# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.10.2-10
changelog:
  - Bump version to 1.3.10.2-10
  - Resolves: Bug 1909342 - DS crash in deref plugin while dereferencing an entry that exists but that is not returned by internal search
  - Resolves: Bug 1921856 - “write” permission of ACI changes ns-slapd’s behavior on search operation 
  - Resolves: Bug 1881968 - Replication Lag under high load


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-11
changelog:
  - Bump version to 1.3.10.2-11
  - Resolves: Bug 1953673 - Add new access log keywords for time spent in work queue and actual operation time
  - Resolves: Bug 1931182 - information disclosure during the binding of a DN


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-13
changelog:
  - Bump version to 1.3.10.2-13
  - Resolves: Bug 2005399 - Internal unindexed searches in syncrepl
  - Resolves: Bug 2005432 - CVE-2021-3652 389-ds:1.4/389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed
  - Resolves: Bug 2005434 - ACIs are being evaluated against the Replication Manager account in a replication context.
  - Resolves: Bug 2005435 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-14
changelog:
  - Bump version to 1.3.10.2-14
  - Resolves: Bug 2018257 - hang because of incorrect accounting of readers in vattr rwlock
  - Resolves: Bug 2010976 - IPA server (389ds) is very slow in execution of some searches (`&(memberOf=...)(objectClass=ipaHost)` in particular)


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-15
changelog:
  - Bump version to 1.3.10.2-15
  - Resolves: Bug 2049812 - Fix csn generator to limit time skew drift
  - Resolves: Bug 2048530 - CVE-2021-4091 389-ds-base: double-free of the virtual attribute context in persistent search


author: Thierry Bordaz <tbordaz@redhat.com> - 1.3.10.2-16
changelog:
  - Bump version to 1.3.10.2-16
  - Resolves: Bug 2077395 - CVE-2022-0918 389-ds:1.4/389-ds-base: sending crafted message could result in DoS
  - Resolves: Bug 2014768 - Log the Auto Member invalid regex rules in the LDAP errors log
  - Resolves: Bug 2018153 - RFE - Provide an option to abort an Auto Member rebuild task
  - Resolves: Bug 2093294 - CVE-2022-0996 389-ds:1.4/389-ds-base: expired password was still allowed to access the database


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-1
changelog:
  - Update to 1.18.8 relase
  - ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841397, CVE-2020-10754)
  - ifcfg-rh: handle 802-1x.pin properties.


author: Wim Taymans <wtaymans@redhat.com> - 1.2.15-17
changelog:
  - Fix Some CVEs: CVE-2019-7572, CVE-2019-7573, CVE-2019-7574,
    CVE-2019-7575, CVE-2019-7576, CVE-2019-7577, CVE-2019-7578,
    CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638
  - Resolves: rhbz#1716201, rhbz#1716202, rhbz#1716206,
  - Resolves: rhbz#1716207, rhbz#1716208


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-7
changelog:
  - Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix
    security issues.  CVE-2017-6827, CVE-2017-6828,
    CVE-2017-6829, CVE-2017-6830, CVE-2017-6831,
    CVE-2017-6832, CVE-2017-6833, CVE-2017-6834, CVE-2017-6835,
    CVE-2017-6836, CVE-2017-6837, CVE-2017-6838, CVE-2017-6839


author: Wim Taymans <wtaymans@redhat.com> - 1:0.3.6-9
changelog:
  - Apply security patches. CVE-2018-17095, CVE-2018-13440
  - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-16.P2.4
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Fix invalid tsig request (CVE-2020-8617)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.1
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)


author: Nick Clifton <nickc@redhat.com> 2.27-42.base
changelog:
  - Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749085)


author: Nick Clifton <nickc@redhat.com> 2.27-44.base
changelog:
  - Allow the BFD library to handle the copying of files which contain secondary reloc sections.  (#1785294)
  - Implement assembler workaround for Intel JCC microcode bug.  (#1778892)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.12.1.el7]
changelog:
  - [x86] x86/speculation: Prevent deadlock on ssb_state::lock (Waiman Long) [1841121 1836322]
  - [vfio] vfio-pci: Invalidate mmaps and block MMIO access on disabled memory (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio-pci: Fault mmaps to enable vma tracking (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Support faulting PFNMAP vmas (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/pci: call irq_bypass_unregister_producer() before freeing irq (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio_pci: Enable memory accesses before calling pci_map_rom (Alex Williamson) [1837297 1820632] {CVE-2020-12888}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.13.1.el7]
changelog:
  - [x86] x86/speculation: Support old struct x86_cpu_id & x86_match_cpu() kABI (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [cpufreq] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header (Waiman Long) [1827187 1827188] {CVE-2020-0543}


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: genkey.patch
  -->  Debrand certs
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: debrand_taint_cpu.patch
  -->  Rename RHEL7 to SL7
  - Added Source: sl-ldup.x509
  -->  The FNAL SL signing certificate for driver updates
  - Added Source: kernel-spec_use_our_keys.patch
  -->  Remove the TUV keys and sign with ours
  - Added Source: kernel.ini
  -->  Config file for automated patch script
  - Added Source: sl-kpatch.x509
  -->  The FNAL SL signing certificate for kpatch updates
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: kernel-spec_debrand_taint_cpu.patch
  -->  Apply our debrand patch


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.18.1.el7]
changelog:
  - [fs] locks: allow filesystems to request that ->setlease be called without i_lock (Jeff Layton) [1838602 1830606]
  - [fs] locks: move fasync setup into generic_add_lease (Jeff Layton) [1838602 1830606]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.18.2.el7]
changelog:
  - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837429 1837430] {CVE-2020-10713}
  - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837429 1837430] {CVE-2020-10713}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.10.1.el7]
changelog:
  - [md] dm-mirror: provide the merge method (Mikulas Patocka) [1890059]
  - [nvme] nvme-rdma: cancel async events before freeing event struct (David Milburn) [1857397]
  - [s390] dasd: Use struct_size() helper (Sterling Alexander) [1886477]
  - [s390] dasd: fix inability to use DASD with DIAG driver (Sterling Alexander) [1886477]
  - [hv] hv_utils: drain the timesync packets on onchannelcallback (Vitaly Kuznetsov) [1884735]
  - [hv] hv_utils: return error if host timesysnc update is stale (Vitaly Kuznetsov) [1884735]
  - [x86] cpu: Re-apply forced caps every time CPU caps are re-read (Herbert Xu) [1886792]
  - [x86] cpu: Factor out application of forced CPU caps (Herbert Xu) [1886792]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.11.1.el7]
changelog:
  - [netdrv] hdlc_ppp: add range checks in ppp_cp_parse_cr() (Guillaume Nault) [1882078] {CVE-2020-25643}
  - [fs] ext4: fix potential negative array index in do_split() (Pavel Reichl) [1846164] {CVE-2020-14314}
  - [fs] nfsd: apply umask on fs without ACL support ("J. Bruce Fields") [1870215] {CVE-2020-24394}
  - [kernel] watchdog/core: Remove the park_in_progress obfuscation (Waiman Long) [1860661]
  - [mm] swap_slots: recheck cache->slots_ret under spin_lock_irq() protection (Rafael Aquini) [1862915]
  - [netdrv] ethernet: i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (Stefan Assmann) [1845677]
  - [infiniband] mlx5: Fix use-after-free in dereg_mr() (Alaa Hleihel) [1880184]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.15.1.el7]
changelog:
  - [fs] ceph: quota: fix null pointer dereference in quota check (Jeff Layton) [1890386]
  - [netdrv] revert "mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query" (Alaa Hleihel) [1896756]
  - [kernel] timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion (Waiman Long) [1890911]
  - [kernel] exit: Optimize forget_original_parent() for large thread group exiting (Waiman Long) [1872110]
  - [kernel] exit: reparent: call forget_original_parent() under tasklist_lock (Waiman Long) [1872110]
  - [kernel] Disable tasklist_waiters when qrwlock is enabled (Waiman Long) [1872110]
  - [fs] cifs: handle ERRBaduid for SMB1 (Leif Sahlberg) [1847041]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.1.1.el7]
changelog:
  - [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1869751]
  - [scsi] scsi: ses: don't ask for diagnostic pages repeatedly during probe (Maurizio Lombardi) [1855324]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.1.el7]
changelog:
  - [edac] EDAC/i10nm: Update driver to support different bus number config register offsets (Aristeu Rozanski) [1840276]
  - [edac] EDAC, {skx, i10nm}: Make some configurations CPU model specific (Aristeu Rozanski) [1840276]
  - [net] test nouarg before dereferencing zerocopy pointers (Patrick Talbert) [1862273]
  - [net] packet: copy user buffers before orphan or clone (Patrick Talbert) [1862273]
  - [netdrv] net/mlx5e: Fix deallocation of non-fully init encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Allow concurrent creation of encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Protect encap hash table with mutex (Alaa Hleihel) [1874101]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.2.el7]
changelog:
  - [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
  - [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.20.1.el7]
changelog:
  - [md] Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1889372]
  - [md] improve variable names in md_flush_request() (Xiao Ni) [1889372]
  - [kernel] timer: Fix potential bug in requeue_timers() (Waiman Long) [1914011]
  - [x86] kvm: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Vitaly Kuznetsov) [1890669]
  - [x86] kvm: avoid incorrect writes to host MSR_IA32_SPEC_CTRL (Vitaly Kuznetsov) [1890669]
  - [md] dm-mirror: fix a crash if the underlying block device doesn't have merge_bvec_fn (Mikulas Patocka) [1916407]
  - [gpu] drm/i915: Fix use-after-free when destroying GEM context (Dave Airlie) [1814731] {CVE-2020-7053}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.21.1.el7]
changelog:
  - [pinctrl] devicetree: Avoid taking direct reference to device name string (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [pinctrl] Delete an error message (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [tty] vt: keyboard, reorder user buffer handling in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, rename i to kb_func in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, extend func_buf_lock to readers (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, simplify vt_kdgkbsent (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] keyboard, do not speculate on func_table index (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: fix write/write race in ioctl(KDSKBSENT) handler (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [iommu] amd: return error on real irq alloc failure (Jerry Snitselaar) [1918273]
  - [iommu] amd: Set DTE[IntTabLen] to represent 512 IRTEs (Jerry Snitselaar) [1921187]
  - [iommu] amd: Increase interrupt remapping table limit to 512 entries (Jerry Snitselaar) [1921187]
  - [scsi] lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix ADISC reception terminating login state if a NVME target (Dick Kennedy) [1875961]
  - [netdrv] i40e: revert "i40e: don't report link up for a VF who hasn't enabled queues" (Stefan Assmann) [1901064]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.23.1.el7]
changelog:
  - tcm_loop: add WQ_MEM_RECLAIM and flush_work (Maurizio Lombardi) [1925652]
  - net/mlx4_en: Handle TX error CQE (Alaa Hleihel) [1925691]
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Alaa Hleihel) [1925691]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.24.1.el7]
changelog:
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930826] {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930849] {CVE-2021-27363}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930807] {CVE-2021-27364}
  - redhat: add CI file for kernel-private (Bruno Meneguele)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.30.1.el7]
changelog:
  - pf: Prohibit alu ops for pointer types not defining ptr_limit (Jiri Olsa) [1942689] {CVE-2020-27170}
  - bpf: Add sanity check for upper ptr_limit (Jiri Olsa) [1942689] {CVE-2020-27170}
  - bpf: Simplify alu_limit masking for pointer arithmetic (Jiri Olsa) [1942689] {CVE-2020-27170}
  - bpf: Fix off-by-one for area size in creating mask to left (Jiri Olsa) [1942689] {CVE-2020-27170}
  - netxen_nic: fix MSI/MSI-x interrupts (Tony Camuso) [1894274]
  - block: fix use-after-free on cached last_lookup partition (Ming Lei) [1898596]
  - mm: reduce struct page_cgroup overhead when page_owner is not enabled (Rafael Aquini) [1948451]
  - vt: selection, close sel_buffer race (Chris von Recklinghausen) [1831034] {CVE-2020-8648}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.31.1.el7]
changelog:
  - mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() (Philipp Rudo) [1917840]
  - scsi: qla2xxx: Fix the call trace for flush workqueue (Nilesh Javali) [1937945]
  - futex: Handle faults correctly for PI futexes (Donghai Qiao) [1935108] {CVE-2021-3347}
  - futex: Provide and use pi_state_update_owner() (Donghai Qiao) [1935108] {CVE-2021-3347}
  - futex: Replace pointless printk in fixup_owner() (Donghai Qiao) [1935108] {CVE-2021-3347}
  - futex: Ensure the correct return value from futex_lock_pi() (Donghai Qiao) [1935108] {CVE-2021-3347}
  - scsi: qla2xxx: Remove WARN_ON_ONCE in qla2x00_status_cont_entry() (Nilesh Javali) [1933784]
  - scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path (Philipp Rudo) [1917839]
  - net: netfilter: Avoid deadlock when loading logger backend (Phil Sutter) [1858329]
  - net: netfilter: Link nfnetlink into bzImage (Phil Sutter) [1858329]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.36.1.el7]
changelog:
  - cipso,calipso: resolve a number of problems with the DOI refcounts (Antoine Tenart) [1967720]
  - net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() (Alaa Hleihel) [1962406]
  - sched/debug: Fix cgroup_path[] serialization (Waiman Long) [1912221]
  - sched/debug: Reset watchdog on all CPUs while processing sysrq-t (Waiman Long) [1912221]
  - vt: vt_ioctl: fix use-after-free in vt_in_use() (Vladis Dronov) [1872778]
  - vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console (Vladis Dronov) [1872778]
  - vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines (Vladis Dronov) [1872778]
  - vt: selection, introduce vc_is_sel (Vladis Dronov) [1872778]
  - redhat: genspec: generate changelog entries since last release (Augusto Caringi)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.40.1.el7]
changelog:
  - redhat: ppc64: CONFIG_RTAS_FILTER (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - powerpc/rtas: Fix typo of ibm,open-errinjct in RTAS filter (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - powerpc/rtas: Restrict RTAS requests from userspace (Aristeu Rozanski) [1906443] {CVE-2020-27777}
  - IB/mlx5: Fix initializing CQ fragments buffer (Alaa Hleihel) [1962499]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.42.1.el7]
changelog:
  - [s390] s390/dasd: fix list corruption of lcu list (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: fix list corruption of pavgroup group list (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: prevent inconsistent LCU device data (Claudio Imbrenda) [1889418]
  - [s390] s390/dasd: fix hanging device offline processing (Claudio Imbrenda) [1889418]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.44.1.el7]
changelog:
  - fs: dlm: change handling of reconnects (Bob Peterson) [1834878]
  - DLM: fix NULL pointer dereference in send_to_sock() (Bob Peterson) [1834878]
  - DLM: fix to reschedule rwork (Bob Peterson) [1834878]
  - DLM: fix to use sk_callback_lock correctly (Bob Peterson) [1834878]
  - DLM: fix overflow dlm_cb_seq (Bob Peterson) [1834878]
  - DLM: fix conversion deadlock when DLM_LKF_NODLCKWT flag is set (Bob Peterson) [1834878]
  - DLM: use CF_CLOSE flag to stop dlm_send correctly (Bob Peterson) [1834878]
  - DLM: Reanimate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
  - DLM: fix race condition between dlm_recoverd_stop and dlm_recoverd (Bob Peterson) [1834878]
  - DLM: close othercon at send/receive error (Bob Peterson) [1834878]
  - DLM: retry rcom when dlm_wait_function is timed out. (Bob Peterson) [1834878]
  - DLM: fix to use sock_mutex correctly in xxx_accept_from_sock (Bob Peterson) [1834878]
  - DLM: fix race condition between dlm_send and dlm_recv (Bob Peterson) [1834878]
  - DLM: fix double list_del() (Bob Peterson) [1834878]
  - DLM: Eliminate CF_WRITE_PENDING flag (Bob Peterson) [1834878]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975511]
  - vxlan: check return value of gro_cells_init() (Aristeu Rozanski) [1970618]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988218] {CVE-2021-37576}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.45.1.el7]
changelog:
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - mm: page_counter: mitigate consequences of a page_counter underflow (Scott Wood) [2000973]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested(CVE-2021-3656) (Jon Maloy) [1985425] {CVE-2021-3656}
  - KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted (Marcelo Tosatti) [1991856]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985408] {CVE-2021-3653}
  - scsi: qedf: Initiate cleanup for ELS commands as well (Nilesh Javali) [1982702]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.48.1.el7]
changelog:
  - scsi: qedf: Add check to synchronize abort and flush (Nilesh Javali) [1941766]
  - scsi: ibmvfc: Reinit target retries (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Avoid move login if fast fail is enabled (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Handle move login failure (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Avoid link down on FS9100 canister reboot (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: don't check for failure from mempool_alloc() (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: Use compiler attribute defines instead of __attribute__() (Desnes A. Nunes do Rosario) [1882627]
  - scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info (Desnes A. Nunes do Rosario) [1882627]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.52.1.el7]
changelog:
  - acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (David Arcari) [2019588]
  - x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (David Arcari) [2019218]
  - x86/cpu/AMD: Fix erratum 1076 (CPB bit) (David Arcari) [2019218]
  - i40e: Fix the conditional for i40e_vc_validate_vqs_bitmaps (Stefan Assmann) [1977246]
  - i40e: Fix virtchnl_queue_select bitmap validation (Stefan Assmann) [1977246]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.53.1.el7]
changelog:
  - fuse: fix live lock in fuse_iget() (Miklos Szeredi) [1952046]
  - fuse: fix bad inode (Miklos Szeredi) [1952046]
  - GFS2: Truncate address space mapping when deleting an inode (Bob Peterson) [1364234]
  - gfs2: Fix gfs2_testbit to use clone bitmaps (Bob Peterson) [1364234]
  - gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps (Bob Peterson) [1364234]
  - gfs2: Fix oversight in gfs2_ail1_flush (Bob Peterson) [1364234]
  - gfs2: Additional information when gfs2_ail1_flush withdraws (Bob Peterson) [1364234]
  - gfs2: leaf_dealloc needs to allocate one more revoke (Bob Peterson) [1364234]
  - gfs2: allow journal replay to hold sd_log_flush_lock (Bob Peterson) [1364234]
  - gfs2: don't allow releasepage to free bd still used for revokes (Bob Peterson) [1364234]
  - gfs2: flesh out delayed withdraw for gfs2_log_flush (Bob Peterson) [1364234]
  - gfs2: Do proper error checking for go_sync family of glops functions (Bob Peterson) [1364234]
  - gfs2: drain the ail2 list after io errors (Bob Peterson) [1364234]
  - gfs2: Withdraw in gfs2_ail1_flush if write_cache_pages fails (Bob Peterson) [1364234]
  - gfs2: Do log_flush in gfs2_ail_empty_gl even if ail list is empty (Bob Peterson) [1364234]
  - gfs2: Check for log write errors before telling dlm to unlock (Bob Peterson) [1364234]
  - gfs2: Prepare to withdraw as soon as an IO error occurs in log write (Bob Peterson) [1364234]
  - gfs2: Issue revokes more intelligently (Bob Peterson) [1364234]
  - gfs2: Add verbose option to check_journal_clean (Bob Peterson) [1364234]
  - gfs2: fix infinite loop when checking ail item count before go_inval (Bob Peterson) [1364234]
  - gfs2: Force withdraw to replay journals and wait for it to finish (Bob Peterson) [1364234]
  - gfs2: Allow some glocks to be used during withdraw (Bob Peterson) [1364234]
  - gfs2: move check_journal_clean to util.c for future use (Bob Peterson) [1364234]
  - gfs2: Ignore dlm recovery requests if gfs2 is withdrawn (Bob Peterson) [1364234]
  - gfs2: Only complain the first time an io error occurs in quota or log (Bob Peterson) [1364234]
  - gfs2: log error reform (Bob Peterson) [1364234]
  - gfs2: Rework how rgrp buffer_heads are managed (Bob Peterson) [1364234]
  - gfs2: clear ail1 list when gfs2 withdraws (Bob Peterson) [1364234]
  - gfs2: Introduce concept of a pending withdraw (Bob Peterson) [1364234]
  - gfs2: Return bool from gfs2_assert functions (Bob Peterson) [1364234]
  - gfs2: Turn gfs2_consist into void functions (Bob Peterson) [1364234]
  - gfs2: Remove usused cluster_wide arguments of gfs2_consist functions (Bob Peterson) [1364234]
  - gfs2: Report errors before withdraw (Bob Peterson) [1364234]
  - gfs2: Split gfs2_lm_withdraw into two functions (Bob Peterson) [1364234]
  - gfs2: Fix incorrect variable name (Bob Peterson) [1364234]
  - gfs2: Don't write log headers after file system withdraw (Bob Peterson) [1364234]
  - gfs2: clean up iopen glock mess in gfs2_create_inode (Bob Peterson) [1364234]
  - gfs2: Close timing window with GLF_INVALIDATE_IN_PROGRESS (Bob Peterson) [1364234]
  - gfs2: fix infinite loop in gfs2_ail1_flush on io error (Bob Peterson) [1364234]
  - gfs2: Introduce function gfs2_withdrawn (Bob Peterson) [1364234]
  - gfs2: replace more printk with calls to fs_info and friends (Bob Peterson) [1364234]
  - gfs2: dump fsid when dumping glock problems (Bob Peterson) [1364234]
  - gfs2: simplify gfs2_freeze by removing case (Bob Peterson) [1364234]
  - gfs2: Rename SDF_SHUTDOWN to SDF_WITHDRAWN (Bob Peterson) [1364234]
  - gfs2: Warn when a journal replay overwrites a rgrp with buffers (Bob Peterson) [1364234]
  - gfs2: log which portion of the journal is replayed (Bob Peterson) [1364234]
  - gfs2: slow the deluge of io error messages (Bob Peterson) [1364234]
  - gfs2: Don't withdraw under a spin lock (Bob Peterson) [1364234]
  - GFS2: Clear gl_object when deleting an inode in gfs2_delete_inode (Bob Peterson) [1364234]
  - gfs2: Use fs_* functions instead of pr_* function where we can (Bob Peterson) [1364234]
  - GFS2: Use pr_<level> more consistently (Bob Peterson) [1364234]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.58.1.el7]
changelog:
  - Bluetooth: fix use-after-free error in lock_sock_nested() (Gopal Tiwari) [2005687]
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047597] {CVE-2022-22942}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.5.1.el7]
changelog:
  - [x86] x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs (Myron Stowe) [1849223]
  - [kernel] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression (Oleg Nesterov) [1861396]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859468] {CVE-2020-14331}
  - [pci] hv: Retry PCI bus D0 entry on invalid device state (Mohammed Gamal) [1846667]
  - [pci] hv: Fix the PCI HyperV probe failure path to release resource properly (Mohammed Gamal) [1846667]
  - [x86] xen: Add call of speculative_store_bypass_ht_init() to PV paths (Vladis Dronov) [1882468]
  - [powerpc] powerpc/smp: Use nid as fallback for package_id (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add Power9 scheduler topology (Desnes Augusto Nunes do Rosario) [1826306]
  - [kernel] sched: Add a new SD_SHARE_POWERDOMAIN for sched_domain (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] sched, powerpc: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] sched, s390: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] s390/topology: Remove call to update_cpu_masks() (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add cpu_l2_cache_map (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Rework CPU topology construction (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Use cpu_to_chip_id() to find core siblings (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc, hotplug: Avoid to touch non-existent cpumasks (Desnes Augusto Nunes do Rosario) [1826306]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.6.1.el7]
changelog:
  - [net] netfilter: nf_queue: place bridge physports into queue_entry struct (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: do not release refcouts until nf_reinject is done (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: make nf_queue_entry_release_refs static (Florian Westphal) [1885682]
  - [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
  - [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.61.1.el7]
changelog:
  - x86/efi: reset the correct tlb_state when returning from efi_switch_mm() (Rafael Aquini) [2055587]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.62.1.el7]
changelog:
  - cifs: fix handling of DFS links where we can not access all components (Ronnie Sahlberg) [1937304]
  - redhat: kernel.spec: install new kernel boot entry in posttrans, not post (Denys Vlasenko) [1893756]
  - [s390] s390/cpumf: Support for CPU Measurement Facility CSVN 7 (Mete Durlu) [2048920]
  - dm table: fix iterate_devices based device capability checks (Mike Snitzer) [2054743]
  - buffer: eliminate the need to call free_more_memory() in __getblk_slow() (Carlos Maiolino) [2030609]
  - buffer: grow_dev_page() should use __GFP_NOFAIL for all cases (Carlos Maiolino) [2030609]
  - buffer: have alloc_page_buffers() use __GFP_NOFAIL (Carlos Maiolino) [2030609]
  - mm: memcg: do not fail __GFP_NOFAIL charges (Rafael Aquini) [2054345]
  - mm: filemap: do not drop action modifier flags from the gfp_mask passed to __add_to_page_cache_locked() (Rafael Aquini) [2054345]
  - Added ZSTREAM=yes to makefile (Lucas Zampieri)


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.65.1.el7]
changelog:
  - CI: Remove deprecated option (Veronika Kabatova)
  - RDMA/core: Fix panic when port_pkey_list isn't initialized (Kamal Heib) [2046571]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.66.1.el7]
changelog:
  - net-sysfs: add check for netdevice being present to speed_show (William Zhao) [2055457]
  - CI: Drop baseline runs (Veronika Kabatova)
  - perf/x86/intel: Add more Icelake CPUIDs (Michael Petlan) [2072317]
  - perf vendor events intel: Add Icelake V1.00 event file (Michael Petlan) [2072317]
  - perf vendor events intel: Add core event list for Icelake Server (Michael Petlan) [2072317]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.71.1.el7]
changelog:
  - netfilter: nf_tables: disallow non-stateful expression in sets earlier (Phil Sutter) [2093000] {CVE-2022-1966}
  - netfilter: nf_tables: fix memory leak if expr init fails (Phil Sutter) [2093000]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-1160.75.1.el7]
changelog:
  - xfs: fix up non-directory creation in SGID directories (Andrey Albershteyn) [2089360]
  - x86/speculation/mmio: Print SMT warning (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - KVM: x86/speculation: Disable Fill buffer clear within guests (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/srbds: Update SRBDS mitigation selection (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - cpu/speculation: Add prototype for cpu_show_srbds() (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/bugs: Group MDS, TAA & Processor MMIO Stale Data mitigations (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - Documentation: Add documentation for Processor MMIO Stale Data (Rafael Aquini) [2090249] {CVE-2022-21123 CVE-2022-21125 CVE-2022-21166}
  - [s390] s390/zcrypt: use kvmalloc instead of kmalloc for 256k alloc (Mete Durlu) [2072970]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1159.el7]
changelog:
  - [kernel] modsign: Import certificates from optional MokListRT (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1862840]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.el7]
changelog:
  - [kernel] modsign: Add nomokvarconfig kernel parameter (Lenny Szubowicz) [1867857]
  - [firmware] modsign: Add support for loading certs from the EFI MOK config table (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Move import of MokListRT certs to separate routine (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Avoid spurious error message after last MokListRTn (Lenny Szubowicz) [1867857]


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-5.el7
changelog:
  - ci-Remove-race-condition-between-cloud-init-and-Network-v2.patch [bz#1748015]
  - ci-cc_mounts-fix-incorrect-format-specifiers-316.patch [bz#1772505]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1772505
    ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-6.el7
changelog:
  - ci-Use-reload-or-try-restart-instead-of-try-reload-or-r.patch [bz#1748015]
  - ci-ec2-Do-not-log-IMDSv2-token-values-instead-use-REDAC.patch [bz#1821999]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-7.el7
changelog:
  - ci-ec2-only-redact-token-request-headers-in-logs-avoid-.patch [bz#1821999]
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: cockpit-spec-debranding.patch
  -->  Correctly brand this as NOT TUV's product
  - Added Source: cockpit-spec-nokub-32bit.patch
  -->  Make sure to not bother with kubernetes on 32bit
  - Added Source: cockpit.ini
  -->  Config file for automated patch script


author: Jan Grulich <jgrulich@redhat.com> - 0.23-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1568618


author: Jan Grulich <jgrulich@redhat.com> - 0.26-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1668355


author: Andreas Schneider <asn@redhat.com> - 4.10.16-14
changelog:
  - resolves: #1937867 - Fix possible core dump with printing support
  - resolves: #1930747 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.10.16-16
changelog:
  - resolves: #2019661 - Fix CVE-2016-2124
  - resolves: #2019673 - Fix CVE-2020-25717
  - resolves: #2021428 - Add missing PAC buffer types to krb5pac.idl


author: Andreas Schneider <asn@redhat.com> - 4.10.16-18
changelog:
  - resolves: #2034800 - Fix usermap script regression caused by CVE-2020-25717
  - resolves: #2036595 - Fix MIT realm regression caused by CVE-2020-25717
  - resolves: #2046148 - Fix CVE-2021-44142


author: Isaac Boukris <iboukris@redhat.com> - 4.10.16-2
changelog:
  - resolves: #1828354 - add additioanl hostnames to the keytab
  - resolves: #1836427 - add dnshostname option net-ads-join


author: Andreas Schneider <asn@redhat.com> - 4.10.16-8
changelog:
  - resolves: #1878205 - Fix restarting winbind on package upgrade
  - resolves: #1892632 - Fix CVE-2020-14318
  - resolves: #1891687 - Fix CVE-2020-14323
  - resolves: #1879834 - Fix CVE-2020-1472
  - resolves: #1892313 - Fix memory leak in winbindd (wbinfo -u)
  - resolves: #1868917 - Fix %U substitution for 'valid users' option
  - resolves: #1853272 - Fix 'require_membership_of' documentation in
                         pam_winbind{.conf} manpage


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: dhcp.ini
  -->  Config file for automated patch script
  - Removed Patch: dhcp-4.2.0-errwarn-message.patch
  -->  Remove patch containing instructions to report bugs to bugzilla.redhat.com


author: Petr Menšík <pemensik@redhat.com> - 2.76-16.1
changelog:
  - Accept responses only on correct sockets (CVE-2020-25684)
  - Use strong verification on queries (CVE-2020-25685)
  - Handle multiple identical DNS queries better (CVE-2020-25686)
  - Link against nettle for sha256 hash implementation


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5
changelog:
  - fix CVE-2019-3814: improper certificate validation (#1674369)
  - fix CVE-2019-7524: buffer overflow in indexer-worker process resulting in privilege 
    escalation (#1700398)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1741787)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6.1
changelog:
  - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1871841)
  - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1871843)
  - fix CVE-2020-12674 crash due to assert in RPA implementation (#1871842)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
    by assuming the date is correct and changing the weekday.


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
  - Fix CVE-2018-17456: arbitrary code execution via .gitmodules
    Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Ondrej Pohorelsky <opohorel@redhat.com> - 1.8.3.1-21
changelog:
  - Fix CVE-2019-1387: remote code execution in recursive clones with nested
    submodules
    Resolves: CVE-2019-1387


author: Vít Ondruch <vondruch@redhat.com> - 1.8.3.1-23
changelog:
  - Prevent crafted URL containing new lines, empty host or lacks a scheme
    to cause credential leak.
    Resolves: CVE-2020-11008


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-8
changelog:
  - Do not free EvDocumentInfo in ev_window_save_print_settings(),
  - it is freed in EvDocument's destructor
  - Resolves: #1541358


author: Jan Grulich <jgrulich@redhat.com> - 0.27.0-4
changelog:
  - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS
    Resolves: bz#1990352


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-13
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.1.0-14
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-41.1
changelog:
  - fence_lpar: fix issue with long username, hostname, etc not
    working when the command run by the agent exceeds 80 characters
  - fence_evacuate: enable evacuation of instances using private flavors

    Resolves: rhbz#1860545
    Resolves: rhbz#1862024


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-15
changelog:
  - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
    Resolves: bz#1818808

    * Fri Feb 7 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.13-14
  - Fixes receiving of multiple RADIUS packets under load
    Resolves: bz#1630684


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
  - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
  - CVE-2020-11523: Fix integer overflow in region.c (#1837622)
  - CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: fwupdate.ini
  -->  Config file for automated patch script
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: fwupdate-spec-use_our_keys.patch
  -->  Remove the TUV keys and sign with ours


author: Filip Januš <fjanus@redhat.com> - 2.0.35-27
changelog:
  - Fix CVE-2016-5766
  - Resolves: #1356813
  - Upstream patch: https://github.com/libgd/libgd/commit/aba3db8


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
  - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
    sincosl, and tanl function. (#1812119)


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
  - Prepend prefix when HTTP path is relative
  - efi/http: Export {fw,http}_path variables to make them global
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails


author: Peter Jones <pjones@redhat.com> - 2.02-0.86
changelog:
  - Fix several CVEs:
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: grub2_spec-force-efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: secureboot.cer
  -->  Not using upstream Key
  - Replaced Source: securebootca.cer
  -->  Don't recognize upstream CA
  - Added Source: grub2.ini
  -->  Config file for automated patch script


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.87.e7.2
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Jakub Martisko <jamartis@redhat.com> - 1.5-10
changelog:
  - doc change: missing grep options are now mentioned in the zgrep 
    man pages/help message
    Resolves: #1437002


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd-spec_sl_index.html.sl7.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-97
changelog:
  - Resolves: #1852350 - httpd/mod_proxy_http/mod_ssl aborted when sending
    a client cert to backend server
  - Resolves: #1785100 - mod_cgid takes CGIDScriptTimeout x 2 seconds for timeout
  - Resolves: #1862499 - Intermittent Segfault in Apache httpd due to pool
    concurrency issues


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.1
changelog:
  - Resolves: #2011729 - CVE-2021-40438 httpd: mod_proxy: SSRF via a crafted
    request uri-path containing "unix:"


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.3
changelog:
  - Resolves: #2035058 - CVE-2021-44790 httpd: mod_lua: possible buffer overflow
    when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
    malformed requests
  - Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input
  - Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.5
changelog:
  - Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: ipa-spec-debrand.patch
  -->  remove TUV's Artwork
  - Added Source: ipa-spec-fix-osrelease.patch
  -->  Force use of rhel as the ipaplatform
  - Added Source: ipa.ini
  -->  Config file for automated patch script


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.9
changelog:
  - Resolves: #2000261 - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
    - extdom: return LDAP_NO_SUCH_OBJECT if domains differ


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.10
changelog:
  - Resolves: 2025848 - RHEL 8.6 IPA Replica Failed to configure PKINIT setup against a RHEL 7.9 IPA server 
    - Fix cert_request for KDC cert
  - Resolves: 2021444 - CVE-2020-25719 ipa: samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
    - SMB: switch IPA domain controller role


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.7
changelog:
  - Resolves: #1956550 - IPA server installation fails when cert contains non-ASCII character
    - CA less installation: non ASCII chars in CA subject
    - ipatests: use non-ascii chars in CA-less install
  - Resolves: #1974328 - Revise PKINIT upgrade code
    - Allow PKINIT to be enabled when updating from a pre-PKINIT IPA CA server


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.261-2.6.22.1
changelog:
  - Add release notes from IcedTea.
  - Mark license files with appropriate macro.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b09.
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b09 (EA)
  - Update release notes for 8u292-b09.
  - Resolves: rhbz#1938081


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.292.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u292-b10 (GA)
  - Update release notes for 8u292-b10.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1938201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Resolves: rhbz#1999735


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.3.ea
changelog:
  - Add patch to improve performance of common separators in Scanner.useLocale
  - Move alt-java patch to correct section.
  - Resolves: rhbz#1862929


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2022809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b01 (EA)
  - Update release notes for shenandoah-8u332-b01.
  - Switch to EA mode.
  - Related: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Resolves: rhbz#2047529


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07
  - Update release notes for shenandoah-8u342-b07.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Rebase JDK-8186464 patch so it applies after JDK-8190753
  - Resolves: rhbz#2106502


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-0
changelog:
  - Update to jdk-11.0.11.0+9
  - Update release notes to 11.0.11.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-04-20 @ 1pm PT.
  - Resolves: rhbz#1940228


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+4
  - Update release notes to 11.0.12.0+4
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-0
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-1
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012332


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Resolves: rhbz#2022810


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8284920 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2106510


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.9-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+9 (EA)
  - Update release notes for 11.0.8 release.
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-0
changelog:
  - Update to shenandoah-jdk-11.0.8+10 (GA)
  - Switch to GA mode for final release.
  - Update release notes with last minute fix (JDK-8248505).
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-0
changelog:
  - Update to jdk-11.0.9+11
  - Update release notes for 11.0.9 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Stephan Wiesand <stephan wiesand desy de> 1.6.23-289.SLx
changelog:
  - update to release 1.6.23 (security release)
  - addresses OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, OPENAFS-SA-2018-003


author: Stephan Wiesand <stephan wiesand desy de> 1.6.24-290.SLx
changelog:
  - update to release 1.6.24 (security release)
  - addresses OPENAFS-SA-2019-001, OPENAFS-SA-2019-002, OPENAFS-SA-2019-003
  - fix build on EL 6.10


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-6
changelog:
  - Resolves: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                         vulnerability when parsing SAML responses


author: Jakub Hrozek <jhrozek@redhat.com> - 2.5.1-7
changelog:
  - Fix Coverity warning introduced by the previous patch
  - Related: #1963855 - CVE-2021-28091 lasso: XML signature wrapping
                        vulnerability when parsing SAML responses


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-8
changelog:
  - Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
  - Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
                             It is done in two steps (two different nsupdate messages).


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-10
changelog:
  - Resolves: rhbz#1804005 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.8
changelog:
  - Resolves: rhbz#1910131 - sssd throwing error " Unable to parse name test' [1432158283]: The internal name format cannot be parsed" at debug_level 2 [rhel-7.9.z]
  - Resolves: rhbz#1922244 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0. [rhel-7.9.z]
  - Resolves: rhbz#1935685 - SSSD not detecting subdomain from AD forest (7.9z)
  - Resolves: rhbz#1945552 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-7.9.z]
  - Resolves: rhbz#1839972 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR [rhel-7.9.z]


author: Alexey Tikhonov <atikhono@redhat.com> 1.16.5-10.9
changelog:
  - Resolves: rhbz#1988463 - Missing search index for `originalADgidNumber` [rhel-7.9.z]
  - Resolves: rhbz#1968330 - id lookup is failing intermittently
  - Resolves: rhbz#1964415 - Memory leak in the simple access provider
  - Resolves: rhbz#1985457 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-7.9.z]


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.6.alpha
changelog:
  - Fixes for CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682
  - resolves: rhbz#1611550 rhbz#1611551 rhbz#1611552 rhbz#1611553


author: Petr Hracek <phracek@redhat.com> - 2:1.5.13-7
changelog:
  - Security fix for CVE-2015-8126
  - Changing png_ptr to info_ptr base on upstream
  - Related: #1283575


author: Colin Walters <tmlcoch@redhat.com> - 1.7.16-1
changelog:
  - Add LRI_LOWSPEEDTIME and LRI_LOWSPEEDLIMIT
  - downloader: Don't consider CURLE_RECV_ERROR and CURLE_SEND_ERROR as fatal errors (RhBug: 1219817)
  - test_repoconf: Fix SIGSEGV in repoconf_assert_na (RhBug: 1222471)
  - repoconf: Proper handling of gint64 and guint64 types
  - build: Be compatible with cmake 2.8
  - handle: Do not free temporary error msg if there is no one (RhBug: 1219822)
  - utils/make_rpm.sh: Accept rpmbuild options as second argument (Issue #49)
  - Python: call lr_global_init() during module initialization
  - Add global function log_set_file that allow user to set a file where logs will be written (Issue #53)
  - util: Honor RFC 3986 (Issue #55)


author: Marek Blaha <mblaha@redhat.com> - 1.8.1-1
changelog:
  - Add yumrecord substitution mechanism (mluscon)
  - Fix a memory leak in signature verification (cwalters)
  - Add new option LRO_FTPUSEEPSV
  - downloader prepare_next_transfer(): simplify long line
  - downloader prepare_next_transfer(): add missing error check
  - downloader prepare_next_transfer(): cleanup error path
  - downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
  - handle: Don't use proxy cache for downloads of metalink/mirrorlist
  - handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
  - downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
  - Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
  - New test: always try to download from the fastest mirror (Alexander Todorov)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.25-12.1
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985024)


author: Jan Grulich <jgrulich@redhat.com> - 1.4.4-11.20101004cvs
changelog:
  - Fix global buffer overflow
    Resolves: bz#1301202

  - Fix improper handling of CSRC count and extension header length in RTP header
    Resolves: bz#1323705

  - Fix buffer overflow in application of crypto profiles
    Resolves: bz#1141897


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-34
changelog:
  - vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (rhbz#1815269)
  - vmx: make 'fileName' optional for CD-ROMs (rhbz#1815269)
  - RHEL: Fix migration on AMD hosts with old QEMU (rhbz#1815572)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35
changelog:
  - qemu: don't take agent and monitor job for shutdown (CVE-2019-20485)
  - qemu: don't hold a monitor and agent job for reboot (CVE-2019-20485)
  - qemu: don't hold monitor and agent job when setting time (CVE-2019-20485)
  - qemu: remove use of qemuDomainObjBeginJobWithAgent() (CVE-2019-20485)
  - qemu: remove qemuDomainObjBegin/EndJobWithAgent() (CVE-2019-20485)
  - storage: Fix daemon crash on lookup storagepool by targetpath (CVE-2020-10703)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
  - virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support (rhbz#1823976)
  - virDevMapperGetTargetsImpl: quit early if device is not a devmapper target (rhbz#1823976)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.1
changelog:
  - qemu: end the agent job in qemuDomainSetTimeAgent (rhbz#1844952)
  - util: string: Introduce macro for automatic string lists (rhbz#1839992)
  - util: Rework virStringListAdd (rhbz#1839992)
  - qemu: Create multipath targets for PRs (rhbz#1839992)
  - util: Move virIsDevMapperDevice() to virdevmapper.c (rhbz#1839992)
  - virDevMapperGetTargetsImpl: Check for dm major properly (rhbz#1839992)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.3
changelog:
  - rpc: gendispatch: handle empty flags (CVE-2020-25637)
  - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
  - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
  - conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1868549)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-13
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662996)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.3-6.git4391e5c
changelog:
  - Update the fix for CVE-2019-3816
    Resolves: #1668658
  - Remove Dist Tag from the oldest changelog entry


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
  - Fix CVE-2015-8035 (#1595697)
  - Fix CVE-2018-14404 (#1602817)
  - Fix CVE-2017-15412 (#1729857)
  - Fix CVE-2016-5131 (#1714050)
  - Fix CVE-2017-18258 (#1579211)
  - Fix CVE-2018-1456 (#1622715)


author: David King <dking@redhat.com> - 2.9.1-6.5
changelog:
  - Fix CVE-2019-19956 (#1793000)
  - Fix CVE-2019-20388 (#1810057)
  - Fix CVE-2020-7595 (#1810073)
  - Fix xsd:any schema validation (#1812145)


author: Miroslav Lichvar <mlichvar@redhat.com> 2.0-1
changelog:
  - update to 2.0 (#1623919)
  - add support for more accurate synchronization to phc2sys (#1643977)
  - add support for active-backup team interface (#1650672)
  - limit unicast message rate per address and grant duration


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:1.2.17-18
changelog:
  - Fix Unsafe deserialization flaw in Chainsaw log viewer
  - Fix SQL injection when application is configured to use JDBCAppender
  - Fix remote code execution when application is configured to use JMSSink
  - Resolves: CVE-2022-23307, CVE-2022-23305, CVE-2022-23302


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.68-1
changelog:
  - Rebase to 5.5.68
    This is the last upstream release. This major version reached upstream EOL
  - Related to: rhbz#1834835


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-61.5
changelog:
  - Update Intel CPU microcode to microcode-20200602 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1827189):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.
  - Change the URL in the intel-microcode2ucode.8 to point to the GitHub
    repository since the microcode download section at Intel Download Center
    does not exist anymore.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.9
changelog:
  - Update Intel CPU microcode to microcode-20210525 release, addresses
    CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513
    (#1962659, #1962709, #1962729, #1962675):
    - Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
    - Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
    - Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
    - Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
      at revision 0xb00000f;
    - Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
      at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
    - Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
    - Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
    - Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
    - Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
    - Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
    - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
      intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up
      to 0xb00003e;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up
      to 0x2006b06;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up
      to 0xea;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xde up to 0xea;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up
      to 0xea;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x44 up to 0x46;
    - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up
      to 0x19;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159
      up to 0x100015b;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006
      up to 0x4003102;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003006 up to 0x5003102;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e
      up to 0x7002302;
    - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
      0x7000019 up to 0x700001b;
    - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000017
      up to 0xf000019;
    - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
      0xe00000f up to 0xe000012;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x40 up
      to 0x44;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x1e up
      to 0x20;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x2e up
      to 0x34;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x34 up
      to 0x36;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x18 up
      to 0x1a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa0
      up to 0xa6;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x28 up
      to 0x2a;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xe0 up
      to 0xea;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xe0
      up to 0xea;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xe0
      up to 0xec;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe0
      up to 0xe8;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode from revision
      0xe0 up to 0xea.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.10
changelog:
  - Make intel-06-2d-07, intel-06-4e-03, intel-06-4f-01, intel-06-55-04,
    intel-06-5e-03, intel-06-8c-01, intel-06-8e-9e-0x-0xca,
    and intel-06-8e-9e-0x-dell caveats dependent on intel caveat.
  - Enable 06-8c-01 microcode update by default.
  - Enable 06-5e-03 microcode update by default (#1897684).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826589):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.1
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893261, #1893249, #1893229):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
      0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
      to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
      to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
      to 0xde;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
      up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
      up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
      to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
      to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
      to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
      up to 0xa0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
      up to 0xe0.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.8
changelog:
  - Update Intel CPU microcode to microcode-20210216 release (#1905111):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a08 up
      to 0x2006a0a;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003003
      up to 0x4003006;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003003 up to 0x5003006.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
changelog:
  - Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
                             OIDCAuthNHeader not skipped in an "AuthType oauth20"
                             configuration [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
changelog:
  - Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                             issue exists in URLs with slash and backslash [rhel-7]
  - Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
                             in logout url when using URLs with leading slashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
changelog:
  - Fix a regression in the previous patches
  - Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                            issue exists in URLs with slash and backslash [rhel-7]


author: Joe Orton <jorton@redhat.com> - 1.7.14-13
changelog:
  - fix mod_authz_svn regression with mod_auth_kerb (#1306431)
  - fix "svn diff" property handling (#1378178)
  - fix permissions of /run/svnserve to match tmpfiles (#1496243)


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
  - add missing part of memory leak patch (#1794168)
  - fix if_inet6 messages floood (#1765449)
  - revert bz#1486733 (#1771050)
  - fix issue for process status when process name contains whitespace (#1782180)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
  - Explicitly enable upgradedb/sharedb test cycles


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - revert sql default language in man pages
  - fix SEC_PKCS12EnableCipher so python-nss tests will still work.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-3
changelog:
  - Include softoken specific patches required by the NSS 3.67
    release including:
  -  sdb timeout fixes.
  -  coverity patch.
  -  fixing private key macing


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29.el7_8.2
changelog:
  - don't update transmission time on invalid response (CVE-2020-11868)
  - randomize transmit timestamp in client requests (CVE-?, #1813787)


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.2
changelog:
  - ovt-Rectify-a-log-spew-in-vmsvc-logging-vmware-vmsvc-roo.patch [bz#1911853]
  - Resolves: bz#1911853
    ([ESXi][RHEL7.9][ warning] [guestinfo] GuestInfoGetDiskDevice: Missing disk device name; VMDK mapping unavailable for "/", fsName: "/dev/sda2")


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.0.5-3.el7_9.3
changelog:
  - ovt-Fix-memory-leaks-in-guestInfo-diskInfo.c.patch [bz#1937420]
  - Resolves: bz#1937420
    ([ESXi][RHEL7.9] Memory leak in vmtoolsd when disable-query-diskinfo is set to false [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 11.0.5-3.el7_9.4
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119310]
  - Resolves: bz#2119310
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-7.9.z])


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-23
changelog:
  - Fix CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd (#1895328)


author: Simon Pichugin <spichugi@redhat.com> - 2.4.44-25
changelog:
  - Fix CVE-2020-25709 openldap: assertion failure in Certificate List syntax validation (#2040539)
  - Fix CVE-2020-25710 openldap: assertion failure in CSN normalization with invalid input (#2040538)


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
  - Fix segfault in systemdunitdependency probe (RHBZ#1478285)
  - Build and ship HTML manual (RHBZ#1465661)
  - Fix oscap-ssh with --sudo (RHBZ#1803114)
  - Change category of verbose message (RHBZ#1640522)
  - Fix segfault in CVRF module (RHBZ#1642283)


author: Marcus Burghardt <maburgha@redhat.com> - 1.2.17-14
changelog:
  - Fix memory leaks in probe-api (RHBZ#1861793)
  - Prevent duplicate variables in Ansible Playbooks (RHBZ#1944683)
  - Fix trailing whitespace in Ansible Playbooks
  - Fix inconsistent result from security_patches_up_to_date (RHBZ#1858502)
  - Fix multiple segfaults and broken test (RHBZ#1911999)
  - Improve --stig-viewer output when there is no 1:1 connection between rules
  - Lower memory limits and improve their checking (RHBZ#1932833)


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-22
changelog:
  - fix CVE-2021-23841 openssl: NULL pointer dereference
    in X509_issuer_and_serial_hash()
  - fix CVE-2021-23840 openssl: integer overflow in CipherUpdate
  - Resolves: rhbz#1932132, rhbz#1932126


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-23
changelog:
  - fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#1996054


author: Sahana Prasad <sahana@redhat.com> 1.0.2k-24
changelog:
  - Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
  - Resolves: rhbz#2039993


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.0.2k-25
changelog:
  - Fixes CVE-2022-2078 Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Related: rhbz#2067160


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
  - Improve help for clean-up option
  - Avoid pending DC fencing getting "stuck" in status display
  - Rebase on upstream 1.1.23-rc1
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1787749
  - Resolves: rhbz#1792492


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
  - Fix hugepage metrics in pmdalinux (BZ 1730107)
  - Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
  - Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
  - Fix pcp-atopsar sample count command line argument (BZ 1764748)
  - Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
  - Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
  - Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
  - Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-15
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1905374 - restrict EE profile list and enrollment submission
    per LDAP group without immediate issuance [rhel-7.9.z] (cfu)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-16
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958277 - PKCS10Client EC Attribute Encoding [cfu]
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500:
    Non-2xx response from CA REST API: 500 [ftweedale, ckelley]
  - ##########################################################################
  - # RHCS 9.7 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1959937 - TPS Allowing Token Transactions while
    the CA is Down [cfu]
  - Bugzilla Bug 1979710 - TPS Not properly enforcing Token Profile
    Separation [cfu]


author: Dogtag Team <devel@lists.dogtagpki.org> 10.5.18-17
changelog:
  - ##########################################################################
  - # RHEL 7.9 (Batch Update 8):
  - ##########################################################################
  - Bugzilla Bug 1958788 - ipa: ERROR: Request failed with status 500: Non-2xx
    response from CA REST API: 500 [ftweedal, ckelley]
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - Bugzilla Bug #1774177 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.18 in RHCS 9.7 (Batch Update 7)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-91
changelog:
  - Security fixes for CVE-2020-26116, CVE-2020-26137 and CVE-2022-0391
  - Test fixes for the latest expat security release
  - Update the certificates utilized in the test suite
  Resolves: rhbz#1883014, rhbz#1883632, rhbz#2047376, rhbz#1896494


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: Charalampos Stratakis <cstratak@redhat.com> - 2.0.0-23gitd1c6db8
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Lumír Balhar <lbalhar@redhat.com> - 12.1.0-7
changelog:
  - Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
  Resolves: rhbz#1813439 rhbz#1813447
  - Remove useless macros definitions


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
  - Add three new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1643829


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
  - Resolves: bz#1771961
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
  - Resolves: bz#1791560
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7_8.1
changelog:
  - kvm-util-add-slirp_fmt-helpers.patch [bz#1798970]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798970]
  - Resolves: bz#1798970
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.8.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
  - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
  - kvm-slirp-disable-tcp_emu.patch [bz#1791679]
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
  - Resolves: bz#1791679
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
  - Resolves: bz#1800515
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
  - Resolves: bz#1802215
    (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
  - Resolves: bz#1810408
    (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
  - kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
  - Resolves: bz#1837565
    (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
  - Resolves: bz#1869693
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
  - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
  - kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
  - Resolves: bz#1842923
    (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
  - Resolves: bz#1860960
    (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
  - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
  - Resolves: bz#1884997
    (qemu-kvm FTBFS on rhel7.9)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.4
changelog:
  - kvm-ide-atapi-check-logical-block-address-and-read-size-.patch [bz#1917449]
  - Resolves: bz#1917449
    (CVE-2020-29443 qemu-kvm: QEMU: ide: atapi: OOB access while processing read commands [rhel-7.9.z])


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-2
changelog:
  - libwebp security fixes:
    Resolves: bz#1961742
    Resolves: bz#1961743
    Resolves: bz#1961744
    Resolves: bz#1961745


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
  - Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Watson Sato <wsato@redhat.com> - 0.1.49-12
changelog:
  - CIS Profile (RHBZ#1821633)
    - Make sure boot target is multi-user.target when xorg package is removed
    - Add CIS Profile content attribution to Center for Internet Security


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: scap-security-guide_spec-add-all-el-stigs.patch
  -->  Package all EL scap guidelines, not just TUV
  - Added Source: scap-security-guide.ini
  -->  Config file for automated patch script
  - Added Patch: 0005-rename-in-new-location.patch
  -->  Make sure the branding is right


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.52-1
changelog:
  - Update to the latest upstream release (RHBZ#1665233)
  - Update RHEL7 DISA STIG to V2R8 (RHBZ#1665233)


author: Watson Sato <wsato@redhat.com> - 0.1.54-2
changelog:
  - Remove Kickstart for not shipped profile (RHBZ#1497415)
  - Fix STIG id reference format for sshd_x11_use_localhost (RHBZ#1921643)


author: Watson Sato <wsato@redhat.com> - 0.1.57-7
changelog:
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix name of antivirus package in STIG profile (RHBZ#2066321)
  - Update RHEL7 DISA STIG profile to v3r7 (RHBZ#2079217)


author: Watson Sato <wsato@redhat.com> - 0.1.63-1
changelog:
  - Update to the latest upstream release (RHBZ#2116359)
  - Fix SSH Key permissions (RHBZ#2021258)
  - Remove PCI-DSS Benchmark(RHBZ2038165)
  - Updated source of CVE data feed(RHBZ#2028432)
  - Improved alignment with DISA's RHEL7 STIG(RHBZ#1967950)
  - Update RHEL7 STIG profile to v3r8 (RHBZ#2112939)
  - Add warning how to override audit buffer (RHBZ#1993822)
  - Fix smartcard_auth rule for systems installed without authconfig (RHBZ#2116359)
  - Fix check of enable_fips_mode on s390x (RHBZ#2116359)
  - Fix applicability of pam_pkcs11 and grub2 rules on s390x (RHBZ#2116359)


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Peter Jones <pjones@redhat.com> - 15-6
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: shim-spec_efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: securebootca.cer
  -->  Use the FNAL SL signing certificate
  - Added Source: shim.ini
  -->  Config file for automated patch script


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-4
changelog:
  - CVE 2021-3480:  slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1942937


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632999


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
  - Keepalive fix
    Resolves: rhbz#1719736
  - Fix hang on migration after password expired
    Resolves: rhbz#1761776


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15.1
changelog:
  - Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow
  - Resolves: #1829772 - CVE-2019-12525 squid: parsing of header
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
  - Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
    a trusted client to perform HTTP Request Smuggling


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - more clear formulation of man page note - previous note was a bit ambiguous


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-3
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2021d-1
changelog:
  - Rebase to tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
  - Do not search for DNSSEC info when domain-insecure is set
    for stub zone (#1678550)
  - Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-17
changelog:
  - CVE fix for: CVE-2021-4008 (#2030161), CVE-2021-4009 (#2030171),
    CVE-2021-4010 (#2030176), CVE-2021-4011 (#2030180)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.4-18
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2109031, rhbz#2109033


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-13
changelog:
  - Fix remote code execution vulnerability
  - Resolves: CVE-2021-21344
  - Resolves: CVE-2021-21345
  - Resolves: CVE-2021-21346
  - Resolves: CVE-2021-21347
  - Resolves: CVE-2021-21350


author: Marian Koncek <mkoncek@redhat.com> - 1.3.1-15
changelog:
  - Fix remote code execution vulnerabilities
  - Resolves: CVE-2021-39139
  - Resolves: CVE-2021-39140
  - Resolves: CVE-2021-39141
  - Resolves: CVE-2021-39144
  - Resolves: CVE-2021-39145
  - Resolves: CVE-2021-39146
  - Resolves: CVE-2021-39147
  - Resolves: CVE-2021-39148
  - Resolves: CVE-2021-39149
  - Resolves: CVE-2021-39150
  - Resolves: CVE-2021-39151
  - Resolves: CVE-2021-39152
  - Resolves: CVE-2021-39153
  - Resolves: CVE-2021-39154


