# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-1
changelog:
- Bump version to  1.3.10.2-1
- Resolves: Bug 1724761 - Entry cache contention during base search
- Resolves: Bug 1515319 - nsDS5ReplicaId cant be set to the old value it had before
- Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions
- Resolves: Bug 1762901 - cenotaph errors on modrdn operations
- Resolves: Bug 1772616 - Typo in the replication debug message "error 0 for oparation 561" 
- Resolves: Bug 1781276 - Regression: NSS has interop problems as server when using limited cipher list
- Resolves: Bug 1787921 - Crash on startup: Bus error in __env_faultmem.isra.1.part.2
- Resolves: Bug 1759142 - No error returned when adding an entry matching filters for a non existing automember group
- Resolves: Bug 1763365 - ns-slapd is crashing while restarting ipactl
- Resolves: Bug 1769418 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
- Resolves: Bug 1775165 - ldclt core dumped when run with -e genldif option
- Resolves: Bug 1796558 - Memory leak in ACI using IP subject
- Resolves: Bug 1769296 - cl-dump exit code is 0 even if command fails with invalid arguments


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-2
changelog:
- Bump version to  1.3.10.2-2
- Resolves: Bug 1820433 - Invalid defaults.inf, missing key db_home_dir
- Resolves: Bug 1801327 - intermittent SSL hang with rhds
- Resolves: Bug 1807537 - wildcards in rootdn-allow-ip attribute are not accepted
- Resolves: Bug 1827284 - Memory leak in indirect COS


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-3
changelog:
- Bump version to 1.3.10.2-3
- Resolves: Bug 1824930 - ipa ns-slapd 3 threads deadlock, db pages, state_change lock, write vattr lock
- Resolves: Bug 1837477 - ns-slapd hangs during CleanAllRUV tests


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-5
changelog:
- Bump version to 1.3.10.2-5
- Resolves: Bug 1700987 - 389-base-ds expected file permissions in package don't match final runtime permissions


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-6
changelog:
- Bump version to 1.3.10.2-6
- Resolves: Bug 1839085 - IPA: Winsync not honoring parameters winSyncDirectoryFilter and winSyncWindowsFilter


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-7
changelog:
- Bump version to 1.3.10.2-7
- Resolves: Bug 1870624 - RHDS - allow more than 1 empty AttributeDescription for ldapsearch, without the risk of denial of service
- Resolves: Bug 1876028 - errors log with incorrectly formatted message parent_update_on_childchange on PARENTUPDATE_DEL
- Resolves: Bug 1860008 - On ADD replication URP issue internal searches with filter containing unescaped chars


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-8
changelog:
- Bump version to 1.3.10.2-8
- Resolves: Bug 1904145 - group rdn with leading space char and add fails error 21 invalid syntax and delete fails error 32
- Resolves: Bug 1902042 - Entries conflict not resolved by replication


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-10
changelog:
- Bump version to 1.3.10.2-10
- Resolves: Bug 1909342 - DS crash in deref plugin while dereferencing an entry that exists but that is not returned by internal search
- Resolves: Bug 1921856 - “write” permission of ACI changes ns-slapd’s behavior on search operation 
- Resolves: Bug 1881968 - Replication Lag under high load


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-11
changelog:
- Bump version to 1.3.10.2-11
- Resolves: Bug 1953673 - Add new access log keywords for time spent in work queue and actual operation time
- Resolves: Bug 1931182 - information disclosure during the binding of a DN


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-13
changelog:
- Bump version to 1.3.10.2-13
- Resolves: Bug 2005399 - Internal unindexed searches in syncrepl
- Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
- Resolves: Bug 2005434 - ACIs are being evaluated against the Replication Manager account in a replication context.
- Resolves: Bug 2005435 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-14
changelog:
- Bump version to 1.3.10.2-14
- Resolves: Bug 2018257 - hang because of incorrect accounting of readers in vattr rwlock
- Resolves: Bug 2010976 - IPA server (389ds) is very slow in execution of some searches (`&(memberOf=...)(objectClass=ipaHost)` in particular)


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-15
changelog:
- Bump version to 1.3.10.2-15
- Resolves: Bug 2049812 - Fix csn generator to limit time skew drift
- Resolves: Bug 2048530 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in persistent search


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-16
changelog:
- Bump version to 1.3.10.2-16
- Resolves: Bug 2077395 - CVE-2022-0918 389-ds:1.4/389-ds-base: sending crafted message could result in DoS
- Resolves: Bug 2014768 - Log the Auto Member invalid regex rules in the LDAP errors log
- Resolves: Bug 2018153 - RFE - Provide an option to abort an Auto Member rebuild task
- Resolves: Bug 2093294 - CVE-2022-0996 389-ds:1.4/389-ds-base: expired password was still allowed to access the database


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10-2-17
changelog:
- Bump version to 1.3.10.2-17
- Resolves: Bug 2113056 - Import may break replication because changelog starting csn may not be created
- Resolves: Bug 2131083 - SIGSEGV in sync_repl


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-5
changelog:
- Bump version to 1.3.10.1-5
- Resolves: Bug 1744623 - DB Deadlock on modrdn appears to corrupt database and entry cache(cont)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-6
changelog:
- Bump version to 1.3.10.1-6
- Resolves: Bug 1801694 - ns-slapd is crashing while restarting ipactl
- Resolves: Bug 1803023 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
- Resolves: Bug 1803052 - Memory leak in ACI using IP subject
- Resolves: Bug 1801703 - Regression: NSS has interop problems as server when using limited cipher list
- Resolves: Bug 1809160 - Entry cache contention during base search


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.1-7
changelog:
- Bump version to 1.3.10.1-7
- Resolves: Bug 1803023 - Several memory leaks reported by Valgrind (fix regression)


author: Simon Pichugin <spichugi@redhat.com> - 1.3.11.1-1
changelog:
- Bump version to 1.3.11.1-1
- Resolves: Bug 2170224 - Backport Rust password storage PBKDF2 schemes
- Resolves: Bug 2170221 - Boolean attributes should be case insensitive
- Resolves: Bug 2170218 - Slow memberof fixup task for large static groups, high CPU use


author: James Chapman <jachapma@redhat.com> - 1.3.11.1-5
changelog:
- Bump version to 1.3.11.1-5
- Resolves: RHEL-33337 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request
- Resolves: RHEL-34817 - redhat-ds:11/389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c


author: Jan Horak <jhorak@redhat.com> - 6.7.8.9-15
changelog:
- Added fix for CVE-2016-5118, CVE-2016-5240, rhbz#1269562,
  rhbz#1326834, rhbz#1334188, rhbz#1269553


author: Thomas Haller <thaller@redhat.com> - 1:1.18.4-1
changelog:
- Update to 1.18.4 release
- cli: fix bash completion for slave-types (rh #1654062)
- core: improve handling of policy routing rules when restarting daemon (rh #1696881)
- ifcfg-rh: preserve existance of ethernet setting in profile (rh #1703960)
- tui: only add bond options to profile that are supported by tui (rh #1715720)
- cli: fix resetting default value for properties (rh #1715887)
- core: fix detecting parent device by connection's UUID (rh #1716438)
- core: fix setting IPv6 route options and destination (rh #1727193)
- core: support more "arp_validate" bond options (rh #1730793)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.4-2
changelog:
- dhcp: include conditionals from existing dhclient configuration (rh #1758550)
- core: fix sending ARP announcements (rh #1767681)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.18.6-1
changelog:
- Update to 1.18.6 release
- cli: unset "ipv[46].never-default" when setting "ipv[46].gateway" (rh #1785039)
- core: keep MTU of MACsec and MAC-VLAN interfaces in sync with parent (rh #1723690)
- core: forbid autoactivation of parent when it is blocked by user request (rh #1765566)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.6-2
changelog:
- vpn: gracefully handle invalid routes from VPN plugins
- workaround g_strtoll() failing with EAGAIN (rh #1797915)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-1
changelog:
- Update to 1.18.8 relase
- ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841397, CVE-2020-10754)
- ifcfg-rh: handle 802-1x.pin properties.


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-2
changelog:
- Backport OVS related fixes (rh #1871935)
- ovs: support changing the MTU of ovs interfaces (rh #1820052)
- ovs: fix race condition in setting MAC address (rh #1852106)


author: Sumit Bose <sbose@redhat.com> - 0.8.1-8
changelog:
- Various updates for RHEL-7.7
- many adcli-krb5-????? directories are created /tmp [#1588596]
- adcli exports kerberos ticket with old kvno [#1642546]
- [RFE] Have `adcli join` work without FQDN in `hostname` output [#1595911]
- Improve handling of service principals [#1644311]
- [RFE] adcli command with --unix-* options doesn't update
  values in UnixAttributes Tab for user [#1337489]
- [RFE] adcli join should preserve SPN added by adcli preset-computer [#1630187]
- [RFE] Need an option for adcli command which will show domain join status. [#1622583]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-9
changelog:
- Fixes for RHEL-7.7 updates
- additional patch for [RFE] adcli join should preserve SPN added by adcli
  preset-computer [#1630187]
- new patches for many adcli-krb5-????? directories are created /tmp [#1588596]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-10
changelog:
- adcli is failing with "Couldn't add keytab entries: FILE:/etc/krb5.keytab:
  Cannot allocate memory" [1665162]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-11
changelog:
- Fixes and improvements for RHEL-7.8
- Issue is that with arcfour-hmac as first encryption type in the config ... [#1683745]
- adcli update --add-samba-data does not work as expected [#1738573]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-14
changelog:
- Fixes for RHEL-7.9
- Update' adcli update --add-samba-data ' info under correct section in man adcli [#1774622]
- [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1802258]


author: Sumit Bose <sbose@redhat.com> - 0.8.1-15
changelog:
- More fixes for RHEL-7.9
- No longer able to delete computer from AD using adcli [#1840752]
- adcli: presetting $computer in $domain domain failed: Cannot set computer
  password: Authentication error [#1762633]


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-6
changelog:
- warn if processing prelinked binary objects and the prelink binary
  is not available
  Resolves: rbhz#1004826


author: Daniel Kopecek <dkopecek@redhat.com> - 0.15.1-10
changelog:
- Updated the default configuration file. New defaults contributed
  by Steve Grubb.
  Resolves: rhbz#1304334


author: Marcela Mašláňová <mmaslano@redhat.com> - 3.1.13-16
changelog:
- the correct solution is remove smp_flags, they don't work properly on ppc with
  the option mpower7
- Related: rhbz#1048745


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-21
changelog:
- correct the DST correction when using UTC time specification (#1328832)
- clear non-job files from at dir and test for write error on fclose
  to fix bogus syslog messages


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.13-23
changelog:
- fix the ownership of the spool directory (#1414228)
- document the -n option of atd (#739870)
- fix handling of the aborted jobs (due to possibly
  temporary conditions) and avoid flooding the syslog


author: Stephan Bergmann <sbergman@redhat.com> - 1:5.3.6.1-17
changelog:
- Resolves: rhbz#1545262 Workaround for spurious ppc64le automated testing crash
- Resolves: rhbz#1610692 silence console warnings from print dialog


author: Eike Rathke <erack@redhat.com> - 1:5.3.6.1-26
changelog:
- Fix CVE-2022-38745 Empty entry in Java class path
- Fix CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing
- Fix CVE-2023-1183 libreoffice: Arbitrary File Write
- Fix CVE-2023-6185 escape url passed to gstreamer


author: Ian Kent <ikent@redhat.com> - 5.0.7-108
changelog:
- bz1728914 - getmntent returns additional "-hosts" entries when
  automounter is used with "hosts" map
  - remove unused function has_fstab_option().
  - remove unused function reverse_mnt_list().
  - remove a couple of old debug messages.
  - fix amd entry memory leak.
  - fix unlink_mount_tree() not umounting mounts.
  - add ignore mount option.
  - use ignore option for offset mounts as well.
  - add config option for "ignore" mount option
  - use bit flags for autofs mount types in mnt_list.
  - use mp instead of path in mnt_list entries.
  - always use PROC_MOUNTS to make mount lists.
  - add glibc getmntent_r().
  - use local getmntent_r in table_is_mounted().
  - refactor unlink_active_mounts() in direct.c.
  - don't use tree_is_mounted() for mounted checks.
  - use single unlink_umount_tree() for both direct and indirect mounts.
  - move unlink_mount_tree() to lib/mounts.c.
  - use local_getmntent_r() for unlink_mount_tree().
  - use local getmntent_r() in get_mnt_list().
  - use local getmntent_r() in tree_make_mnt_list().
- Resolves: rhbz#1728914


author: Ian Kent <ikent@redhat.com> - 5.0.7-109
changelog:
- bz1728914 - getmntent returns additional "-hosts" entries when
  automounter is used with "hosts" map
  - fix missing initialization of autofs_point flags.
- Related: rhbz#1728914


author: Ian Kent <ikent@redhat.com> - 5.0.7-110
changelog:
- bz1806514 - strictexpire option not set for offset mounts
  - also use strictexpire for offsets.
- Resolves: rhbz#1806514


author: Ian Kent <ikent@redhat.com> - 5.0.7-111
changelog:
- bz1806514 - strictexpire option not set for offset mounts
  - fix patch not applied.
- Related: rhbz#1806514


author: Ian Kent <ikent@redhat.com> - 5.0.7-112
changelog:
- bz1818664 - autofs cannot mount samba/cifs shares that end with a dollar sign
  - fix trailing dollar sun entry expansion.
- Resolves: rhbz#1818664


author: Ian Kent <ikent@redhat.com> - 5.0.7-114
changelog:
- bz1847762 - automount program crashes with "malloc(): invalid next size
  (unsorted)
  - initialize struct addrinfo for getaddrinfo() calls.
  - fix quoted string length calc in expandsunent().
  - fix autofs mount options construction.
-Resolves: rhbz#1847762


author: Ian Kent <ikent@redhat.com> - 5.0.7-115
changelog:
- bz1885511 - automount force unlink option (-F) does not work as expected
  on autofs-5.0.7-109.el7
  - fix direct mount unlink_mount_tree() path.
  - fix unlink mounts umount order.
- bz1858586 - autofs share doesn't mount when using nobind over RDMA where
  nfs-server and nfs-client are the same systems
  - mount_nfs.c fix local rdma share not mounting.
- Resolves: rhbz#1885511 rhbz#1858586


author: Ian Kent <ikent@redhat.com> - 5.0.7-116
changelog:
- bz1885511 - automount force unlink option (-F) does not work as expected
  on autofs-5.0.7-109.el7
  - fix incorrect logical compare in unlink_mount_tree().
- Related: rhbz#1885511


author: Ian Kent <ikent@redhat.com> - 5.0.7-116el7_9.1
changelog:
- bz2107752 - autofs: send FAIL cmd/ioctl mess when encountering problems
  with mount trigger
  - fix kernel mount status notification.
- Resolves: rhbz#2107752


author: Ian Kent <ikent@redhat.com> - 5.0.7-107
changelog:
- bz1734057 - automount segfaults if a bad hosts entry is added
  in /etc/auto.master
  - fix reset flex scan buffer on init.
- Resolves: rhbz#1734057


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.14.28-5
changelog:
- Append python-botocore and python-jmespath bundled directory to
  search path where needed

  Resolves: rhbz#1509434


author: Ville Skyttä <ville.skytta@iki.fi> - 0:5.2-10
changelog:
- Specify explicit source encoding to fix build with Java 7.
- Install jar and javadocs unversioned.
- Crosslink with JDK javadocs.


author: Andy Grimm <agrimm@gmail.com> - 0:5.2-13
changelog:
- This package should not own _mavendepmapfragdir (RHBZ#850005)
- Build with maven, and clean up deprecated spec constructs
- Fix pom file (See http://jira.codehaus.org/browse/MEV-592)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.1
changelog:
- Fix tsig-request verify (CVE-2020-8622)
- Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
- Correct update-policy type subdomain to match documentation (CVE-2020-8624)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.10
changelog:
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Stepan Broz <sbroz@redhat.com> - 32:9.11.4-26.P2.16
changelog:
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
  CVE-2023-50868)
- Add missing design by contract tests to dns_catz*
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
- Do not use header_prev in expire_lru_headers


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-23.P2
changelog:
- Limit number of queries triggered by a request (CVE-2020-8616)
- Fix invalid tsig request (CVE-2020-8617)


author: Tomas Krizek <tkrizek@redhat.com> - 11.1-1
changelog:
- update to letest upstream version
- resolves: #1393889 Rebase to bind-dyndb-ldap 11+
- resolves: #1165796 bind-dyndb-ldap crashes if server is shutting down and connection to LDAP is down
- resolves: #1413805 bind-dyndb-ldap default schema is shipped with syntax error


author: Petr Menšík <pemensik@redhat.com> - 11.1-6
changelog:
- Bump BIND version and fix library dependecies
- Rebuild for bind 9.11.3. Minor tweaks to compile.
- Support for bind 9.11.5 headers


author: Nick Clifton <nickc@redhat.com> 2.27-42.base
changelog:
- Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749085)


author: Nick Clifton <nickc@redhat.com> 2.27-44.base
changelog:
- Allow the BFD library to handle the copying of files which contain secondary reloc sections.  (#1785294)
- Implement assembler workaround for Intel JCC microcode bug.  (#1778892)


author: Josef Ridky <jridky@redhat.com> - 0:1.8.18-3
changelog:
- Fix issues with warning: dereferencing type-punned pointer 
  will break strict-aliasing rules from RPMDiff


author: Pavel Cahyna <pcahyna@redhat.com> - 0:1.8.18-10
changelog:
- Protect against negative values to memmove that caused
  "ipmitool sol activate" to crash against an IBM DataPower appliance
  (#1951480) and IP-131 Dayton blades in a SGI ICE-X (#2025519)
  Cherry-picked from upstream PR#78.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.18-11
changelog:
- Add upstream ipmievd patch to check received msg id against expectation
  Fixes problem where SEL response is not recognized correctly
  when SEL request times out
  Resolves: rhbz#2224569


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.93.1.el7]
changelog:
- Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Wander Lairson Costa) [2152941] {CVE-2022-3564}
- proc/pagemap: walk page tables under pte lock (Rafael Aquini) [2190338]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.94.1.el7]
changelog:
- netfilter: nf_tables: deactivate anonymous set from preparation phase (Florian Westphal) [2196159] {CVE-2023-32233}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.95.1.el7]
changelog:
- perf/s390x: Align the register list to what we support (Michael Petlan) [2207745]
- Revert "[tools] s390/perf: add perf register support for floating-point registers" (Michael Petlan) [2207745]
- s390/perf: add perf_regs support and user stack dump (Michael Petlan) [2207745]
- s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR (Tobias Huschle) [2212672]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.96.1.el7]
changelog:
- sched/fair: Eliminate bandwidth race between throttling and distribution (Phil Auld) [2180681]
- sched/fair: Fix race between runtime distribution and assignment (Phil Auld) [2180681]
- sched/fair: Don't assign runtime for throttled cfs_rq (Phil Auld) [2180681]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.97.1.el7]
changelog:
- net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216982] {CVE-2023-35788}
- netfilter: conntrack: re-fetch conntrack after insertion (Florian Westphal) [2188190]
- netfilter: conntrack: handle tcp challenge acks during connection reuse (Florian Westphal) [2128262]
- netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst (Florian Westphal) [2128262]
- netfilter: conntrack: remove unneeded indent level (Florian Westphal) [2128262]
- netfilter: conntrack: ignore overly delayed tcp packets (Florian Westphal) [2128262]
- netfilter: conntrack: prepare tcp_in_window for ternary return value (Florian Westphal) [2128262]
- netfilter: conntrack: connection timeout after re-register (Florian Westphal) [2128262]
- netfilter: conntrack: always store window size un-scaled (Florian Westphal) [2128262]
- netfilter: conntrack: work around exceeded receive window (Florian Westphal) [2128262]
- netfilter: conntrack: avoid misleading 'invalid' in log message (Florian Westphal) [2128262]
- netfilter: remove BUG_ON() after skb_header_pointer() (Florian Westphal) [2128262]
- netfilter: nf_conntrack_tcp: re-init for syn packets only (Florian Westphal) [2128262]
- netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options (Florian Westphal) [2128262]
- netfilter: conntrack: re-init state for retransmitted syn-ack (Florian Westphal) [2128262]
- netfilter: conntrack: move synack init code to helper (Florian Westphal) [2128262]
- netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (Florian Westphal) [2128262]
- netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options (Florian Westphal) [2128262]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.98.1.el7]
changelog:
- GFS2: gfs2_dir_get_hash_table(): avoiding deferred vfree() is easy here... (Andrew Price) [2190450]
- GFS2: use kvfree() instead of open-coding it (Andrew Price) [2190450]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.99.1.el7]
changelog:
- x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226841] {CVE-2023-20593}
- x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226841] {CVE-2023-20593}
- x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226841] {CVE-2023-20593}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.100.1.el7]
changelog:
- bnxt: count Tx drops (Jamie Bainbridge) [2175062]
- bnxt: make sure xmit_more + errors does not miss doorbells (Jamie Bainbridge) [2175062]
- netfilter: nf_tables: skip deactivated anonymous sets during lookups (Florian Westphal) [2196159] {CVE-2023-32233}
- netfilter: nf_tables: do not allow SET_ID to refer to another table (Florian Westphal) [2196159]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.101.1.el7]
changelog:
- cifs: fix a buffer leak in smb2_query_symlink (Jay Shin) [2166706]
- kernfs: Improve kernfs_notify() poll notification latency (Ian Kent) [1703180]
- netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221720] {CVE-2023-35001}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.102.1.el7]
changelog:
- net/sched: cls_u32: Fix reference counter leak leading to overflow (Davide Caratti) [2225486] {CVE-2023-3609}
- NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION (Benjamin Coddington) [2219604]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.103.1.el7]
changelog:
- net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225555] {CVE-2023-3611}
- net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Davide Caratti) [2225555]
- net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225639] {CVE-2023-3776}
- redhat: fix to be able to build with rpm 4.19.0 (Denys Vlasenko)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.104.1.el7]
changelog:
- CI: Remove unused kpet_tree_family (Nikolai Kondrashov)
- xen/x86: don't lose event interrupts (Vitaly Kuznetsov) [RHEL-1534]
- Documentation/x86: Fix backwards on/off logic about YMM support (Waiman Long) [2229893] {CVE-2022-40982}
- KVM: Add GDS_NO support to KVM (Waiman Long) [2229893] {CVE-2022-40982}
- x86/speculation: Add Kconfig option for GDS (Waiman Long) [2229893] {CVE-2022-40982}
- x86/speculation: Add force option to GDS mitigation (Waiman Long) [2229893] {CVE-2022-40982}
- x86/speculation: Add Gather Data Sampling mitigation (Waiman Long) [2229893] {CVE-2022-40982}
- Documentation/ABI: Mention retbleed vulnerability info file for sysfs (Waiman Long) [2229893]
- docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed (Waiman Long) [2229893]
- x86/speculation: Add missing srbds=off to the mitigations= help text (Waiman Long) [2229893]
- x86: Sync Intel family names & cpu_vuln_blacklist[] with upstream (Waiman Long) [2229893]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.105.1.el7]
changelog:
- net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}
- net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228703] {CVE-2023-4128}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.106.1.el7]
changelog:
- gfs2: Fix quota=quiet oversight (Bob Peterson) [2196280]
- gfs2: Free quota data objects synchronously (Andreas Gruenbacher) [2196280]
- gfs2: Fix initial quota data refcount (Andreas Gruenbacher) [2196280]
- gfs2: Factor out duplicate quota data disposal code (Andreas Gruenbacher) [2196280]
- gfs2: Use gfs2_qd_dispose in gfs2_quota_cleanup (Andreas Gruenbacher) [2196280]
- gfs2: Fix wrong quota shrinker return value (Andreas Gruenbacher) [2196280]
- gfs2: ignore negated quota changes (Bob Peterson) [2196280]
- gfs2: Introduce new quota=quiet mount option (Bob Peterson) [2196280]
- gfs2: Add quota_change type (Bob Peterson) [2196280]
- gfs2: Rename sd_{ glock => kill }_wait (Andreas Gruenbacher) [2196280]
- gfs2: Wake up when sd_glock_disposal becomes zero (Alexander Aring) [2196280]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.107.1.el7]
changelog:
- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Phil Sutter) [RHEL-8433] {CVE-2023-42753}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.108.1.el7]
changelog:
- net: usb: ax88179_178a: fix failed operations during ax88179_reset (Jose Ignacio Tornos Martinez) [RHEL-6302]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.1.el7]
changelog:
- [edac] EDAC/i10nm: Update driver to support different bus number config register offsets (Aristeu Rozanski) [1840276]
- [edac] EDAC, {skx, i10nm}: Make some configurations CPU model specific (Aristeu Rozanski) [1840276]
- [net] test nouarg before dereferencing zerocopy pointers (Patrick Talbert) [1862273]
- [net] packet: copy user buffers before orphan or clone (Patrick Talbert) [1862273]
- [netdrv] net/mlx5e: Fix deallocation of non-fully init encap entries (Alaa Hleihel) [1874101]
- [netdrv] net/mlx5e: Allow concurrent creation of encap entries (Alaa Hleihel) [1874101]
- [netdrv] net/mlx5e: Protect encap hash table with mutex (Alaa Hleihel) [1874101]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.3.1.el7]
changelog:
- [net] net-sysfs: Call dev_hold always in rx_queue_add_kobject (Hangbin Liu) [1846454] {CVE-2019-20811}
- [net] net-sysfs: Call dev_hold always in netdev_queue_add_kobject (Hangbin Liu) [1846454] {CVE-2019-20811}
- [net] net-sysfs: call dev_hold if kobject_init_and_add success (Hangbin Liu) [1846454] {CVE-2019-20811}
- [netdrv] macvlan: Change status when lower device goes down (Hangbin Liu) [1848950]
- [netdrv] macvlan: make operstate and carrier more accurate (Hangbin Liu) [1848950]
- [infiniband] RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() (Kamal Heib) [1858707]
- [infiniband] RDMA/ipoib: Return void from ipoib_ib_dev_stop() (Kamal Heib) [1858707]
- [net] tcp: limit sk_write_qlen based on sndbuf size (Florian Westphal) [1847765]
- [netdrv] net/mlx5e: Modify uplink state on interface up/down (Alaa Hleihel) [1733181]
- [netdrv] net/mlx5: E-Switch, Disable esw manager vport correctly (Alaa Hleihel) [1733181]
- [netdrv] net/mlx5: E-Switch, Properly refer to host PF vport as other vport (Alaa Hleihel) [1733181]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.4.1.el7]
changelog:
- [block] virtio-blk: handle block_device_operations callbacks after hot unplug (Stefan Hajnoczi) [1811893]
- [scsi] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Nilesh Javali) [1826127]
- [scsi] scsi: qla2xxx: Fix stale mem access on driver unload (Nilesh Javali) [1826127]
- [scsi] scsi: qedf: Fix crash when MFW calls for protocol stats while function is still probing (Nilesh Javali) [1836443]
- [scsi] scsi: qedf: Keep track of num of pending flogi (Nilesh Javali) [1836443]
- [scsi] scsi: qedf: Fix race betwen fipvlan request and response path (Nilesh Javali) [1836443]
- [scsi] scsi: qedf: Decrease the LL2 MTU size to 2500 (Nilesh Javali) [1836443]
- [scsi] scsi: qedf: Check for module unloading bit before processing link update AEN (Nilesh Javali) [1836443]
- [scsi] scsi: qedf: Initiator fails to re-login to switch after link down (Nilesh Javali) [1836443]
- [scsi] scsi: qedf: Fix crash during sg_reset (Nilesh Javali) [1836443]
- [scsi] scsi: qedf: Stop sending fipvlan request on unload (Nilesh Javali) [1836443]
- [message] scsi: mptscsih: Fix read sense data size (Tomas Henzl) [1829803]
- [scsi] scsi: megaraid_sas: Clear affinity hint (Tomas Henzl) [1828312]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.5.1.el7]
changelog:
- [x86] x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs (Myron Stowe) [1849223]
- [kernel] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression (Oleg Nesterov) [1861396]
- [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859468] {CVE-2020-14331}
- [pci] hv: Retry PCI bus D0 entry on invalid device state (Mohammed Gamal) [1846667]
- [pci] hv: Fix the PCI HyperV probe failure path to release resource properly (Mohammed Gamal) [1846667]
- [x86] xen: Add call of speculative_store_bypass_ht_init() to PV paths (Vladis Dronov) [1882468]
- [powerpc] powerpc/smp: Use nid as fallback for package_id (Desnes Augusto Nunes do Rosario) [1826306]
- [powerpc] powerpc/smp: Add Power9 scheduler topology (Desnes Augusto Nunes do Rosario) [1826306]
- [kernel] sched: Add a new SD_SHARE_POWERDOMAIN for sched_domain (Desnes Augusto Nunes do Rosario) [1826306]
- [powerpc] sched, powerpc: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
- [s390] sched, s390: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
- [s390] s390/topology: Remove call to update_cpu_masks() (Desnes Augusto Nunes do Rosario) [1826306]
- [powerpc] powerpc/smp: Add cpu_l2_cache_map (Desnes Augusto Nunes do Rosario) [1826306]
- [powerpc] powerpc/smp: Rework CPU topology construction (Desnes Augusto Nunes do Rosario) [1826306]
- [powerpc] powerpc/smp: Use cpu_to_chip_id() to find core siblings (Desnes Augusto Nunes do Rosario) [1826306]
- [powerpc] powerpc, hotplug: Avoid to touch non-existent cpumasks (Desnes Augusto Nunes do Rosario) [1826306]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.6.1.el7]
changelog:
- [net] netfilter: nf_queue: place bridge physports into queue_entry struct (Florian Westphal) [1885682]
- [net] netfilter: nf_queue: do not release refcouts until nf_reinject is done (Florian Westphal) [1885682]
- [net] netfilter: nf_queue: make nf_queue_entry_release_refs static (Florian Westphal) [1885682]
- [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
- [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.7.1.el7]
changelog:
- [fs] xfs: fix off-by-one in inode alloc block reservation calculation (Brian Foster) [1857203]
- [fs] xfs: fix inode allocation block res calculation precedence (Brian Foster) [1857203]
- [powerpc] powernv/dump: Handle multiple writes to ack attribute (Gustavo Duarte) [1873189]
- [powerpc] powernv/dump: Fix race while processing OPAL dump (Gustavo Duarte) [1873189]
- [powerpc] powernv: opal-dump: Use IRQ_HANDLED instead of numbers in interrupt handler (Gustavo Duarte) [1873189]
- [powerpc] opal_elog: Handle multiple writes to ack attribute (Gustavo Duarte) [1873189]
- [powerpc] powernv/elog: Fix race while processing OPAL error log event (Gustavo Duarte) [1873189]
- [powerpc] powernv Adapt opal-elog and opal-dump to new sysfs_remove_file_self (Gustavo Duarte) [1873189]
- [powerpc] powernv: Fix opal-elog interrupt handler (Gustavo Duarte) [1873189]
- [net] flow_dissector: switch to siphash (Davide Caratti) [1835614] {CVE-2019-18282}
- [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875317] {CVE-2020-14385}
- [fs] cifs: make 'nodfs' mount opt a superblock flag (Leif Sahlberg) [1873033]
- [crypto] crypto: authenc - fix parsing key with misaligned rta_len (Herbert Xu) [1846355] {CVE-2020-10769}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.8.1.el7]
changelog:
- [kernel] sched/fair: Fix RCU stall upon -ENOMEM in sched_create_group() (Kenneth Yin) [1878000]
- [security] selinux: do not report error on connect(AF_UNSPEC) (Paolo Abeni) [1886305]
- [kernel] timer: Fix lockup in __run_timers() caused by large jiffies/timer_jiffies delta (Waiman Long) [1849716]
- [mm] revert "mm/page_alloc: fix memmap_init_zone pageblock alignment" (Artem Savkov) [1878732]
- [mm] page_alloc: Make paranoid check in move_freepages a VM_BUG_ON (Artem Savkov) [1878732]
- [nvme] rdma: Avoid double freeing of async event data (Gopal Tiwari) [1878950]
- [pci] hv: Fix a timing issue which causes kdump to fail occasionally (Mohammed Gamal) [1846667]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.9.1.el7]
changelog:
- [hv] hv: vmbus: Only notify Hyper-V for die events that are oops (Vitaly Kuznetsov) [1868130]
- [uapi] include: do not export changes made to struct ip_ct_sctp (Florian Westphal) [1887975]
- [net] openvswitch: free vport unless register_netdevice() succeeds (Timothy Redaelli) [1869190]
- [net] openvswitch: do not free vport if register_netdevice() is failed (Timothy Redaelli) [1869190]
- [kernel] signals: avoid random wakeups in sigsuspend() (Oleg Nesterov) [1704650]
- [fs] nfs: Fix getxattr kernel panic and memory overflow (Benjamin Coddington) [1880893] {CVE-2020-25212}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.10.1.el7]
changelog:
- [md] dm-mirror: provide the merge method (Mikulas Patocka) [1890059]
- [nvme] nvme-rdma: cancel async events before freeing event struct (David Milburn) [1857397]
- [s390] dasd: Use struct_size() helper (Sterling Alexander) [1886477]
- [s390] dasd: fix inability to use DASD with DIAG driver (Sterling Alexander) [1886477]
- [hv] hv_utils: drain the timesync packets on onchannelcallback (Vitaly Kuznetsov) [1884735]
- [hv] hv_utils: return error if host timesysnc update is stale (Vitaly Kuznetsov) [1884735]
- [x86] cpu: Re-apply forced caps every time CPU caps are re-read (Herbert Xu) [1886792]
- [x86] cpu: Factor out application of forced CPU caps (Herbert Xu) [1886792]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.11.1.el7]
changelog:
- [netdrv] hdlc_ppp: add range checks in ppp_cp_parse_cr() (Guillaume Nault) [1882078] {CVE-2020-25643}
- [fs] ext4: fix potential negative array index in do_split() (Pavel Reichl) [1846164] {CVE-2020-14314}
- [fs] nfsd: apply umask on fs without ACL support ("J. Bruce Fields") [1870215] {CVE-2020-24394}
- [kernel] watchdog/core: Remove the park_in_progress obfuscation (Waiman Long) [1860661]
- [mm] swap_slots: recheck cache->slots_ret under spin_lock_irq() protection (Rafael Aquini) [1862915]
- [netdrv] ethernet: i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (Stefan Assmann) [1845677]
- [infiniband] mlx5: Fix use-after-free in dereg_mr() (Alaa Hleihel) [1880184]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.109.1.el7]
changelog:
- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (Waiman Long) [RHEL-17703]
- scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly (Oleksandr Natalenko) [2224973]
- scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly (Oleksandr Natalenko) [2224973]
- scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly (Oleksandr Natalenko) [2224973]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.111.1.el7]
changelog:
- redhat: rewrite genlog and support Y- tags (Jan Stancek)
- scsi: zfcp: Fix double free of FSF request when qdio send fails (Tobias Huschle) [RHEL-16335]
- fbcon: set_con2fb_map needs to set con2fb_map! (Jocelyn Falempe) [RHEL-1204] {CVE-2023-38409}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.112.1.el7]
changelog:
- net: sched: sch_qfq: Use non-work-conserving warning handler (Davide Caratti) [RHEL-14397]
- net: sched: sch_qfq: Fix UAF in qfq_dequeue() (Davide Caratti) [RHEL-14397] {CVE-2023-4921}
- cpufreq: Initialize policy->kobj while allocating policy (Waiman Long) [2161654]
- net: bonding: fix possible NULL deref in rlb code (Hangbin Liu) [RHEL-17227]
- net: bonding: fix use-after-free after 802.3ad slave unbind (Hangbin Liu) [RHEL-17227]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.113.1.el7]
changelog:
- igb: set max size RX buffer when store bad packet is enabled (Wander Lairson Costa) [RHEL-15181] {CVE-2023-45871}
- Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm (David Marlin) [RHEL-2742] {CVE-2022-42896}
- Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (David Marlin) [RHEL-2742] {CVE-2022-42896}
- Bluetooth: Use separate L2CAP LE credit based connection result values (David Marlin) [RHEL-2742] {CVE-2022-42896}
- Bluetooth: L2CAP: Fix L2CAP_CR_SCID_IN_USE value (David Marlin) [RHEL-2742] {CVE-2022-42896}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.114.1.el7]
changelog:
- netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-23500] {CVE-2024-1086}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.114.2.el7]
changelog:
- sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26402] {CVE-2024-26602}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.115.1.el7]
changelog:
- af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
- NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.116.1.el7]
changelog:
- bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.117.1.el7]
changelog:
- tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-18052]
- tracing: Fix race in perf_trace_buf initialization (Michael Petlan) [RHEL-18052]
- net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
- net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-16458] {CVE-2023-4623}
- gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28785]
- vt: vt_ioctl: fix race in VT_RESIZEX (Jay Shin) [RHEL-28639] {CVE-2020-36558}
- selinux: cleanup and consolidate the XFRM alloc/clone/delete/free code (Ondrej Mosnacek) [RHEL-27751]
- bluetooth: Add cmd validity checks at the start of hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- bluetooth: Perform careful capability checks in hci_sock_ioctl() (David Marlin) [RHEL-3682] {CVE-2023-2002}
- cifs: fix panic in smb2_reconnect (Jay Shin) [RHEL-26301]
- af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16144] {CVE-2023-4622}
- NFS: Set the stable writes BDI capability (Benjamin Coddington) [RHEL-22193]
- RDMA/i40iw: Prevent zero-length STAG registration (Kamal Heib) [RHEL-6299] {CVE-2023-25775}
- sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26402] {CVE-2024-26602}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.12.1.el7]
changelog:
- [mm] mmap: relax file size limit for regular files (Rafael Aquini) [1855985]
- [mm] mmap: introduce sane default mmap limits (Rafael Aquini) [1855985]
- [of] Move dynamic node fixups out of powerpc and into common code (Laurent Vivier) [1866138]
- [fs] nfs: Fix double-free in filelayout_alloc_commit_info/filelayout_free_lseg (Benjamin Coddington) [1679980]
- [hid] HID: hid-plantronics: Re-resend Update to map button for PTT products (Torez Smith) [1769502]
- [fs] dlm: make posix locks interruptible (Alexander Aring) [1826858]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.13.1.el7]
changelog:
- [s390] zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl (Philipp Rudo) [1896826]
- [block] block/diskstats: more accurate approximation of io_ticks for slow disks (Ming Lei) [1859364]
- [block] block: delete part_round_stats and switch to less precise counting (Ming Lei) [1859364]
- [md] dm: simplify start of block stats accounting for bio-based (Ming Lei) [1859364]
- [block] block/rsxx: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
- [block] drbd: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
- [md] md: use generic io stats accounting functions to simplify io stat accounting (Ming Lei) [1859364]
- [nvme] limit number of IO queues on Dell/Kioxia config (Gopal Tiwari) [1883403]
- [netdrv] hv_netvsc: make recording RSS hash depend on feature flag (Mohammed Gamal) [1898280]
- [netdrv] hv_netvsc: record hardware hash in skb (Mohammed Gamal) [1898280]
- [fs] block: Fix use-after-free in blkdev_get() (Ming Lei) [1902414] {CVE-2020-15436}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.14.1.el7]
changelog:
- [fs] nfsd: fix incorrect umasks ("J. Bruce Fields") [1905208]
- [hv] vmbus: Add timeout to vmbus_wait_for_unload (Mohammed Gamal) [1888979]
- [scsi] qla2xxx: Fix device loss on 4G and older HBAs (Nilesh Javali) [1889311]
- [s390] dasd: Fix zero write for FBA devices (Philipp Rudo) [1896839]
- [net] ipv6: use in6_dev_put in dad timer handler instead of __in6_dev_put (Xin Long) [1809519]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.15.1.el7]
changelog:
- [fs] ceph: quota: fix null pointer dereference in quota check (Jeff Layton) [1890386]
- [netdrv] revert "mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query" (Alaa Hleihel) [1896756]
- [kernel] timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion (Waiman Long) [1890911]
- [kernel] exit: Optimize forget_original_parent() for large thread group exiting (Waiman Long) [1872110]
- [kernel] exit: reparent: call forget_original_parent() under tasklist_lock (Waiman Long) [1872110]
- [kernel] Disable tasklist_waiters when qrwlock is enabled (Waiman Long) [1872110]
- [fs] cifs: handle ERRBaduid for SMB1 (Leif Sahlberg) [1847041]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1153.el7]
changelog:
- [x86] mm: Fix mremap not considering huge pmd devmap (Rafael Aquini) [1843437] {CVE-2020-10757}
- [mm] mm, dax: check for pmd_none() after split_huge_pmd() (Rafael Aquini) [1843437] {CVE-2020-10757}
- [mm] mm: mremap: streamline move_page_tables()'s move_huge_pmd() corner case (Rafael Aquini) [1843437] {CVE-2020-10757}
- [mm] mm: mremap: validate input before taking lock (Rafael Aquini) [1843437] {CVE-2020-10757}
- [wireless] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() (Jarod Wilson) [1844070] {CVE-2020-12654}
- [wireless] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() (Jarod Wilson) [1844026] {CVE-2020-12653}
- [net] netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6 (Florian Westphal) [1845428]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1154.el7]
changelog:
- [fs] gfs2: move privileged user check to gfs2_quota_lock_check (Robert S Peterson) [1798713]
- [fs] gfs2: Fix problems regarding gfs2_qa_get and _put (Robert S Peterson) [1798713]
- [fs] gfs2: don't call quota_unhold if quotas are not locked (Robert S Peterson) [1798713]
- [fs] gfs2: Remove unnecessary gfs2_qa_{get, put} pairs (Robert S Peterson) [1798713]
- [fs] gfs2: Split gfs2_rsqa_delete into gfs2_rs_delete and gfs2_qa_put (Robert S Peterson) [1798713]
- [fs] gfs2: Change inode qa_data to allow multiple users (Robert S Peterson) [1798713]
- [fs] gfs2: eliminate gfs2_rsqa_alloc in favor of gfs2_qa_alloc (Robert S Peterson) [1798713]
- [fs] gfs2: Switch to list_{first,last}_entry (Robert S Peterson) [1798713]
- [fs] gfs2: Clean up inode initialization and teardown (Robert S Peterson) [1798713]
- [fs] gfs2: Minor gfs2_alloc_inode cleanup (Robert S Peterson) [1798713]
- [fs] gfs2: Fix busy-on-umount in gfs2_atomic_open() (Andrew Price) [1812558]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1155.el7]
changelog:
- [x86] Revert "x86: respect memory size limiting via mem= parameter" (Joel Savitz) [1851576]
- [mm] Revert "mm/memory_hotplug.c: only respect mem= parameter during boot stage" (Joel Savitz) [1851576]
- [fs] nfsd: only WARN once on unmapped errors ("J. Bruce Fields") [1850430]
- [powerpc] pci/of: Fix OF flags parsing for 64bit BARs (Greg Kurz) [1840114]
- [fs] cifs: fix NULL dereference in match_prepath (Leif Sahlberg) [1759852]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1156.el7]
changelog:
- [fs] gfs2: Fix regression due to unwanted gfs2_qa_put (Robert S Peterson) [1798713]
- [include] signal: Unfairly acquire tasklist_lock in send_sigio() if irq disabled (Waiman Long) [1838799]
- [fs] signal: Don't take tasklist_lock if PID type is PIDTYPE_PID (Waiman Long) [1838799]
- [vfio] vfio/pci: Fix SR-IOV VF handling with MMIO blocking (Alex Williamson) [1820632] {CVE-2020-12888}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1159.el7]
changelog:
- [kernel] modsign: Import certificates from optional MokListRT (Lenny Szubowicz) [1862840]
- [crypto] crypto/pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862840]
- [crypto] crypto/pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1862840]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.el7]
changelog:
- [kernel] modsign: Add nomokvarconfig kernel parameter (Lenny Szubowicz) [1867857]
- [firmware] modsign: Add support for loading certs from the EFI MOK config table (Lenny Szubowicz) [1867857]
- [kernel] modsign: Move import of MokListRT certs to separate routine (Lenny Szubowicz) [1867857]
- [kernel] modsign: Avoid spurious error message after last MokListRTn (Lenny Szubowicz) [1867857]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.1.1.el7]
changelog:
- [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1869751]
- [scsi] scsi: ses: don't ask for diagnostic pages repeatedly during probe (Maurizio Lombardi) [1855324]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.2.el7]
changelog:
- [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
- [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.16.1.el7]
changelog:
- [tty] Fix ->pgrp locking in tiocspgrp() (Chris von Recklinghausen) [1908193] {CVE-2020-29661}
- [net] fix struct pid memory leak (Jay Shin) [1901797]
- [hid] Fix assumption that devices have inputs (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
- [hid] microsoft: the driver now neeed MEMLESS_FF infrastructure (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
- [hid] microsoft: Add rumble support for Xbox One S controller (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
- [hid] microsoft: Convert private data to be a proper struct (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
- [hid] revert "hid: microsoft: fix invalid rdesc for 3k kbd" (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
- [hid] input: ignore System Control application usages if not System Controls (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
- [hid] hid-microsoft: Do the check for the ms usage page per device (Chris von Recklinghausen) [1821870] {CVE-2019-19532}
- [net] net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc (Antoine Tenart) [1903819]
- [net] net-sysfs: take the rtnl lock when storing xps_cpus (Antoine Tenart) [1903819]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.17.1.el7]
changelog:
- [x86] kvm: svm: Initialize prev_ga_tag before use ("Dr. David Alan Gilbert") [1909036]
- [scsi] scsi_dh: fix scheduling while atomic and also missing unlock in error path (Mike Snitzer) [1619147]
- [video] hyperv_fb: Fix the cache type when mapping the VRAM (Mohammed Gamal) [1908896]
- [video] hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (Mohammed Gamal) [1908896]
- [scsi] target: iscsi: Fix cmd abort fabric stop race (Maurizio Lombardi) [1784540]
- [scsi] target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock (Maurizio Lombardi) [1784540]
- [s390] kernel/uv: handle length extension properly (Claudio Imbrenda) [1899172]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.18.1.el7]
changelog:
- [fs] nfs: Fix security label length not being reset (Dave Wysochanski) [1917504]
- [target] scsi: Fix XCOPY NAA identifier lookup (Maurizio Lombardi) [1900469] {CVE-2020-28374}
- [ipc] sem.c: fully initialize sem_array before making it visible (Vladis Dronov) [1877264]
- [netdrv] geneve: add transport ports in route lookup for geneve (Sabrina Dubroca) [1885144] {CVE-2020-25645}
- [kernel] perf/core: Fix race in the perf_mmap_close() function (Michael Petlan) [1869936] {CVE-2020-14351}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.19.1.el7]
changelog:
- [kernel] watchdog: use nmi registers snapshot in hardlockup handler (Prarit Bhargava) [1916589]
- [nvme] nvmet: allow Keep Alive for Discovery controller (Gopal Tiwari) [1910817]
- [net] netfilter: ctnetlink: add a range check for l3/l4 protonum (Florian Westphal) [1888296] {CVE-2020-25211}
- [net] icmp: randomize the global rate limiter (Antoine Tenart) [1896515] {CVE-2020-25705}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.20.1.el7]
changelog:
- [md] Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1889372]
- [md] improve variable names in md_flush_request() (Xiao Ni) [1889372]
- [kernel] timer: Fix potential bug in requeue_timers() (Waiman Long) [1914011]
- [x86] kvm: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Vitaly Kuznetsov) [1890669]
- [x86] kvm: avoid incorrect writes to host MSR_IA32_SPEC_CTRL (Vitaly Kuznetsov) [1890669]
- [md] dm-mirror: fix a crash if the underlying block device doesn't have merge_bvec_fn (Mikulas Patocka) [1916407]
- [gpu] drm/i915: Fix use-after-free when destroying GEM context (Dave Airlie) [1814731] {CVE-2020-7053}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.21.1.el7]
changelog:
- [pinctrl] devicetree: Avoid taking direct reference to device name string (Aristeu Rozanski) [1922902] {CVE-2020-0427}
- [pinctrl] Delete an error message (Aristeu Rozanski) [1922902] {CVE-2020-0427}
- [tty] vt: keyboard, reorder user buffer handling in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
- [tty] vt: keyboard, rename i to kb_func in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
- [tty] vt: keyboard, extend func_buf_lock to readers (Aristeu Rozanski) [1896775] {CVE-2020-25656}
- [tty] vt: keyboard, simplify vt_kdgkbsent (Aristeu Rozanski) [1896775] {CVE-2020-25656}
- [tty] keyboard, do not speculate on func_table index (Aristeu Rozanski) [1896775] {CVE-2020-25656}
- [tty] vt: fix write/write race in ioctl(KDSKBSENT) handler (Aristeu Rozanski) [1896775] {CVE-2020-25656}
- [iommu] amd: return error on real irq alloc failure (Jerry Snitselaar) [1918273]
- [iommu] amd: Set DTE[IntTabLen] to represent 512 IRTEs (Jerry Snitselaar) [1921187]
- [iommu] amd: Increase interrupt remapping table limit to 512 entries (Jerry Snitselaar) [1921187]
- [scsi] lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1875961]
- [scsi] lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1875961]
- [scsi] lpfc: Fix ADISC reception terminating login state if a NVME target (Dick Kennedy) [1875961]
- [netdrv] i40e: revert "i40e: don't report link up for a VF who hasn't enabled queues" (Stefan Assmann) [1901064]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.22.1.el7]
changelog:
- mm: do not stall register_shrinker() (Rafael Aquini) [1926043]
- sched/rt: Fix PI handling vs. sched_setscheduler() (Phil Auld) [1928082]
- sched/rt: Simplify pull_rt_task() logic and remove .leaf_rt_rq_list (Phil Auld) [1928082]
- sched: Queue RT tasks to head when prio drops (Phil Auld) [1928082]
- sched/core: Use READ_ONCE()/WRITE_ONCE() in move_queued_task()/task_rq_lock() (Phil Auld) [1928082]
- mmc: block: handle complete_work on separate workqueue (Ming Lei) [1918916]
- tcp: fix to update snd_wl1 in bulk receiver fast path (Vladis Dronov) [1929804]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.23.1.el7]
changelog:
- tcm_loop: add WQ_MEM_RECLAIM and flush_work (Maurizio Lombardi) [1925652]
- net/mlx4_en: Handle TX error CQE (Alaa Hleihel) [1925691]
- net/mlx4_en: Avoid scheduling restart task if it is already running (Alaa Hleihel) [1925691]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.24.1.el7]
changelog:
- scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930826] {CVE-2021-27365}
- scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930849] {CVE-2021-27363}
- scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930807] {CVE-2021-27364}
- redhat: add CI file for kernel-private (Bruno Meneguele)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.25.1.el7]
changelog:
- redhat: Enable CKI RT verification for kernel-private (Juri Lelli)
- redhat: Enable CKI RT verification (Juri Lelli)
- RDMA/ipoib: Remove racy Subnet Manager sendonly join checks (Honggang Li) [1922460]
- net: sched: protect against stack overflow in TC act_mirred (Davide Caratti) [1916682]
- floppy: check_events callback should not return a negative number (Jay Shin) [1928576]
- floppy: fix lock_fdc() signal handling (Jay Shin) [1928576]
- ipv6: clean up anycast when an interface is destroyed (Xin Long) [1917700]
- virtio_net: fix virtnet_open and virtnet_probe competing for try_fill_recv (Laurent Vivier) [1895319]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.26.1.el7]
changelog:
- selinux: fix deadlock in security_set_bools() (Ondrej Mosnacek) [1939091]
- md: fix md io stats accounting broken (Ming Lei) [1927106]
- redhat: Fix realtime_check for -private (Juri Lelli)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.27.1.el7]
changelog:
- video: hyperv: hyperv_fb: Obtain screen resolution from Hyper-V host (Mohammed Gamal) [1941841]
- Drivers: hv: vmbus: enable VMBus protocol version 5.0 (Mohammed Gamal) [1941841]
- redhat: Add git suffix to realtime_check merge_tree (Juri Lelli)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.28.1.el7]
changelog:
- i40e: acquire VSI pointer only after VF is initialized (Stefan Assmann) [1886003]
- ACPICA: Store GPE register enable masks upfront (Al Stone) [1883174]
- netfilter: nf_tables: validate NFTA_SET_TABLE parameter (Phil Sutter) [1873171]
- sctp: change to hold/put transport for proto_unreach_timer (Xin Long) [1707184]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.29.1.el7]
changelog:
- drm/i915: warn on guc enable about CVE (Dave Airlie) [1935277] {CVE-2020-12362}
- sched: prevent divide by zero error in scale_rt_power() (Phil Auld) [1910763]
- x86/efi: reset the correct tlb_state in efi_switch_mm() (Rafael Aquini) [1837531]
- x86/mm, sched/core: Turn off IRQs in switch_mm() (Rafael Aquini) [1837531]
- x86/mm, sched/core: Uninline switch_mm() (Rafael Aquini) [1837531]
- x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Rafael Aquini) [1837531]
- hpsa: fix regression issue for old controllers (Joseph Szczypek) [1830268]
- scsi: hpsa: Correct dev cmds outstanding for retried cmds (Joseph Szczypek) [1830268]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.30.1.el7]
changelog:
- pf: Prohibit alu ops for pointer types not defining ptr_limit (Jiri Olsa) [1942689] {CVE-2020-27170}
- bpf: Add sanity check for upper ptr_limit (Jiri Olsa) [1942689] {CVE-2020-27170}
- bpf: Simplify alu_limit masking for pointer arithmetic (Jiri Olsa) [1942689] {CVE-2020-27170}
- bpf: Fix off-by-one for area size in creating mask to left (Jiri Olsa) [1942689] {CVE-2020-27170}
- netxen_nic: fix MSI/MSI-x interrupts (Tony Camuso) [1894274]
- block: fix use-after-free on cached last_lookup partition (Ming Lei) [1898596]
- mm: reduce struct page_cgroup overhead when page_owner is not enabled (Rafael Aquini) [1948451]
- vt: selection, close sel_buffer race (Chris von Recklinghausen) [1831034] {CVE-2020-8648}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.31.1.el7]
changelog:
- mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() (Philipp Rudo) [1917840]
- scsi: qla2xxx: Fix the call trace for flush workqueue (Nilesh Javali) [1937945]
- futex: Handle faults correctly for PI futexes (Donghai Qiao) [1935108] {CVE-2021-3347}
- futex: Provide and use pi_state_update_owner() (Donghai Qiao) [1935108] {CVE-2021-3347}
- futex: Replace pointless printk in fixup_owner() (Donghai Qiao) [1935108] {CVE-2021-3347}
- futex: Ensure the correct return value from futex_lock_pi() (Donghai Qiao) [1935108] {CVE-2021-3347}
- scsi: qla2xxx: Remove WARN_ON_ONCE in qla2x00_status_cont_entry() (Nilesh Javali) [1933784]
- scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path (Philipp Rudo) [1917839]
- net: netfilter: Avoid deadlock when loading logger backend (Phil Sutter) [1858329]
- net: netfilter: Link nfnetlink into bzImage (Phil Sutter) [1858329]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.32.1.el7]
changelog:
- Bluetooth: verify AMP hci_chan before amp_destroy (Gopal Tiwari) [1962532] {CVE-2021-33034}
- net: ipv4: route: Fix sending IGMP messages with link address (Hangbin Liu) [1958339]
- hv_netvsc: remove ndo_poll_controller (Mohammed Gamal) [1953075]
- Fix double free in nvme_trans_log_temperature (Gopal Tiwari) [1946793]
- rcu: Call touch_nmi_watchdog() while printing stall warnings (Artem Savkov) [1924688]
- sched/fair: Use RCU accessors consistently for ->numa_group (Rafael Aquini) [1915635] {CVE-2019-20934}
- sched/fair: Don't free p->numa_faults with concurrent readers (Rafael Aquini) [1915635] {CVE-2019-20934}
- sched/numa: Simplify task_numa_compare() (Rafael Aquini) [1915635] {CVE-2019-20934}
- sched/numa: Fix task_numa_free() lockdep splat (Rafael Aquini) [1915635] {CVE-2019-20934}
- sched/numa: Move task_numa_free() to __put_task_struct() (Rafael Aquini) [1915635] {CVE-2019-20934}
- [s390] s390/dasd: fix diag 0x250 inline assembly (Philipp Rudo) [1910395]
- vsock/vmci: log once the failed queue pair allocation (Stefano Garzarella) [1892237]
- VMCI: Stop log spew when qp allocation isn't possible (Stefano Garzarella) [1892237]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.33.1.el7]
changelog:
- CI: Disable result checking for realtime check (Veronika Kabatova)
- CI: Explicitly disable result checking for private CI (Veronika Kabatova)
- CI: Rename variable (Veronika Kabatova)
- mm: memcontrol: switch to rcu protection in drain_all_stock() (Waiman Long) [1957719]
- sctp: Don't add the shutdown timer if its already been added (Xin Long) [1953052]
- media: xirlink_cit: add missing descriptor sanity checks (Mark Langsdorf) [1826877] {CVE-2020-11668}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.34.1.el7]
changelog:
- futex: remove lockdep_assert_held() in pi_state_update_owner() (Donghai Qiao) [1965495]
- video: hyperv_fb: Add ratelimit on error message (Mohammed Gamal) [1957803]
- Drivers: hv: vmbus: Increase wait time for VMbus unload (Mohammed Gamal) [1957803]
- Drivers: hv: vmbus: Initialize unload_event statically (Mohammed Gamal) [1957803]
- blk-mq: always allow reserved allocation in hctx_may_queue (Ming Lei) [1926825]
- s390/pci: fix out of bounds access during irq setup (Philipp Rudo) [1917943]
- s390/pci: improve irq number check for msix (Philipp Rudo) [1917943]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.35.1.el7]
changelog:
- CI: Merge configuration (Veronika Kabatova)
- [pci/aer] Work around use-after-free in pcie_do_fatal_recovery() (Al Stone) [1933663]
- [pci/aer] do not invoke error recovery with non-fatal errors (Al Stone) [1933663]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.36.1.el7]
changelog:
- cipso,calipso: resolve a number of problems with the DOI refcounts (Antoine Tenart) [1967720]
- net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() (Alaa Hleihel) [1962406]
- sched/debug: Fix cgroup_path[] serialization (Waiman Long) [1912221]
- sched/debug: Reset watchdog on all CPUs while processing sysrq-t (Waiman Long) [1912221]
- vt: vt_ioctl: fix use-after-free in vt_in_use() (Vladis Dronov) [1872778]
- vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console (Vladis Dronov) [1872778]
- vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines (Vladis Dronov) [1872778]
- vt: selection, introduce vc_is_sel (Vladis Dronov) [1872778]
- redhat: genspec: generate changelog entries since last release (Augusto Caringi)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.37.1.el7]
changelog:
- bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971457]
- net: Update window_clamp if SOCK_RCVBUF is set (Balazs Nemeth) [1962196]
- bpf, x86: Validate computation of branch displacements for x86-64 (Jiri Olsa) [1947249] {CVE-2021-29154}
- mm: vmalloc: add cond_resched() in __vunmap() (Rafael Aquini) [1896794]
- mm/vmalloc: __vmalloc_area_node(): avoid 32-bit overflow (Rafael Aquini) [1896794]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.38.1.el7]
changelog:
- seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975251]
- memcg, slab: Fix incorrect placement of rcu_head in struct memcg_cache_params (Waiman Long) [1951810]
- netfilter: x_tables: Use correct memory barriers. (Phil Sutter) [1949087] {CVE-2021-29650}
- netfilter: nf_nat: don't bug when mapping already exists (Florian Westphal) [1972970]
- netfilter: don't setup nat info for confirmed ct (Florian Westphal) [1972970]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.39.1.el7]
changelog:
- netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980489] {CVE-2021-22555}
- Revert "be2net: disable bh with spin_lock in be_process_mcc" (Petr Oros) [1971744]
- futex: futex_requeue can potentially free the pi_state structure twice (Donghai Qiao) [1966856]
- xfs: sync lazy sb accounting on quiesce of read-only mounts (Carlos Maiolino) [1921551]
- scsi: lpfc: Fix crash caused by switch reboot (Dick Kennedy) [1897576]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.40.1.el7]
changelog:
- redhat: ppc64: CONFIG_RTAS_FILTER (Aristeu Rozanski) [1906443] {CVE-2020-27777}
- powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter (Aristeu Rozanski) [1906443] {CVE-2020-27777}
- powerpc/rtas: Restrict RTAS requests from userspace (Aristeu Rozanski) [1906443] {CVE-2020-27777}
- IB/mlx5: Fix initializing CQ fragments buffer (Alaa Hleihel) [1962499]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.42.1.el7]
changelog:
- [s390] s390/dasd: fix list corruption of lcu list (Claudio Imbrenda) [1889418]
- [s390] s390/dasd: fix list corruption of pavgroup group list (Claudio Imbrenda) [1889418]
- [s390] s390/dasd: prevent inconsistent LCU device data (Claudio Imbrenda) [1889418]
- [s390] s390/dasd: fix hanging device offline processing (Claudio Imbrenda) [1889418]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.43.1.el7]
changelog:
- PCI: hv: Add support for protocol 1.3 and support PCI_BUS_RELATIONS2 (Mohammed Gamal) [1984128]
- PCI: hv: Decouple the func definition in hv_dr_state from VSP message (Mohammed Gamal) [1984128]
- PCI: hv: Only queue new work items in hv_pci_devices_present() if necessary (Mohammed Gamal) [1984128]
- i40e: improve locking of mac_filter_hash (Stefan Assmann) [1993850]
- i40e: always propagate error value in i40e_set_vsi_promisc() (Stefan Assmann) [1993850]
- i40e: fix return of uninitialized aq_ret in i40e_set_vsi_promisc (Stefan Assmann) [1993850]
- i40e: Remove scheduling while atomic possibility (Stefan Assmann) [1993850]
- scsi: lpfc: Fix pt2pt discovery on SLI3 HBAs (Dick Kennedy) [1922479]
- qed: Disable "MFW indication via attention" SPAM every 5 minutes (Manish Chopra) [1854544]
- NFS: Fix a performance regression caused by buffered IO locking (Benjamin Coddington) [1995649]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.44.1.el7]
changelog:
- fs: dlm: change handling of reconnects (Bob Peterson) [1834878]
- DLM: fix NULL pointer dereference in send_to_sock() (Bob Peterson) [1834878]
- DLM: fix to reschedule rwork (Bob Peterson) [1834878]
- DLM: fix to use sk_callback_lock correctly (Bob Peterson) [1834878]
- DLM: fix overflow dlm_cb_seq (Bob Peterson) [1834878]
- DLM: fix conversion deadlock when DLM_LKF_NODLCKWT flag is set (Bob Peterson) [1834878]
- DLM: use CF_CLOSE flag to stop dlm_send correctly (Bob Peterson) [1834878]
- DLM: Reanimate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
- DLM: fix race condition between dlm_recoverd_stop and dlm_recoverd (Bob Peterson) [1834878]
- DLM: close othercon at send/receive error (Bob Peterson) [1834878]
- DLM: retry rcom when dlm_wait_function is timed out. (Bob Peterson) [1834878]
- DLM: fix to use sock_mutex correctly in xxx_accept_from_sock (Bob Peterson) [1834878]
- DLM: fix race condition between dlm_send and dlm_recv (Bob Peterson) [1834878]
- DLM: fix double list_del() (Bob Peterson) [1834878]
- DLM: Eliminate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
- KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975511]
- vxlan: check return value of gro_cells_init() (Aristeu Rozanski) [1970618]
- KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988218] {CVE-2021-37576}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.45.1.el7]
changelog:
- CI: handle RT branches in a single config (Veronika Kabatova)
- CI: Drop private CI config (Veronika Kabatova)
- CI: extend template use (Veronika Kabatova)
- mm: page_counter: mitigate consequences of a page_counter underflow (Scott Wood) [2000973]
- KVM: nSVM: always intercept VMLOAD/VMSAVE when nested(CVE-2021-3656) (Jon Maloy) [1985425] {CVE-2021-3656}
- KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted (Marcelo Tosatti) [1991856]
- KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985408] {CVE-2021-3653}
- scsi: qedf: Initiate cleanup for ELS commands as well (Nilesh Javali) [1982702]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.46.1.el7]
changelog:
- RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy (Kamal Heib) [1978075] {CVE-2020-36385}
- RDMA/ucma: Fix locking for ctx->events_reported (Kamal Heib) [1978075] {CVE-2020-36385}
- RDMA/ucma: Fix the locking of ctx->file (Kamal Heib) [1978075] {CVE-2020-36385}
- RDMA/cma: Add missing locking to rdma_accept() (Kamal Heib) [1978075] {CVE-2020-36385}
- RDMA/ucma: Add missing locking around rdma_leave_multicast() (Kamal Heib) [1978075] {CVE-2020-36385}
- RDMA/ucma: Put a lock around every call to the rdma_cm layer (Kamal Heib) [1978075] {CVE-2020-36385}
- nvme-pci: Unblock reset_work on IO failure (Gopal Tiwari) [1981610]
- nvme-pci: Don't disable on timeout in reset state (Gopal Tiwari) [1981610]
- nvme-pci: shutdown on timeout during deletion (Gopal Tiwari) [1981610]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.47.1.el7]
changelog:
- PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus (Mohammed Gamal) [1948961]
- PCI: hv: Remove bus device removal unused refcount/functions (Mohammed Gamal) [1948961]
- PCI: hv: Fix a race condition when removing the device (Mohammed Gamal) [1948961]
- scsi: qla2xxx: Fix use after free in eh_abort path (Nilesh Javali) [1899599]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.48.1.el7]
changelog:
- scsi: qedf: Add check to synchronize abort and flush (Nilesh Javali) [1941766]
- scsi: ibmvfc: Reinit target retries (Desnes A. Nunes do Rosario) [1882627]
- scsi: ibmvfc: Avoid move login if fast fail is enabled (Desnes A. Nunes do Rosario) [1882627]
- scsi: ibmvfc: Handle move login failure (Desnes A. Nunes do Rosario) [1882627]
- scsi: ibmvfc: Avoid link down on FS9100 canister reboot (Desnes A. Nunes do Rosario) [1882627]
- scsi: ibmvfc: don't check for failure from mempool_alloc() (Desnes A. Nunes do Rosario) [1882627]
- scsi: ibmvfc: Use compiler attribute defines instead of __attribute__() (Desnes A. Nunes do Rosario) [1882627]
- scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info (Desnes A. Nunes do Rosario) [1882627]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.50.1.el7]
changelog:
- tcp: grow window for OOO packets only for SACK flows (Guillaume Nault) [1990665]
- scsi: mpt3sas: Fix unlock imbalance (Tomas Henzl) [2006536]
- pci-hyperv: Fix setting CPU affinity on Azure (Vitaly Kuznetsov) [2019272]
- media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt() (Lucas Zampieri) [1956471] {CVE-2021-42739}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.51.1.el7]
changelog:
- mm, fs: Fix do_generic_file_read() error return (Carlos Maiolino) [2020857]
- perf/core: Fix a memory leak in perf_event_parse_addr_filter() (Michael Petlan) [1901932]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.52.1.el7]
changelog:
- acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (David Arcari) [2019588]
- x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (David Arcari) [2019218]
- x86/cpu/AMD: Fix erratum 1076 (CPB bit) (David Arcari) [2019218]
- i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps (Stefan Assmann) [1977246]
- i40e: Fix virtchnl_queue_select bitmap validation (Stefan Assmann) [1977246]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.53.1.el7]
changelog:
- fuse: fix live lock in fuse_iget() (Miklos Szeredi) [1952046]
- fuse: fix bad inode (Miklos Szeredi) [1952046]
- GFS2: Truncate address space mapping when deleting an inode (Bob Peterson) [1364234]
- gfs2: Fix gfs2_testbit to use clone bitmaps (Bob Peterson) [1364234]
- gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps (Bob Peterson) [1364234]
- gfs2: Fix oversight in gfs2_ail1_flush (Bob Peterson) [1364234]
- gfs2: Additional information when gfs2_ail1_flush withdraws (Bob Peterson) [1364234]
- gfs2: leaf_dealloc needs to allocate one more revoke (Bob Peterson) [1364234]
- gfs2: allow journal replay to hold sd_log_flush_lock (Bob Peterson) [1364234]
- gfs2: don't allow releasepage to free bd still used for revokes (Bob Peterson) [1364234]
- gfs2: flesh out delayed withdraw for gfs2_log_flush (Bob Peterson) [1364234]
- gfs2: Do proper error checking for go_sync family of glops functions (Bob Peterson) [1364234]
- gfs2: drain the ail2 list after io errors (Bob Peterson) [1364234]
- gfs2: Withdraw in gfs2_ail1_flush if write_cache_pages fails (Bob Peterson) [1364234]
- gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty (Bob Peterson) [1364234]
- gfs2: Check for log write errors before telling dlm to unlock (Bob Peterson) [1364234]
- gfs2: Prepare to withdraw as soon as an IO error occurs in log write (Bob Peterson) [1364234]
- gfs2: Issue revokes more intelligently (Bob Peterson) [1364234]
- gfs2: Add verbose option to check_journal_clean (Bob Peterson) [1364234]
- gfs2: fix infinite loop when checking ail item count before go_inval (Bob Peterson) [1364234]
- gfs2: Force withdraw to replay journals and wait for it to finish (Bob Peterson) [1364234]
- gfs2: Allow some glocks to be used during withdraw (Bob Peterson) [1364234]
- gfs2: move check_journal_clean to util.c for future use (Bob Peterson) [1364234]
- gfs2: Ignore dlm recovery requests if gfs2 is withdrawn (Bob Peterson) [1364234]
- gfs2: Only complain the first time an io error occurs in quota or log (Bob Peterson) [1364234]
- gfs2: log error reform (Bob Peterson) [1364234]
- gfs2: Rework how rgrp buffer_heads are managed (Bob Peterson) [1364234]
- gfs2: clear ail1 list when gfs2 withdraws (Bob Peterson) [1364234]
- gfs2: Introduce concept of a pending withdraw (Bob Peterson) [1364234]
- gfs2: Return bool from gfs2_assert functions (Bob Peterson) [1364234]
- gfs2: Turn gfs2_consist into void functions (Bob Peterson) [1364234]
- gfs2: Remove usused cluster_wide arguments of gfs2_consist functions (Bob Peterson) [1364234]
- gfs2: Report errors before withdraw (Bob Peterson) [1364234]
- gfs2: Split gfs2_lm_withdraw into two functions (Bob Peterson) [1364234]
- gfs2: Fix incorrect variable name (Bob Peterson) [1364234]
- gfs2: Don't write log headers after file system withdraw (Bob Peterson) [1364234]
- gfs2: clean up iopen glock mess in gfs2_create_inode (Bob Peterson) [1364234]
- gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS (Bob Peterson) [1364234]
- gfs2: fix infinite loop in gfs2_ail1_flush on io error (Bob Peterson) [1364234]
- gfs2: Introduce function gfs2_withdrawn (Bob Peterson) [1364234]
- gfs2: replace more printk with calls to fs_info and friends (Bob Peterson) [1364234]
- gfs2: dump fsid when dumping glock problems (Bob Peterson) [1364234]
- gfs2: simplify gfs2_freeze by removing case (Bob Peterson) [1364234]
- gfs2: Rename SDF_SHUTDOWN to SDF_WITHDRAWN (Bob Peterson) [1364234]
- gfs2: Warn when a journal replay overwrites a rgrp with buffers (Bob Peterson) [1364234]
- gfs2: log which portion of the journal is replayed (Bob Peterson) [1364234]
- gfs2: slow the deluge of io error messages (Bob Peterson) [1364234]
- gfs2: Don't withdraw under a spin lock (Bob Peterson) [1364234]
- GFS2: Clear gl_object when deleting an inode in gfs2_delete_inode (Bob Peterson) [1364234]
- gfs2: Use fs_* functions instead of pr_* function where we can (Bob Peterson) [1364234]
- GFS2: Use pr_<level> more consistently (Bob Peterson) [1364234]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.54.1.el7]
changelog:
- block: queue lock must be acquired when iterating over rls (Ming Lei) [2029574]
- Bluetooth: use correct lock to prevent UAF of hdev object (Chris von Recklinghausen) [1968211] {CVE-2021-3573}
- xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Carlos Maiolino) [2034857] {CVE-2021-4155}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.55.1.el7]
changelog:
- SUNRPC: Fix null rpc_clnt dereference in rpc_task_queued tracepoint (Benjamin Coddington) [2039508]
- buffer: eliminate the need to call free_more_memory() in __getblk_slow() (Carlos Maiolino) [2030609]
- buffer: grow_dev_page() should use __GFP_NOFAIL for all cases (Carlos Maiolino) [2030609]
- buffer: have alloc_page_buffers() use __GFP_NOFAIL (Carlos Maiolino) [2030609]
- net: add READ_ONCE() annotation in __skb_wait_for_more_packets() (Sabrina Dubroca) [2033561]
- efi: Decode IA32/X64 Context Info structure (Aristeu Rozanski) [1950302]
- efi: Decode IA32/X64 MS Check structure (Aristeu Rozanski) [1950302]
- efi: Decode additional IA32/X64 Bus Check fields (Aristeu Rozanski) [1950302]
- efi: Decode IA32/X64 Cache, TLB, and Bus Check structures (Aristeu Rozanski) [1950302]
- efi: Decode UEFI-defined IA32/X64 Error Structure GUIDs (Aristeu Rozanski) [1950302]
- efi: Decode IA32/X64 Processor Error Info Structure (Aristeu Rozanski) [1950302]
- efi: Decode IA32/X64 Processor Error Section (Aristeu Rozanski) [1950302]
- efi: Fix IA32/X64 Processor Error Record definition (Aristeu Rozanski) [1950302]
- HID: core: Sanitize event code and type when mapping input (Aristeu Rozanski) [1920848] {CVE-2020-0465}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.56.1.el7]
changelog:
- RDMA/mlx5: Fix access to wrong pointer while performing flush due to error (Kamal Heib) [1984070]
- af_unix: fix garbage collect vs MSG_PEEK (William Zhao) [2031970] {CVE-2021-0920}
- selinux: fix race condition when computing ocontext SIDs (Ondrej Mosnacek) [2040196]
- Bluetooth: fix the erroneous flush_work() order (Chris von Recklinghausen) [1964556] {CVE-2021-3564}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.57.1.el7]
changelog:
- fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [2042760] {CVE-2020-0466}
- epoll: Keep a reference on files added to the check list (Carlos Maiolino) [2042760] {CVE-2020-0466}
- drm/i915: Flush TLBs before releasing backing store (Dave Airlie) [2044319] {CVE-2022-0330}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.58.1.el7]
changelog:
- Bluetooth: fix use-after-free error in lock_sock_nested() (Gopal Tiwari) [2005687]
- drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047597] {CVE-2022-22942}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.60.1.el7]
changelog:
- svcrdma: Fix leak of svc_rdma_recv_ctxt objects (Benjamin Coddington) [2028740]
- sunrpc: Remove unneeded pointer dereference (Benjamin Coddington) [2028740]
- x86/platform/uv: Add more to secondary CPU kdump info (Frank Ramsay) [2042462]
- [s390] s390/AP: support new dynamic AP bus size limit (Claudio Imbrenda) [1997156]
- CI: Enable baseline realtime checks (Veronika Kabatova)
- CI: Rename pipelines to include release names (Veronika Kabatova)
- RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032075] {CVE-2021-4028}
- fget: clarify and improve __fget_files() implementation (Miklos Szeredi) [2032478] {CVE-2021-4083}
- fget: check that the fd still exists after getting a ref to it (Miklos Szeredi) [2032478] {CVE-2021-4083}
- net: Set fput_needed iff FDPUT_FPUT is set (Miklos Szeredi) [2032478] {CVE-2021-4083}
- vfs, fdtable: Add fget_task helper (Miklos Szeredi) [2032478] {CVE-2021-4083}
- fs: add fget_many() and fput_many() (Miklos Szeredi) [2032478] {CVE-2021-4083}
- fs/file.c: __fget() and dup2() atomicity rules (Miklos Szeredi) [2032478] {CVE-2021-4083}
- vfs: Don't let __fdget_pos() get FMODE_PATH files (Miklos Szeredi) [2032478] {CVE-2021-4083}
- get rid of fget_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
- sockfd_lookup_light(): switch to fdget^W^Waway from fget_light (Miklos Szeredi) [2032478] {CVE-2021-4083}
- fs: __fget_light() can use __fget() in slow path (Miklos Szeredi) [2032478] {CVE-2021-4083}
- fs: factor out common code in fget_light() and fget_raw_light() (Miklos Szeredi) [2032478] {CVE-2021-4083}
- fs: factor out common code in fget() and fget_raw() (Miklos Szeredi) [2032478] {CVE-2021-4083}
- introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty() (Miklos Szeredi) [2032478] {CVE-2021-4083}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.61.1.el7]
changelog:
- x86/efi: reset the correct tlb_state when returning from efi_switch_mm() (Rafael Aquini) [2055587]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.62.1.el7]
changelog:
- cifs: fix handling of DFS links where we can not access all components (Ronnie Sahlberg) [1937304]
- redhat: kernel.spec: install new kernel boot entry in posttrans, not post (Denys Vlasenko) [1893756]
- [s390] s390/cpumf: Support for CPU Measurement Facility CSVN 7 (Mete Durlu) [2048920]
- dm table: fix iterate_devices based device capability checks (Mike Snitzer) [2054743]
- buffer: eliminate the need to call free_more_memory() in __getblk_slow() (Carlos Maiolino) [2030609]
- buffer: grow_dev_page() should use __GFP_NOFAIL for all cases (Carlos Maiolino) [2030609]
- buffer: have alloc_page_buffers() use __GFP_NOFAIL (Carlos Maiolino) [2030609]
- mm: memcg: do not fail __GFP_NOFAIL charges (Rafael Aquini) [2054345]
- mm: filemap: do not drop action modifier flags from the gfp_mask passed to __add_to_page_cache_locked() (Rafael Aquini) [2054345]
- Added ZSTREAM=yes to makefile (Lucas Zampieri)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.63.1.el7]
changelog:
- NFSv4: Set the connection timeout to match the lease period (Benjamin Coddington) [2066699]
- SUNRPC: Allow changing of the TCP timeout parameters on the fly (Benjamin Coddington) [2066699]
- SUNRPC: Refactor TCP socket timeout code into a helper function (Benjamin Coddington) [2066699]
- SUNRPC: Remove unused function rpc_get_timeout() (Benjamin Coddington) [2066699]
- kernel/timer: Fix incorrect assertion in requeue_timers() (Waiman Long) [2048502]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.65.1.el7]
changelog:
- CI: Remove deprecated option (Veronika Kabatova)
- RDMA/core: Fix panic when port_pkey_list isn't initialized (Kamal Heib) [2046571]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.66.1.el7]
changelog:
- net-sysfs: add check for netdevice being present to speed_show (William Zhao) [2055457]
- CI: Drop baseline runs (Veronika Kabatova)
- perf/x86/intel: Add more Icelake CPUIDs (Michael Petlan) [2072317]
- perf vendor events intel: Add Icelake V1.00 event file (Michael Petlan) [2072317]
- perf vendor events intel: Add core event list for Icelake Server (Michael Petlan) [2072317]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.67.1.el7]
changelog:
- mm/rmap.c: explicitly reset vma->anon_vma in unlink_anon_vmas() (Rafael Aquini) [1824109 2069962]
- mm/rmap.c: don't reuse anon_vma if we just want a copy (Rafael Aquini) [1824109 2069962]
- mm/mmap.c: rb_parent is not necessary in __vma_link_list() (Rafael Aquini) [1824109 2069962]
- mm/mmap.c: extract __vma_unlink_list() as counterpart for __vma_link_list() (Rafael Aquini) [1824109 2069962]
- mm/mmap.c: __vma_unlink_prev() is not necessary now (Rafael Aquini) [1824109 2069962]
- mm/mmap.c: prev could be retrieved from vma->vm_prev (Rafael Aquini) [1824109 2069962]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.68.1.el7]
changelog:
- libceph: fix potential use-after-free on linger ping and resends (Ilya Dryomov) [2088025]
- xfs: use length to balance duplicate bno buffers in perag rb_tree (Brian Foster) [2050464]
- sock: sock_dequeue_err_skb() needs hard irq safety (Kenneth Yin) [2070408]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.71.1.el7]
changelog:
- netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2093000] {CVE-2022-1966}
- netfilter: nf_tables: fix memory leak if expr init fails (Phil Sutter) [2093000]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.72.1.el7]
changelog:
- sched,perf: Fix periodic timers (Valentin Schneider) [2077346]
- sched: debug: Remove the cfs bandwidth timer_active printout (Valentin Schneider) [2077346]
- sched: Cleanup bandwidth timers (Valentin Schneider) [2077346]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.73.1.el7]
changelog:
- qede: Reduce verbosity of ptp tx timestamp (Manish Chopra) [2080646]
- RDMA/cma: Fix unbalanced cm_id reference count during address resolve (Kamal Heib) [2085425]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.75.1.el7]
changelog:
- xfs: fix up non-directory creation in SGID directories (Andrey Albershteyn) [2089360]
- x86/speculation/mmio: Print SMT warning (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- KVM: x86/speculation: Disable Fill buffer clear within guests (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/speculation/srbds: Update SRBDS mitigation selection (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- cpu/speculation: Add prototype for cpu_show_srbds() (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/speculation: Add a common function for MD_CLEAR mitigation update (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- Documentation: Add documentation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
- [s390] s390/zcrypt: use kvmalloc instead of kmalloc for 256k alloc (Mete Durlu) [2072970]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.77.1.el7]
changelog:
- net/mlx5: Add Fast teardown support (Jay Shin) [2077711]
- net/mlx5: Free IRQs in shutdown path (Jay Shin) [2077711]
- net/mlx5: Change teardown with force mode failure message to warning (Jay Shin) [2077711]
- net/mlx5: Cancel health poll before sending panic teardown command (Jay Shin) [2077711]
- net/mlx5: Add fast unload support in shutdown flow (Jay Shin) [2077711]
- net/mlx5: Expose command polling interface (Jay Shin) [2077711]
- posix-timers: Remove remaining uses of tasklist_lock (Oleg Nesterov) [2115147]
- posix-timers: Use sighand lock instead of tasklist_lock on timer deletion (Oleg Nesterov) [2115147]
- posix-cpu-timers: remove tasklist_lock in posix_cpu_clock_get() (Oleg Nesterov) [2115147]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.78.1.el7]
changelog:
- net_sched: cls_route: remove from list when handle is 0 (Davide Caratti) [2121809] {CVE-2022-2588}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.79.1.el7]
changelog:
- x86/speculation: Add LFENCE to RSB fill sequence (Rafael Aquini) [2115073] {CVE-2022-26373}
- x86/speculation: Protect against userspace-userspace spectreRSB (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/speculation: cope with spectre_v2=retpoline cmdline on retbleed-affected Intel CPUs (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- KVM: emulate: do not adjust size of fastop and setcc subroutines (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/kvm: fix FASTOP_SIZE when return thunks are enabled (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/speculation: Disable RRSBA behavior (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/kexec: Disable RET on kexec (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Add Cannon lake to RETBleed affected CPU list (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpu/amd: Enumerate BTC_NO (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/common: Stamp out the stepping madness (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpu/amd: Add Spectral Chicken (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Do IBPB fallback check only once (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Add retbleed=ibpb (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Report Intel retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Enable STIBP for JMP2RET (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Add AMD retbleed= boot parameter (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/bugs: Report AMD retbleed vulnerability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86: Add magic AMD return-thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86: Use return-thunk in asm code (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/sev: Avoid using __x86_return_thunk (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/vsyscall_emu/64: Don't use RET in vsyscall emulation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/kvm: Fix SETcc emulation for return thunks (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86,objtool: Create .return_sites (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86: Undo return-thunk damage (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/retpoline: Use -mfunction-return (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpufeatures: Move RETPOLINE flags to word 11 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- objtool: Add ELF writing capability (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86: Prepare asm files for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86: Prepare inline-asm for straight-line-speculation (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/kvm: Fix fastop function ELF metadata (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/kvm: Move kvm_fastop_exception to .fixup section (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/vdso: Fix vDSO build if a retpoline is emitted (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpufeatures: Carve out CQM features retrieval (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpufeatures: Re-tabulate the X86_FEATURE definitions (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpufeature: Move processor tracing out of scattered features (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6 (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}
- x86/alternatives: Cleanup DPRINTK macro (Rafael Aquini) [2090227] {CVE-2022-23816 CVE-2022-23825 CVE-2022-29900 CVE-2022-29901}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.80.1.el7]
changelog:
- scsi: lpfc: Fix FCP I/O flush functionality for TMF routines (Dick Kennedy) [1969988]
- scsi: lpfc: Fix illegal memory access on Abort IOCBs (Dick Kennedy) [1969988]
- NFS: Fix extra call to dput() in nfs_prime_dcache (Benjamin Coddington) [2117856]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.81.1.el7]
changelog:
- [netdrv] bnxt: don't lock the tx queue from napi poll (Jamie Bainbridge) [2110869]
- [netdrv] bnxt_en: reverse order of TX disable and carrier off (Jamie Bainbridge) [2110869]
- [netdrv] qede: confirm skb is allocated before using (Jamie Bainbridge) [2131145]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.82.1.el7]
changelog:
- net: usb: ax88179_178a: Fix packet receiving (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
- net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
- net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
- ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32 (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
- net: usb: ax88179_178a: fix packet alignment padding (Jose Ignacio Tornos Martinez) [2120504] {CVE-2022-2964}
- mm: swap: disable swap_vma_readahead for PPC64 (Rafael Aquini) [2142455]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.83.1.el7]
changelog:
- x86/sme: avoid using __x86_return_thunk (Rafael Aquini) [2122158]
- scsi: core: Simplify control flow in scmd_eh_abort_handler() (Ewan D. Milne) [2128337]
- scsi: core: Avoid leaving shost->last_reset with stale value if EH does not run (Ewan D. Milne) [2128337]
- [netdrv] i40e: Fix freeing of uninitialized misc IRQ vector (Jamie Bainbridge) [2129248]
- x86/speculation: Use generic retpoline by default on AMD (Rafael Aquini) [2062165] {CVE-2021-26401}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.84.1.el7]
changelog:
- blk-mq: fix flush-rq race (Ming Lei) [2088029]
- scsi: target: iscsi: Fix a race condition between login_work and the login thread (Maurizio Lombardi) [2154243]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.85.1.el7]
changelog:
- sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [2054037]
- sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [2054037]
- sctp: handle errors when updating asoc (Xin Long) [2054037]
- sctp: no need to check assoc id before calling sctp_assoc_set_id (Xin Long) [2054037]
- s390/topology: fix warning when disabling cpus (Tobias Huschle) [2071980]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.86.1.el7]
changelog:
- openvswitch: fix OOB access in reserve_sfa_size() (Rado Vrbovsky) [2141780] {CVE-2022-2639}
- openvswitch: fix flow actions reallocation (Rado Vrbovsky) [2141780] {CVE-2022-2639}
- gitlab-ci: use CI templates from production branch (Michael Hofmann)
- mm: prevent page_frag_alloc() from corrupting the memory (Rafael Aquini) [2141062]
- mm: Use fixed constant in page_frag_alloc instead of size + 1 (Rafael Aquini) [2141062]
- mm: page_alloc: fix ref bias in page_frag_alloc() for 1-byte allocs (Rafael Aquini) [2141062]
- x86/pat: Pass valid address to sanitize_phys() (Jeff Moyer) [1974485]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.87.1.el7]
changelog:
- Revert "openvswitch: fix flow actions reallocation" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
- Revert "openvswitch: fix OOB access in reserve_sfa_size()" (Rado Vrbovsky) [2141780] {CVE-2022-2639}
- kvm/emulate: Fix SETcc emulation function offsets with SLS (Vitaly Kuznetsov) [2143438]
- mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Rafael Aquini) [2138620] {CVE-2022-42703}
- mm, rmap: handle anon_vma_prepare() common case inline (Rafael Aquini) [2138620] {CVE-2022-42703}
- proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152565] {CVE-2022-4378}
- proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152565] {CVE-2022-4378}
- scsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts (Nilesh Javali) [2092105]
- fs: move S_ISGID stripping into the vfs_*() helpers (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
- fs: Add missing umask strip in vfs_tmpfile (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}
- fs: add mode_strip_sgid() helper (Andrey Albershteyn) [2159946] {CVE-2018-13405 CVE-2021-4037}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.88.1.el7]
changelog:
- KVM: x86: add bit to indicate correct tsc_shift (Marcelo Tosatti) [2152838]
- KVM: x86: rewrite handling of scaled TSC for kvmclock (Marcelo Tosatti) [2152838]
- KVM: x86: rename argument to kvm_set_tsc_khz (Marcelo Tosatti) [2152838]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.90.1.el7]
changelog:
- NFSv4.1: Fix open stateid recovery (Benjamin Coddington) [2156890]
- NFS: Don't open code clearing of delegation state (Benjamin Coddington) [2156890]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.92.1.el7]
changelog:
- packet: fix use-after-free in prb_retire_rx_blk_timer_expired() (Florian Westphal) [2182642]
- x86/bugs: Workaround for incorrectly set X86_BUG_RETBLEED under VMware (Waiman Long) [2189556]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1151.el7]
changelog:
- [netdrv] qede: Fix multicast mac configuration (Michal Schmidt) [1740064]
- [scsi] sd_dif: avoid incorrect ref_tag errors on 4K devices larger than 2TB (Ewan Milne) [1833528]
- [hid] HID: hiddev: do cleanup in failure of opening a device (Torez Smith) [1814257] {CVE-2019-19527}
- [hid] HID: hiddev: avoid opening a disconnected device (Torez Smith) [1814257] {CVE-2019-19527}
- [x86] x86: make mul_u64_u64_div_u64() "static inline" (Oleg Nesterov) [1845864]
- [mm] mm: page_isolation: fix potential warning from user (Rafael Aquini) [1845620]
- [s390] s390/mm: correct return value of pmd_pfn (Claudio Imbrenda) [1841106]
- [fs] fs/proc/vmcore.c:mmap_vmcore: skip non-ram pages reported by hypervisors (Lianbo Jiang) [1790799]
- [kernel] kernel/sysctl.c: ignore out-of-range taint bits introduced via kernel.tainted (Rafael Aquini) [1845356]
- [documentation] kernel: add panic_on_taint (Rafael Aquini) [1845356]
- [fs] ext4: Remove unwanted ext4_bread() from ext4_quota_write() (Lukas Czerner) [1845379]
- [scsi] scsi: sg: add sg_remove_request in sg_write ("Ewan D. Milne") [1840699] {CVE-2020-12770}
- [fs] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (Donghai Qiao) [1832062] {CVE-2020-10732}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1152.el7]
changelog:
- [nvmem] nvmem: properly handle returned value nvmem_reg_read (Vladis Dronov) [1844409]
- [mailbox] PCC: fix dereference of ERR_PTR (Vladis Dronov) [1844409]
- [kernel] futex: Unlock hb->lock in futex_wait_requeue_pi() error path (Vladis Dronov) [1844409]
- [fs] aio: fix inconsistent ring state (Jeff Moyer) [1845326]
- [vfio] vfio/mdev: make create attribute static (Vladis Dronov) [1837549]
- [vfio] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Synchronize device create/remove with parent removal (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Avoid creating sysfs remove file on stale device removal (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Improve the create/remove sequence (Vladis Dronov) [1837549]
- [vfio] treewide: Add SPDX license identifier - Makefile/Kconfig (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Avoid inline get and put parent helpers (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Fix aborting mdev child device removal if one fails (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Follow correct remove sequence (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Avoid masking error code to EBUSY (Vladis Dronov) [1837549]
- [include] vfio/mdev: Drop redundant extern for exported symbols (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Removed unused kref (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Avoid release parent reference during error path (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: Add iommu related member in mdev_device (Vladis Dronov) [1837549]
- [vfio] vfio/mdev: add static modifier to add_mdev_supported_type (Vladis Dronov) [1837549]
- [vfio] vfio: mdev: make a couple of functions and structure vfio_mdev_driver static (Vladis Dronov) [1837549]
- [char] tpm/tpm_tis: Free IRQ if probing fails (David Arcari) [1774698]
- [kernel] audit: fix a memleak caused by auditing load module (Richard Guy Briggs) [1843370]
- [kernel] audit: fix potential null dereference 'context->module.name' (Richard Guy Briggs) [1843370]
- [nvme] nvme: limit number of IO queues on Dell/Samsung config (David Milburn) [1837617]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.9.1-5
changelog:
- Apply a patch by Stephen Gallagher to patch autoconf, not configure to
  allow optflags to be passed in by build environment
- Run autoreconf before configure
- git rm obsolete patches
- Apply upstream patch to stop overriding AC_CONFIG_MACRO_DIR


author: Jakub Hrozek <jhrozek@redhat.com> - 1.10.1-1
changelog:
- New upstream release 1.10
- Obsolete upstreamed patches
- Amend the multilib patch, there's no need to patch configure since we
  are running autoreconf anyways
- https://raw.github.com/bagder/c-ares/cares-1_10_0/RELEASE-NOTES


author: Kai Engert <kaie@redhat.com> - 2017.2.16-71
changelog:
- Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
  Mozilla removed code signing trust from all CAs (rhbz#1472933)


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-76
changelog:
- Update to CKBI 2.32 from NSS 3.44
-   Removing:
-   # Certificate "Visa eCommerce Root"
-   # Certificate "AC Raiz Certicamara S.A."
-   # Certificate "TC TrustCenter Class 3 CA II"
-   # Certificate "ComSign CA"
-   # Certificate "S-TRUST Universal Root CA"
-   # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5"
-   # Certificate "Certplus Root CA G1"
-   # Certificate "Certplus Root CA G2"
-   # Certificate "OpenTrust Root CA G1"
-   # Certificate "OpenTrust Root CA G2"
-   # Certificate "OpenTrust Root CA G3"
-  Adding:
-   # Certificate "GlobalSign Root CA - R6"
-   # Certificate "OISTE WISeKey Global Root GC CA"
-   # Certificate "GTS Root R1"
-   # Certificate "GTS Root R2"
-   # Certificate "GTS Root R3"
-   # Certificate "GTS Root R4"
-   # Certificate "UCA Global G2 Root"
-   # Certificate "UCA Extended Validation Root"
-   # Certificate "Certigna Root CA"
-   # Certificate "emSign Root CA - G1"
-   # Certificate "emSign ECC Root CA - G3"
-   # Certificate "emSign Root CA - C1"
-   # Certificate "emSign ECC Root CA - C3"
-   # Certificate "Hongkong Post Root CA 3"


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-79
changelog:
- Update to CKBI 2.41 from NSS 3.53.0
-    Removing:
-     # Certificate "AddTrust Low-Value Services Root"
-     # Certificate "AddTrust External Root"
-     # Certificate "UTN USERFirst Email Root CA"
-     # Certificate "Certplus Class 2 Primary CA"
-     # Certificate "Deutsche Telekom Root CA 2"
-     # Certificate "Staat der Nederlanden Root CA - G2"
-     # Certificate "Swisscom Root CA 2"
-     # Certificate "Certinomis - Root CA"
-    Adding:
-     # Certificate "Entrust Root Certification Authority - G4"
- fix permissions on ghosted files.


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-71
changelog:
- Update to CKBI 2.48 from NSS 3.66
-    Removing:
-     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
-     # Certificate "GeoTrust Global CA"
-     # Certificate "GeoTrust Universal CA"
-     # Certificate "GeoTrust Universal CA 2"
-     # Certificate "QuoVadis Root CA"
-     # Certificate "Sonera Class 2 Root CA"
-     # Certificate "Taiwan GRCA"
-     # Certificate "GeoTrust Primary Certification Authority"
-     # Certificate "thawte Primary Root CA"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
-     # Certificate "GeoTrust Primary Certification Authority - G3"
-     # Certificate "thawte Primary Root CA - G2"
-     # Certificate "thawte Primary Root CA - G3"
-     # Certificate "GeoTrust Primary Certification Authority - G2"
-     # Certificate "VeriSign Universal Root Certification Authority"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
-     # Certificate "Trustis FPS Root CA"
-     # Certificate "EE Certification Centre Root CA"
-     # Certificate "LuxTrust Global Root 2"
-     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
-     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
-    Adding:
-     # Certificate "Microsoft ECC Root Certificate Authority 2017"
-     # Certificate "Microsoft RSA Root Certificate Authority 2017"
-     # Certificate "e-Szigno Root CA 2017"
-     # Certificate "certSIGN Root CA G2"
-     # Certificate "Trustwave Global Certification Authority"
-     # Certificate "Trustwave Global ECC P256 Certification Authority"
-     # Certificate "Trustwave Global ECC P384 Certification Authority"
-     # Certificate "NAVER Global Root Certification Authority"
-     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
-     # Certificate "GlobalSign Secure Mail Root R45"
-     # Certificate "GlobalSign Secure Mail Root E45"
-     # Certificate "GlobalSign Root R46"
-     # Certificate "GlobalSign Root E46"
-     # Certificate "GLOBALTRUST 2020"
-     # Certificate "ANF Secure Server Root CA"
-     # Certificate "Certum EC-384 CA"
-     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-71
changelog:
- Update to CKBI 2.54 from NSS 3.79
-    Removing:
-     # Certificate "GlobalSign Root CA - R2"
-     # Certificate "Cybertrust Global Root"
-     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
-    Adding:
-     # Certificate "TunTrust Root CA"
-     # Certificate "HARICA TLS RSA Root CA 2021"
-     # Certificate "HARICA TLS ECC Root CA 2021"
-     # Certificate "HARICA Client RSA Root CA 2021"
-     # Certificate "HARICA Client ECC Root CA 2021"
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
-     # Certificate "vTrus ECC Root CA"
-     # Certificate "vTrus Root CA"
-     # Certificate "ISRG Root X2"
-     # Certificate "HiPKI Root CA - G1"
-     # Certificate "Telia Root CA v2"
-     # Certificate "D-TRUST BR Root CA 1 2020"
-     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-72
changelog:
- Update to CKBI 2.54 from NSS 3.79
-    Adding:
-     # Certificate "CAEDICOM Root"
-     # Certificate "I.CA Root CA/RSA"
-     # Certificate "MULTICERT Root Certification Authority 01"
-     # Certificate "Certification Authority of WoSign G2"
-     # Certificate "CA WoSign ECC Root"
-     # Certificate "CCA India 2015 SPL"
-     # Certificate "Swedish Government Root Authority v3"
-     # Certificate "Swedish Government Root Authority v2"
-     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
-     # Certificate "OpenTrust Root CA G1"
-     # Certificate "OpenTrust Root CA G2"
-     # Certificate "OpenTrust Root CA G3"
-     # Certificate "Certplus Root CA G1"
-     # Certificate "Certplus Root CA G2"
-     # Certificate "Government Root Certification Authority"
-     # Certificate "A-Trust-Qual-02"
-     # Certificate "Thailand National Root Certification Authority - G1"
-     # Certificate "TrustCor ECA-1"
-     # Certificate "TrustCor RootCert CA-2"
-     # Certificate "TrustCor RootCert CA-1"
-     # Certificate "Certification Authority of WoSign"
-     # Certificate "CA 沃通根证书"
-     # Certificate "SSC GDL CA Root B"
-     # Certificate "SAPO Class 2 Root CA"
-     # Certificate "SAPO Class 3 Root CA"
-     # Certificate "SAPO Class 4 Root CA"
-     # Certificate "CA Disig Root R1"
-     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
-     # Certificate "ApplicationCA2 Root"
-     # Certificate "GlobalSign"
-     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
-     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
-     # Certificate "Halcom Root CA"
-     # Certificate "Swisscom Root EV CA 2"
-     # Certificate "CFCA GT CA"
-     # Certificate "Digidentity L3 Root CA - G2"
-     # Certificate "SITHS Root CA v1"
-     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
-     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
-     # Certificate "Swisscom Root CA 2"
-     # Certificate "IGC/A AC racine Etat francais"
-     # Certificate "PersonalID Trustworthy RootCA 2011"
-     # Certificate "Swedish Government Root Authority v1"
-     # Certificate "Swiss Government Root CA II"
-     # Certificate "Swiss Government Root CA I"
-     # Certificate "Network Solutions Certificate Authority"
-     # Certificate "COMODO Certification Authority"
-     # Certificate "LuxTrust Global Root"
-     # Certificate "AC1 RAIZ MTIN"
-     # Certificate "Microsoft Root Certificate Authority 2011"
-     # Certificate "CCA India 2011"
-     # Certificate "ANCERT Certificados Notariales V2"
-     # Certificate "ANCERT Certificados CGN V2"
-     # Certificate "EE Certification Centre Root CA"
-     # Certificate "DigiNotar Root CA G2"
-     # Certificate "Federal Common Policy CA"
-     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
-     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
-     # Certificate "China Internet Network Information Center EV Certificates Root"
-     # Certificate "Verizon Global Root CA"
-     # Certificate "SwissSign Silver Root CA - G3"
-     # Certificate "SwissSign Platinum Root CA - G3"
-     # Certificate "SwissSign Gold Root CA - G3"
-     # Certificate "Microsec e-Szigno Root CA 2009"
-     # Certificate "SITHS CA v3"
-     # Certificate "Certinomis - Autorité Racine"
-     # Certificate "ANF Server CA"
-     # Certificate "Thawte Premium Server CA"
-     # Certificate "Thawte Server CA"
-     # Certificate "TC TrustCenter Universal CA III"
-     # Certificate "KEYNECTIS ROOT CA"
-     # Certificate "I.CA - Standard Certification Authority, 09/2009"
-     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
-     # Certificate "VI Registru Centras RCSC (RootCA)"
-     # Certificate "CCA India 2007"
-     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
-     # Certificate "ipsCA Global CA Root"
-     # Certificate "ipsCA Main CA Root"
-     # Certificate "Actalis Authentication CA G1"
-     # Certificate "A-Trust-Qual-03"
-     # Certificate "AddTrust External CA Root"
-     # Certificate "ECRaizEstado"
-     # Certificate "Configuration"
-     # Certificate "FNMT-RCM"
-     # Certificate "StartCom Certification Authority"
-     # Certificate "TWCA Root Certification Authority"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
-     # Certificate "thawte Primary Root CA - G2"
-     # Certificate "GeoTrust Primary Certification Authority - G2"
-     # Certificate "VeriSign Universal Root Certification Authority"
-     # Certificate "thawte Primary Root CA - G3"
-     # Certificate "GeoTrust Primary Certification Authority - G3"
-     # Certificate "E-ME SSI (RCA)"
-     # Certificate "ACEDICOM Root"
-     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
-     # Certificate "Correo Uruguayo - Root CA"
-     # Certificate "CNNIC ROOT"
-     # Certificate "Common Policy"
-     # Certificate "Macao Post eSignTrust Root Certification Authority"
-     # Certificate "Staat der Nederlanden Root CA - G2"
-     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
-     # Certificate "AC Raíz Certicámara S.A."
-     # Certificate "Cisco Root CA 2048"
-     # Certificate "CA Disig"
-     # Certificate "InfoNotary CSP Root"
-     # Certificate "UCA Global Root"
-     # Certificate "UCA Root"
-     # Certificate "DigiNotar Root CA"
-     # Certificate "Starfield Services Root Certificate Authority"
-     # Certificate "I.CA - Qualified root certificate"
-     # Certificate "I.CA - Standard root certificate"
-     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
-     # Certificate "Japanese Government"
-     # Certificate "AdminCA-CD-T01"
-     # Certificate "Admin-Root-CA"
-     # Certificate "Izenpe.com"
-     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
-     # Certificate "Halcom CA FO"
-     # Certificate "Halcom CA PO 2"
-     # Certificate "Root CA"
-     # Certificate "GPKIRootCA"
-     # Certificate "ACNLB"
-     # Certificate "state-institutions"
-     # Certificate "state-institutions"
-     # Certificate "SECOM Trust Systems CO.,LTD."
-     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
-     # Certificate "D-TRUST Root Class 2 CA 2007"
-     # Certificate "D-TRUST Root Class 3 CA 2007"
-     # Certificate "SSC Root CA A"
-     # Certificate "SSC Root CA B"
-     # Certificate "SSC Root CA C"
-     # Certificate "Autoridad de Certificacion de la Abogacia"
-     # Certificate "Root CA Generalitat Valenciana"
-     # Certificate "VAS Latvijas Pasts SSI(RCA)"
-     # Certificate "ANCERT Certificados CGN"
-     # Certificate "ANCERT Certificados Notariales"
-     # Certificate "ANCERT Corporaciones de Derecho Publico"
-     # Certificate "GLOBALTRUST"
-     # Certificate "Certipost E-Trust TOP Root CA"
-     # Certificate "Certipost E-Trust Primary Qualified CA"
-     # Certificate "Certipost E-Trust Primary Normalised CA"
-     # Certificate "Cybertrust Global Root"
-     # Certificate "GlobalSign"
-     # Certificate "IGC/A"
-     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
-     # Certificate "TC TrustCenter Universal CA I"
-     # Certificate "TC TrustCenter Universal CA II"
-     # Certificate "TC TrustCenter Class 2 CA II"
-     # Certificate "TC TrustCenter Class 4 CA II"
-     # Certificate "Swisscom Root CA 1"
-     # Certificate "Microsec e-Szigno Root CA"
-     # Certificate "LGPKI"
-     # Certificate "AC RAIZ DNIE"
-     # Certificate "Common Policy"
-     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
-     # Certificate "A-Trust-nQual-03"
-     # Certificate "A-Trust-nQual-03"
-     # Certificate "CertRSA01"
-     # Certificate "KISA RootCA 1"
-     # Certificate "KISA RootCA 3"
-     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
-     # Certificate "A-CERT ADVANCED"
-     # Certificate "A-Trust-Qual-01"
-     # Certificate "A-Trust-nQual-01"
-     # Certificate "A-Trust-Qual-02"
-     # Certificate "Staat der Nederlanden Root CA"
-     # Certificate "Serasa Certificate Authority II"
-     # Certificate "TDC Internet"
-     # Certificate "America Online Root Certification Authority 2"
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
-     # Certificate "Government Root Certification Authority"
-     # Certificate "RSA Security Inc"
-     # Certificate "Public Notary Root"
-     # Certificate "GeoTrust Global CA"
-     # Certificate "GeoTrust Global CA 2"
-     # Certificate "GeoTrust Universal CA"
-     # Certificate "GeoTrust Universal CA 2"
-     # Certificate "QuoVadis Root Certification Authority"
-     # Certificate "Autoridade Certificadora Raiz Brasileira"
-     # Certificate "Post.Trust Root CA"
-     # Certificate "Microsoft Root Authority"
-     # Certificate "Microsoft Root Certificate Authority"
-     # Certificate "Microsoft Root Certificate Authority 2010"
-     # Certificate "Entrust.net Secure Server Certification Authority"
-     # Certificate "UTN-USERFirst-Object"
-     # Certificate "BYTE Root Certification Authority 001"
-     # Certificate "CISRCA1"
-     # Certificate "ePKI Root Certification Authority - G2"
-     # Certificate "ePKI EV SSL Certification Authority - G1"
-     # Certificate "AC Raíz Certicámara S.A."
-     # Certificate "SSL.com EV Root Certification Authority RSA"
-     # Certificate "LuxTrust Global Root 2"
-     # Certificate "ACA ROOT"
-     # Certificate "Security Communication ECC RootCA1"
-     # Certificate "Security Communication RootCA3"
-     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
-     # Certificate "Network Solutions RSA Certificate Authority"
-     # Certificate "Network Solutions ECC Certificate Authority"
-     # Certificate "Australian Defence Public Root CA"
-     # Certificate "SI-TRUST Root"
-     # Certificate "Halcom Root Certificate Authority"
-     # Certificate "Application CA G3 Root"
-     # Certificate "GLOBALTRUST 2015"
-     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
-     # Certificate "emSign Root CA - G2"
-     # Certificate "emSign Root CA - C2"
-     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
-     # Certificate "DigiCert CS ECC P384 Root G5"
-     # Certificate "DigiCert CS RSA4096 Root G5"
-     # Certificate "DigiCert RSA4096 Root G5"
-     # Certificate "DigiCert ECC P384 Root G5"
-     # Certificate "HARICA Code Signing RSA Root CA 2021"
-     # Certificate "HARICA Code Signing ECC Root CA 2021"
-     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-74
changelog:
- Update to CKBI 2.54 from NSS 3.79
-    Removing:
-     # Certificate "TrustCor ECA-1"
-     # Certificate "TrustCor RootCert CA-2"
-     # Certificate "TrustCor RootCert CA-1"
-     # Certificate "Network Solutions Certificate Authority"
-     # Certificate "COMODO Certification Authority"
-     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
-     # Certificate "Microsec e-Szigno Root CA 2009"
-     # Certificate "TWCA Root Certification Authority"
-     # Certificate "Izenpe.com"
-     # Certificate "state-institutions"
-     # Certificate "GlobalSign"
-     # Certificate "Common Policy"
-     # Certificate "A-Trust-nQual-03"
-     # Certificate "A-Trust-Qual-02"
-     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
-     # Certificate "Government Root Certification Authority"
-     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-71
changelog:
- Update to CKBI 2.60_v7.0.306 from NSS 3.91
-    Removing:
-     # Certificate "Camerfirma Global Chambersign Root"
-     # Certificate "Staat der Nederlanden EV Root CA"
-     # Certificate "OpenTrust Root CA G1"
-     # Certificate "Swedish Government Root Authority v1"
-     # Certificate "DigiNotar Root CA G2"
-     # Certificate "Federal Common Policy CA"
-     # Certificate "TC TrustCenter Universal CA III"
-     # Certificate "CCA India 2007"
-     # Certificate "ipsCA Global CA Root"
-     # Certificate "ipsCA Main CA Root"
-     # Certificate "Macao Post eSignTrust Root Certification Authority"
-     # Certificate "InfoNotary CSP Root"
-     # Certificate "DigiNotar Root CA"
-     # Certificate "Root CA"
-     # Certificate "GPKIRootCA"
-     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
-     # Certificate "TC TrustCenter Universal CA I"
-     # Certificate "TC TrustCenter Universal CA II"
-     # Certificate "TC TrustCenter Class 2 CA II"
-     # Certificate "TC TrustCenter Class 4 CA II"
-     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
-     # Certificate "CertRSA01"
-     # Certificate "KISA RootCA 3"
-     # Certificate "A-CERT ADVANCED"
-     # Certificate "A-Trust-Qual-01"
-     # Certificate "A-Trust-nQual-01"
-     # Certificate "Serasa Certificate Authority II"
-     # Certificate "TDC Internet"
-     # Certificate "America Online Root Certification Authority 2"
-     # Certificate "RSA Security Inc"
-     # Certificate "Public Notary Root"
-     # Certificate "Autoridade Certificadora Raiz Brasileira"
-     # Certificate "Post.Trust Root CA"
-     # Certificate "Entrust.net Secure Server Certification Authority"
-     # Certificate "ePKI EV SSL Certification Authority - G1"
-    Adding:
-     # Certificate "DigiCert TLS ECC P384 Root G5"
-     # Certificate "DigiCert TLS RSA4096 Root G5"
-     # Certificate "DigiCert SMIME ECC P384 Root G5"
-     # Certificate "DigiCert SMIME RSA4096 Root G5"
-     # Certificate "Certainly Root R1"
-     # Certificate "Certainly Root E1"
-     # Certificate "E-Tugra Global Root CA RSA v3"
-     # Certificate "E-Tugra Global Root CA ECC v3"
-     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
-     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
-     # Certificate "BJCA Global Root CA1"
-     # Certificate "BJCA Global Root CA2"
-     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
-     # Certificate "A-Trust-Root-05"
-     # Certificate "ADOCA02"
-     # Certificate "StartCom Certification Authority G2"
-     # Certificate "ATHEX Root CA"
-     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
-     # Certificate "GeoTrust Primary Certification Authority"
-     # Certificate "thawte Primary Root CA"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
-     # Certificate "America Online Root Certification Authority 1"
-     # Certificate "Juur-SK"
-     # Certificate "ComSign CA"
-     # Certificate "ComSign Secured CA"
-     # Certificate "ComSign Advanced Security CA"
-     # Certificate "Global Chambersign Root"
-     # Certificate "Sonera Class2 CA"
-     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
-     # Certificate "VeriSign, Inc."
-     # Certificate "GTE CyberTrust Global Root"
-     # Certificate "Equifax Secure Global eBusiness CA-1"
-     # Certificate "Equifax"
-     # Certificate "Class 1 Primary CA"
-     # Certificate "Swiss Government Root CA III"
-     # Certificate "Application CA G4 Root"
-     # Certificate "SSC GDL CA Root A"
-     # Certificate "GlobalSign Code Signing Root E45"
-     # Certificate "GlobalSign Code Signing Root R45"
-     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-72
changelog:
- hand merge the two 'GlobalSign ECC Root CA R4' certs together and the two 'AC RAIZ FNMT-RCM' certs together to keep p11kit from getting confused.


author: Pablo Greco <pgreco@centosproject.org>
changelog:
- Own yum vars
- Generate yum vars at build time
- Remove dist_suffix
- Fix autorelabel preset
- Fix tuned profile in system-release-cpe
- Set aarch64 tuned profile to server
- Update to 7.7


author: Pablo Greco <pgreco@centosproject.org>
changelog:
- Add rootfs-expand to aarch64
- Create generic kvariant in aarch64 if it doesn't exist (for new kernel repos)
- Own kvariant var in armhfp and aarch64
- Backport move of /etc/os-release to /usr/lib/os-release (ngompa)
- Spec file cleanup (carlwgeorge)
- Update to 7.8


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-8
changelog:
- Disable iterate-10 test which fails intermitently (#1596161)
- Add BuildRequires for running autoreconf


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-9
changelog:
- Remove patch to pass _PROXY, _proxy, LANG and LC_* environment
  variables to helpers. The root cause was a bug in IPA (#1596161)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-12
changelog:
- Add documentation for the '-N' option to the dogtag-ipa-renew-agent-submit
  man page (#1651368)
- SCEP: Don't set message=<ca ident> with GetCaps and GetCACert (#1608781)
- SCEP operation GetCAChain is not valid. Should be GetCACertChain (#1590727)
- Document owner and permission parameters to getcert (#1549585)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-17
changelog:
- certmonger creates CSRs with invalid DER syntax for X509v3 extensions
  with critical=FALSE (#2015511)


author: Miroslav Rezanina <mrezanin@redhat.com> - 18.5-5.el7
changelog:
- ci-Fix-for-network-configuration-not-persisting-after-r.patch [bz#1593010]
- Resolves: bz#1593010
  ([cloud-init][RHVM]cloud-init network configuration does not persist reboot [RHEL 7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 18.5-6.el7
changelog:
- ci-util-json.dumps-on-python-2.7-will-handle-UnicodeDec.patch [bz#1744526]
- Resolves: bz#1744526
  ([cloud-init][OpenStack] cloud-init can't persist instance-data.json)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-2.el7
changelog:
- ci-Removing-cloud-user-from-wheel.patch [bz#1549638]
- ci-Remove-race-condition-between-cloud-init-and-Network.patch [bz#1748015]
- ci-cc_set_password-increase-random-pwlength-from-9-to-2.patch [bz#1812170]
- ci-utils-use-SystemRandom-when-generating-random-passwo.patch [bz#1812173]
- ci-Enable-ssh_deletekeys-by-default.patch [bz#1574338]
- Resolves: bz#1549638
  ([RHEL7]cloud-user added to wheel group and sudoers.d causes 'sudo -v' prompts for passphrase)
- Resolves: bz#1574338
  (CVE-2018-10896 cloud-init: SSH host keys are not regenerated for the new instances [rhel-7])
- Resolves: bz#1748015
  ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
- Resolves: bz#1812170
  (CVE-2020-8632 cloud-init: Too short random password length in cc_set_password in config/cc_set_passwords.py [rhel-7])
- Resolves: bz#1812173
  (CVE-2020-8631 cloud-init: Use of random.choice when generating random password [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-3.el7
changelog:
- ci-Do-not-use-fallocate-in-swap-file-creation-on-xfs.-7.patch [bz#1772505]
- Resolves: bz#1772505
  ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-4.el7
changelog:
- ci-swap-file-size-being-used-before-checked-if-str-315.patch [bz#1772505]
- Resolves: bz#1772505
  ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-5.el7
changelog:
- ci-Remove-race-condition-between-cloud-init-and-Network-v2.patch [bz#1748015]
- ci-cc_mounts-fix-incorrect-format-specifiers-316.patch [bz#1772505]
- Resolves: bz#1748015
  ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
- Resolves: bz#1772505
  ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-6.el7
changelog:
- ci-Use-reload-or-try-restart-instead-of-try-reload-or-r.patch [bz#1748015]
- ci-ec2-Do-not-log-IMDSv2-token-values-instead-use-REDAC.patch [bz#1821999]
- Resolves: bz#1748015
  ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
- Resolves: bz#1821999
  ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-7.el7
changelog:
- ci-ec2-only-redact-token-request-headers-in-logs-avoid-.patch [bz#1821999]
- Resolves: bz#1821999
  ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Jon Maloy <jmaloy@redhat.com> - 19.4-7.el7_9.2
changelog:
- ci-When-tools.conf-does-not-exist-running-cmd-vmware-to.patch [bz#1839619]
- ci-Changing-notation-of-subp-call.patch [bz#1839619]
- ci-DHCP-sandboxing-failing-on-noexec-mounted-var-tmp-52.patch [bz#1871916]
- Resolves: bz#1839619
  ([ESXi][RHEL7.9][cloud-init]ERROR log in cloud-init.log after clone VM on ESXi platform [rhel-7.9.z])
- Resolves: bz#1871916
  ([Azure][RHEL 7.9] cloud-init Permission denied with the use of mount option noexec [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 19.4-7.el7_9.3
changelog:
- ci-network-Fix-type-and-respect-name-when-rendering-vla.patch [bz#1861871]
- Resolves: bz#1861871
- ([rhel7][cloud-init] ifup bond0.504 Error: Connection activation failed: No suitable device found for this connection [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 19.4-7.el7_9.3
changelog:
- ci-network-Fix-type-and-respect-name-when-rendering-vla.patch [bz#1861871]
- Resolves: bz#1861871
  ([rhel7][cloud-init] ifup bond0.504 Error: Connection activation failed: No suitable device found for this connection [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 19.4-7.el7_9.4
changelog:
- ci-DataSourceAzure-update-password-for-defuser-if-exist.patch [bz#1900807]
- Resolves: bz#1900807
  (Update existing user password RHEL7x)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-7.el7_9.5
changelog:
- ci-Fix-unit-failure-of-cloud-final.service-if-NetworkMa.patch [bz#1897616]
- Resolves: bz#1897616
  ([rhel-7]cloud-final.service fails if NetworkManager not installed.)


author: Jon Maloy <jmaloy@redhat.com> - 19.4-7.el7_9.6
changelog:
- ci-cloudinit-net-handle-two-different-routes-for-the-sa.patch [bz#2003231]
- Resolves: bz#2003231
  (anything above 19.2 of cloud init it fails to assign default route and connect to the meta data service)


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.2
changelog:
- Fix dmeventd crash with modified reserved_stack configuration option.
- Fix lvm crashing when .cache file is changed by external tools.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.187-6.el7_9.5
changelog:
- Fix fsadm failure due to accessing unbound variable.
- Fix segfault in vgextend when a PV is missing in the processed VG.


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-8
changelog:
+ control-center-3.26.2-8
- Fix Wi-Fi networks not getting updated
- Show "Wi-Fi disabled" page when Wi-Fi is disabled
- Resolves: #1545713


author: Jiri Vanek <jvanek@redhat.com> - 1.1-5
changelog:
- posttrans silenced, the error is appearing only in state, when there is nothing to copy
- Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 2.2-1
changelog:
- added "jre/lib/security/blacklisted.certs" to cared files
- moved to newest release 2.1
- moved to new upstream at pagure.io
- added new script of copy_jdk_configs_fixFiles.sh 
- copy_jdk_configs.lua  aligned to it
- Resolves: rhbz#1427463


author: Ondrej Vasik <ovasik@redhat.com> - 8.22-18
changelog:
- fix xfs build failure in chrooted environment (#1263341)
- update filesystem lists for stat and tail from latest upstream
  (#1327881, #1280357) 
- disable id/setgid.sh test(missing chroot feature), fix 
  cp-a-selinux test (#1266500,#1266501)
- colorls.sh - change detection of interactive shell for ksh
  compatibility (#1321648)
- fix date --date crash with empty or invalid TZ envvar (#1325786)
- df -l: do not hang on a dead autofs mount point (#1309247)
- sort -h: fix functionality of human readable numeric sort for other
  than first field (#1328360)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-19
changelog:
- timeout: fix race possibly terminating wrong process (#1439465)
- ls: allow interruption when reading slow directories (#1421802)
- fold: preserve new-lines in mutlibyte text (#1418505)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-23
changelog:
- update description of the -a/--all option in df.1 man page (#1553212)
- sort -M: fix memory leak when using multibyte locale (#1540059)


author: Kamil Dudka <kdudka@redhat.com> - 8.22-24
changelog:
- doc: improve description of the --kibibytes option of ls (#1527391)
- doc: fix typo in date example (#1620624)
- stat,tail: sync the list of file systems with coreutils-8.31 (#1659530)
- df: avoid stat() for dummy file systems with -l (#1668137)
- df: prioritize mounts nearer the device root (#1042840)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-5
changelog:
- Resolves: rhbz#1376819
- Resolves: rhbz#1634710

- configure: add --with-initconfigdir option (rhbz#1376819)
- merge upstream commit c0d8af0c7b247df16a90850b0edab4f978cb8192 (rhbz#1376819)
- Use RuntimeDirectory instead of tmpfiles.d (rhbz#1376819)
- merge upstream commit fde7fa0c6408709ccdd090aa9064e6a78232498a (rhbz#1376819)
- totemcrypto: Fix importing of the private key (rhbz#1634710)
- merge upstream commit 3f3e6b62719a263cb221c19a06d9a2c570234caa (rhbz#1634710)
- qnetd: Check existence of NSS DB dir before fork (rhbz#1376819)
- merge upstream commit eac28dffdf7f060f41f2b2e95bb0f4c6c033425d (rhbz#1376819)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-1
changelog:
- Resolves: rhbz#1732039
- Resolves: rhbz#1153818
- Resolves: rhbz#1647120

- Rebase to Corosync 2.4.5


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-2
changelog:
- Resolves: rhbz#1656492

- totem: Increase ring_id seq after load (rhbz#1656492)
- merge upstream commit 1061804d09565363aba73e369faf310a7d2c4d86 (rhbz#1656492)


author: Jan Friesse <jfriesse@redhat.com> - 2.4.5-3
changelog:
- Resolves: rhbz#1737884
- Resolves: rhbz#1737887

- Do not set exec permission for service file
- Fix CFLAGS definition


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-5
changelog:
- Resolves: rhbz#1679792
- Resolves: rhbz#1780134

- votequorum: Ignore the icmap_get_* return value (rhbz#1780134)
- merge upstream commit 8ad3c6bbb4556332c5a6b7fecdab73310c045b24 (rhbz#1780134)
- votequorum: Reflect runtime change of 2Node to WFA (rhbz#1780134)
- merge upstream commit bfbed8c320b0c0c5d3db48630f3de77e5fd62b75 (rhbz#1780134)
- votequorum: set wfa status only on startup (rhbz#1679792)
- merge upstream commit 6894792d76b1e8932bc822bb040933ae17e1a0c7 (rhbz#1679792)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-6
changelog:
- Resolves: rhbz#1835885

- stats: Add basic schedule-miss stats to needle (rhbz#1835885)
- merge upstream commit 274fda334a84253222e01b779349784ec552921b (rhbz#1835885)
- main: Add schedmiss timestamp into message (rhbz#1835885)
- merge upstream commit 3166a87749fa4817d90ed335f3c5843fc38e7304 (rhbz#1835885)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-7
changelog:
- Related: rhbz#1835885

- main: Make schedmiss in cmap and log equal (rhbz#1835885)
- merge upstream commit 44c1c8ea31f981bdd7856d4eb8f4ac49f95a85e3 (rhbz#1835885)


author: Jan Friesse <jfriesse@redhat.com> 2.4.5-7.1
changelog:
- Resolves: rhbz#1896311
- Resolves: rhbz#1897087

- spausedd: Fix log_perror (rhbz#1896311)
- spausedd: Add ability to move process into root cgroup (rhbz#1897087)


author: Dave Anderson <anderson@redhat.com> - 7.2.3-5
changelog:
- Rebase to github commits b9d76838 to c79a11fa
  Resolves: rhbz#1559460
- Fix ppc64/ppc6le stacksize calculation
  Resolves: rhbz#1589685


author: Dave Anderson <anderson@redhat.com> - 7.2.3-7
changelog:
- Support ppc64 increased VA range
- Fix ppc64 "bt" command failure reporting invalid NIP value
  Resolves: rhbz#1617936


author: Dave Anderson <anderson@redhat.com> - 7.2.3-8
changelog:
- Fix ppc64 "bt" command failure reporting invalid NIP value for a user-space task. 
  Resolves: rhbz#1617936


author: Dave Anderson <anderson@redhat.com> - 7.2.3-9
changelog:
- Alternate list loop detection option
  Resolves: rhbz#1595389
- Readline library tab completion plugin
  Resolves: rhbz#1656165


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.3-11.1
changelog:
- crash/sadump, kaslr: fix failure of calculating kaslr_offset due to an sadump format restriction
  Resolves: rhbz#1854016


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-16
changelog:
- disable mail from anacron with empty MAILTO
- crontab: do not block access with PAM when running as root
- improve the crontab man page
- do not hardcode system_u selinux user but use the user from
  the current context


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-17
changelog:
- make anacron not to contradict itself in syslog
  (job output does not have to be necessarily mailed)


author: Tomáš Mráz <tmraz@redhat.com> - 1.4.11-18
changelog:
- fix regression - spurious PAM log message from crontab (#1479064)
- allow empty variables in crontabs (#1439217)


author: Marcel Plch <mplch@redhat.com> - 1.4.11-20
changelog:
- Fix race condition when crontab is modified the same second
  before and after reading the crontab
- Resolves: rhbz#1638691


author: Marcel Plch <mplch@redhat.com> - 1.4.11-22
changelog:
- Backport upstream patch to fix cron failing on
  smart card authentication
- Resolves: rhbz#1650314


author: Jan Staněk <jstanek@redhat.com> - 1.4.11-24
changelog:
- Limit memory allocated for file descriptors
  Backports https://github.com/cronie-crond/cronie/commit/584911514ce6aa2f16e1d79431bac816ea62cb2c
  Resolves: rhbz#2026289


author: Isaac Boukris <iboukris@redhat.com> - 4.10.16-2
changelog:
- resolves: #1828354 - add additioanl hostnames to the keytab
- resolves: #1836427 - add dnshostname option net-ads-join


author: Andreas Schneider <asn@redhat.com> - 4.10.16-8
changelog:
- resolves: #1878205 - Fix restarting winbind on package upgrade
- resolves: #1892632 - Fix CVE-2020-14318
- resolves: #1891687 - Fix CVE-2020-14323
- resolves: #1879834 - Fix CVE-2020-1472
- resolves: #1892313 - Fix memory leak in winbindd (wbinfo -u)
- resolves: #1868917 - Fix %U substitution for 'valid users' option
- resolves: #1853272 - Fix 'require_membership_of' documentation in
                       pam_winbind{.conf} manpage


author: Andreas Schneider <asn@redhat.com> - 4.10.16-14
changelog:
- resolves: #1937867 - Fix possible core dump with printing support
- resolves: #1930747 - Ensure that libwbclient has been updated before
                       restarting services


author: Andreas Schneider <asn@redhat.com> - 4.10.16-16
changelog:
- resolves: #2019661 - Fix CVE-2016-2124
- resolves: #2019673 - Fix CVE-2020-25717
- resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl


author: Andreas Schneider <asn@redhat.com> - 4.10.16-18
changelog:
- resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717
- resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717
- resolves: #2046148 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.10.16-19
changelog:
- resolves: #2081649 - Fix idmap_rfc2307 and idmap_nss returning wrong
                       mapping for uid/gid conflict


author: Andreas Schneider <asn@redhat.com> - 4.10.15-1
changelog:
- related: #1785121 - Rebase to version 4.10.15
- resolves: #1828924 - Fix typo in pam_winbind documentation about require_membership_of
- resolves: #1801496 - Add missing ctdb directories


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-44
changelog:
- 1774460 - CVE-2019-8696 cups: stack-buffer-overflow in libcups's asn1_get_packed function [rhel-7]
- 1774461 - CVE-2019-8675 cups: stack-buffer-overflow in libcups's asn1_get_type function [rhel-7]
- 1753809 - Settings in ~/.cups/client.conf aren't used


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.6.3-46
changelog:
- 1715907 - CUPS- client: cupsGetPPD3() function tries to load PPD from IPP printer and not from the CUPS queue


author: Tim Waugh <twaugh@redhat.com> - 1.0.35-21
changelog:
- Fix heap-based buffer overflow in texttopdf filter (bug #1241242,
  CVE-2015-3258, CVE-2015-3279).


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.0.35-28
changelog:
- 1816109 - Queues are not cleaned up after stopping cups-browsed
- 1811190 - cups-browsed leaks memory


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
- prevent curl --rate-limit from hanging on file URLs (#1281969)
- fix NTLM password overflow via integer overflow (CVE-2018-14618)
- fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
- backport options to force TLS 1.3 in curl and libcurl (#1672639)
- prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Jakub Jelen <jjelen@redhat.com> 2.1.26-18
changelog:
- Revert updated GSSAPI flags as in RFC 4752 to restore backward compatibility (#1154566)
- Add and document ability to run saslauth as non-root user (#1188065)
- Support AIX SASL GSSAPI (#1174322)
- Update client library to be thread safe (#1147659)
- Fix problem, that parsing short prefix matches the whole mechanism name (#1089267)
- Don't use unnecessary quotes around user description (#1082564)
- Fix confusing message when config file has typo (#1022479)


author: Jeff Moyer <jmoyer@redhat.com> - 62-1
changelog:
- Rebase to v62 (Jeff Moyer)
  - a new monitor command / daemon
  - an ndctl udev rule for recording the unsafe shutdown count
  - smart error injection
  - create-namespace fix for fragmented namespaces
- Resolves: bz#1610649 bz#1611833 bz#1456320


author: Jeff Moyer <jmoyer@redhat.com> - 64.1-1
changelog:
- Rebase to v64.1 (Jeff Moyer)
  - add security commands
  - fix broken udev rule for dirty shutdown count
- Resolves: bz#1634348 bz#1635441


author: Jeff Moyer <jmoyer@redhat.com> - 65.1.el7
changelog:
- Rebase to v65
  - clear-errors: new command to clear errors on a namespace
  - monitor: remove the requirement of a default config
  - sanitize-dimm: allow a zero-key for secure-erase
  - sanitize-dimm: preserve keys after an overwrite
  - load-keys: fix for non-TPM keys
- Fix test harness to run against the rhel7 test kernel modules
- Related: rhbz#1722481


author: Jeff Moyer <jmoyer@redhat.com> - 65.2.el7
changelog:
- Remove 'daxctl migrate-device-model' command.  We won't
  support hot-plugging device dax into the memory hierarchy
  on RHEL 7.
- Resolves: rhbz#1734153


author: Jeff Moyer <jmoyer@redhat.com> - 65.3.el7
changelog:
- modify nvdimm-security.conf touse '&&' instead of ';'
  Without this change, the module doesn't load
- Resolves: rhbz#1725405


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
- network: parsing of /proc/mounts returned (bug #1572659)
- netconsole: LSB header added (bug #1508489)
- ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
- network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
- Configure autorelabel service to output to journal and to console if set (bug #1634661)
- Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
- ifup-eth: Check that device name is set (bug #1741830)
- Add option for IPv6 GRE tunnel (bug #1691552)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-125
changelog:
- Modify 0250-RHBZ-1610867-rescan-change.patch
  * Fix memory Leak
- Modify 0255-RHBZ-1638651-marginal-path.patch
  * Fix NULL dereference
- Refresh 0252-RHBZ-1623595-cmd-error-status.patch
- Resolves: bz #1610867, #1638651


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-127
changelog:
- Add 0256-RHBZ-1672175-retry-no-fd-paths.patch
  * retry adding paths if they couldn't be opened initially
- Add 0257-RHBZ-1679556-dont-check-dm-devices.patch
  * don't check if dm devices are multipath paths
- Add 0258-RHBZ-1634183-ANA-prioritizer.patch
  * Add NVMe ANA path prioritizer
- Resolves: bz #1634183, #1672175, #1679556


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-128
changelog:
- Modify 0258-RHBZ-1634183-ANA-prioritizer.patch
  * minor change
- Add 0259-RHBZ-1701604-fix-nr-active.patch
  * recalculate the number of active paths whenever a path is checked
- Add 0260-RHBZ-1634183-prio-fixes.patch
- Add 0261-RHBZ-1714506-skip-blacklisted-paths.patch
  * ignore blacklisted paths in mpathpersist
- Add 0262-RHBZ-1699486-reload-with-failed-paths.patch
  * allow forced reloads even if there are no reusable paths
- Add 0263-RHBZ-1686708-nvme-hcil.patch
  * make nvme ids work like in upstream
- Add 0264-RHBZ-1699441-de-series-config.patch
- Resolves: bz #1686708, #1699441, #1699486, #1701604, #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-129
changelog:
- Add 0265-RHBZ-1721855-mpathpersist-speedup.patch
  * only grab path information from necessary devices, and allow batch files.
- Add 0266-RHBZ-1696817-fix-emc-checker.patch
  * fix detection of inactive snapshots
- Add 0267-RHBZ-1661156-powermax-config.patch
- Remove 0261-RHBZ-1714506-skip-blacklisted-paths.patch
  * This fix is superseded by 0265-RHBZ-1721855-mpathpersist-speedup.patch
- Resolves: bz #1661156, #1696817, #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-130
changelog:
- Add 0268-RHBZ-1721855-mpathpersist-fixes.patch
  * Fix issues in the mpathpersist speedup code
- Resolves: bz #1721855


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-131
changelog:
- Modify 0268-RHBZ-1721855-mpathpersist-fixes.patch
  * The fix for 1721855 broke 1714506.
- Resolves: bz #1714506


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-132
changelog:
- Add 0269-RHBZ-1804420-remove-kpartx-limit.patch
  * Remove the 256 device limit, when searching loop devices with kpartx
- Resolves: bz #1804420


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-133
changelog:
- Add 0270-RHBZ-1775481-segfault-fix.patch
  * Fix segfault related to missing dm device tables
- 0271-RHBZ-1806197-mpathconf-typo.patch
- Resolves: bz #1775481, #1806197


author: Marian Csontos <mcsontos@redhat.com> - 0.7.3-1
changelog:
- Update to latest bugfix and documentation update release.
- *_restore tools wipe superblock as a last resort.
- Add thin_check --override-mapping-root.


author: Lianbo Jiang <lijiang@redhat.com> - 1:3.2-4
changelog:
- Fix System Slot Information for PCIe SSD
- Resolves: rhbz#1793900
- Sync with upstream(commit:62bce59fed1)
- Resolves: rhbz#1767323


author: Petr Menšík <pemensik@redhat.com> - 2.76-16.1
changelog:
- Accept responses only on correct sockets (CVE-2020-25684)
- Use strong verification on queries (CVE-2020-25685)
- Handle multiple identical DNS queries better (CVE-2020-25686)
- Link against nettle for sha256 hash implementation


author: Kamil Dudka <kdudka@redhat.com> - 0.12-0.34.pre6
changelog:
- update to latest upstream pre-release
- drop unneeded patches
- fix autoconf warnings
- explicitly disable using OpenSSL and GnuTLS


author: Jan Synáček <jsynacek@redhat.com> - 1:24.3-21
changelog:
- fix libjpeg detection fails with gcc7 (#1487557)
- fix Emacs GUI Toolbar icons missing (#1477745)
- fix hardening: TLS certificate warnings should be hard errors (#1403643)


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-15
changelog:
- move instaweb to separate git-instaweb subpackage.
	Resolves: #1213059
- move gnome-keyring to a separate git-gnome-keyring subpackage.
	Resolves: #1284081


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-16
changelog:
- Remove EL-5 settings and old Fedora conditionals.
  Taken from fedora commits 903d8f35ed8ae16bece8ae8033f3d3926cc97595 and
  2c6eff99d7b50b87e8a1fe2e4a0489dfd90659b8.
- Fix builds using '--without docs'
- Change git-instaweb default from lighttpd(not available in rhel7) to
  apache2.
- Add requires for git-{instaweb,gnome-keyring} to pull them, when
  installing git-all.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-17
changelog:
- Correctly return an error from fsck on encountering a .gitmodules symlink.
  This was broken in the debian 2.1.x backport and found by covscan.
  Fix the test to catch this.
- Correct a typo in changelog.


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
- Fix httpd modules path to be independent from system architecture.
Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
- Fix CVE-2018-17456: arbitrary code execution via .gitmodules
  Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
  and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Ondrej Pohorelsky <opohorel@redhat.com> - 1.8.3.1-21
changelog:
- Fix CVE-2019-1387: remote code execution in recursive clones with nested
  submodules
  Resolves: CVE-2019-1387


author: Vít Ondruch <vondruch@redhat.com> - 1.8.3.1-23
changelog:
- Prevent crafted URL containing new lines, empty host or lacks a scheme
  to cause credential leak.
  Resolves: CVE-2020-11008


author: Milan Crha <mcrha@redhat.com> - 3.28.2-1
changelog:
- Update to 3.28.2
- Add patch for GNOME bug #795997 (Fails to parse Google OAuth2 authorization code)
- Resolves: #1575495


author: Milan Crha <mcrha@redhat.com> - 3.28.5-4
changelog:
- Add patch for RH bug #1392567 (Sync CategoryList with mail Labels)
- Add patch for RH bug #1764669 (Send meeting change notifications only if being the organizer)


author: Jan Grulich <jgrulich@redhat.com> - 0.26-2
changelog:
- Fix heap-based buffer over-read in Exiv2::Image::byteSwap4 in image.cpp
  Resolves: bz#1547207

  Fix heap-based buffer over-read in Exiv2::getULong function in types.cpp
  Resolves: bz#1545232


author: Jan Grulich <jgrulich@redhat.com> - 0.26-3
changelog:
- Fix uncontrolled recursion in image.cpp:Exiv2::Image::printIFDStructure() which can allow a
  remote attacker to cause a denial of service via a crafted tif file
  Resolves: bz#1548410


author: Jan Grulich <jgrulich@redhat.com> - 0.27.0-4
changelog:
- Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS
  Resolves: bz#1990352


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-13
changelog:
- Fix multiple CVEs
- CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
- CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
- CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
- CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
- CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
- CVE-2022-22825 Integer overflow in lookup in xmlparse.c
- CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
- CVE-2022-22823 Integer overflow in build_model in xmlparse.c
- CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
- Resolves: CVE-2022-23852
- Resolves: CVE-2021-45960
- Resolves: CVE-2021-46143
- Resolves: CVE-2022-22827
- Resolves: CVE-2022-22826
- Resolves: CVE-2022-22825
- Resolves: CVE-2022-22824
- Resolves: CVE-2022-22823
- Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-14
changelog:
- Fix multiple CVEs
- CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
- CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
- CVE-2022-25315 expat: integer overflow in storeRawNames()
- Resolves: CVE-2022-25236
- Resolves: CVE-2022-25235
- Resolves: CVE-2022-25315


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-31
changelog:
- fence_compute/fence_evacuate: fix region_name content type and
  project shortopt in usage text and project-domain shortopt
  Resolves: rhbz#1760203
- fence_rhevm: add cookie support
  Resolves: rhbz#1763675
- fencing: improve stdin quote parsing
  Resolves: rhbz#1769784


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-34
changelog:
- fence_aws: improve parameter logic to allow setting region parameter
  while using credentials from ~/.aws/config
  Resolves: rhbz#1673468
-


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-39
changelog:
- fence_vmware_rest: add filter parameter to avoid 1000 VM API limit
  and avoid failing when hitting it during the monitor-action
  Resolves: rhbz#1654058


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-41.1
changelog:
- fence_lpar: fix issue with long username, hostname, etc not
  working when the command run by the agent exceeds 80 characters
- fence_evacuate: enable evacuation of instances using private flavors

  Resolves: rhbz#1860545
  Resolves: rhbz#1862024


author: Eric Garver <egarver@redhat.com> - 0.6.3-3
changelog:
- backport recent upstream stable fixes
- backport fix --remove-rules deleting all direct rules
- backport fix unable to delete rich rule forward-port
- backport fix forward-port for external zone hijacking internal zone
- backport fix testsuite iptables locking


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
- CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
- CVE-2020-11523: Fix integer overflow in region.c (#1837622)
- CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Honza Horak <hhorak@redhat.com> - 2.0.35-19
changelog:
- Spec file cleanup
- Compile and run test suite during build
- Using chrpath to get rid of --rpath in gd-progs


author: Filip Januš <fjanus@redhat.com> - 2.0.35-27
changelog:
- Fix CVE-2016-5766
- Resolves: #1356813
- Upstream patch: https://github.com/libgd/libgd/commit/aba3db8


author: Nils Philippsen <nils@redhat.com> - 0.2.0-11
changelog:
- replace lua-5.2 patch by upstream commit
- fix buffer overflow in and add plausibility checks to ppm-load op
  (CVE-2012-4433)
- fix multi-lib issue in generated documentation


author: Paul Howarth <paul@city-fan.org> - 2.2.2-1
changelog:
- Update to 2.2.2
  - geoipupdate now calls fsync on the database directory after a rename to
    make it durable in the event of a crash
- Update autotools patch


author: Paul Howarth <paul@city-fan.org> - 2.3.1-1
changelog:
- Update to 2.3.1
  - geoipupdate now uses TCP keep-alive when compiled with cURL 7.25 or
    greater
  - Previously, on an invalid gzip file, geoipupdate would output binary data
    to stderr; it now displays an appropriate error message
  - Install README, ChangeLog, GeoIP.conf.default etc. into docdir (GH#33)
  - $(sysconfdir) is now created if it doesn't exist (GH#33)
  - The sample config file is now usable (GH#33)


author: Paul Howarth <paul@city-fan.org> - 2.4.0-1
changelog:
- Update to 2.4.0
  - geoipupdate now checks that the database directory is writable: if it is
    not, it reports the problem and aborts
  - geoipupdate now acquires a lock when starting up to ensure only one
    instance may run at a time: a new option, 'LockFile', exists to set the
    file to use as a lock ('.geoipupdate.lock' in the database directory by
    default)
  - geoipupdate now prints out additional information from the server when a
    download request results in something other than HTTP status 2xx; this
    provides more information when the API does not respond with a database
    file
  - ${datarootdir}/GeoIP is now created on 'make install' (GH#29)
  - Previously, a variable named 'ERROR' was used, which caused issues building
    on Windows (GH#36)
- Drop EL-5 support
  - Drop BuildRoot: and Group: tags
  - Drop explicit buildroot cleaning in %install section
  - Drop explicit %clean section
  - noarch subpackages always available now
  - libcurl-devel always available now


author: Paul Howarth <paul@city-fan.org> - 2.5.0-1
changelog:
- Update to 2.5.0
  - Replace use of strnlen() due to lack of universal availability (GH#71)
  - Document the 'LockFile' option in the 'GeoIP.conf' man page (GH#64)
  - Remove unused base64 library (GH#68)
  - Add the new configuration option 'PreserveFileTimes'; if set, the
    downloaded files will get the same modification times as their original on
    the server (default is '0') (GH#63)
  - Use the correct types when calling 'curl_easy_setopt()'; this fixes
    warnings generated by libcurl's 'typecheck-gcc.h' (GH#61)
  - In 'GeoIP.conf', the 'UserId' option was renamed to 'AccountID' and the
    'ProductIds' option was renamed to 'EditionIDs'; the old options will
    continue to work, but upgrading to the new names is recommended for
    forward compatibility


author: Andrew Price <anprice@redhat.com> - 3.1.10-3
changelog:
- libgfs2: Issue one write per rgrp when creating them
- mkfs.gfs2: Fix resource group alignment issue
- mkfs.gfs2: Free unnecessary cached pages, disable readahead
  Resolves: rhbz#1440269


author: Andrew Price <anprice@redhat.com> - 3.1.10-5
changelog:
- Update URL in spec file
  Resolves: rhbz#1501738
- fsck.gfs2: Make -p, -n and -y conflicting options
  Resolves: rhbz#1507091


author: Andrew Price <anprice@redhat.com> - 3.1.10-9
changelog:
- fsck.gfs2: Don't check fs formats we don't recognise
- libgfs2: Fix pointer cast byte order issue
  Resolves: rhbz#1616389


author: Andrew Price <anprice@redhat.com> - 3.1.10-10
changelog:
- libgfs2: Use sizeof for 'reserved' fields in ondisk.c
- fsck.gfs2: Disambiguate 'check_data'
- gfs2-utils: Accept a char* instead of a buffer head in gfs2_check_meta
- fsck.gfs2: Disambiguate check_metalist
- fsck.gfs2: Fix segfault in build_and_check_metalist
- fsck.gfs2: Retain context for indirect pointers in ->check_metalist
- fsck.gfs2: Clear bad indirect block pointers when bitmap meets expectations
  Resolves: rhbz#1487726


author: Andrew Price <anprice@redhat.com> - 3.1.10-11
changelog:
- gfs2_jadd: Handle out-of-space issues
- gfs2_jadd: error handling overhaul
  Resolves: rhbz#1837640


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
- CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
  sincosl, and tanl function. (#1812119)


author: Florian Weimer <fweimer@redhat.com> - 2.17-325
changelog:
- Support /etc/sysconfig/strcasecmp-nonascii for enabling non-ASCII case
  conversion in strcasecmp, strncasecmp (#1993930)


author: Florian Weimer <fweimer@redhat.com> - 2.17-326.2
changelog:
- nscd: Do not use sendfile for the netgroup cache
- nscd: Use-after-free in netgroup cache
- CVE-2021-27645: nscd: double-free in netgroup cache
- CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34263)
- CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
- CVE-2024-33601: nscd: crash on out-of-memory condition
- CVE-2024-33602: nscd: memory corruption with NSS netgroup modules


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-57
changelog:
- fixes bugs bz#1600379 bz#1689375 bz#1782428 bz#1798897 bz#1815462 
  bz#1889966 bz#1891403 bz#1901468 bz#1903911 bz#1908635 bz#1917488 bz#1918018 
  bz#1919132 bz#1925425 bz#1927411 bz#1927640 bz#1928676 bz#1942816 bz#1943467 
  bz#1945143 bz#1946171 bz#1957191 bz#1957641


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-60
changelog:
- fixes bugs bz#1668303 bz#1853631 bz#1901468 bz#1904137 bz#1911665 
  bz#1962972 bz#1973566 bz#1994593 bz#1995029 bz#1997447 bz#2006205


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-7
changelog:
- Add window-grouper extension
  Resolves: #1355845

- Add disable-screenshield extension
  Resolves: #1643501


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-13
changelog:
- Adjust dash-to-dock for classic backports
  Resolves: #1805920
- Fix inconsistent state in window-list prefs dialog
  Resolves: #1613835
- Add accessible name to status icons
  Resolves: #1600999


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-9
changelog:
+ gnome-settings-daemon-3.26.2-9
- Revert automatic suspend after inactivity, it was rejected
- Related: #1449171


author: Benjamin Berg <bberg@redhat.com> - 3.28.1-9
changelog:
- Keep auto-logout working inside VMs
  Resolves: #1672998
- Never log out automatically from greeter sessions
  Resolves: #1729296


author: Carlos Garnacho <cgarnach@redhat.com> - 3.28.1-11
changelog:
- Fix possible crash on gsd-media-keys startup
  Resolves: #1878167
- Ignore permission issues during gsd-housekeeping file deletion
  Resolves: #1909954
- Revert mapping of "XF86RFKill" key
  Resolves: #1888412


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.87.el7.2
changelog:
- Fix another batch of CVEs
  Resolves: CVE-2020-14372
  Resolves: CVE-2020-25632
  Resolves: CVE-2020-25647
  Resolves: CVE-2020-27749
  Resolves: CVE-2020-27779
  Resolves: CVE-2021-20225
  Resolves: CVE-2021-20233


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
- Prepend prefix when HTTP path is relative
- efi/http: Export {fw,http}_path variables to make them global
  Resolves: rhbz#1616395
- efi/http: Enclose literal IPv6 addresses in square brackets
- efi/net: Allow to specify a port number in addresses
- efi/ip4_config: Improve check to detect literal IPv6 addresses
- efi/net: Print a debug message if parsing the address fails
  Resolves: rhbz#1732765


author: Peter Jones <pjones@redhat.com> - 2.02-0.83
changelog:
- Fix several CVEs:
  Resolves: CVE-2020-10713
  Resolves: CVE-2020-14308
  Resolves: CVE-2020-14309
  Resolves: CVE-2020-14310
  Resolves: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 2.02-0.84
changelog:
- Couple more late fixes.
  Resolves: CVE-2020-10713
  Resolves: CVE-2020-14308
  Resolves: CVE-2020-14309
  Resolves: CVE-2020-14310
  Resolves: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 2.02-0.85
changelog:
- Couple more late fixes.
  Resolves: CVE-2020-10713
  Resolves: CVE-2020-14308
  Resolves: CVE-2020-14309
  Resolves: CVE-2020-14310
  Resolves: CVE-2020-14311
  Resolves: CVE-2020-15705


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.78
changelog:
- Prevent errors from diskfilter scan of removable drives
  Resolves: rhbz#1446418
- Avoid grub2-efi package to overwrite existing /boot/grub2/grubenv file
  Resolves: rhbz#1497918
- Remove glibc32 and glibc-static(x86-32) BuildRequires
  Resolves: rhbz#1614259


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.79
changelog:
- Ignore the modification time when doing RPM verification of /boot/efi files
  Resolves: rhbz#1496952


author: Colin Walters <walters@verbum.org> 0.10.23-17
changelog:
- Hack the gtk-doc to remove plugin docs that are not shipped
- Drop mythtv, opencv sources that are no longer buildable


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-21
changelog:
- Remove insecure NSF plugin
- vmncdec: Sanity-check width/height before using it
Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-22
changelog:
- h264parse: Ensure codec_data has the required size when reading number of SPS
Resolves: rhbz#1400839


author: Wim Taymans <wtaymans@redhat.com> - 0.10.23-24
changelog:
- Patch CVE-2023-44446: MXF demuxer use-after-free
- Disable gtk-doc to fix the build
- Resolves: RHEL-16792


author: Wim Taymans <wtaymans@redhat.com> - 1.4.5-6
changelog:
- Fix h264 and h265 buffer size checks
- Fix mpegts pat parsing and add more size checks
Resolves: rhbz#1400898


author: Wim Taymans <wtaymans@redhat.com> - 1.10.4-4
changelog:
- Patch CVE-2023-44446: MXF demuxer use-after-free
- Disable gtk-doc to fix build
- Resolves: RHEL-16793


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-2
changelog:
- Prevent spawning new daemons if outgoing operation exists (#1632960)
- CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887)


author: Petr Stodulka <pstodulk@redhat.com> - 1.5-8
changelog:
- Gzip overwrite existing files when user choose "no" on yes/no question.
  It's due to wrong dupicit declaration of yesno() function in gzip.h
  which is compiled wrong with -O2 option.
  Resolves: rhbz#1201689


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
- doc change: missing grep options are now mentioned in the zgrep 
  man pages/help message
  Resolves: #1437002


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.7
changelog:
- Fix: "Argument list too long" when using virt-v2v on Windows guest
  with French copy of Citrix installed
  related: rhbz#1145056


author: Richard W.M. Jones <rjones@redhat.com> - 1.3.10-5.8
changelog:
- Tolerate corruption in some hives
  resolves: rhbz#1423436
- Switch to using git to manage patches.


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1:1.8.1.3-14
changelog:
- Remove dependency on initscripts
- Add After=network.target to systemd service
- Resolves: rhbz#1283893, rhbz#1269717


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-90
changelog:
- Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
  in mod_auth_digest
- Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
  bypass due to race condition
- Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-91
changelog:
- Resolves: #1630886 - scriptlet can fail if hostname is not installed
- Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
  mod_authnz_ldap when using too small Accept-Language values
- Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
  failure in reading the HTTP request
- Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
  directive
- Resolves: #1633152 - mod_session missing apr-util-openssl
- Resolves: #1649470 - httpd response contains garbage in Content-Type header
- Resolves: #1724034 - Unexpected OCSP in proxy SSL connection


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
- Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
  newline in the file name
- Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
- Resolves: #1724879 - httpd terminates all SSL connections using an abortive
  shutdown
- Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
- Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
  mod_cache_socache can allow a remote attacker to cause a denial of service
- Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
  mod_session can allow a remote user to modify session data for CGI applications


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
- Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
  a client cert to backend server
- Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
- Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
  concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
- Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
  request uri-path containing "unix:"


author: CentOS Sources <bugs@centos.org> - 2.4.6-97.el7.centos.1
changelog:
- Remove index.html, add centos-noindex.tar.gz
- change vstring
- change symlink for poweredby.png
- update welcome.conf with proper aliases


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
- Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
  when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com>
changelog:
- Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
  malformed requests
- Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
  ap_escape_quotes() via malicious input
- Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
- Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
  vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.6
changelog:
- Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
  corrupt and mixed-up responses


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
changelog:
- Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
  mod_rewrite and mod_proxy


author: Jarod Wilson <jarod@redhat.com> 22.1-1
changelog:
- Update to upstream v22.1 release with stable-v22 branch fixes
- Add support for Broadcom 57500 RoCE adapter
- Resolves: rhbz#1678274


author: Jarod Wilson <jarod@redhat.com> 22.4-1
changelog:
- Update to v22.4 stable release
- Support mlx5 scatter to CQE over DCT QP
- Fix ibacm segfault on non-IB hardware
- Resolves: rhbz#1715489
- Resolves: rhbz#1712296


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-1
changelog:
- updated to 1.6.2
- fixed also rhbz#1303437 - package owns /etc/bash_completion.d but it should not own it 
- generated maven metadata (isntalled but not used. 
set -e 
   _pompart="need" 
   _jarpart="tobe" 
_filelist=".mfiles" 
install -dm 755 /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments 
for _dir in /usr/lib/java %{_javajnidir} /usr/share/java; do 
    if [ -f /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart ]; then 
	_jpath="/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64$_dir/$_jarpart" 
    fi 
done 
python -m /usr/share/java-utils/maven_depmap   \
          -p "/usr" -n "" \
          /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-fragments/icedtea-web \
          /builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64/usr/share/maven-poms/$_pompart \
        >> ${_filelist} 
sed -i 's:/builddir/build/BUILDROOT/icedtea-web-1.7.1-4.el7_9.x86_64::' ${_filelist} 
sort -u -o ${_filelist} ${_filelist} 


- Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.6.2-3
changelog:
- added --family to make it part of javas alternatives alignment
- java-javaver-openjdk collected into preffered_java 
- Resolves: rhbz#1299537


author: Jiri Vanek <jvanek@redhat.com> 1.7-1
changelog:
- updated to itw 1.7 and sync from fedora
- added forgotten slaves of itweb-settings policyeditor
- Own %{_datadir}/%{name} dir
- Mark non-English man pages with %lang
- Install COPYING as %license
- last three by Ville Skytta <ville.skytta@iki.fi> via 1481270
- for sake of rpms added patch0, bashCompDirHardcodedAgain.patch to hardcode bashcompletion dir
- removed maven macros in favour of manual handling (bug)
- Resolves: rhbz#1475411


author: Jiri Vanek <jvanek@redhat.com> 1.7.1-2
changelog:
- added patch1, patch4 and patch11 to fix CVE-2019-10182
- added patch2 to fix CVE-2019-10181
- added patch3 and patch33 to fix CVE-2019-10185
- Resolves: rhbz#1724958 
- Resolves: rhbz#1725928 
- Resolves: rhbz#1724989


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-3.el7
changelog:
- Resolves: #1834385 Man page syntax issue detected by rpminspect
  - Man pages: fix syntax issues
- Resolves: #1829787 ipa service-del deletes the required principal when specified in lower/upper case
  - Make check_required_principal() case-insensitive
- Resolves: #1825829 ipa-advise on a RHEL7 IdM server generate a configuration script for client having hardcoded python3
  - ipa-advise: fallback to /usr/libexec/platform-python if python3 not found
- Resolves: #1812020 CVE-2015-9251 ipa: js-jquery: Cross-site scripting via cross-domain ajax requests
  - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1
- Resolves: #1713487 CVE-2019-11358 ipa: js-jquery: prototype pollution in object's prototype leading to denial of service or remote code execution or property injection
  - Web UI: Upgrade jQuery version 2.0.3 -> 3.4.1


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
- Resolves: #1842950 ipa-adtrust-install fails when replica is offline
  - ipa-adtrust-install: avoid failure when replica is offline
- Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
  - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
- Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
  -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
- Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
  - wgi/plugins.py: ignore empty plugin directories
- Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
  - Improve PKI subsystem detection
  - ipatests: add test for PKI subsystem detection
  - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
- Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
  - Add more indices
- Resolves: #1884819 IdM Web UI shows users as disabled
  - fix cert-find errors in CA-less deployment
- Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
  - CAless installation: set the perms on KDC cert file
  - ipatests: check KDC cert permissions in CA less install
- Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
  - WebUI: Fix jQuery DOM manipulation issues
- Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
  - fix iPAddress cert issuance for >1 host/service


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.5
changelog:
- Resolves: #1931405 krb5kdc crash - Segmentation fault in ldap_first_entry().
  - ipa-kdb: fix compiler warnings
  - ipa-kdb: add missing prototypes
  - ipa-kdb: reformat ipa_kdb_certauth
  - ipa-kdb: mark test functions as static
  - ipa-kdb: do not use OpenLDAP functions with NULL LDAP context
- Resolves: #1835741 krb5kdc crashing on ipa server
- Resolves: #1929372 krb5kdc is crashing intermittently on IPA server.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.7
changelog:
- Resolves: #1956550 - IPA server installation fails when cert contains non-ASCII character
  - CA less installation: non ASCII chars in CA subject
  - ipatests: use non-ascii chars in CA-less install
- Resolves: #1974328 - Revise PKINIT upgrade code
  - Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.9
changelog:
- Resolves: #2000261 - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
  - extdom: return LDAP_NO_SUCH_OBJECT if domains differ


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
changelog:
- Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server 
  - Fix cert_request for KDC cert
- Resolves: 2021444 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
  - SMB: switch IPA domain controller role


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.11
changelog:
- Resolves: 2082272 - [RFE] Require confirmation to change "Default host group" in IdM automember rules
  - WebUI: Add confirmation dialog for changing default user/host group


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.12
changelog:
- Resolves: 2084223 - 'ipa idview-show idviewname' & IPA WebUI takes longer time to return the results
  - idviews: use cached ipaOriginalUid value when resolving ID override
- Resolves: 2124369 - OTP token sync always returns OK even with random numbers
  - ipa otptoken-sync: return error when sync fails
  - ipatests: add negative test for otptoken-sync
  - ipatests: python2 does not support f-strings
  - Fix otptoken_sync plugin


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.13
changelog:
- Resolves: 2148249 - ipa-client-install does not maintain server affinity during installation
  - Defer creating the final krb5.conf on clients
  - Move client certificate request after krb5.conf is created
  - server install: remove error log about missing bkup file


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.14
changelog:
- Resolves: 2180919 [rhel-7] Sequence processing failures for group_add using server context
  - ipaserver: deepcopy objectclasses list from IPA config


author: Julien Rische <jrische@redhat.com> - 4.6.8-5.el7_9.17
changelog:
- Resolves: RHEL-29926 ipa: user can obtain a hash of the passwords of all domain users and perform offline brute force


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-10.el7
changelog:
- Resolves: #1728123 - EMBARGOED CVE-2019-10195 ipa: FreeIPA: batch API logging user passwords to /var/log/httpd/error_log [rhel-7]
  - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
- Resolves: #1773550 - IPA upgrade fails for latest ipa package when adtrust is installed
  - Do not run trust upgrade code if master lacks Samba bindings
- Resolves: #1767302 - EMBARGOED CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf() [rhel-7.8]
  - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-11.el7
changelog:
- Resolves: #1778777 - After upgrade AD Trust Agents were removed from LDAP
  - trust upgrade: ensure that host is member of adtrust agents


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-12.el7
changelog:
- Resolves: #1754902 - Running ipa-server-install fails when RHEL 7.7 packages are installed on RHEL 7.6
- Resolves: #1404770 - ID Views: do not allow custom Views for the masters
  - idviews: prevent applying to a master
- Resolves: #1801791 - Compatibility Schema difference in functionality for systems following RHEL 7.5 -> 7.6 upgrade path as opposed to new RHEL 7.6 systems
  - install/updates: move external members past schema compat update
- Resolves: #1795890 - ipa-pkinit-manage enable fails on replica if it doesn't host the CA
  - pkinit setup: fix regression on master install
  - pkinit enable: use local dogtag only if host has CA
- Resolves: #1788907 - Renewed certs are not picked up by IPA CAs
  - Allow an empty cookie in dogtag-ipa-ca-renew-agent-submit
- Resolves: #1780548 - Man page ipa-cacert-manage does not display correctly on RHEL
  - ipa-cacert-manage man page: fix indentation
- Resolves: #1782587 - add "systemctl restart sssd" to warning message when adding trust agents to replicas
  - adtrust.py: mention restarting sssd when adding trust agents
- Resolves: #1771356 - Default client configuration breaks ssh in FIPS mode
  - Use default ssh host key algorithms
- Resolves: #1755535 - ipa-advise on a RHEL7 IdM server is not able to generate a configuration script for a RHEL8 IdM client
  - smartcard: make the ipa-advise script compatible with authselect/authconfig
- Resolves: #1758406 - KRA authentication fails when IPA CA has custom Subject DN
  - upgrade: fix ipakra people entry 'description' attribute
  - krainstance: set correct issuer DN in uid=ipakra entry
- Resolves: #1756568 - ipa-server-certinstall man page does not match built-in help
  - ipa-server-certinstall manpage: add missing options
- Resolves: #1206690 - UPG not being enforced properly
  - ipa user_add: do not check group if UPG is disabled
- Resolves: #1811982 - CVE-2018-14042 ipa: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip.
- Resolves: #1811978 - CVE-2018-14040 ipa: bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
- Resolves: #1811972 - CVE-2016-10735 ipa: bootstrap: XSS in the data-target attribute
- Resolves: #1811969 -CVE-2018-20676 ipa: bootstrap: XSS in the tooltip data-viewport attribute
- Resolves: #1811966 - CVE-2018-20677 ipa: bootstrap: XSS in the affix configuration target property
- Resolves: #1811962 - CVE-2019-8331 ipa: bootstrap: XSS in the tooltip or popover data-template attribute
  - Web UI: Upgrade Bootstrap version 3.3.7 -> 3.4.1
- Resolves: #1769791 - Invisible part of notification area in Web UI intercepts clicks of some page elements
  - WebUI: Fix notification area layout
- Resolves: #1545755 - ipa-replica-prepare should not update pki admin password
  - Fix indentation levels
  - ipa-pwd-extop: use SLAPI_BIND_TARGET_SDN
  - ipa-pwd-extop: don't check password policy for non-Kerberos account set by DM or a passsync manager
  - Don't save password history on non-Kerberos accounts


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-1.el7
changelog:
- Resolves: #1819725 - Rebase IPA to latest 4.6.x version
- Resolves: #1817927 - host-add --password logs cleartext userpassword to Apache error log
- Resolves: #1817923 - IPA upgrade is failing with error "Failed to get request: bus, object_path and dbus_interface must not be None."
- Resolves: #1817922 - covscan memory leaks report
- Resolves: #1817919 - Enable compat tree to provide information about AD users and groups on trust agents
- Resolves: #1817918 - Secure tomcat AJP connector
- Resolves: #1817886 - ipa group-add-member: prevent adding IPA objects as external members
- Resolves: #1788718 - ipa-server-install incorrectly setting slew mode (-x) when setting up ntpd


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-2.el7
changelog:
- Resolves: #1802408 CVE-2020-1722 ipa: No password length restriction leads to denial of service
  - Add interactive prompt for the LDAP bind password to ipa-getkeytab
  - CVE-2020-1722: prevent use of too long passwords


author: Michal Ruprich <mruprich@redhat.com> - 3.1.7-1
changelog:
- Related: #913329 - [RFE] include iperf3 in RHEL 7
                   - adding latest version before including iperf3 in RHEL-7


author: Michal Ruprich - 3.1.7-2
changelog:
- Related: #913329 - [RFE] include iperf3 in RHEL 7
                   - adding requires to spec file for devel package


author: Jakub Čajka <jcajka@redhat.com> - 2.4.8-1
changelog:
- Resolves: #1182038 - [7.2 FEAT] iprutils package update - ppc64/ppc64le
- Resolves: #1183460 - RHEL7.1 BE: iprutils: Set known zeroed after format


author: Sinny Kumari <skumari@redhat.com> - 2.4.11.1-1
changelog:
- Resolves: #1274367 - [7.3 FEAT] iprutils package update
- Resolves: #1297921 - IPR: Raid migration fails to kick while executing through command line


author: Sinny Kumari <skumari@redhat.com> - 2.4.12.1-1
changelog:
- Resolves: #1364131 - Integrate various important bug fixes for iprutils in
  RHEL7.3 by updating iprutils to 2.4.12


author: Sinny Kumari <skumari@redhat.com> - 2.4.16.1-1
changelog:
- Resolves: #1587834 - vpdupdate takes over an hour on system with 104 drive
- Resolves: #1521052 - iprutils package update for POWER
- Resolves: #1547891 - iprconfig unable to Download microcode on all applicable devices
- Resolves: #1576013 - iprconfig tools shows wrong error message, while creating raid using RI SSDs and normal SSDs


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-12
changelog:
- 1389071 handle newer ISCSI_ERR_NOP_TIMEDOUT code from the kernel
- 1624670 Login negotiation failed due to CHAP_N values do not match
          (rec update race condition)


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-17
changelog:
- 1518367 boot from iSCSI not establishing all sessions persistently
- 1667965 A manual restart of iscsi.service modifies records node.startup value


author: Chris Leech <cleech@redhat.com> - 6.2.0.874-18
changelog:
- 1809945 backport new CHAP modes for FIPS environments (SHA1 and SHA256 only, no SHA3 in OpenSSL-1.0.2)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190318-71.git283373f
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- cxgb4: update firmware to revision 1.23.3.0 (rhbz 1642422)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190429-72.gitddde598
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- cxgb4: update firmware to revision 1.23.4.0 (rhbz 1690727)
- linux-firmware: Add firmware file for Intel Bluetooth 22161 (rhbz 1622438)


author: Jan Stancek <jstancek@redhat.com> - 20190815-73.git07b925b
changelog:
- Update to latest upstream linux-firmware image for assorted updates (rhbz 1741356)
- iwlwifi- Update to support the Cyclone Peak Dual Band 2x2 802.11ax
- iwl7265-firmware sub-package merged into iwl7260-firmware sub-package


author: Jan Stancek <jstancek@redhat.com> - 20190918-74.git6c6918a
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Update bnx2x firmware to latest upstream (rhbz 1720386)


author: Jan Stancek <jstancek@redhat.com> - 20191203-75.gite8a0f4c
changelog:
- Update to latest upstream linux-firmware image for assorted updates
- Update qed zipped/unzipped firmware to latest upstream (rhbz 1720385)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-80.git78c0348
changelog:
- Cross-Process Information Leak (RHEL-8938)
- Return Address Predictor velunerability leading to information disclosure (RHEL-9250)


author: Rado Vrbovsky <rvrbovsk@redhat.com> - 20200421-80.git78c0348
changelog:
- AMD: INVD instruction may lead to a loss of SEV-ES guest machine memory integrity problem (RHEL-13985)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20200421-83.git78c0348
changelog:
- hw: intel: Fix protection mechanism failure for some Intel(R) PROSet/Wireless WiFi
Resolves: RHEL-4010, RHEL-4013, RHEL-4016, RHEL-4018, RHEL-4021


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b05-shenandoah-merge-2020-08-28.
- Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b05-0.2.ea
changelog:
- Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u272-b06.
- Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
- Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
- Set vendor property and vendor URLs
- Made URLs to be preconfigured by OS
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
- Include a test in the RPM to check the build has the correct vendor information.
- Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
- Improve quoting of vendor name
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
- Update to aarch64-shenandoah-jdk8u272-b10.
- Switch to GA mode for final release.
- Update release notes for 8u272 release.
- Add backport of JDK-8254177 to update to tzdata 2020b
- Require tzdata 2020b due to resource changes in JDK-8254177
- Delay tzdata 2020b dependency until tzdata update has shipped.
- Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
- Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
- This tarball is embargoed until 2020-10-20 @ 1pm PT.
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
- Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.275.b01-0
changelog:
- Update to aarch64-shenandoah-jdk8u275-b01 (GA)
- Update release notes for 8u275.
- Resolves: rhbz#1895062


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
- Added patch600: rh1750419-redhat_alt_java.patch
- Replaced alt-java placeholder with real patched alt-java
- Removed patch529: rh1566890-CVE_2018_3639-speculative_store_bypass.patch
- Removed patch531: rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
- Both surpassed by new patch
- Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b01-0.1.ea
changelog:
- Extend RH1750419 alt-java fix to include external debuginfo, following JDK-8252395 in 8u282-b01
- Resolves: rhbz#1901690


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b02-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b02 (EA)
- Update release notes for 8u282-b02.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b03 (EA)
- Update release notes for 8u282-b03.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b04 (EA)
- Update release notes for 8u282-b04.
- Remove upstreamed patch PR3519
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b05-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b05 (EA)
- Update release notes for 8u282-b05 and make some minor corrections.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b06 (EA)
- Update release notes for 8u282-b06.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b07-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u282-b07 (EA)
- Update release notes for 8u282-b07.
- Fix placement issue in release notes, caught by comparing with vanilla version.
- Resolves: rhbz#1903903


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b08-0
changelog:
- Update to aarch64-shenandoah-jdk8u282-b08 (GA)
- Update release notes for 8u282-b08.
- This tarball is embargoed until 2021-01-19 @ 1pm PT.
- Resolves: rhbz#1908963


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b04-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b04 (EA)
- Update release notes for 8u292-b04.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b05 (EA)
- Update release notes for 8u292-b05.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.1.ea
changelog:
- Re-organise S/390 patches for upstream submission, separating 8u upstream from Shenandoah fixes.
- Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b05-0.2.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
- Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
- Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813 in 8u.
- Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are accurate.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b06 (EA)
- Update release notes for 8u292-b06.
- Require tzdata 2020f due to JDK-8259048
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b07-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b07 (EA)
- Update release notes for 8u292-b07.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b08-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b08 (EA)
- Update release notes for 8u292-b08.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u292-b09 (EA)
- Update release notes for 8u292-b09.
- Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-0
changelog:
- Update to aarch64-shenandoah-jdk8u292-b10 (GA)
- Update release notes for 8u292-b10.
- This tarball is embargoed until 2021-04-20 @ 1pm PT.
- Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b01-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b01 (EA)
- Update release notes for 8u302-b01.
- Switch to EA mode.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b02-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b02 (EA)
- Update release notes for 8u302-b02.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b03 (EA)
- Update release notes for 8u302-b03.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b03-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
- Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b04-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b04 (EA)
- Update release notes for 8u302-b04.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b05 (EA)
- Update release notes for 8u302-b05.
- Remove JDK-8266929/RH1960024 as now upstream.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b06 (EA)
- Update release notes for 8u302-b06.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
- Update to aarch64-shenandoah-jdk8u302-b07 (EA)
- Update release notes for 8u302-b07.
- Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
- Update to aarch64-shenandoah-jdk8u302-b08 (EA)
- Update release notes for 8u302-b08.
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-07-20 @ 1pm PT.
- Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b01-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b01 (EA)
- Update release notes for 8u312-b01.
- Switch to EA mode.
- Remove "-clean" suffix as no 8u312 builds are unclean.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b02-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b02 (EA)
- Update release notes for 8u312-b02.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b03-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b03 (EA)
- Update release notes for 8u312-b03.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b04-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b04 (EA)
- Update release notes for 8u312-b04.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b05 (EA)
- Update release notes for 8u312-b05.
- Related: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
- Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
- Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
- Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
- Add patch to improve performance of common separators in Scanner.useLocale
- Move alt-java patch to correct section.
- Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
- Update to aarch64-shenandoah-jdk8u312-b07 (EA)
- Update release notes for 8u312-b07.
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-10-19 @ 1pm PT.
- Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
- Update to aarch64-shenandoah-jdk8u322-b04 (EA)
- Update release notes for 8u322-b04.
- Require tzdata 2021c as of JDK-8274407.
- Switch to EA mode.
- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
- Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
- Update to aarch64-shenandoah-jdk8u322-b06 (EA)
- Update release notes for 8u322-b06.
- Switch to GA mode for final release.
- Require tzdata 2021e as of JDK-8275766.
- Update tarball generation script to use git following shenandoah-jdk8u's move to github
- Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
- Update to shenandoah-jdk8u332-b01 (EA)
- Update release notes for shenandoah-8u332-b01.
- Switch to EA mode.
- Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
- Update to shenandoah-jdk8u332-b06 (EA)
- Update release notes for shenandoah-8u332-b06.
- Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
- Update to shenandoah-jdk8u332-b09 (GA)
- Update release notes for 8u332-b09.
- Switch to GA mode for final release.
- This tarball is embargoed until 2022-04-19 @ 1pm PT.
- Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
- Update to shenandoah-jdk8u342-b07
- Update release notes for shenandoah-8u342-b07.
- Print release file during build, which should now include a correct SOURCE value from .src-rev
- Update tarball script with IcedTea GitHub URL and .src-rev generation
- Use "git apply" with patches in the tarball script to allow binary diffs
- Remove redundant "REPOS" variable from tarball script
- Include script to generate bug list for release notes
- Update tzdata requirement to 2022a to match JDK-8283350
- Rebase JDK-8186464 patch so it applies after JDK-8190753
- Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
- Update to shenandoah-jdk8u345-b01 (GA)
- Update release notes for 8u345-b01.
- Resolves: rhbz#2112383


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
- Update to shenandoah-jdk8u352-b08 (GA)
- Update release notes for shenandoah-8u352-b08.
- * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
- Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
- Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
- Add test to ensure timezones can be translated
- Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.1.ea
changelog:
- Update to shenandoah-jdk8u362-b07 (EA)
- Update release notes for shenandoah-8u362-b07.
- Switch to EA mode for 8u362 pre-release builds.
- Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
- Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
- Update TestTranslations.java to test the new America/Ciudad_Juarez zone
- Resolves: rhbz#2150191


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-1
changelog:
- Update to shenandoah-jdk8u352-b08 (GA)
- Update release notes for shenandoah-8u352-b08.
- Fix broken links and missing release notes in older releases.
- Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
  - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
  - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
  - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
- Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
- Update to shenandoah-jdk8u372-b07 (GA)
- Update release notes for shenandoah-8u372-b07.
- Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
- Update generate_tarball.sh to add support for passing a boot JDK to the configure run
- Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
- Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
- Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
- ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
- Resolves: rhbz#2185182
- Resolves: rhbz#2159458


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b01-0.1.ea
changelog:
- Update to shenandoah-jdk8u382-b01 (EA)
- Update release notes for shenandoah-8u382-b01.
- Switch to EA mode.
- Remove JDK-8271199 patch which is now upstream.
- Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b04-0.1.ea
changelog:
- Update to shenandoah-jdk8u382-b04 (EA)
- Update release notes for shenandoah-8u382-b04.
- Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
- Update to shenandoah-jdk8u372-b05 (GA)
- Update release notes for shenandoah-8u372-b05.
- ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
- Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.382.b05-1
changelog:
- Update to shenandoah-jdk8u382-b05 (GA)
- Update release notes for shenandoah-8u382-b05.
- ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
- Resolves: rhbz#2221106


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.392.b08-1
changelog:
- For non debug subpackages, ghosted all alternatives (rhbz1649776)
- For non system JDKs, if-outed versionless provides.
- Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
- Related: RHEL-11319


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
- Update to shenandoah-jdk8u392-b08 (GA)
- Update release notes for shenandoah-8u392-b08.
- Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
- Update bug URL for RHEL to point to the Red Hat customer portal
- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
- Regenerate PR2462 patch following JDK-8315135
- Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
- Add missing JFR alternative ghost
- Move jcmd to the headless package
- ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
- Resolves: RHEL-12212
- Resolves: RHEL-13574
- Resolves: RHEL-13575
- Resolves: RHEL-13576
- Resolves: RHEL-11319
- Resolves: RHEL-13577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-3
changelog:
- Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
- Resolves: RHEL-19630


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b01-0.1.ea
changelog:
- Update to shenandoah-jdk8u402-b01 (EA)
- Update release notes for shenandoah-8u402-b01.
- Switch to EA mode.
- Sync NEWS with vanilla branch version.
- Related: RHEL-17914


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.1.ea
changelog:
- Update to shenandoah-jdk8u402-b06 (GA)
- Update release notes for shenandoah-8u402-b06.
- Drop local copy of JDK-8312489 which is now included upstream
- Switch to GA mode.
- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
- Resolves: RHEL-17914
- Resolves: RHEL-20965


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
- Update to shenandoah-jdk8u412-b01 (EA)
- Update release notes for shenandoah-8u412-b01.
- Switch to EA mode.
- Related: RHEL-30926


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
- Invoke xz in multi-threaded mode
- generate_source_tarball.sh: Add WITH_TEMP environment variable
- generate_source_tarball.sh: Multithread xz on all available cores
- generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
- generate_source_tarball.sh: Update comment about tarball naming
- generate_source_tarball.sh: Reformat comment header
- generate_source_tarball.sh: Reformat and update help output
- generate_source_tarball.sh: Do a shallow clone, for speed
- generate_source_tarball.sh: Eliminate some removal prompting
- generate_source_tarball.sh: Make tarball reproducible
- generate_source_tarball.sh: Prefix temporary directory with temp-
- generate_source_tarball.sh: Remove temporary directory exit conditions
- generate_source_tarball.sh: Set compile-command in Emacs
- generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
- generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
- generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
- generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
- generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
- generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
- Use backward-compatible patch syntax
- generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
- generate_source_tarball.sh: Remove trailing period in echo
- generate_source_tarball.sh: Use long-style argument to grep
- generate_source_tarball.sh: Add license
- generate_source_tarball.sh: Add indentation instructions for Emacs
- Remove -T0 argument from systemtap tar invocation
- Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
changelog:
- Turn off xz multi-threading on i686 as it fails with an out of memory error
- Normalise whitespace
- Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
- generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
- generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
- generate_source_tarball.sh: Adapt version logic to work with 8u
- generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
- generate_source_tarball.sh: Update examples in header for clarity
- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
- Move maintenance scripts to a scripts subdirectory
- icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
- jconsole.desktop.in: Restored by running icedtea_sync.sh
- policytool.desktop.in: Likewise.
- Restore IcedTea sources correctly in spec file
- discover_trees.sh: Set compile-command and indentation instructions for Emacs
- discover_trees.sh: shellcheck: Do not use -o (SC2166)
- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
- generate_source_tarball.sh: Add authorship
- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
- generate_source_tarball.sh: Handle an existing checkout
- generate_source_tarball.sh: Sync indentation with java-21-openjdk version
- generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
- Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.1.ea
changelog:
- Update to shenandoah-jdk8u412-b07 (EA)
- Update release notes for shenandoah-8u412-b07.
- Require tzdata 2024a due to upstream inclusion of JDK-8322725
- Only require tzdata 2023d for now as 2024a is unavailable in buildroot
- Resolves: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-1
changelog:
- Update to shenandoah-jdk8u412-b08 (GA)
- Update release notes for shenandoah-8u412-b08.
- Complete release note for Certainly roots
- Switch to GA mode.
- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
- Related: RHEL-30926


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-5
changelog:
- Introduced ssbd_arches to denote architectures with SSBD mitigation (currently only x86_64)
- Introduced nm-based check to verify alt-java on ssbd_arches is patched, and no other alt-java or java binaries are patched
- RH1750419 patch amended to emit a warning on architectures where alt-java is the same as java
- Resolves: rhbz#1901695


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.1-0.0.ea
changelog:
- Update to jdk-11.0.10.0+1
- Update release notes to 11.0.10.0+1
- Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
- Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags.
- Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with Fedora version.
- Cleanup debug package descriptions and version number placement.
- Switch to EA mode for 11.0.10 pre-release builds.
- Drop JDK-8222286 & JDK-8254177 as applied upstream
- Explicitly request bundled Harfbuzz (too risky to change this so late in the RHEL 7 lifecycle)
- Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
- Update to jdk-11.0.10.0+2
- Update release notes to 11.0.10.0+2
- Update tarball generation script to use PR3818 which handles JDK-8171279 changes
- Drop JDK-8250861 as applied upstream.
- Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.2-0.0.ea
changelog:
- Completely revert hacks from previous release, using buildver in configure and tzdata 2020b
- Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.5-0.0.ea
changelog:
- Update to jdk-11.0.10.0+5
- Update release notes to 11.0.10.0+5
- Drop JDK-8222527 as applied upstream.
- Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.8-0.0.ea
changelog:
- Update to jdk-11.0.10.0+8
- Update release notes to 11.0.10.0+8 and add missing JDK-8245051 from b04.
- Resolves: rhbz#1903907


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-0
changelog:
- Update to jdk-11.0.10.0+9
- Update release notes to 11.0.10.0+9
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-01-19 @ 1pm PT.
- Resolves: rhbz#1908970


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
- Perform static library build on a separate source tree with bundled image libraries
- Make static library build optional
- Based on initial work by Severin Gehwolf
- Resolves: rhbz#1930527


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.2-0.1.ea
changelog:
- Debug builds need to find their documentation from the release build.
- RHEL 7 builds still include a doc package for debug builds, though debug builds do not build docs.
- Resolves: rhbz#1930527


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:11.0.11.0.3-0.1.ea
changelog:
- Fix issue where CheckVendor.java test erroneously passes when it should fail.
- Add proper quoting so '&' is not treated as a special character by the shell.
- Resolves: rhbz#1938082


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-0
changelog:
- Update to jdk-11.0.11.0+9
- Update release notes to 11.0.11.0+9
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-04-20 @ 1pm PT.
- Resolves: rhbz#1940228


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.0.ea
changelog:
- Update to jdk-11.0.12.0+1
- Update release notes to 11.0.12.0+1
- Switch to EA mode for 11.0.12 pre-release builds.
- Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
- Remove local JDK-8187450 backport as now included upstream.
- Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
- Update to jdk-11.0.12.0+4
- Update release notes to 11.0.12.0+4
- Correct bug ID JDK-8264846 to intended ID of JDK-8264848
- Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
- Update to jdk-11.0.12.0+6
- Update release notes to 11.0.12.0+6
- Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
- Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-0
changelog:
- Update to jdk-11.0.12.0+7
- Update release notes to 11.0.12.0+7
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-07-20 @ 1pm PT.
- Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-3
changelog:
- Restructure the build so a minimal initial build is then used for the final build (with docs)
- This reduces pressure on the system JDK and ensures the JDK being built can do a full build
- Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.1-0.1.ea
changelog:
- Update to jdk-11.0.13.0+1
- Update release notes to 11.0.13.0+1
- Update tarball generation script to use git following OpenJDK 11u's move to github
- Switch to EA mode for 11.0.13 pre-release builds.
- Remove non-Free test from source tarball.
- Related: rhbz#1999936


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-1
changelog:
- Update to jdk-11.0.12.0+8
- Update release notes to 11.0.12.0+8
- Switch to GA mode for final release.
- This tarball is embargoed until 2021-10-19 @ 1pm PT.
- Resolves: rhbz#2012332


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
- Replaced hardcoded 11 by featurever where appropriate
- Fixed comment of `for slowdebug` to correct `any debug`
- Related: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
- Update to jdk-11.0.14.0+8
- Update release notes to 11.0.14.0+8
- Switch to EA mode for 11.0.14 pre-release builds.
- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
- Rename blacklisted.certs to blocked.certs following JDK-8253866
- Resolves: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
- Update to jdk-11.0.14.0+9
- Update release notes to 11.0.14.0+9
- Switch to GA mode for final release.
- This tarball is embargoed until 2022-01-18 @ 1pm PT.
- Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.1-0.1.ea
changelog:
- Update to jdk-11.0.15.0+1
- Update release notes to 11.0.15.0+1
- Switch to EA mode for 11.0.15 pre-release builds.
- Related: rhbz#2047531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
- Update to jdk-11.0.15.0+9
- Update release notes to 11.0.15.0+9
- Switch to GA mode for release
- ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
- Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
- Remove security items from release notes that were only in 17u and N/A for 11u
- Related: rhbz#2073422


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
- Add additional patch during tarball generation to align tests with ECC changes
- Related: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
- Update to jdk-11.0.16+8
- Update release notes to 11.0.16+8
- Use same tarball naming style as java-17-openjdk and java-latest-openjdk
- Drop JDK-8284920 patch now upstreamed
- Print release file during build, which should now include a correct SOURCE value from .src-rev
- Update tarball script with IcedTea GitHub URL and .src-rev generation
- Use "git apply" with patches in the tarball script to allow binary diffs
- Include script to generate bug list for release notes
- Update tzdata requirement to 2022a to match JDK-8283350
- Make use of the vendor version string to store our version & release rather than an upstream release date
- Explicitly require crypto-policies during build and runtime for system security properties
- Resolves: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-1
changelog:
- Update to jdk-11.0.16.1+1
- Update release notes to 11.0.16.1+1
- Add patch to provide translations for Europe/Kyiv added in tzdata2022b
- Add test to ensure timezones can be translated
- Resolves: rhbz#2119512


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
- Update to jdk-11.0.17+1
- Update release notes to 11.0.17+1
- Switch to EA mode for 11.0.17 pre-release builds.
- Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
- Include Aleksey's patch for JDK-8291053 to try and get HarfBuzz to build again
- Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.1.ea
changelog:
- Try to build using system HarfBuzz to avoid build failures with 4.4.1 & gcc 4.8.5
- Related: rhbz#2130373


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
- Update to jdk-11.0.17+8 (GA)
- Update release notes to 11.0.17+8
- Switch to GA mode for release
- Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
changelog:
- Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
- Update CLDR data with Europe/Kyiv (JDK-8293834)
- Drop JDK-8292223 patch which we found to be unnecessary
- Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
- Remove unneeded JDK-8291053 patch as we no longer build in-tree HarfBuzz
- Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.1.ea
changelog:
- Update to jdk-11.0.18+1
- Update release notes to 11.0.18+1
- Switch to EA mode for 11.0.18 pre-release builds.
- Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
- Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
- Update to jdk-11.0.18+9
- Update release notes to 11.0.18+9
- Drop local copy of JDK-8293834 now this is upstream
- Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
- Update TestTranslations.java to test the new America/Ciudad_Juarez zone
- Resolves: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
- Update to jdk-11.0.18+10 (GA)
- Update release notes to 11.0.18+10
- Switch to GA mode for release
- ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
- Related: rhbz#2150192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
- Update to jdk-11.0.19.0+7
- Update release notes to 11.0.19.0+7
- Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
- Update generate_tarball.sh to add support for passing a boot JDK to the configure run
- Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
- Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
- Rebase RH1750419 alt-java patch against 11.0.19+6
- ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
- Resolves: rhbz#2185182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.1-0.1.ea
changelog:
- Update to jdk-11.0.20+1 (EA)
- Update release notes to 11.0.20+1
- Switch to EA mode
- Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
- Add missing Swing release note
- Related: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
changelog:
- Update to jdk-11.0.20.0+8 (GA)
- Update release notes to 11.0.20.0+8
- Switch to GA mode for release
- ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
- Resolves: rhbz#2221106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
- Update to jdk-11.0.20.1+1 (GA)
- Update release notes to 11.0.20.1+1
- Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
- Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
- Update openjdk_news script to specify subdirectory last
- Add missing discover_trees script required by openjdk_news
- Synchronise runtime and buildtime tzdata requirements
- Update README.md to match the version in later RHEL releases
- Resolves: rhbz#2236229


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.21.0.9-1
changelog:
- For non debug subpackages, ghosted all alternatives (rhbz1649776)
- For non system JDKs, if-outed versionless provides.
- Aligned versions to be %{epoch}:%{version}-%{release} instead of chaotic
- Related: RHEL-11320


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-1
changelog:
- Update to jdk-11.0.21+9 (GA)
- Update release notes to 11.0.21+9
- Remove system crypto policy patch which doesn't belong on RHEL 7 with no system policies
- Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
- Update bug URL for RHEL to point to the Red Hat customer portal
- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
- Apply all patches using -p1
- Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
- Add missing JFR alternative ghost
- Move jcmd to the headless package
- Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
- Disable the serviceability agent on Zero architectures even when the architecture itself is supported
- ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
- Resolves: RHEL-12217
- Resolves: RHEL-12910
- Resolves: RHEL-12913
- Resolves: RHEL-11320
- Resolves: RHEL-13227
- Resolves: RHEL-13217


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
- Restore %{epoch}:%{javaver} versioning to jre, java, jre-headless, java-headless, java-devel & java-sdk
- Resolves: RHEL-19642


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.6-0.1.ea
changelog:
- Update to jdk-11.0.22+6 (EA)
- Update release notes to 11.0.22+6
- Switch to EA mode
- Drop local copy of JDK-8312489 which is now included upstream
- Resolves: RHEL-21031


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
- Update to jdk-11.0.22+7 (GA)
- Update release notes to 11.0.22+7
- Switch to GA mode for release
- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
- Resolves: RHEL-20966


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.1-0.1.ea
changelog:
- Update to jdk-11.0.23+1 (EA)
- Update release notes to 11.0.23+1
- Switch to EA mode
- Speed up PPC build by removing ppc64le --with-jobs=1 workaround


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
- Update to jdk-11.0.23+9 (GA)
- Update release notes to 11.0.23+9
- Switch to GA mode for release
- Require tzdata 2024a due to upstream inclusion of JDK-8322725
- Only require tzdata 2023d for now as 2024a is unavailable in buildroot
- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
- Resolves: RHEL-30914


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-2
changelog:
- Fix 11.0.22 release date in NEWS
- Restore ppc64le --with-jobs=1 workaround to avoid flaky ppc builds


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.6-0.0.ea
changelog:
- Update to jdk-11.0.9+6 (EA)
- Update tarball generation script to use PR3802, handling JDK-8233228 & JDK-8177334
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.8-0.0.ea
changelog:
- Update to jdk-11.0.9+8 (EA)
- Remove JDK-8252258/RH1868406 now applied upstream.
- Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.10-0.1.ea
changelog:
- Set vendor property and vendor URLs
- Made URLs to be preconfigured by OS
- Moved vendor_version_string to a better place
- Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-0
changelog:
- Update to jdk-11.0.9+11
- Update release notes for 11.0.9 release.
- Add backport of JDK-8254177 to update to tzdata 2020b
- Require tzdata 2020b due to resource changes in JDK-8254177
- This tarball is embargoed until 2020-10-20 @ 1pm PT.
- Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-1
changelog:
- Move all license files to NVR-specific JVM directory.
- This bad placement was killing parallel installability and thus having a bad impact on leapp, if used.
- Resolves: rhbz#1896609


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.9.11-1
changelog:
- Update to jdk-11.0.9.1+1
- RPM version stays at 11.0.9.11 so as to not break upgrade path.
- Adds a single patch for JDK-8250861.
- Resolves: rhbz#1895275


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-2
changelog:
- Add backport of JDk-8222537 so the Host header is sent when using proxies.
- Resolves: rhbz#1869530


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-8
changelog:
- Fix vlock doesn't perform PAM account management or credential reinitialization
  Resolves: #1032140


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.15.5-14
changelog:
- Replace CtrlL_Lock with Caps_Lock in generated us.map
  Resolves: #1441411
- Improve man pages and usage messages quality and consistency
  Resolves: #949015


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-8
changelog:
- Powerdevil: do not notify about a non existent action
  Resolves: bz#1289149
- Plasma taskmanager: close context menu when task is closed
  Resolves: bz#1262603


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-10
changelog:
- Fix grouping of tasks in taskmanager applet
  Resolves: bz#1348917
- Fix unlocking of kscreenlocker, unlock it just once
  Resolves: bz#1333441


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-13
changelog:
- Sanitise notification HTML
  Resolves: bz#1568853

- Increase cpu buffer size in ksysguard
  Resolves: bz#1611762


author: Jan Grulich <jgrulich@redhat.com> - 4.11.19-14
changelog:
- Do not show disabled buttons in Plastik decoration theme
  Resolves: bz#1677641

- Taskmanager: dismiss group when application is closed and there is enough space
  Resolve: bz#1698048


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-43
changelog:
- module-setup: re-fix 99kdumpbase network dependency
- kdumpctl: bail out immediately if host key verification failed


author: Bhupesh Sharma <bhsharma@redhat.com> 2.0.15-48
changelog:
- dracut-module-setup.sh: ensure cluster info is ready before query.
- dracut-module-setup.sh: improve get_alias()


author: Siteshwar Vashisht <svashisht@redhat.com> - 20120801-37
changelog:
- Add configuration option to enable signal bubbling for backward compatibility
  Resolves: #1484937


author: Kamil Dudka <kdudka@redhat.com> - 20120801-137
changelog:
- Increase the release number by 100 to make sure it stays higher than in RHEL-6
  Related: #1484937


author: John Dennis <jdennis@redhat.com> - 2.4.1-8
changelog:
- Add explicit minimum dependency on glib2 2.42,
  for some reason RPM is not automatically detecting the dependency
  Resolves: #1254989


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-3
changelog:
- Resolves: #1634267 - ECP signature check fails with
                       LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when assertion signed
                       instead of response


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-4
changelog:
- Resolves: #1730009 - lasso includes "Destination" attribute in SAML
                       AuthnRequest populated with SP
                       AssertionConsumerServiceURL when ECP workflow
                       is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-5
changelog:
- Resolves: #1719014 - Expired certificate prevents tests from running
- Actually apply the patch file for the previous build
- Related: #1730009 - lasso includes "Destination" attribute in SAML
                       AuthnRequest populated with SP
                       AssertionConsumerServiceURL when ECP workflow
                       is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-6
changelog:
- Resolves: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                       vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-7
changelog:
- Fix Coverity warning introduced by the previous patch
- Related: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                      vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 1.1.29-1
changelog:
- Resolves: rhbz#1393810 - Rebase libldb to enable samba rebase to
                           version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.2-1
changelog:
- Resolves: rhbz#1470056 - Rebase libldb to enable samba rebase to
                           version 4.7.x


author: Fridolin Pokorny <fpokorny@redhat.com> - 458-3
changelog:
- Expanded lessecho usage (#948597)
- Added lessfilter info to man (#948597)
- Expanded lesskey usage (#948597)
- Added --old-bot to help (#948597)


author: Jozef Mlich <jmlich@redhat.com> - 458-5
changelog:
- fixing regression in 72dfd3f63594e1d4c9416180a95c47ae583934c6
  incorrect parsing of commandline arguments
- Resolves #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-8
changelog:
- changes introduced in less-458-old-bot-in-help.patch
  wasn't compiled in. It is necessary to use mkhelp tool.
  Resolves: #948597


author: Jozef Mlich <jmlich@redhat.com> - 458-9
changelog:
- The --use-backslash option documented in the man page
  was missing from online help for less.
  Resolves: #1109090


author: Luboš Uhliarik <luhliari@redhat.com> - 4.4.8-6
changelog:
- Fix lftp does not follow http redirect (302) in mirror mode (#1181580)
- Fix lftp exists randomly when "cmd:fail-exit" is set (#1193984)
- Added RFE - lftp configurations for restricting each SSL/TLS 
  version (#1182987)
- Fixed bogus dates of this SPEC


author: Michal Ruprich - 4.4.8-9
changelog:
- Resolves: #1374653 -  File size decreases when synchronizing folders with a sftp account using lftp


author: Michal Ruprich - 4.4.8-10
changelog:
- Related: #1374653 - File size decreases when synchronizing folders with a sftp account using lftp
                    - Patch edited so that it corresponds to upstream


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-11
changelog:
- Resolves: #1514815 - lftp doesn't seems to consider 'set net:max-retries'
- Resolves: #1556675 - "get" command with lftp does not fail on net:max-retries


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-12
changelog:
- Resolves: #1611641 - CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-13
changelog:
- Resolves: #1573296 - lftp with ssl gives error Fatal error: gnutls_record_recv: The TLS connection was non-properly terminated


author: Karel Zak <kzak@redhat.com> 2.23.2-59
changelog:
- fix #1618711 - exec option in mount unable to override the implicit noexec in user option
- fix #1616264 - Login to emergency shell failed


author: Karel Zak <kzak@redhat.com> 2.23.2-60
changelog:
- fix #1664752 - Bull (Atos) server lands up in invalid stty settings on the serial console after boot preventing login


author: Karel Zak <kzak@redhat.com> 2.23.2-61
changelog:
- #1203378 - Cannot use swapon with fallocated XFS swapfile
- #1632944 - blkid/lsblk does not recognize exfat filesystem without a label
- #1633657 - mount -a always tries to mount CIFS share subdir despite being already mounted
- #1639465 - Bad formatting in agetty.8 man page
- #1667942 - libsmartcols: scols_print_table_to_string() doesn't work
- #1678451 - Unable to mount to a directory that matches a dm device under /dev


author: Karel Zak <kzak@redhat.com> 2.23.2-62
changelog:
- fix #1734545 - blkid_get_dev() leak file descriptor to underlying block device
- fix #1712768 - lsmem segfaults on ppc64 wih -o
- fix #1690102 - setarch(8) does not check error return values properly.
- fix #1734261 - lscpu not showing Physical socket, chips information


author: Karel Zak <kzak@redhat.com> 2.23.2-64
changelog:
- fix #1788896 - Internal testsuite: libmount tests failed
- fix #1802240 - systemd-udev segmentation fault in crc32() at lib/crc32.c (libblkid)
- fix #1816183 - "mount -a" should ignore already mounted bind mounts.
- fix #1747710 - please backport the "uid=forget" and "gid=forget" UDF mount options to libmount
- fix #1784579 - RHEL-7: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit


author: Karel Zak <kzak@redhat.com> 2.23.2-65
changelog:
- fix #1826719 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir
- fix #1745657 - mismatch between spec file and uuidd runtime directory


author: Karel Zak <kzak@redhat.com> 2.23.2-65.el7_9.1
changelog:
- fix #1905956 - RHEL-7: chrt regression: unwanted 'nice' value reset on sched_setattr() [rhel-7.9.z]
- fix #1905954 - RHEL-7: chrt regression: unexpected default scheduler [rhel-7.9.z]
- fix #1883013 - RHEL-7: chrt command does not support the -R option [rhel-7.9.z]


author: Petr Sabata <psabata@redhat.com> - 0.6.20-1
changelog:
- 0.6.20 bump
- Repackaging prehistoric libexif-docs, introducing version string in filename
- Buildroot cleanup


author: Petr Šabata <contyk@redhat.com> - 0.6.21-1
changelog:
- 0.6.21 bump
- A security bugfixing release (CVE-2012-2812, CVE-2012-2813, CVE-2012-2814,
  CVE-2012-2836, CVE-2012-2837, CVE-2012-2840, CVE-2012-2841 & CVE-2012-2845)
- Drop the pre-generated docs and introduce a doc subpackage


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
- core: when restarting services, don't close fds (#1803802)
- unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
- tests: add basic journal test (#1803802)
- tests: add regression test for `systemctl restart systemd-journald` (#1803802)
- tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-74
changelog:
- sd-bus: bump message queue size again (#1770158)
- unit: fix potential use of cgroup_path after free() when freeing unit (#1760149)
- add test for ExecStopPost (#1733998)
- core: when restarting services, don't close fds (#1757704)
- unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1757704)
- tests: add basic journal test (#1757704)
- tests: add regression test for `systemctl restart systemd-journald` (#1757704)
- tests: add test that journald keeps fds over termination by signal (#1757704)
- nss-util: silence warning about deprecated RES_USE_INET6 (#1799002)
- journal: do not trigger assertion when journal_file_close() get NULL (#1786046)
- mount: don't propagate errors from mount_setup_unit() further up (#1804757)
- mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1804757)
- fix the fix for #1691511 (#1804757)
- v3: Properly parsing SCSI Hyperv devices (#8509) (#1809053)
- Consider smb3 as remote filesystem (#1811700)
- mount: don't add Requires for tmp.mount (#1813270)
- sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1769928)
- sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1812889)
- sd-journal: remove the dead code and actually fix #14695 (#1812889)
- swap: adjust swap.c in a similar way to what we just did to mount.c (#1749621)
- swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749621)
- core: add a new unit file setting CollectMode= for tweaking the GC logic (#1817576)
- run: add "-G" as shortcut for "--property=CollectMode=inactive-or-failed" (#1817576)
- core: clarify that the CollectMode bus property is constant (#1817576)
- udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1814028)
- logind: check PolicyKit before allowing VT switch (#1797672)
- timer: don't use persietent file timestamps from the future (#6823) (#1769923)
- core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766477)
- bus_open leak sd_event_source when udevadm trigger。 (#1798503)
- journal-remote: split-mode=host, remove port from journal filename (#1244691)
- core: downgrade log message about inability to propagate cgroup release message (#1679934)
- units: move Before deps for quota services to remote-fs.target (#5627) (#1693374)
- set kptr_restrict=1 (#1689344)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
- core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
- core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
- core: coldplug possible nop_job (#1829754)
- core: make sure to restore the control command id, too (#1828953)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.1
changelog:
- device: make sure we emit PropertiesChanged signal once we set sysfs (#1793527)
- device: don't emit PropetiesChanged needlessly (#1793527)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.2
changelog:
- core: don't update unit description if it is already set to the same value (#1793527)
- unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#1793527)
- core: fix unnecessary fallback to the rescue mode caused by initrd-switch-root.service's exit status judgment error (#1825232)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-78.4
changelog:
- test: add a test/reproducer for BZ#1989245 (#1989245)
- strv: fix buffer size calculation in strv_join_quoted() (#1989245)
- install: refactor find_symlinks() and don't search for symlinks recursively (#1828758)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.1
changelog:
- Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.2
changelog:
- Resolves: rhbz#1854317 - sssd crashes after last update to sssd-common-1.16.4-37.el7_8.1 with servers configured with multiple domains [rhel-7.9.z]
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
- just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.3
changelog:
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
  (Previous attempt to fix this issue was incomplete)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.4
changelog:
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
  (Previous attempt to fix this issue was incomplete (again))


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.5
changelog:
- Resolves: rhbz#1859554 - Secondary LDAP group go missing from 'id' command on RHEL 7.8 with sssd-1.16.2-37.el7_8.1 [rhel-7.9.z]
  (Previous attempt to fix this issue was incomplete (again))
- just bumping the version to build for proper target


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.6
changelog:
- Resolves: rhbz#1899593 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr() [rhel-7.9.z]
- Resolves: rhbz#1888409 - sssd component logging is now too generic in syslog/journal [rhel-7.9.z]
- Resolves: rhbz#1852659 - sssd service is starting even though it is disabled state [rhel-7.9.z]
- Resolves: rhbz#1893443 - User lookups over the InfoPipe responder fail intermittently [rhel-7.9.z]
- Resolves: rhbz#1871288 - krb5_child denies ssh users when pki device detected [rhel-7.9.z]
- Resolves: rhbz#1853703 - Unexpected behavior and issue with filter_users/filter_groups option [rhel-7.9.z]
- Resolves: rhbz#1756240 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains [rhel-7.9.z]
- Resolves: rhbz#1851112 - LDAP bind can fail due to unconfigurable DNS server timeouts that inhibit SSSD failover [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.7
changelog:
- Resolves: rhbz#1875514 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [rhel-7.9.z]
- Resolves: rhbz#1772513 - SSSD is generating lot of LDAP queries in a very large environment [rhel-7.9.z]
- Resolves: rhbz#1736845 - [RFE] Backporting certificate matching rules for files, AD and LDAP provider [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.8
changelog:
- Resolves: rhbz#1910131 - sssd throwing error " Unable to parse name test' [1432158283]: The internal name format cannot be parsed" at debug_level 2 [rhel-7.9.z]
- Resolves: rhbz#1922244 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0. [rhel-7.9.z]
- Resolves: rhbz#1935685 - SSSD not detecting subdomain from AD forest (7.9z)
- Resolves: rhbz#1945552 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-7.9.z]
- Resolves: rhbz#1839972 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.9
changelog:
- Resolves: rhbz#1988463 - Missing search index for `originalADgidNumber` [rhel-7.9.z]
- Resolves: rhbz#1968330 - id lookup is failing intermittently
- Resolves: rhbz#1964415 - Memory leak in the simple access provider
- Resolves: rhbz#1985457 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.11
changelog:
- Resolves: rhbz#1968316 - SSSD: User authentication failing after server reboot.
- Resolves: rhbz#2000238 - disabled root ad domain causes subdomains to be marked offline
- Resolves: rhbz#1984591 - After sssd update to 1.16.5-10.el7_9.8.x86_64 the customer is facing slow connection/authentication (due to discovery of unexpected AD domains)


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.12
changelog:
- Resolves: rhbz#2006382 - IPA Intermittence fetching groups
- Resolves: rhbz#2006866 - sssd_be segfault due to empty forest root name
- Resolves: rhbz#2031729 - IPA clients fail to resolve override group names.
- Resolves: rhbz#2032867 - AD Domain in the AD Forest Missing after sssd latest update


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.13
changelog:
- Resolves: rhbz#2079441 - SSSD update prompts for smartcard pin twice - After update to 7.9 [rhel-7.9.z]
- Resolves: rhbz#2073352 - Use right sdap_domain in ad_domain_info_send [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.14
changelog:
- Resolves: rhbz#2097014 - SSSD -> sssd_be and sssd_ifp coredump [rhel-7.9.z]
- Resolves: rhbz#2107380 - sssd timezone issues sudonotafter [rhel-7.9.z]
- Resolves: rhbz#2116207 - SSSD starting offline after reboot [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.15
changelog:
- Resolves: rhbz#2149703 - smartcards: special characters must be escaped when building search filter [rhel-7.9.z]
- Resolves: rhbz#2149902 - EMBARGOED CVE-2022-4254 sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters [rhel-7.9.z]


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> 1.16.5-10.16
changelog:
- Resolves: RHEL-16003 - sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy [rhel-7.9.z]


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-6
changelog:
- Resolves: rhbz#1819013 - pam_sss reports PAM_CRED_ERR when providing wrong password for an existing IPA user, but this error's description is misleading
- Resolves: rhbz#1800571 - Multiples Kerberos ticket on RHEL 7.7 after lock and unlock screen


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-7
changelog:
- Resolves: rhbz#1835813 - sssd boots offline if symlink for /etc/resolv.conf is broken/missing
- Resolves: rhbz#1837545 - Users must be informed better when internal WATCHDOG terminates process.


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-8
changelog:
- Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
- Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
                           It is done in two steps (two different nsupdate messages).


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-10
changelog:
- Resolves: rhbz#1804005 - sssd doesn't follow the link order of AD Group Policy Management
- Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
- Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
- Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-4
changelog:
- disable TPACKET_V3 memory mapped packet capture on AF_PACKET socket, use TPACKET_V2 instead (#1085096)


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-5
changelog:
- display also first packet when capturing in cooked mode (#1176612)
- make sure that userland bpf filter interpreter is given snaplen such that size of
  cooked header is account for


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-6
changelog:
- libpcap now correctly recognizes Netlink datalink type (#1031974)
- fix vlan tagged packet filtering (#1079525)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.12-1
changelog:
- downloader: Allow max one resume + nicer message if xattr cannot be set (RhBug: 1130685)
- downloader: Resume only files that were originaly downloaded by Librepo (RhBug: 1130685)
- downloader: Show also calculated checksums in error message about bad checksum
- Python: Return all strings in unicode


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.13-1
changelog:
- Fix ABI compatibility (RhBug: 1185180)
- fastestmirror: Add LRO_FASTESTMIRRORTIMEOUT option
- downloader: Move broken mirror at the end of the list of mirrors (RhBug: 1183998)
- Make building tests and docs optional
- librepo: Don't download remote mirrorlist/metalink when LRO_LOCAL is specified (Resolves #41)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.14-1
changelog:
- tests: Use g_assert_cmpuint instead of ck_assert_uint_eq (Pullrequest #43)
- Add LRO_OFFLINE
- Python: Handle: Raise ValueError instead of TypeError when an unknown option is specified
- Python: Result: Use ValueError instead of TypeError when an unknown option value is specified
- Add LR_VERSION constant with version string
- python: Import contants from C librepo module in a loop
- repoconf: Add support for failover and skip_if_unavailable options
- handle: Change of LRO_LOCAL causes invalidation of internal mirrorlist (related to RhBug: 1188600)
- Load local mirrorlists when LRO_LOCAL is on (related to RhBug: 1188600)
- util: Add lr_is_local_path()
- New module repoconf for reading *.repo files
- Add LRO_HTTPHEADER option (RhBug: 1181123)


author: Tomas Mlcoch <tmlcoch at redhat.com> - 1.7.15-1
changelog:
- Do not inlude header in the body output (RhBug: 1207685)
- metalink: Proper error handling
- New LRR_RPMMD_* contants
- Support for client certificates
- Use 'metadata in the rpm-md format' instead of 'yum metadata' (Issue #51)
- CMakeLists.txt: do not check for CXX
- build: Use solely pkg-config to find glib


author: Colin Walters <tmlcoch@redhat.com> - 1.7.16-1
changelog:
- Add LRI_LOWSPEEDTIME and LRI_LOWSPEEDLIMIT
- downloader: Don't consider CURLE_RECV_ERROR and CURLE_SEND_ERROR as fatal errors (RhBug: 1219817)
- test_repoconf: Fix SIGSEGV in repoconf_assert_na (RhBug: 1222471)
- repoconf: Proper handling of gint64 and guint64 types
- build: Be compatible with cmake 2.8
- handle: Do not free temporary error msg if there is no one (RhBug: 1219822)
- utils/make_rpm.sh: Accept rpmbuild options as second argument (Issue #49)
- Python: call lr_global_init() during module initialization
- Add global function log_set_file that allow user to set a file where logs will be written (Issue #53)
- util: Honor RFC 3986 (Issue #55)


author: Marek Blaha <mblaha@redhat.com> - 1.8.1-1
changelog:
- Add yumrecord substitution mechanism (mluscon)
- Fix a memory leak in signature verification (cwalters)
- Add new option LRO_FTPUSEEPSV
- downloader prepare_next_transfer(): simplify long line
- downloader prepare_next_transfer(): add missing error check
- downloader prepare_next_transfer(): cleanup error path
- downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
- handle: Don't use proxy cache for downloads of metalink/mirrorlist
- handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
- downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
- Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
- New test: always try to download from the fastest mirror (Alexander Todorov)


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
- Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
- Resolves: rhbz#1553406 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted
- Resolves: rhbz#1572425 shared IKE SA leads to rekey interop issues


author: Paul Wouters <pwouters@redhat.com> - 3.25-1
changelog:
- Resolves: rhbz#1591817 rebase libreswan to 3.25
- Resolves: rhbz#1536404 CERT_PKCS7_WRAPPED_X509 error
- Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
- Resolves: rhbz#1574011 libreswan is missing a Requires: unbound-libs >= 1.6.6


author: Paul Wouters <pwouters@redhat.com> - 3.25-2
changelog:
- Resolves: rhbz#1597322 Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors


author: Paul Wouters <pwouters@redhat.com> - 3.25-5
changelog:
- Resolves: rhbz#1639404 Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth
- Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N
- Resolves: rhbz#1629902 libreswan assertion failed when OAKLEY_KEY_LENGTH is zero for IKE using AES_CBC
- Resolves: rhbz#1623279 [abrt] [faf] libreswan: strncpy(): /usr/libexec/ipsec/pluto killed by 11
- Resolves: rhbz#1625303 config: recursive include check doesn't work
- Resolves: rhbz#1664521 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits


author: Paul Wouters <pwouters@redhat.com> - 3.25-6
changelog:
- Resolves: rhbz#1630355 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N [updated]
- Resolves: rhbz#1679735 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure


author: Paul Wouters <pwouters@redhat.com> - 3.25-7
changelog:
- Resolves: rhbz#1673105 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart


author: Paul Wouters <pwouters@redhat.com> - 3.25-8
changelog:
- Resolves: rhbz#1686991 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE


author: Paul Wouters <pwouters@redhat.com> - 3.25-9
changelog:
- Resolves: rhbz#1724200 libreswan: XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.25-12.1
changelog:
- a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985024)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
- curl consumes too much memory during scp download (#1080459)
- prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
- session: avoid printing misleading debug messages (#1503294)
- scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
- fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
- fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
- fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
- fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
- fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
- fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
- fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Tony Asleson <tasleson@redhat.com> - 1.8.1-2
changelog:
- https://bugzilla.redhat.com/show_bug.cgi?id=1872745
- https://bugzilla.redhat.com/show_bug.cgi?id=1903665


author: David Shea <dshea@redhat.com> - 0.4.1-4
changelog:
- Merge fixes from lp:timezonemap
- Add cc-timezone-location.h to timezonemapincludes_HEADERS so it gets installed (iain.lane)
- Set en_name correctly (iain.lane)
- Don't call g_type_init() on glib >= 2.35; it's deprecated (iain.lane)


author: David Shea <dshea@redhat.com> - 0.4.2-6
changelog:
- Updated the time zone map images
- Updated the city data from geonames.org
- Fix a memory leak and potential crash with the locations list
- Cycle through a smaller list of map locations on repeated clicks


author: David Shea <dshea@redhat.com> - 0.4.4-1
changelog:
- Fixes for LP#1440157:
  Port to libsoup directly for geoname results
  Fix some memory leaks
  Do not reuse GCancellables
- Upstream merges of SVG update and constrained location cycles


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-29
changelog:
- qemu: Forcibly mknod() even if it exists (rhbz#1752978)
- qemu_process: fix starting VMs if machine group has limited cpuset.cpus (rhbz#1746517)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-30
changelog:
- nwfilter: Remove redundant check if object exists (rhbz#1766475)
- RHEL: qemu: Enable virt-ssbd for host-model with old QEMU (rhbz#1745181)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-31
changelog:
- process: wait longer on kill per assigned Hostdev (rhbz#1771204)
- process: wait longer 5->30s on hard shutdown (rhbz#1771204)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-32
changelog:
- qemu: Don't emit SUSPENDED_POSTCOPY event on destination (rhbz#1791886)
- node_device_conf: Don't leak @physical_function in virNodeDeviceGetPCISRIOVCaps (rhbz#1792831)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-34
changelog:
- vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (rhbz#1815269)
- vmx: make 'fileName' optional for CD-ROMs (rhbz#1815269)
- RHEL: Fix migration on AMD hosts with old QEMU (rhbz#1815572)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35
changelog:
- qemu: don't take agent and monitor job for shutdown (CVE-2019-20485)
- qemu: don't hold a monitor and agent job for reboot (CVE-2019-20485)
- qemu: don't hold monitor and agent job when setting time (CVE-2019-20485)
- qemu: remove use of qemuDomainObjBeginJobWithAgent() (CVE-2019-20485)
- qemu: remove qemuDomainObjBegin/EndJobWithAgent() (CVE-2019-20485)
- storage: Fix daemon crash on lookup storagepool by targetpath (CVE-2020-10703)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
- virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support (rhbz#1823976)
- virDevMapperGetTargetsImpl: quit early if device is not a devmapper target (rhbz#1823976)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.1
changelog:
- qemu: end the agent job in qemuDomainSetTimeAgent (rhbz#1844952)
- util: string: Introduce macro for automatic string lists (rhbz#1839992)
- util: Rework virStringListAdd (rhbz#1839992)
- qemu: Create multipath targets for PRs (rhbz#1839992)
- util: Move virIsDevMapperDevice() to virdevmapper.c (rhbz#1839992)
- virDevMapperGetTargetsImpl: Check for dm major properly (rhbz#1839992)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.3
changelog:
- rpc: gendispatch: handle empty flags (CVE-2020-25637)
- rpc: add support for filtering @acls by uint params (CVE-2020-25637)
- rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
- qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
- conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1868549)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.4
changelog:
- virdevmapper.c: Join two WITH_DEVMAPPER sections together (rhbz#1933557)
- virDevMapperGetTargetsImpl: Use VIR_AUTOSTRINGLIST (rhbz#1933557)
- virdevmapper: Don't use libdevmapper to obtain dependencies (rhbz#1933557)
- virdevmapper: Don't cache device-mapper major (rhbz#1933557)
- virdevmapper: Handle kernel without device-mapper support (rhbz#1933557)
- virdevmapper: Ignore all errors when opening /dev/mapper/control (rhbz#1933557)
- virdevmapper: fix stat comparison in virDMSanitizepath (rhbz#1933557)
- virDevMapperGetTargetsImpl: Use correct length when copying into dm.name (rhbz#1933557)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-10
changelog:
- Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157671)
- Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
  (bug #1157671)
- Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
  handling) (bug #1157671)
- Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
  (bug #1157671)
- Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
  handling) (bug #1157671)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-11
changelog:
- Fix a crash in the VNC server library on connecting an IPv4 client if the
  server could not start listening on an IPv6 socket (bug #1314814)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-13
changelog:
- Fix CVE-2018-15127 (Heap out-of-bounds write in
  rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662996)


author: Rahul Sundaram <sundaram@fedoraproject.org> - 0.3.0-1
changelog:
- upstream release 0.3.0
- enable gif2webp
- add build requires on giflib-devel and libtiff-devel
- use make_install and hardened macros
- list binaries explicitly


author: Jaromir Capik <jcapik@redhat.com> - 0.3.0-5
changelog:
- Removing __PPC__ macro conflicting with __BYTE_ORDER__ endian check (#1127230)
- Resolves: rhbz#1127230


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6
changelog:
- Fix missing entities after CVE-2014-3660 fix
- CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
- Fix regressions introduced by CVE-2014-0191 patch


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
- Fix a series of CVEs (rhbz#1286496)
- CVE-2015-7941 Stop parsing on entities boundaries errors
- CVE-2015-7941 Cleanup conditional section error handling
- CVE-2015-8317 Fail parsing early on if encoding conversion failed
- CVE-2015-7942 Another variation of overflow in Conditional sections
- CVE-2015-7942 Fix an error in previous Conditional section patch
- Fix parsing short unclosed comment uninitialized access
- CVE-2015-7498 Avoid processing entities after encoding conversion failures
- CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
- CVE-2015-5312 Another entity expansion issue
- CVE-2015-7499 Add xmlHaltParser() to stop the parser
- CVE-2015-7499 Detect incoherency on GROW
- CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
- CVE-2015-8242 Buffer overead with HTML parser in push mode
- CVE-2015-1819 Enforce the reader to run in constant memory


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
- Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
- Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
- Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
- Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
- Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
- Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
- Fix inappropriate fetch of entities content (CVE-2016-4449)
- Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
- Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
- Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
- Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
- Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
- Avoid building recursive entities (CVE-2016-3627)
- Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
- More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
- Fix CVE-2015-8035 (#1595697)
- Fix CVE-2018-14404 (#1602817)
- Fix CVE-2017-15412 (#1729857)
- Fix CVE-2016-5131 (#1714050)
- Fix CVE-2017-18258 (#1579211)
- Fix CVE-2018-1456 (#1622715)


author: David King <dking@redhat.com> - 2.9.1-6.5
changelog:
- Fix CVE-2019-19956 (#1793000)
- Fix CVE-2019-20388 (#1810057)
- Fix CVE-2020-7595 (#1810073)
- Fix xsd:any schema validation (#1812145)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.4-3.20140718gitbdb6a3
changelog:
- fix resetting of linreg servo (#1165045)
- fix phc2sys automatic mode with multiple interfaces (#1108795)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-5
changelog:
- add support for active-backup bonding (#1002657)
- add support for IP over InfiniBand (#1472880)
- fix handling of unknown/invalid management TLVs in pmc (#1459446 #1459449)


author: Miroslav Lichvar <mlichvar@redhat.com> 1.8-6
changelog:
- add support for bonding to timemaster (#1549015)
- improve timemaster to restart terminated processes (#1527170)
- start ptp4l, timemaster and phc2sys after network-online target (#1541991)
- don't forward management requests to UDS port (#1520366)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-1
changelog:
- update to 2.0 (#1623919)
- add support for more accurate synchronization to phc2sys (#1643977)
- add support for active-backup team interface (#1650672)
- limit unicast message rate per address and grant duration


author: Chris Leech <cleech@redhat.com> - 1.0.1-3.git036e314
changelog:
- 1273663 sync with upstream v1.0.1-26-g036e314
  system capability incorrect advertised as station only


author: Martin Sehnoutka <msehnout@redhat.com> - 3.4.0-0.20160601gitf9185e5.1
changelog:
- New upstream release
- Drop patches that are already present in upstream
- Apply upstream fix for systemd paths
- Resolves: #1297795


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-6.20160601gitf9185e5
changelog:
- Fix License field capitalization
- Resolves: rhbz#1577175
- Add detection of AMD Ryzen w/ Vega graphics
- Resolves: rhbz#1569542
- Fix issues found by Coverity Scan
- Resolves: rhbz#1578007


author: Bryan Mason <bmason@redhat.com> - 3.4.0-8.20160601gitf9185e5.el7_9.1
changelog:
- New flag for no sensors added. This flag is used in VM environment
  to make sensors binaries not fail if no sensors was detected.
- Resolves: RHEL-17699


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.2.17-18
changelog:
- Fix Unsafe deserialization flaw in Chainsaw log viewer
- Fix SQL injection when application is configured to use JDBCAppender
- Fix remote code execution when application is configured to use JMSSink
- Resolves: CVE-2022-23307, CVE-2022-23305, CVE-2022-23302


author: Pavel Šimerda <psimerda@redhat.com> - 3:2.1.15-23
changelog:
- Resolves: #1232749 - fix bad subject of the welcome email when creating list
  using newlist command


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2
changelog:
- Update Intel CPU microcode to microcode-20201027 release, addresses
  CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
  (#1893261, #1893249, #1893229):
  - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
  - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
  - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
  - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
  - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
  - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
    0xe0;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
    to 0x2006a08;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
    to 0xde;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
    to 0xde;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
    to 0xe0;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
    to 0xde;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xd6 up to 0xde;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
    to 0xde;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
    to 0xde;
  - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
    from revision 0x43 up to 0x44;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
    up to 0x1000159;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
    up to 0x4003003;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5002f01 up to 0x5003003;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
    to 0x40;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
    to 0x1e;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
    to 0x18;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
    up to 0xa0;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
    up to 0xe0.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.4
changelog:
- Update Intel CPU microcode to microcode-20201112 release:
  - Addition of 06-8a-01/0x10 (LKF B2/B3) microcode at revision 0x28;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x32 up
    to 0x34;
  - Updated releasenote file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.5
changelog:
- Do not use "grep -q" in a pipe in check_caveats.
- Add 06-55-04/06-55-06/06-55-07 (SKX-SP/CLX-SP) microcode-20201110 caveats
  (#1905111).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.8
changelog:
- Update Intel CPU microcode to microcode-20210216 release (#1905111):
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a08 up
    to 0x2006a0a;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003003
    up to 0x4003006;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003003 up to 0x5003006.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.9
changelog:
- Update Intel CPU microcode to microcode-20210525 release, addresses
  CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513
  (#1962659, #1962709, #1962729, #1962675):
  - Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
  - Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
  - Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
  - Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
  - Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
    at revision 0xb00000f;
  - Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
    at revision 0xb00000f;
  - Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
  - Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
  - Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
  - Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
  - Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
  - Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
  - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
    intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up
    to 0xb00003e;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up
    to 0x2006b06;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
    to 0xea;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
    to 0xea;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up
    to 0xea;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up
    to 0xea;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xde up to 0xea;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up
    to 0xea;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up
    to 0xea;
  - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
    from revision 0x44 up to 0x46;
  - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up
    to 0x19;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159
    up to 0x100015b;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006
    up to 0x4003102;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003006 up to 0x5003102;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e
    up to 0x7002302;
  - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
    0x7000019 up to 0x700001b;
  - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000017
    up to 0xf000019;
  - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
    0xe00000f up to 0xe000012;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x40 up
    to 0x44;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x1e up
    to 0x20;
  - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x2e up
    to 0x34;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x34 up
    to 0x36;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x18 up
    to 0x1a;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa0
    up to 0xa6;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x28 up
    to 0x2a;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xe0 up
    to 0xea;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xe0
    up to 0xea;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xe0
    up to 0xec;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe0
    up to 0xe8;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode from revision
    0xe0 up to 0xea.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.10
changelog:
- Make intel-06-2d-07, intel-06-4e-03, intel-06-4f-01, intel-06-55-04,
  intel-06-5e-03, intel-06-8c-01, intel-06-8e-9e-0x-0xca,
  and intel-06-8e-9e-0x-dell caveats dependent on intel caveat.
- Enable 06-8c-01 microcode update by default.
- Enable 06-5e-03 microcode update by default (#1897684).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.12
changelog:
- Update Intel CPU microcode to microcode-20220204 release, addresses
  CVE-2021-0127, CVE-2021-0145, CVE-2021-33120 (#2051547, #2049549, #2049566):
  - Removal of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
  - Removal of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
    at revision 0xb00000f;
  - Removal of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
    at revision 0xb00000f;
  - Removal of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xea up to 0xec;
  - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
    intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb00003e up
    to 0xb000040;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006b06 up
    to 0x2006c0a;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xea up to 0xec;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x88 up to 0x9a;
  - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
    from revision 0x46 up to 0x49;
  - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x19 up
    to 0x1a;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015b
    up to 0x100015c;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003102
    up to 0x400320a;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003102 up to 0x500320a;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002302
    up to 0x7002402;
  - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
    0x700001b up to 0x700001c;
  - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000019
    up to 0xf00001a;
  - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
    0xe000012 up to 0xe000014;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x44 up
    to 0x46;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x20 up
    to 0x24;
  - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x34 up
    to 0x36;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0002a0
    up to 0xd000331;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x36 up
    to 0x38;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1a up
    to 0x1c;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa6
    up to 0xa8;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2a up
    to 0x2d;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x16 up
    to 0x22;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x2c up
    to 0x3c;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xea
    up to 0xec;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
    0xea up to 0xec;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
    revision 0xea up to 0xec;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xea up
    to 0xec;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode from revision 0xea up to 0xec;
  - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x11 up
    to 0x15;
  - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x1d up
    to 0x2400001f;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
    revision 0xea up to 0xec;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
    0xea up to 0xec;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xea
    up to 0xec;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
    0xea up to 0xec;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
    0xea up to 0xec;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xea up
    to 0xec;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xea
    up to 0xec;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xec
    up to 0xee;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe8
    up to 0xea;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xea up to 0xec;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x40 up
    to 0x50.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.14
changelog:
- Update Intel CPU microcode to microcode-20220510 release, addresses
  CVE-2022-0005, CVE-2022-21131, CVE-2022-21136, CVE-2022-21151 (#2090246,
    - Addition of 06-97-02/0x03 (ADL-HX C0) microcode at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    at revision 0x1f;
  - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
    intel-ucode/06-97-05) at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    at revision 0x1f;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode at
    revision 0x41c;
  - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) at revision 0x41c;
  - Addition of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) at revision 0x41c;
  - Addition of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode at revision 0x41c;
  - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
    intel-ucode/06-bf-02) at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
    at revision 0x1f;
  - Addition of 06-97-02/0x03 (ADL-HX C0) microcode (in
    intel-ucode/06-bf-05) at revision 0x1f;
  - Addition of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) at revision 0x1f;
  - Addition of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
    at revision 0x1f;
  - Addition of 06-bf-05/0x03 (ADL C0) microcode at revision 0x1f;
  - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
    intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xec up to 0xf0;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006c0a up
    to 0x2006d05;
  - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
    intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xec up to 0xf0;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x9a up to 0xa4;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xec up
    to 0xf0;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xec up to 0xf0;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xec up
    to 0xf0;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xec up
    to 0xf0;
  - Update of 06-37-09/0x0f (VLV D0) microcode from revision 0x90c up
    to 0x90d;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015c
    up to 0x100015d;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400320a
    up to 0x4003302;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x500320a up to 0x5003302;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002402
    up to 0x7002501;
  - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x46 up
    to 0x48;
  - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x24 up
    to 0x28;
  - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x36 up
    to 0x38;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000331
    up to 0xd000363;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x38 up
    to 0x3a;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1c up
    to 0x1e;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa8
    up to 0xb0;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x2d up
    to 0x31;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x22 up
    to 0x26;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3c up
    to 0x3e;
  - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x15 up
    to 0x16;
  - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x2400001f
    up to 0x24000023;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xec up
    to 0xf0;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xec
    up to 0xf0;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xee
    up to 0xf0;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xea
    up to 0xf0;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xec up to 0xf0;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x50 up
    to 0x53.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.15
changelog:
- Update Intel CPU microcode to microcode-20220510 release, addresses
  CVE-2022-21233 (#2119080):
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006d05 up
    to 0x2006e05;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015d
    up to 0x100015e;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000363
    up to 0xd000375;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3a up
    to 0x3c;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x1e up
    to 0x20;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb0
    up to 0xb2;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x26 up
    to 0x28;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x3e up
    to 0x40;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode from revision
    0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x1f up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x1f up to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x1f up to 0x22;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode from revision 0x1f
    up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x1f up to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x1f up to 0x22;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x41c up to 0x421;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x41c up to 0x421;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x41c up to 0x421;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x41c
    up to 0x421;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x53 up
    to 0x54;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x1f up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode from revision 0x1f up
    to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x1f up to 0x22;
  - Update of 06-97-02/0x03 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
  - Update of 06-97-05/0x03 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x1f up to 0x22;
  - Update of 06-bf-02/0x03 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x1f up to 0x22;
  - Update of 06-bf-05/0x03 (ADL C0) microcode from revision 0x1f up
    to 0x22.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.16
changelog:
- Update Intel CPU microcode to microcode-20230214 release, addresses
  CVE-2022-21216, CVE-2022-33196, CVE-2022-33972, CVE-2022-38090 (#2171238,
    - Addition of 06-6c-01/0x10 (ICL-D B0) microcode at revision 0x1000211;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode at revision
    0x2b000181;
  - Addition of 06-8f-04/0x10 microcode at revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) at revision 0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) at
    revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) at revision 0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) at revision 0x2c000170;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) at
    revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode at revision
    0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode at revision
    0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) at
    revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) at revision 0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) at revision 0x2c000170;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) at
    revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) at revision 0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode at revision
    0x2b000181;
  - Addition of 06-8f-06/0x10 microcode at revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) at revision 0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) at revision 0x2c000170;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode at revision
    0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) at revision 0x2b000181;
  - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) at
    revision 0x2c000170;
  - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) at revision 0x2c000170;
  - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) at
    revision 0x2c000170;
  - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) at revision 0x2b000181;
  - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode at revision
    0x2b000181;
  - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode at revision
    0x2c000170;
  - Addition of 06-b7-01/0x32 (RPL-S S0) microcode at revision 0x112;
  - Addition of 06-ba-02/0xc0 microcode at revision 0x410e;
  - Addition of 06-ba-03/0xc0 microcode (in intel-ucode/06-ba-02) at
    revision 0x410e;
  - Addition of 06-ba-02/0xc0 microcode (in intel-ucode/06-ba-03) at
    revision 0x410e;
  - Addition of 06-ba-03/0xc0 microcode at revision 0x410e;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa4 up to 0xa6;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
    revision 0xf0 up to 0xf4;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
    intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xf0 up
    to 0xf4;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x100015e
    up to 0x1000161;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003302
    up to 0x4003303;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003302 up to 0x5003303;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002501
    up to 0x7002503;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000375
    up to 0xd000389;
  - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3c up
    to 0x3e;
  - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x20 up
    to 0x22;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb2
    up to 0xb8;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x31 up
    to 0x32;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x40 up
    to 0x42;
  - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x16 up
    to 0x17;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
    0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x22
    up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x421 up to 0x429;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x421 up to 0x429;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x421 up to 0x429;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x421
    up to 0x429;
  - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x24000023
    up to 0x24000024;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf0 up
    to 0xf4;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf0
    up to 0xf4;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf0
    up to 0xf4;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf0
    up to 0xf4;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xf0 up to 0xf4;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x54 up
    to 0x57;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x22 up to
    0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x22 up to 0x2c (old pf 0x3);
  - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x22 up to
    0x2c (old pf 0x3).
- Change the logger severity level to warning to align with the kmsg one.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-66
changelog:
- Update Intel CPU microcode to microcode-20200508 release (#1835549):
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
    up to 0x78.
- Change the URL in the intel-microcode2ucode.8 to point to the GitHub
  repository since the microcode download section at Intel Download Center
  does not exist anymore.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-67
changelog:
- Update Intel CPU microcode to microcode-20200520 release (#1783103):
  - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
    up to 0x621;
  - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
    up to 0x71a.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-68
changelog:
- Update Intel CPU microcode to microcode-20200602 release, addresses
  CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795352, #1795355, #1827190):
  - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
  - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
    up to 0x2f;
  - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
    up to 0x26;
  - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
  - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
    up to 0x22;
  - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
    up to 0xdc;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
    up to 0x1000157;
  - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
    (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
    up to 0x2006906;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
    up to 0x4002f01;
  - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
    up to 0x5002f01;
  - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
    up to 0xdc;
  - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
    from revision 0xca up to 0xd6;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
    0xca up to 0xd6;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
  - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
    up to 0xd6;
  - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-70
changelog:
- Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision
  0xdc, use 0xd6 by default (#1846133).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73
changelog:
- Update Intel CPU microcode to microcode-20200609 release (#1826589):
  - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.1
changelog:
- Add README file to the documentation directory.
- Add publicly-sourced codenames list to supply to gen_provides.sh; update
  the latter to handle the somewhat different format.
- Add SUMMARY.intel-ucode file containing metadata information from
  the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.17
changelog:
- Force locale to C in check_caveats, reload_microcode, and update_ucode.
- Cleanup the dangling symlinks in update_ucode.
- Avoid spurious find failures due to calls on directories that may not exist.
- Add support for the new, more correct, variant of dracut's default
  $fw_dir path in dracut_99microcode_ctl-fw_dir_override_module_init.sh.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.18
changelog:
- Update Intel CPU microcode to microcode-20230516 release:
  - Addition of 06-be-00/0x01 (ADL-N A0) microcode at revision 0x10;
  - Addition of 06-9a-04/0x40 (AZB A0) microcode at revision 0x4;
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006e05 up
    to 0x2006f05;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xa6 up to 0xaa;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000161
    up to 0x1000171;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003303
    up to 0x4003501;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003303 up to 0x5003501;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002503
    up to 0x7002601;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000389
    up to 0xd000390;
  - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000211
    up to 0x1000230;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xb8
    up to 0xba;
  - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x32 up
    to 0x33;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x28 up
    to 0x2a;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x42 up
    to 0x44;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf0
    up to 0xf2;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
    0xf0 up to 0xf2;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
    revision 0xf0 up to 0xf2;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf0 up
    to 0xf2;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode from revision 0xf4 up to 0xf6;
  - Update of 06-8f-04/0x10 microcode from revision 0x2c000170 up to
    0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
    0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
    0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000181
    up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode from revision 0x2c000170 up to
    0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000181
    up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
    0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000181 up to 0x2b000461;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
    0x2c000170 up to 0x2c0001d1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
    0x2b000181 up to 0x2b000461;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x429 up to 0x42a;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x429 up to 0x42a;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x429 up to 0x42a;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x429
    up to 0x42a;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
    revision 0xf0 up to 0xf2;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
    0xf0 up to 0xf2;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf0
    up to 0xf2;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
    0xf0 up to 0xf2;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
    0xf4 up to 0xf8;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf4 up
    to 0xf6;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf4
    up to 0xf6;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf4
    up to 0xf6;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf4
    up to 0xf6;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xf4 up to 0xf6;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x57 up
    to 0x58;
  - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x112 up
    to 0x113;
  - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode from revision
    0x410e up to 0x4112;
  - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode (in
    intel-ucode/06-ba-02) from revision 0x410e up to 0x4112;
  - Update of 06-ba-02/0xc0 (RPL-H 6+8/P 6+8 J0) microcode (in
    intel-ucode/06-ba-03) from revision 0x410e up to 0x4112;
  - Update of 06-ba-03/0xc0 (RPL-U 2+8 Q0) microcode from revision 0x410e
    up to 0x4112.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.19
changelog:
- Update Intel CPU microcode to microcode-20230808 release, addresses
  CVE-2022-40982, CVE-2022-41804, CVE-2023-23908 (#2223994):
  - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
    intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006f05 up
    to 0x2007006;
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xaa up to 0xac;
  - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000171
    up to 0x1000181;
  - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003501
    up to 0x4003604;
  - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
    0x5003501 up to 0x5003604;
  - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002601
    up to 0x7002703;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000390
    up to 0xd0003a5;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xba
    up to 0xbc;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2a up
    to 0x2c;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x44 up
    to 0x46;
  - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode from revision
    0xf2 up to 0xf4;
  - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xf2
    up to 0xf4;
  - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode from
    revision 0xf2 up to 0xf4;
  - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xf2 up
    to 0xf4;
  - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
    microcode from revision 0xf6 up to 0xf8;
  - Update of 06-8f-04/0x10 microcode from revision 0x2c0001d1 up to
    0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
    0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
    0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000461
    up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode from revision 0x2c0001d1 up to
    0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000461
    up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
    0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b000461 up to 0x2b0004b1;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
    0x2c0001d1 up to 0x2c000271;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
    0x2b000461 up to 0x2b0004b1;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
    0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x2c up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2c up to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2c up to 0x2e;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2c
    up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2c up to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2c up to 0x2e;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x42a up to 0x42c;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x42a up to 0x42c;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x42a up to 0x42c;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42a
    up to 0x42c;
  - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from
    revision 0xf2 up to 0xf4;
  - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision
    0xf2 up to 0xf4;
  - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode from revision 0xf2
    up to 0xf4;
  - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode from revision
    0xf2 up to 0xf4;
  - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode from revision
    0xf8 up to 0xfa;
  - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf6 up
    to 0xf8;
  - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf6
    up to 0xf8;
  - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf6
    up to 0xf8;
  - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf6
    up to 0xf8;
  - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
    0xf6 up to 0xf8;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x58 up
    to 0x59;
  - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x113 up
    to 0x119;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2c up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2c up
    to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x2c up to 0x2e;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2c up to 0x2e;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x2c up to 0x2e;
  - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2c up
    to 0x2e;
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
    0x4112 up to 0x4119 (old pf 0xc0);
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
    intel-ucode/06-ba-02) from revision 0x4112 up to 0x4119 (old pf 0xc0);
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    intel-ucode/06-ba-03) from revision 0x4112 up to 0x4119 (old pf 0xc0);
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4112
    up to 0x4119 (old pf 0xc0);
  - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x10 up
    to 0x11 (old pf 0x1).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.20
changelog:
- Update Intel CPU microcode to microcode-20231009 release, addresses
  CVE-2023-23583 (RHEL-3920):
  - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
    intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xac up to 0xb4;
  - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003a5
    up to 0xd0003b9;
  - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000230
    up to 0x1000268;
  - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xbc
    up to 0xc2;
  - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x2c up
    to 0x34;
  - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x46 up
    to 0x4e;
  - Update of 06-8f-04/0x10 microcode from revision 0x2c000271 up to
    0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode from revision
    0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-04) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
    0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0004b1
    up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-05) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode from revision 0x2c000271 up to
    0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0004b1
    up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-06) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
    0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
    intel-ucode/06-8f-07) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
    intel-ucode/06-8f-08) from revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
    revision 0x2c000271 up to 0x2c000290;
  - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
    intel-ucode/06-8f-08) from revision 0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
    0x2c000271 up to 0x2c000290;
  - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
    0x2b0004b1 up to 0x2b0004d0;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
    0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-97-02) from revision 0x2e up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2e up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
    from revision 0x2e up to 0x32;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-97-05) from revision 0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x2e
    up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2e up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
    from revision 0x2e up to 0x32;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
    0x42c up to 0x430;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
    intel-ucode/06-9a-03) from revision 0x42c up to 0x430;
  - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
    intel-ucode/06-9a-04) from revision 0x42c up to 0x430;
  - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x42c
    up to 0x430;
  - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x4 up
    to 0x5;
  - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x59 up
    to 0x5d;
  - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x119 up
    to 0x11d;
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
    0x4119 up to 0x411c;
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
    intel-ucode/06-ba-02) from revision 0x4119 up to 0x411c;
  - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
    intel-ucode/06-ba-03) from revision 0x4119 up to 0x411c;
  - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4119
    up to 0x411c;
  - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x11 up
    to 0x12;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-02) from revision 0x2e up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x2e up
    to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
    from revision 0x2e up to 0x32;
  - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
  - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
    intel-ucode/06-bf-05) from revision 0x2e up to 0x32;
  - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
    from revision 0x2e up to 0x32;
  - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x2e up
    to 0x32.


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.7-21
changelog:
- Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
- Resolves: CVE-2022-37434


author: John Dennis <jdennis@redhat.com> - 0.13.1-2
changelog:
- Resolves: rhbz#1481330 Add diagnostic logging
- Resolves: rhbz#1295472 Add MellonSignatureMethod config option to set
  signature method used to sign SAML messages sent by Mellon.
  Defaults to original sha1.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-3
changelog:
- Resolves: rhbz#1652980 - mod_auth_mellon Cert files name wrong when
                           hostname contains a number


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-4
changelog:
- Resolves: rhbz#1576719 - ECP flow not triggering, instead client access
                           secured resources without ECP authentication


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-5
changelog:
- Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                           in logout url when using URLs with backslashes
                           [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
changelog:
- Apply the patch from the previous commit
- Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                           in logout url when using URLs with backslashes
                           [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
changelog:
- Resolves: rhbz#1727789 - mod_auth_mellon fix for AJAX header name
                           X-Requested-With


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-8
changelog:
- Resolves: rhbz#1731052 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via
                           the login?ReturnTo= substring which could facilitate
                           information theft [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-9
changelog:
- Resolves: rhbz#1791264 - Backport SameSite=None cookie from upstream to
                           support latest browsers


author: John Dennis <jdennis@redhat.com> - 1.8.8-3
changelog:
- fix unit test failure caused by apr_jwe_decrypt_content_aesgcm()
  failing to null terminate decrypted string
  Resolves: bug#1292561 New package: mod_auth_openidc


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-4
changelog:
- Resolves: rhbz#1626299 - CVE-2017-6059 mod_auth_openidc: Shows
                           user-supplied content on error pages [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
changelog:
- Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
                           OIDCAuthNHeader not skipped in an "AuthType oauth20"
                           configuration [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
changelog:
- Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                           issue exists in URLs with slash and backslash [rhel-7]
- Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
                           in logout url when using URLs with leading slashes
                           [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
changelog:
- Fix a regression in the previous patches
- Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                          issue exists in URLs with slash and backslash [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-8
changelog:
- Resolves: rhbz#1823762 - Backport SameSite=None cookie from
                           mod_auth_openidc upstream to support
                           latest browsers [rhel-7.9.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-9
changelog:
- Rebuild to pick up the proper build tag
- Related: rhbz#1823762 - Backport SameSite=None cookie from
                          mod_auth_openidc upstream to support
                          latest browsers [rhel-7.9.z]


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-44
changelog:
- add support for glusterfs (#1316386)
- change services to start after network-online.target (#1388118)
- fix interface fadeout configuration (#1547355)
- fix scanf pattern for ICMP stats (#1693547)
- change buffer size in pass_common.c file (#1695363 and #1731357)
- remove initial whitespace reading from scanf pattern of /sys/dev/block/../stat file (#1700494)
- fix for CVE-2018-18066 (#1638911)
- add Counter64 support for UCD-SNMP-MIB (#1703752)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
- add missing part of memory leak patch (#1794168)
- fix if_inet6 messages floood (#1765449)
- revert bz#1486733 (#1771050)
- fix issue for process status when process name contains whitespace (#1782180)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
- Fixed SHA-3 implementation to conform to final standard (#1252936)
- Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
  in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
- Use a cache-silent version of mpz_powm to prevent cache-timing
  attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.63
changelog:
- nfs.conf: Fixed manage-gids option typo (bz 1677403)
- sm-notify: Added -f flag to nfs.conf parsing (bz 1688932)
- Add nfs.conf equivalent for the statd --no-notify cmdline option (bz 1688918)
- nfs-server: Use reload not restart to start gssproxy (bz 1644169)


author: Steve Dickson <steved@redhat.com> 1.3.0-0.67
changelog:
- rpc.gssd: removed a number memory leaks (bz 1807110)
- mount: Report correct error in the fall_back cases (bz 1752329)
- gssd: daemonize earlier (bz 1645083)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
- Resolves: Bug 1269363 - CVE-2015-7183
- nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
- Rebase to NSPR 4.11
- Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-5
changelog:
- Fix pkix name constraints processing to only process the common name if the
  certusage you are checking is IPSEC or SSL Server.


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
- back out out-of-bounds patch (patch for nss-softokn).
- Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-8
changelog:
- Increase timeout on ssl_gtest so that slow platforms can complete when
   running on a busy system.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
- Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
- Explicitly enable upgradedb/sharedb test cycles


author: Tuomo Soini <tis@foobar.fi> - 3.53.1-3
changelog:
- Fix tests by updating PayPalEE.cert to valid one
- Fix tests to expect small primes failing rhbz#1884793
- Fix Cannot compile code with nss headers and -Werror=strict-prototypes
  rhbz#1885321


author: Johnny Hughes <johnny@centos.org> - 3.53.1-3
changelog:
- much thanks to both Tuomo Soini (foobar.fi) and Pat Riehecky (scientificlinux.org)
  for finding the fix to these issues


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
- revert sql default language in man pages
- fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-3
changelog:
- include patches for CVE-2020-6829, CVE-2020-12400,
  and CVE-2020-12401 from upstream (ECC constant time issues).
- include patches for CVE-2020-12403 from upstream
  (CHACHA issues).
- include self-tests for kdfs and cmac.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
- turn of ALTIVEC instruction for powerpc because they require
  power8 and we need to support power7 on RHEL7 still.
- Fix typo in measure.
- Make sure only 2048 and greater primes are used in FIPS mode
  for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
- turn off ALTIVEC instruction for powerpc because they require
  power8 and we need to support power7 on RHEL7 still.
- Fix typo in measure.
- Make sure only 2048 and greater primes are used in FIPS mode
  for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
- Include softoken specific patches required by the NSS 3.67
  release including:
-  sdb timeout fixes.
-  coverity patch.
-  fixing private key macing


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-1
changelog:
- Rebase to NSS 3.79.
- add reader/writer lock on encrypted attribute access
- skip attribute verification on attributes with default values
- don't export trust objects if they are default trust objects from dbm


author: Miroslav Rezanina <mrezanin@redhat.com> - 10-2.5-3
changelog:
- ovt-Workaround-for-false-negative-result-when-detecting.patch [bz#1601559]
- Resolves: bz#1601559
  ([ESXi][RHEL7.6] Include new open-vm-tools patches for cloud-init to work with python-2)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.0-2
changelog:
- ovt-Enable-cloud-init-by-default-to-change-the-systemd-u.patch [bz#1662278]
- ovt-Fix-RELRO-flag.patch [bz#1678576]
- Resolves: bz#1662278
  ([ESXi][RHEL7.7]Enable cloud-init by default to change the systemd unit file vmtoolsd.service)
- Resolves: bz#1678576
  ([ESXi][RHEL7.6] Several files lost Full RELRO)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.10-1
changelog:
- Rebase to 10.3.10 [bz#1725187]
- Resolves: bz#1725187
  ([ESXi][RHEL7.8 ]Rebase open-vm-tools to 10.3.10)


author: Miroslav Rezanina <mrezanin@redhat.com> - 10.3.10-2
changelog:
- ovt-Fix-memory-leaks-in-vix-tools-plugin.patch [bz#1760625]
- ovt-End-VGAuth-impersonation-in-the-case-of-error.patch [bz#1760625]
- ovt-Fix-leaks-in-ListAliases-and-ListMappedAliases-9bc72.patch [bz#1760625]
- Resolves: bz#1760625
  ([ESXi][RHEL7.8]Need to backport some severe memory leak fixes from upstream)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-1
changelog:
- Rebase to 11.0.5 [bz#1806675]
- Resolves: bz#1806675
 ([ESXi][RHEL7.9]Rebase open-vm-tools to 11.0.5 for RHEL 7.9)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-2.el7
changelog:
- ovt-Fix-ldconfig-call.patch [bz#1815549]
- ovt-add-appinfo-plugin.patch [bz#1809753]
- Resolves: bz#1809753
  ([ESXi][RHEL7.9]open-vm-tools add appinfo plugin patch)
- Resolves: bz#1815549
  ([ESXi][RHEL7.9]open-vm-tools reports line 1: ?ldconfig: command not found during system installation)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7
changelog:
- ovt-Fix-a-trivial-memory-leak-in-namespacetool.c.patch [bz#1818109]
- ovt-Update-copyright-to-reflect-previous-change.patch [bz#1818109]
- Resolves: bz#1818109
  ([ESXi][RHEL7.9]open-vm-tools coverity scan issue)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.1
changelog:
- ovt-Updated-PAM-configuration-file-to-follow-configured-.patch [bz#1840309]
- Resolves: bz#1840309
  ([ESXi][RHEL7]vmtoolsd authentication issues with ActiveDirectory (AD) [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.2
changelog:
- ovt-Rectify-a-log-spew-in-vmsvc-logging-vmware-vmsvc-roo.patch [bz#1911853]
- Resolves: bz#1911853
  ([ESXi][RHEL7.9][ warning] [guestinfo] GuestInfoGetDiskDevice: Missing disk device name; VMDK mapping unavailable for "/", fsName: "/dev/sda2")


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.3
changelog:
- ovt-Fix-memory-leaks-in-guestInfo-diskInfo.c.patch [bz#1937420]
- Resolves: bz#1937420
  ([ESXi][RHEL7.9] Memory leak in vmtoolsd when disable-query-diskinfo is set to false [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.4
changelog:
- ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119310]
- Resolves: bz#2119310
  (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-7.9.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.5
changelog:
- ovt-Track-Linux-filesystem-id-FSID-for-quiesced-frozen-f.patch [bz#1880404 bz#1994590]
- Resolves: bz#1880404
  ([ESXi] [RHEL7] vmtoolsd task is blocked in the uninterruptible state while attempting to delete (unlink) the file 'quiesce_manifest.xml')
- Resolves: bz#1994590
  ([ESXi][RHEL7.9][open-vm-tools] Snapshot of the RHEL7 guest on the VMWare ESXi hypervisor failed vm hangs)


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.6
changelog:
- ovt-Remove-some-dead-code.patch [bz#2215562]
- Resolves: bz#2215562
  ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.7
changelog:
- ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [RHEL-2413]
- Resolves: RHEL-2413
  (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.8
changelog:
- ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [bz#2226921]
- Resolves: bz#2226921
  ([RHEL7.9][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.9
changelog:
- ovt-Don-t-accept-tokens-with-unrelated-certs.patch [RHEL-14642]
- ovt-File-descriptor-vulnerability-in-the-open-vm-tools-v.patch [RHEL-14676]
- Resolves: RHEL-14642
  (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-7.9.z])
- Resolves: RHEL-14676
  (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-7.9.z])


author: Than Ngo <than@redhat.com> - 3.11.0-1
changelog:
- Resolves: #1063763 - opencryptoki tools should inform the user that he is not in pkcs11 group 
- Resolves: #1641027 - enhanced IBM z14 functions
- Resolves: #1641026 - support m_*Single functions from ep11 lib
- Resolves: #1641025 - rebase to 3.11.0
- Resolves: #1519386 - use CPACF hashes in ep11 token
- Resolves: #1373833 - lock file directory is %ghost now


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
- Resolves: #1688891 - C_EncryptInit fails with CKR_KEY_TYPE_INCONSISTENT. on ep11 token when using imported RSA public key


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
- MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
- MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
- MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-17
changelog:
- MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1575549)
- Reset OPTIND in libexec/functions for getopts to work in subsequent calls (#1564382)
- MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1543451)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-18
changelog:
- MozNSS Compat. Layer: Make log messages more clear (#1543955)
- Build with LDAP_USE_NON_BLOCKING_TLS (#1471039)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
- Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
- Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
- Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
- Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-6.20170227git
changelog:
- Use label from certificate DN if there is none (#1448555)
- Use Cardholder name in the token label (#1449740)
- Avoid infinite loop when reading CAC cards (#1473335)
- Workaround for CAC Alt tokens (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-8.20170227git
changelog:
- Copy labels from certificate (#1448555)
- Avoid infinite loop in CAC driver when reading non-CAC cards (#1473335)
- Properly parse Simple TLV structures in CAC driver (#1473418)


author: Jakub Jelen <jjelen@redhat.com> - 0.16.0-9.20170227git
changelog:
- make ECPoint behavior standards compliant by default (#1562572)
- allow mechanism to be specified in hexadecimal (#1562572)
- Disable pinpad by default (#1547117, #1547744)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
- Rebase to new upstream release (#1656791)
  - Add Support for HID Crescendo 144K (#1612372)
  - Add Support for CAC Alt tokens (#1645581)
  - Fix usage detection from certificates (#1672898)
  - Fix security issues:
    - CVE-2018-16391
    - CVE-2018-16392
    - CVE-2018-16393
    - CVE-2018-16418
    - CVE-2018-16419
    - CVE-2018-16420
    - CVE-2018-16421
    - CVE-2018-16422
    - CVE-2018-16423
    - CVE-2018-16426
    - CVE-2018-16427


author: Matěj Týč <matyc@redhat.com> - 1.2.17-6
changelog:
- Enabled the virtual '(all)' profile support for the scanner (RHBZ#1769272).
- Enabled the '(all)' profile support for oscap-ssh (RHBZ#1769272).


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
- Fix segfault in systemdunitdependency probe (RHBZ#1478285)
- Build and ship HTML manual (RHBZ#1465661)
- Fix oscap-ssh with --sudo (RHBZ#1803114)
- Change category of verbose message (RHBZ#1640522)
- Fix segfault in CVRF module (RHBZ#1642283)


author: Marcus Burghardt <maburgha@redhat.com> - 1.2.17-14
changelog:
- Fix memory leaks in probe-api (RHBZ#1861793)
- Prevent duplicate variables in Ansible Playbooks (RHBZ#1944683)
- Fix trailing whitespace in Ansible Playbooks
- Fix inconsistent result from security_patches_up_to_date (RHBZ#1858502)
- Fix multiple segfaults and broken test (RHBZ#1911999)
- Improve --stig-viewer output when there is no 1:1 connection between rules
- Lower memory limits and improve their checking (RHBZ#1932833)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
- Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
- Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
- Do not segfault in audit code during cleanup (#1488083)
- Add WinSCP 5.10+ compatibility (#1496808)
- Clatch between ClientAlive and rekeying timeouts (#1480510)
- Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
- Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-18 + 0.10.3-2
changelog:
- invalidate supplemental group cache used by temporarily_use_uid()
  when the target uid differs (#1583735)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
- fix CVE-2017-3737 - incorrect handling of fatal error state
- fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
- add S390x assembler updates
- make CA name list comparison function case sensitive (#1548401)
- fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
- fix CVE-2018-0732 - large prime DH DoS of TLS client
- fix CVE-2018-0737 - RSA key generation cache timing vulnerability
- fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
- fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
- fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
- use SHA-256 in FIPS RSA pairwise key check
- fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
  timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
- fix CVE-2018-0734 - DSA signature local timing side channel
- fix CVE-2019-1559 - 0-byte record padding oracle
- close the RSA decryption One & done EM side channel (#1619558)


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
- fix CVE-2021-23841 openssl: NULL pointer dereference
  in X509_issuer_and_serial_hash()
- fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
- Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
- fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
- Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
- Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
- Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
- Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
- Related: rhbz#2067160


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-3
changelog:
- Support more than 64KB of fence agent output
- Avoid unnecessary recovery of group member
- Improve IPC clients' authentication of servers (CVE-2018-16877)
- Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
- Fix use-after-free with potential information disclosure (CVE-2019-3885)
- Resolves: rhbz#1549366
- Resolves: rhbz#1609453
- Resolves: rhbz#1694556
- Resolves: rhbz#1694559
- Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.20-4
changelog:
- Update security patches
- Resolves: rhbz#1694556
- Resolves: rhbz#1694559
- Resolves: rhbz#1694907


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-1
changelog:
- Recover from quiesced DC disk
- Avoid timeouts and excessive stonithd CPU usage at start-up in large clusters
- Default serialized order constraints to symmetrical=false
- Avoid fence loops due to incorrect Pacemaker Remote ordering
- Default concurrent-fencing to true
- Harden GnuTLS priorities
- Rebase on upstream 1.1.21 final version
- Resolves: rhbz#1596125
- Resolves: rhbz#1625671
- Resolves: rhbz#1672225
- Resolves: rhbz#1704870
- Resolves: rhbz#1710422
- Resolves: rhbz#1727280
- Resolves: rhbz#1731189


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.21-3
changelog:
- Avoid invalid transition when guest node's host is unclean but can't be fenced
- Resolves: rhbz#1755659


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
- Show correct disabled resource count in status display
- Run-time option for Pacemaker Remote bind address
- Avoid restart loop when migration is left dangling
- Improve help for clean-up option
- Do not overweight group colocation scores
- Rebase on upstream 1.1.22+63d2d79
- Resolves: rhbz#1458953
- Resolves: rhbz#1743373
- Resolves: rhbz#1757951
- Resolves: rhbz#1758969
- Resolves: rhbz#1760669
- Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
- Improve help for clean-up option
- Avoid pending DC fencing getting "stuck" in status display
- Rebase on upstream 1.1.23-rc1
- Resolves: rhbz#1758969
- Resolves: rhbz#1787749
- Resolves: rhbz#1792492


author: Nathan Scott <nathans@redhat.com> - 4.3.2-1
changelog:
- Numerous fixes in pmlogger daily scripts (BZs 1677848, 1697182, 1579881, 1603143)
- Update PCP selinux policy rules (BZs 1692305, 1695066)
- Adjust spec file /var/run/pcp settings (BZ 1533154)
- Fix pmdaproc kernel process misreporting (BZ 1673250)
- Fix pmdalinux SYSV IPC metric scalability (BZ 1699232)
- Ensure pmdaroot reaps all of its children (BZ 1698517)
- Corrections to python version dependencies (BZ 1676867)
- Fix pcp-atopsar(1) -A (all) option handling (BZ 1673996)
- Update to a more recent PCP bug fix release (BZ 1647308)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-2
changelog:
- Rework the pcp-libs ldconfig post-op (BZ 1705362)
- Resolve a QA file permissions diagnostic issue


author: Nathan Scott <nathans@redhat.com> - 4.3.2-4
changelog:
- Fix a pmdaproc memory leak (BZ 1721107)
- Rebuild with selinux runtime dependency update (BZ 1714101)
- Update selinux-policy to latest upstream (BZs 1699830, 1700989)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
- Fix hugepage metrics in pmdalinux (BZ 1730107)
- Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
- Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
- Fix pcp-atopsar sample count command line argument (BZ 1764748)
- Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
- Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
- Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
- Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-13
changelog:
- Fix pcp-atopsar memory allocation problem with some options (BZ 1857580)
- Fix __pmGetArchiveEnd_ctx sigsegv with corrupt PCP archives (BZ 1878754)


author: Ivan Devat <idevat@redhat.com> - 0.9.168-1
changelog:
- Rebased to latest upstream sources (see CHANGELOG.md)
- Resolves: rhbz#1730747 rhbz#1725849 rhbz#1551663 rhbz#1595444 rhbz#1671174 rhbz#1712315 rhbz#1619253 rhbz#1710750 rhbz#1466088 rhbz#1558063 rhbz#1665898 rhbz#1500012 rhbz#1673829


author: Ivan Devat <idevat@redhat.com> - 0.9.168-2
changelog:
- Do not generate custom DH key if it was not requested by setting its custom length
- Resolves: rhbz#1760434


author: Ivan Devat <idevat@redhat.com> - 0.9.168-3
changelog:
- More fixes for the case when PATH environment variable is not set
- Pcsd no longer sends Server HTTP header
- Empty constraint option are not allowed in pcs constraint order and pcs constraint colocation add commands
- Resolves: rhbz#1500012 rhbz#1765606 rhbz#1671174


author: Ondrej Mular <omular@redhat.com> - 0.9.168-4
changelog:
- Added command 'pcs resource relations'
- Added command 'pcs resource safe-disable'
- Resolves: rhbz#1770975 rhbz#1770973


author: Ivan Devat <idevat@redhat.com> - 0.9.169-1
changelog:
- Rebased to latest upstream sources (see CHANGELOG.md)
- Resolves: rhbz#1822078 rhbz#1759269 rhbz#1448569


author: Ivan Devat <idevat@redhat.com> - 0.9.169-2
changelog:
- Keep autogenerated IDs of set constraints reasonably short
- Use fixed version of python module subprocess (package python2-subprocess32)
- Resolves: rhbz#1820813 rhbz#1824206


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3
changelog:
- Added option: pcs resource [safe-]disable --simulate` has a new option `--brief` to print only a list of affected resources
- Fixed race-condition when removing multiple resources from web UI
- Resolves: rhbz#1833115 rhbz#1843593


author: Ivan Devat <idevat@redhat.com> - 0.9.169-3.el7_3.1
changelog:
- Explicitly close libcurl connections to prevent stalled TCP connections in CLOSE-WAIT state
- Added support for loading DH keys from a file
- Resolves: rhbz#1870551 rhbz#1888479


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
- Backported and sub-packaged libraries historically supplied with Perl 4
  into perl-Perl4-CoreLibs


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
- Add SSL support to Net::SMTP (bug #1557574)
- Do not overload ".." in Math::BigInt (bug #1497734)
- Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Remi Collet <remi@fedoraproject.org> 1:1.9.4-14
changelog:
- add explicit requires on all needed extensions (phpci)
- fix pecl launcher (need ini to be parsed for some
  extenstions going to be build as shared, mainly simplexml)
- add fix for new unpack format (php 5.5)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-3
changelog:
- Updated jss dependencies
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
- Bugzilla Bug #1809273 - CRL generation performs an unindexed search (jmagne)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- # Bugzilla Bug #1549307 - No default TPS Auditor group (ascheel)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-4
changelog:
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE
  additional support and touch-up (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- # Bugzilla Bug #1710975 - TPS - Searching the certificate DB for a brand new


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-6
changelog:
- Patch for CMC Credential Error, RSA PSS typo, and new profile
  for directory-authentication-based Server-Side keygen
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug #1710109 - add RSA PSS support (jmagne)
- Bugzilla Bug #1794213 - Server-Side keygen Enrollment for EE (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-7
changelog:
- Patch for CMCResponse tool
- Bugzilla Bug #1710109 - add RSA PSS support - fix CMCResponse tool (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-8
changelog:
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug #1883639 - add profile caAuditSigningCert (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- # Bugzilla Bug #1710978 - TPS - Add logging to tdbAddCertificatesForCUID if
  - # Bugzilla Bug #1858860 - TPS - Update Error Codes returned to client
  - # Bugzilla Bug #1858861 - TPS - Server side key generation is not working
  - # Bugzilla Bug #1858867 - TPS does not check token cuid on the user


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-9
changelog:
- Bugzilla Bug #1883639 - additional support on upgrade for audit
  cert profile and auditProfileUpgrade + auditProfileUpgrade part 2 (cfu)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
  profiles, audit for IPA (edewata)
- ##########################################################################
- # Backported CVEs (ascheel):
- ##########################################################################
- Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
  parameters in TPS resulting in stored XSS [certificate_system_9-default]
  (edewata, ascheel)
- Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
  scripting (XSS) in the pki-tps web Activity tab
  [certificate_system_9-default] (edewata, ascheel)
- Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
  creation [certificate_system_9-default] (edewata, ascheel)
- Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
  Scripting in 'path length' constraint field in CA's Agent page
  [rhel-7.9.z] (dmoluguw, ascheel)
- Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
  scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
  (dmoluguw, ascheel)
- Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
  Reflected XSS in recoveryID search field at KRA's DRM agent page in
  authorize recovery tab [rhel-7.9.z] (ascheel)
- Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
  reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
- ##########################################################################
- Update to jquery v3.4.1 (ascheel)
- Update to jquery-i18n-properties v1.2.7 (ascheel)
- Update to backbone v1.4.0 (ascheel)
- Upgrade to underscore v1.9.2 (ascheel)
- Update to patternfly v3.59.3 (ascheel)
- Update to jQuery v3.5.1 (ascheel)
- Upgrade to bootstrap v3.4.1 (ascheel)
- Link in new Bootstrap CSS file (ascheel)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
- Change variable 'TPS' to 'tps'
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
  profiles, audit for IPA (edewata)
- ##########################################################################
- # Backported CVEs (ascheel):
- ##########################################################################
- Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
  parameters in TPS resulting in stored XSS [certificate_system_9-default]
  (edewata, ascheel)
- Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
  scripting (XSS) in the pki-tps web Activity tab
  [certificate_system_9-default] (edewata, ascheel)
- Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
  creation [certificate_system_9-default] (edewata, ascheel)
- Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
  Scripting in 'path length' constraint field in CA's Agent page
  [rhel-7.9.z] (dmoluguw, ascheel)
- Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
  scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
  (dmoluguw, ascheel)
- Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
  Reflected XSS in recoveryID search field at KRA's DRM agent page in
  authorize recovery tab [rhel-7.9.z] (ascheel)
- Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
  reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
- ##########################################################################
- Update to jquery v3.4.1 (ascheel)
- Update to jquery-i18n-properties v1.2.7 (ascheel)
- Update to backbone v1.4.0 (ascheel)
- Upgrade to underscore v1.9.2 (ascheel)
- Update to patternfly v3.59.3 (ascheel)
- Update to jQuery v3.5.1 (ascheel)
- Upgrade to bootstrap v3.4.1 (ascheel)
- Link in new Bootstrap CSS file (ascheel)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-13
changelog:
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug 1949136 - PKI instance creation failed with new 389-ds-base
  build (jmagne)
- Bugzilla Bug 1949656 - CRMF requests with extensions other than SKID cannot
  be processed (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-14
changelog:
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug 1911472 - Revoke via REST API not working when Agent
  certificate not issued by CA [rhel-7.9.z] (cfu)
- Bugzilla Bug 1914587 - RHEL IPA PKI - Failed to read product version
  String.java.io.FileNotFoundException (ckelley)
- Bugzilla Bug 1942687 - TPS not populating Token Policy, or switching
  PIN_RESET=YES to NO [rhel-7.9.z] (jmagne)
- Bugzilla Bug 1955633 - Recovery of Keys migrated to latest version of KRA
  fail to recover and result in Null Point Exception [rhel-7.9.z] (jmagne)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 6)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
- ##########################################################################
- # RHEL 7.9:
- ##########################################################################
- Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
  per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 8):
- ##########################################################################
- Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
- Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
  Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
- ##########################################################################
- # RHCS 9.7 (Batch Update 8):
- ##########################################################################
- Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
  the CA is Down [cfu]
- Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
  Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 8):
- ##########################################################################
- Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
  response from CA REST API: 500 [ftweedal, ckelley]
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 9):
- ##########################################################################
- Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
  response from CA REST API: 500 [ftweedal, ckelley]
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-18
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 10):
- ##########################################################################
- Bugzillla Bug 1978345 - End Entity's List Certificates Page Back/Forward
  Buttons are Broken (ckelley, jonahon.d.parrish@mail.mil, mharmsen)
- Bugzilla Bug 2008707 - pkispawn bails out too easily for things that could
  have been worked around after installation [RHEL 7.9.z] (cfu)
- Bugzilla Bug 2016773 - Directory authentication plugin requires directory
  admin password just for user authentication (rhel-7.9.z)
  (awnuk@purestorage.com, jmagne)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-19
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 11):
- ##########################################################################
- Bugzilla Bug 1998597 - TPS RA Separation Issues (cfu)
- Bugzilla Bug 2008319 - PKISpawn with ECC Signing Algorithms fail
  in FIPS Mode (cfu)
- Bugzilla Bug 2018608 - Invalid certificates with creation of subCA
  (pkispawn single step) [rhel-7.9.0.z] (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-20
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 14):
- ##########################################################################
- Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
  debug level set to maximum [RHEL 7.9.z] (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-21
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 15):
- ##########################################################################
- Bugzilla Bug #2074722 - user password and pkcs12 password exposure when
  debug level set to maximum [RHEL 7.9.z] (cfu)
- Bugzilla Bug #2082717 - SCEP manual approval failure (cfu)
- ##########################################################################
- # RHCS 9.7:
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-22
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 17):
- ##########################################################################
- Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
  entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
- Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
  caServerKeygen_DirUserCert profile, user can get certificates for other
  UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
- ##########################################################################
- # RHCS 9.7 (Batch Update 17):
- ##########################################################################
- Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
  entities when parsing XML can lead to XXE [certificate_system_9.7.z]
  (ckelley, mharmsen)
- Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
  caServerKeygen_DirUserCert profile, user can get certificates for other
  UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-23
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 18):
- ##########################################################################
- Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
  entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
- Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
  caServerKeygen_DirUserCert profile, user can get certificates for other
  UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
- ##########################################################################
- # RHCS 9.7 (Batch Update 18):
- ##########################################################################
- Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
  entities when parsing XML can lead to XXE [certificate_system_9.7.z]
  (ckelley, mharmsen)
- Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
  caServerKeygen_DirUserCert profile, user can get certificates for other
  UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-24
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 19):
- ##########################################################################
- Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
  entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
- ##########################################################################
- # RHCS 9.7 (Batch Update 19):
- ##########################################################################
- Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
  entities when parsing XML can lead to XXE [certificate_system_9.7.z]
  (ckelley, mharmsen)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-25
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 21):
- ##########################################################################
- Bugzilla Bug #2160355 - RA Separation by KeyType - Set Token Status
  [RHCS 9.7 bu 21] (cfu, ckelley)
- ##########################################################################
- # RHCS 9.7 (Batch Update 21):
- ##########################################################################
- Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
  pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-26
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 22):
- ##########################################################################
- ##########################################################################
- # RHCS 9.7 (Batch Update 22):
- ##########################################################################
- Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
  a list of tokens [RHCS 9.7] (ckelley)
- Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
  Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
- Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
  Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-27
changelog:
- ##########################################################################
- # RHEL 7.9 (Batch Update 23):
- ##########################################################################
- ##########################################################################
- # RHCS 9.7 (Batch Update 23):
- ##########################################################################
- Bugzilla Bug #2179305 - Unable to use the TPS UI "Token Filter" to filter
  a list of tokens [RHCS 9.7] (ckelley)
- Bugzilla Bug #2092522 - TPS Not allowing Token Status Change based on
  Revoke True/False and Hold till last True/False [RHCS 9.7.z] (cfu)
- Bugzilla Bug #2176233 - TPS Not allowing Token Status Change based on
  Revoke True/False and Hold till last True/False (part 2) [RHCS 9.7.z] (cfu)


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
- Constrain number of cycles in rescale filter
- Compute correct coverage values for box filter
- Resolves: #1688417


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
- update to 9.2.21 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
  http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
- update to 9.2.22 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
- update to 9.2.23 per release notes
  http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-4
changelog:
- don't use removed macro %add_to_maven_depmap (#992816)
- lint: trim-lines, reuse %{name} macro, fedora-review fixes
- merge cleanup changes by Stano Ochotnicky


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
- fix incompatibility with 9.6+ (rhbz#1547424)
- it's unnecessary to depend on whole java (rhbz#1406931)


author: Rex Dieter <rdieter@fedoraproject.org> - 6.0-7
changelog:
- better autostart.patch, handle case were autospawn is disabled
  (or otherwise doesn't work, like for root user)
- Resolves: #1269104


author: Wim Taymans <wtaymans@redhat.com> - 10.0-4
changelog:
- Add support for usb audio in the Dell dock TB16
- Add patches to improve default sinks
- Resolves: #1457385


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
- Disallow control chars in http URLs
- Fixes CVE-2019-9740 and CVE-2019-9947
Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
- Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
- Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
- Test fixes for the latest expat security release
- Update the certificates utilized in the test suite
Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: David Lehman <dlehman@redhat.com> - 0.61.15.67-1
changelog:
- fcoe: remove /etc/fcoe dir if it exists before copying configuration
  (rvykydal)
  Resolves: rhbz#1482512
- Find and remove stale LVM metadata immediately after creating md array.
  (dlehman)
  Resolves: rhbz#1223564
- Add ability to specify vg by uuid for vgremove. (dlehman)
  Related: rhbz#1223564


author: David Lehman <dlehman@redhat.com> - 0.61.15.68-1
changelog:
- Catch lvm metadata lookup failure in md post create. (dlehman)
  Related: rhbz#1223564
  Resolves: rhbz#1543579


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
- Deactivate incomplete VGs along with everything else. (dlehman)
  Resolves: rhbz#1554224
- Work around udev timing issues. (dlehman)
  Resolves: rhbz#1592253
  Resolves: rhbz#1592191
- nvdimm: don't crash on non-block devices (rvykydal)
  Related: rhbz#1280500
- Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
  Related: rhbz#1558942
- Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
  Related: rhbz#1558942
- Add a function for identifying NVDIMM namespaces (vtrefny)
  Related: rhbz#1558942
- Add a singleton for NVDIMM namespaces management (vtrefny)
  Resolves: rhbz#1558942
- Backport DependencyGuard from master (vtrefny)
  Related: rhbz#1558942
- Ignore nvdimm devices unless configured in kickstart (rvykydal)
  Related: rhbz#1280500
- Do not ignore nvdimm (pmemX) devices (rvykydal)
  Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
- Remove dependency on libblockdev-nvdimm (vtrefny)
  Resolves: rhbz#1601557
- Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
  Related: rhbz#1601557
- Add version to the LUKS format (vtrefny)
  Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
- Install ndctl when NVDIMMs are used. (dlehman)
  Related: rhbz#1600496
- Escape dots in lvm filter devices (vtrefny)
  Resolves: rhbz#1614039


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.73-1
changelog:
- Use --yes when calling pvresize (vtrefny)
  Related: rhbz#1657000
- Fix typo in partitioning test cleanup. (dlehman)
  Related: rhbz#1657000
- Remove selinux test that doesn't do anything meaningful. (dlehman)
  Related: rhbz#1657000
- Improve parsing of mdadm detail output. (dlehman)
  Related: rhbz#1657000
- Update btrfs tests to use sufficiently large loop devices. (dlehman)
  Related: rhbz#1657000
- vfat labels apparently cannot contain lower case characters. (dlehman)
  Related: rhbz#1657000
- Check label format regardless of mechanism used to set it. (dlehman)
  Related: rhbz#1657000
- Adapt to presence or absence of python-mock. (dlehman)
  Related: rhbz#1657000
- Fixed KS forcing zerombr onto RO disk (japokorn)
  Resolves: rhbz#1544425
- Tell LVM to wipe cachepool metadata when attaching the cachepool (vtrefny)
  Resolves: rhbz#1643531
- Add dependency on python-six (vtrefny)
  Resolves: rhbz#1647173


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
- Handle exceptions raised from parted.Disk ctor. (dlehman)
  Related: rhbz#1677383
- Recommend DASD disk label for disks with an existing DASD label (vtrefny)
  Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
- Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
  Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
- edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
  Related: rhbz#1879920
- Close fd if it fails to read the device (nashok)
  Resolves: rhbz#1879920


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
- Fixup for CVE-2022-22817
- Security fixes for CVE-2022-22815, CVE-2022-22816
Resolves: rhbz#2042522


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.1.13-1
changelog:
- Fix "python2-s3transfer" from EPEL issue by adding it to Obsoletes
- Rebase to v0.1.13 to fix missing "max_bandwidth" issue

  Resolves: rhbz#1576985
  Resolves: rhbz#1578083


author: William Poteat <wpoteat@redhat.com> 1.24.36-1
changelog:
- 1831104: When in Simple Content Access mode, subscription-manager should not
  complain that subscriptions aren't attached (wpoteat@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.24.37-1
changelog:
- 1830994: Fix warning messages in dnf/yum (jhnidek@redhat.com)
- 1823523: Detect rhsm-icon running without psutil (csnyder@redhat.com)
- 1771921: Package profiles sends too early when registering a client
  (wpoteat@redhat.com)
- 1688702: Generate redhat.repo in off-line mode; ENT-2302 (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.24.38-1
changelog:
- 1837244: Fix wrong version provided by subscription-manager version; ENT-2388
  (jhnidek@redhat.com)
- 1834792: Try to terminate rhsmd after timeout; ENT-2368 (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.39-1
changelog:
- 1789457: Syspurpose exception message parsing (wpoteat@redhat.com)
- 1725525: Mark one string for translation; ENT-1680 (jhnidek@redhat.com)
- 1796833: Fix a few broken fr translations (csnyder@redhat.com)
- 1796833: Update translations (csnyder@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.24.41-1
changelog:
- 1842474: Update local and cache file during sync(); ENT-2433
  (jhnidek@redhat.com)
- 1838012: prevent redundant remote syspurpose sync (pmoravec@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.42-1
changelog:
- 1848636, 1849074: Update insights machine-id path (csnyder@redhat.com)
- 1796833: Update translations (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.43-1
changelog:
- 1826300: Ignore auto-attach, when SCA mode is used
  (jhnidek@redhat.com)
- 1850919: False positive log "rhsmd process exceeded runtime and was killed."
  (wpoteat@redhat.com)
- 1868936: Do not print traceback, when profile upload failed
  (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.46-1
changelog:
- 1896715: Set proper read permissions on certs (#2466) (wpoteat@redhat.com)
- 1935592: Fix getting releases, when SCA is used (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.49-1
changelog:
- 2010137: Fix redundant API calls to Candlepin (hyu@redhat.com)
- [1.24] Added support for marketplace ID on RHEL7. (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.24.51-1
changelog:
- 1.24 Add gcp_license_codes to system facts. (jhnidek@redhat.com)
- 1.24 Fix of automatic registration (jhnidek@redhat.com)
- [1.24] Backport support for GCP marketplace ID (jhnidek@redhat.com)
- [1.24] Backported automatic registration (jhnidek@redhat.com)
- Back-ported cloud-what for Python 2.7 (jhnidek@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.24.52-1
changelog:
- tito: update rhel-7.9 releaser (ptoscano@redhat.com)
- managercli: fix RestlibException reporting for get_current_owner()
  (ptoscano@redhat.com)
- refresh: avoid ExceptionMapper in case of RestlibException
  (ptoscano@redhat.com)
- tests: repair attach cases in SCA mode (ptoscano@redhat.com)
- 2097672: Fixed expected message for manual attach case (jajerome@redhat.com)
- 2097672: [1.28] Improve warning message (auto-attach in SCA mode)
  (jhnidek@redhat.com)
- 2097672: [RFE][1.28] Improve the message, when SCA is enabled
  (jhnidek@redhat.com)
- Reverting disabling AutoAttach() and PoolAttach() in SCA mode
  (jhnidek@redhat.com)
- cache: fix typo in debug message (ptoscano@redhat.com)
- 2182768: Disallowed attaching using D-Bus in SCA mode (jhnidek@redhat.com)
- 2182768: Disallowed attaching pool in SCA mode: (jhnidek@redhat.com)
- 1928072: Print warning message and don't do auto-attach (jhnidek@redhat.com)
- managercli: add a local get_current_owner() helper (ptoscano@redhat.com)
- [1.24] Fix issue with locale and D-Bus method GetStatus; (jhnidek@redhat.com)
- Make code Python 2 compatible. (jhnidek@redhat.com)
- 2060101: [1.24] Print correct status, when access mode has changed
  (jhnidek@redhat.com)
- ENT-5542: Build package using GitHub Actions (mhorky@redhat.com)
- Fix failing tests (mhorky@redhat.com)
- tests: drop test_po_files.py (ptoscano@redhat.com)
- Ignore failing tests (mhorky@redhat.com)
- ENT-3759: Test on GitHub Actions (mhorky@redhat.com)
- Alter import of rhsm.config functions (mhorky@redhat.com)
- Add dependency constraints (mhorky@redhat.com)
- Handle tests in containers better (mhorky@redhat.com)


author: Pino Toscano <ptoscano@redhat.com> 1.24.53-1
changelog:
- 2229752: [1.24] Hotfix of D-Bus policy (jhnidek@redhat.com)
- Collect GCP Project information as cloud facts (chambrid@redhat.com)
- Collect Azure Subscription ID as a cloud fact (#3285) (chambrid@redhat.com)
- Stop requiring M2crypto (ptoscano@redhat.com)
- tests: make M2Crypto optional (ptoscano@redhat.com)


author: Pino Toscano <ptoscano@redhat.com>
changelog:
- tito: drop bz requirement (ptoscano@redhat.com)
- fix: 1.24 Add python-requests to the list of required RPMs
  (jhnidek@redhat.com)
- fix: Pin lxml to last version supporting Python 2 (mhorky@redhat.com)
- fix: Add missing package intltool to test script (jhnidek@redhat.com)


author: Lumír Balhar <lbalhar@redhat.com> - 12.1.0-7
changelog:
- Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
Resolves: rhbz#1813439 rhbz#1813447
- Remove useless macros definitions


author: Tomas Orsava <torsava@redhat.com> - 1.10.1-3
changelog:
- Added a patch that shows a custom error message when a FILE passed to
  virtualenv to be used as 'home dir' already exists and is NOT a directory.
Resolves: rhbz#1306513


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
- Rebase to version 15.1.0
- Disable automatic downloads from pypi on new venv creation
Resolves: rhbz#1461154


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
- Add three new patches for CVEs in bundled urllib3 and requests
CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
Resolves: rhbz#1649153
Resolves: rhbz#1700824
Resolves: rhbz#1643829


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
- Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
Resolves: rhbz#1856481
- Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
- Security fix for CVE-2023-24329
- Fix the test suite support for Expat >= 2.4.5
Resolves: rhbz#2173917


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-168.el7
changelog:
- kvm-qxl-check-release-info-object.patch [bz#1712703]
- kvm-bswap.h-Remove-cpu_to_be16wu.patch [bz#1270166]
- kvm-net-Transmit-zero-UDP-checksum-as-0xFFFF.patch [bz#1270166]
- kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734749]
- Resolves: bz#1270166
  (UDP packet checksum is not converted from 0x0000 to 0xffff with Qemu e1000 emulation.)
- Resolves: bz#1712703
  (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7])
- Resolves: bz#1734749
  (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-169.el7
changelog:
- kvm-target-i386-Support-invariant-tsc-flag.patch [bz#1626871]
- kvm-target-i386-block-migration-and-savevm-if-invariant-.patch [bz#1626871]
- kvm-i386-Don-t-copy-host-virtual-address-limit.patch [bz#1706658]
- Resolves: bz#1626871
  ([RFE] request for using TscInvariant feature with qemu-kvm.)
- Resolves: bz#1706658
  ([Intel 7.8 Bug] qemu-kvm fail with "err:kvm_init_vcpu() invalidate argumant" on ICX platform)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-170.el7
changelog:
- kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749735]
- kvm-target-i386-Merge-feature-filtering-checking-functio.patch [bz#1709971]
- kvm-target-i386-Isolate-KVM-specific-code-on-CPU-feature.patch [bz#1709971]
- kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1709971]
- kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1709971]
- kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1709971]
- kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1709971]
- kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1709971]
- kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1709971]
- kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1709971]
- kvm-Remove-arch-capabilities-deprecation.patch [bz#1709971]
- kvm-target-i386-add-MDS-NO-feature.patch [bz#1714791]
- Resolves: bz#1709971
  ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm)
- Resolves: bz#1714791
  ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm)
- Resolves: bz#1749735
  (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-171.el7
changelog:
- kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638471]
- kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638471]
- kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638471]
- kvm-Add-missing-brackets-to-CPUID-0x80000008-code.patch [bz#1760607]
- Resolves: bz#1638471
  ([Intel 7.8 Feat] qemu-kvm Introduce Cascade Lake (CLX) cpu model)
- Resolves: bz#1760607
  (Corrupted EAX values due to missing brackets at CPUID[0x800000008] code)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
- kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
- kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
- Resolves: bz#1771961
  (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
- kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
- kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
- kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
- Resolves: bz#1791560
  (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
- kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
- kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
- kvm-slirp-disable-tcp_emu.patch [bz#1791679]
- kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
- kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
- kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
- Resolves: bz#1618503
  (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
- Resolves: bz#1791679
  (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
- Resolves: bz#1800515
  (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
- Resolves: bz#1802215
  (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
- kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
- Resolves: bz#1810408
  (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
- kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
- kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
- kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
- Resolves: bz#1837565
  (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
- Resolves: bz#1869693
  (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
- kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
- kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
- Resolves: bz#1842923
  (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
- Resolves: bz#1860960
  (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
- kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
- Resolves: bz#1884997
  (qemu-kvm FTBFS on rhel7.9)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.4
changelog:
- kvm-ide-atapi-check-logical-block-address-and-read-size-.patch [bz#1917449]
- Resolves: bz#1917449
  (CVE-2020-29443 qemu-kvm: QEMU: ide: atapi: OOB access while processing read commands [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.5
changelog:
- kvm-dma-helpers-Initialize-DMAAIOCB-in_cancel-flag.patch [bz#2007036]
- Resolves: bz#2007036
  (Memory leak when using dma_read/write with virtio-scsi)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.6
changelog:
- kvm-rbd-avoid-qemu_rbd_snap_list-memory-leaks.patch [bz#2056725]
- Resolves: bz#2056725
  (qemu-kvm leaks on qemu_rbd_snap_list)


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
- Fix QImage allocation failure in qgifhandler
  Resolves: bz#1667863

- Fix QTgaFile CPU exhaustion
  Resolves: bz#1667879

- Fix QBmpHandler segmentation fault on malformed BMP file
  Resolves: bz#1667862


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
- Fix multilib issue with qtcore-config.h header file
  Resolves: bz#1534528

- Move libQt5EglFSDeviceIntegration lib into correct subpackage
  Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
- Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
  Resolves: bz#1814740
  Resolves: bz#1814685


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
- libwebp security fixes:
  Resolves: bz#1961742
  Resolves: bz#1961743
  Resolves: bz#1961744
  Resolves: bz#1961745


author: Sumit Bose <sbose@redhat.com> - 0.16.1-6
changelog:
- Resolves: rhbz#1258745
- Resolves: rhbz#1258488
- Resolves: rhbz#1267563
- Resolves: rhbz#1293390
- Resolves: rhbz#1273924
- Resolves: rhbz#1274368
- Resolves: rhbz#1291924


author: Sumit Bose <sbose@redhat.com> - 0.16.1-10
changelog:
Use current Samba options and read NetBIOS name from keytab
- Resolves: rhbz#1484072
- Resolves: rhbz#1370457


author: Sumit Bose <sbose@redhat.com> - 0.16.1-12
changelog:
Fixes for RHEL-7.9
- Resolves: rhbz#1625001
- Resolves: rhbz#1625005
- Resolves: rhbz#1638396
- Resolves: rhbz#1714223
- Resolves: rhbz#1832134


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-3
changelog:
- Backport fixes for upstream bugs 1974 and 1975
- Apply upstream PR1954 (record permanent MAC address for bond members)
- Apply upstream PR2004 (support for custom network interface naming)
- Backport fix for upstream bug 1926 (support for LACP bonding and teaming)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.4-7
changelog:
- Backport fix for upstream bug 1913 (backup succeeds in case of tar error)
  Resolves: rhbz1631183
- Apply upstream patch PR1885
  Partition information recorded is unexpected when disk has 4K block size
  Resolves: rhbz1610638
- Apply upstream patch PR1887
  LPAR/PPC64 bootlist is incorrectly set when having multiple 'prep' partitions
  Resolves: rhbz1610647
- Apply upstream patch PR1993
  Automatically exclude $BUILD_DIR from the backup
  Resolves: rhbz1655956
- Require xorriso instead of genisoimage, it is now the preferred method
  and supports files over 4GB in size.
  Resolves: rhbz1462189


