
- Resolves: RHEL-3337


author: Hans de Goede <hdegoede@redhat.com> 7.7.1-1
changelog:
- Update to latest git, this is the equivalent of 7.7.1 + fixes for use
  with xserver-1.19 (rhbz#1325613)
- Rebuild against xserver-1.19


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
- Fix a crash when moving an animated cursor between screens
- Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
- CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
  CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
- Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
- CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
  CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
- CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
  Resolves: rhbz#2109031, rhbz#2109033


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
- CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
  CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
  CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
- CVE fix for: CVE-2023-6377, CVE-2023-6478
  Resolves: https://issues.redhat.com/browse/RHEL-18416
  Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
- CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
  CVE-2024-0408 and CVE-2024-0409
  Resolves: https://issues.redhat.com/browse/RHEL-21205
  Resolves: https://issues.redhat.com/browse/RHEL-20578
  Resolves: https://issues.redhat.com/browse/RHEL-20426
  Resolves: https://issues.redhat.com/browse/RHEL-20437
  Resolves: https://issues.redhat.com/browse/RHEL-21192
  Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
- CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
  CVE-2024-31083
  Resolves: https://issues.redhat.com/browse/RHEL-31003
  Resolves: https://issues.redhat.com/browse/RHEL-30989
  Resolves: https://issues.redhat.com/browse/RHEL-30973
- Add util-linux as a dependency of Xvfb
- Fix compilation error on i686


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-13
changelog:
- Fix remote code execution vulnerability
- Resolves: CVE-2021-21344
- Resolves: CVE-2021-21345
- Resolves: CVE-2021-21346
- Resolves: CVE-2021-21347
- Resolves: CVE-2021-21350


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
- fix manual page inconsistencies with help output (private #948533)
- enable/fix the 'xzgrep -h' (private #850898)


