# changelog

author: Thomas Haller <thaller@redhat.com> - 1:1.36.0-0.7
changelog:
  - Upgrade to 1.35.7 release (development)
  - core: fix crash related to DHCPv6 leases (rh #2028849)
  - wifi: fix stale ActiveAccessPoint in D-Bus (rh #1983747)
  - libnm: fix dangling pointer in NMObject (rh #2039331)


author: Lubomir Rintel <lkundrak@v3.sk> - 1:1.36.0-0.8
changelog:
  - Upgrade to 1.35.91 release (release candidate)
  - bond: fix duplicate IPv4 address detection (rh #2028751)
  - core: add support for blackhole routes (rh #1937823) (rh #2013587)
  - core: re-assess IP configuration if one IP family times out (rh #2051904)
  - ovs: remove ovsdb entry on interface removal (rh #2047302)
  - ovs: properly clean up devices on daemon shutdown (rh #2029937)
  - core: avoid losing addresses on handover from initrd to ral root (rh #2047302)
  - core: fix a possibe assertion failure in ACD (rh #2047788)


author: Lubomir Rintel <lkundrak@v3.sk> - 1:1.36.0-0.9
changelog:
  - revert: generate docs during build instead of using pre-generated (rh #1995915)
  - Upgrade to 1.35.92 (release candidate)
  - ppp: increase disconnect timeout (rh #2049596)
  - core: finish activation after all objects are committed (rh #2043133)
  - ipv6: add support for multipath routes (rh #1837254)
  - keyfile: do not write empty string list properties (rh #2022623)


author: Lubomir Rintel <lkundrak@v3.sk> - 1:1.36.0-1
changelog:
  - Upgrade to 1.36.0 release
  - core: avoid losing L3 configuration the second time it's applied (rh #2043514)
  - ovs: avoid removing OVSDB entries on daemon shutdown (rh #2055665)
  - nmcli: fix defaults for some properties on interactive add (rh #2053603)


author: Thomas Haller <thaller@redhat.com> - 1:1.36.0-3
changelog:
  - core: preserve external bridge ports during checkpoint rollback (rh #2035519)
  - ovs-port: fix removal of ovsdb entry if the interface goes away (rh #1935026)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12-6
changelog:
  - Python 2 binary package renamed to python2-pyyaml
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.12-9
changelog:
  - Fix ambiguous Python 2 dependency declarations
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Miro Hrončok <mhroncok@redhat.com> - 3.12-12
changelog:
  - Rename python3-PyYAML to python3-pyyaml
  - Modernize spec
  - Fix python2 invocation

  - Cherry-picked from: https://src.fedoraproject.org/rpms/PyYAML/pull-request/2


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.67.1.el8_6]
changelog:
  - docs: Remove unnecessary unicode character (Patrick Talbert) [2208286 2207988]
  - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity (Tomas Henzl) [2216499 2160149]
  - xfs: verify buffer contents when we skip log replay (Andrey Albershteyn) [2187452 2187456] {CVE-2023-2124}
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216988 2214027] {CVE-2023-35788}
  - sched/core: Always flush pending blk_plug (Phil Auld) [2221304 2115518]
  - netfilter: conntrack: gre: don't set assured flag for clash entries (Florian Westphal) [2223543 2219357]
  - netfilter: conntrack: allow insertion clash of gre protocol (Florian Westphal) [2223543 2219357]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.68.1.el8_6]
changelog:
  - mm/memcg: Fix mem_cgroup_id_get_online() underflow problem (Waiman Long) [2221011 2176760]
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ricardo Robaina) [2196348 2196353] {CVE-2023-2002}
  - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf() (Sabrina Dubroca) [2224519 2179819] {CVE-2023-28466}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.69.1.el8_6]
changelog:
  - libceph: harden msgr2.1 frame segment length checks (Ilya Dryomov) [2227074 2222256]
  - PCI: VMD: ACPI: Make ACPI companion lookup work for VMD bus (Myron Stowe) [2225335 2015785]
  - ceph: fix use-after-free bug for inodes when flushing capsnaps (Xiubo Li) [2218273 2209299]
  - i40e: Use irq_update_affinity_hint() (Ivan Vecera) [2219262 2037943]
  - KVM: x86: fix sending PV IPI (Vitaly Kuznetsov) [2226580 2074835]
  - net: stmmac: propagate feature flags to vlan (Corinna Vinschen) [2219908 2174701]
  - perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery table (Michael Petlan) [2225514 2154044]
  - perf/x86/uncore: Add a quirk for UPI on SPR (Michael Petlan) [2225514 2154044]
  - perf/x86/uncore: Ignore broken units in discovery table (Michael Petlan) [2225514 2154044]
  - perf/x86/uncore: Fix potential NULL pointer in uncore_get_alias_name (Michael Petlan) [2225514 2154044]
  - perf/x86/uncore: Factor out uncore_device_to_die() (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix IIO event constraints for Snowridge (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix IIO event constraints for Skylake Server (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix filter_tid mask for CHA events on Skylake Server (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix Intel ICX IIO event constraints (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box() (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Fix reference count leak in sad_cfg_iio_topology() (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Make set_mapping() procedure void (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Update sysfs-devices-mapping file (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Enable UPI topology discovery for Sapphire Rapids (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Enable UPI topology discovery for Icelake Server (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Get UPI NodeID and GroupID (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Enable UPI topology discovery for Skylake Server (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Generalize get_topology() for SKX PMUs (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Disable I/O stacks to PMU mapping on ICX-D (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Clear attr_update properly (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Introduce UPI topology type (Michael Petlan) [2225514 2154044]
  - perf/x86/intel/uncore: Generalize IIO topology support (Michael Petlan) [2225514 2154044]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.70.1.el8_6]
changelog:
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226830 2226832] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226830 2226832] {CVE-2023-20593}
  - x86/amd: Cache debug register values in percpu variables (Waiman Long) [2226830 2226832] {CVE-2023-20593}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226830 2226832] {CVE-2023-20593}
  - x86/microcode/AMD: Track patch allocation size explicitly (Prarit Bhargava) [2226830 2226832]
  - x86/microcode: Print previous version of microcode after reload (Prarit Bhargava) [2226830 2226832]
  - x86/cpu: Load microcode during restore_processor_state() (Prarit Bhargava) [2226830 2226832]
  - x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - x86/speculation: Restore speculation related MSRs during S3 resume (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - kbuild: remove leftover comment for filechk utility (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - x86/cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - x86/rdrand: Sanity-check RDRAND output (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - firmware: refactor firmware/Makefile (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - kbuild: remove redundant 'set -e' from filechk_offsets (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - kbuild: do not redirect the first prerequisite for filechk (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - kbuild: move bin2c back to scripts/ from scripts/basic/ (Chris von Recklinghausen) [2226830 2226832] {CVE-2023-1637}
  - genirq: Fix reference leaks on irq affinity notifiers (Ricardo Robaina) [2222247 2154842]
  - genirq: Prevent use-after-free and work list corruption (Ricardo Robaina) [2222247 2154842]
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Phil Sutter) [2216164 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Phil Sutter) [2216164 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Phil Sutter) [2216164 2214963] {CVE-2023-3390}
  - vt: drop old FONT ioctls (Wander Lairson Costa) [2224517 2109164] {CVE-2021-33656}


author: Jarod Wilson <jarod@redhat.com> [4.18.0-372.71.1.el8_6]
changelog:
  - iavf: fix reset task race with iavf_remove() (Petr Oros) [2232401]
  - iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies (Petr Oros) [2232401]
  - Revert "iavf: Do not restart Tx queues after reset task failure" (Petr Oros) [2232401]
  - Revert "iavf: Detach device during reset task" (Petr Oros) [2232401]
  - iavf: Wait for reset in callbacks which trigger it (Petr Oros) [2232401]
  - iavf: use internal state to free traffic IRQs (Petr Oros) [2232401]
  - iavf: Fix out-of-bounds when setting channels on remove (Petr Oros) [2232401]
  - iavf: Fix use-after-free in free_netdev (Petr Oros) [2232401]
  - iavf: make functions static where possible (Petr Oros) [2232401]
  - iavf: fix err handling for MAC replace (Petr Oros) [2232401]
  - iavf: remove some unused functions and pointless wrappers (Petr Oros) [2232401]
  - iavf: remove mask from iavf_irq_enable_queues() (Petr Oros) [2232401]
  - iavf: send VLAN offloading caps once after VFR (Petr Oros) [2232401]
  - iavf: remove active_cvlans and active_svlans bitmaps (Stefan Assmann) [2232400]
  - iavf: refactor VLAN filter states (Stefan Assmann) [2232400]
  - iavf: do not track VLAN 0 filters (Stefan Assmann) [2232400]
  - iavf: fix non-tunneled IPv6 UDP packet type and hashing (Stefan Assmann) [2232400]
  - iavf: fix inverted Rx hash condition leading to disabled hash (Stefan Assmann) [2232400]
  - net/sched: move struct tc_mqprio_qopt_offload from pkt_cls.h to pkt_sched.h (Stefan Assmann) [2232400]
  - iavf/iavf_main: actually log ->src mask when talking about it (Stefan Assmann) [2232400]
  - iavf: Fix VF driver counting VLAN 0 filters (Stefan Assmann) [2232400]
  - iavf: Change information about device removal in dmesg (Stefan Assmann) [2232400]
  - iavf: Replace __FUNCTION__ with __func__ (Stefan Assmann) [2232400]
  - net: Remove the obsolte u64_stats_fetch_*_irq() users (drivers). (Stefan Assmann) [2232400]
  - iavf: fix hang on reboot with ice (Stefan Assmann) [2232404]
  - iavf: Fix race condition between iavf_shutdown and iavf_remove (Stefan Assmann) [2232404]
  - iavf: Use irq_update_affinity_hint() (Stefan Assmann) [2232400]
  - netfilter: nft_set_pipapo: fix improper element removal (Phil Sutter) [2227507] {CVE-2023-4004}
  - mm: avoid unnecessary page fault retires on shared memory types (Nico Pache) [2221101]
  - mm: remove redundant check about FAULT_FLAG_ALLOW_RETRY bit (Nico Pache) [2221101]
  - mm: Allow the [page|pfn]_mkwrite callbacks to drop the mmap_sem (Nico Pache) [2221101]
  - mm: clean up the last pieces of page fault accountings (Chris von Recklinghausen) [2221101]
  - mm/x86: use general page fault accounting (Chris von Recklinghausen) [2221101]
  - mm/s390: use general page fault accounting (Chris von Recklinghausen) [2221101]
  - mm/powerpc: use general page fault accounting (Chris von Recklinghausen) [2221101]
  - mm/arm64: use general page fault accounting (Chris von Recklinghausen) [2221101]
  - mm: do page fault accounting in handle_mm_fault (Chris von Recklinghausen) [2221101]
  - module: Don't wait for GOING modules (Mark Langsdorf) [2186307]
  - powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK (Mamatha Inamdar) [2230268]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.72.1.el8_6]
changelog:
  - i40e: Wait for pending VF reset in VF set callbacks (Ivan Vecera) [2228164 2203921]
  - i40e: Add helper for VF inited state check with timeout (Ivan Vecera) [2228164 2203921]
  - scsi: storvsc: Handle SRB status value 0x30 (Cathy Avery) [2231989 2218133]
  - net: sched: fix race condition in qdisc_graft() (Davide Caratti) [2224516 2187718] {CVE-2023-0590}
  - net_sched: add __rcu annotation to netdev->qdisc (Davide Caratti) [2224516 2187718] {CVE-2023-0590}
  - crypto: rng - Fix lock imbalance in crypto_del_rng (Herbert Xu) [2232216 2229700]
  - redhat: workaround CKI cross compilation for scripts (Jan Stancek) [2232138 2123399]
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Cathy Avery) [2230744 1986067]
  - cifs: fix bogus cifs_mount error handling in RHEL8 (Jeffrey Layton) [2229129 2215018]
  - cifs: missing null pointer check in cifs_mount (Jay Shin) [2229129 2215018]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.73.1.el8_6]
changelog:
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221724 2221046] {CVE-2023-35001}
  - redhat/scripts/create-tarball.sh: Use nproc instead of rpm macros (Prarit Bhargava)
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (Davide Caratti) [2219659 2218676] {CVE-2023-3090}
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Prarit Bhargava) [2183135 2119066] {CVE-2022-2873}
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228708 2225512] {CVE-2023-4128}
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228708 2225512] {CVE-2023-4128}
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2228708 2225512] {CVE-2023-4128}
  - rtmutex: Ensure that the top waiter is always woken up (Joel Savitz) [2235394 2170113]
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Benjamin Marzinski) [2183114 2012340] {CVE-2022-2503}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.74.1.el8_6]
changelog:
  - iommu/vt-d: Fix buggy QAT device mask (Jerry Snitselaar) [2221098 2169568]
  - iommu/vt-d: Add a fix for devices need extra dtlb flush (Jerry Snitselaar) [2221098 2169568]
  - gfs2: Fix freeze consistency check in gfs2_trans_add_meta (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: gfs2_freeze_lock_shared cleanup (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: Replace sd_freeze_state with SDF_FROZEN flag (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: Rework freeze / thaw logic (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: Reconfiguring frozen filesystem already rejected (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: Rename gfs2_freeze_lock{ => _shared } (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: Rename the {freeze,thaw}_super callbacks (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: Rename remaining "transaction" glock references (Andreas Gruenbacher) [2231826 2095340]
  - gfs2: init system threads before freeze lock (Bob Peterson) [2231826 2095340]
  - x86/tsc: Disable clocksource watchdog for TSC on qualified platorms (Prarit Bhargava) [2216051 1971939]
  - x86/tsc: Add a timer to make sure TSC_adjust is always checked (Prarit Bhargava) [2216051 1971939]
  - x86/hpet: Use another crystalball to evaluate HPET usability (Prarit Bhargava) [2216051 1971939]
  - x86/tsc: Respect tsc command line paraemeter for clocksource_tsc_early (Prarit Bhargava) [2216051 1971939]
  - Revert "xfs: expose the blockgc workqueue knobs publicly" (Bill O'Donnell) [2236814 2223260]
  - vt: vt_ioctl: fix race in VT_RESIZEX (Cestmir Kalina) [2233515 2068338] {CVE-2020-36558}
  - sched/topology: Skip updating masks for non-online nodes (Diego Domingos) [2210295 1946251]
  - powerpc/numa: Update cpu_cpu_map on CPU online/offline (Diego Domingos) [2210295 1946251]
  - powerpc/numa: Print debug statements only when required (Diego Domingos) [2210295 1946251]
  - powerpc/numa: convert printk to pr_xxx (Diego Domingos) [2210295 1946251]
  - powerpc/numa: Drop dbg in favour of pr_debug (Diego Domingos) [2210295 1946251]
  - netfilter: nf_tables: fix null deref due to zeroed list head (Florian Westphal) [2236817 2134371]
  - xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() (Sabrina Dubroca) [2183128 2136193] {CVE-2022-36879}
  - perf: Fix check before add_event_to_groups() in perf_group_detach() (Michael Petlan) [2235184 2209645] {CVE-2023-2235}
  - mm: swap: get rid of livelock in swapin readahead (Aristeu Rozanski) [2237686 2182084]
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Felix Maurer) [2233502 2176119] {CVE-2023-1206}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.75.1.el8_6]
changelog:
  - netfilter: snat: evict closing tcp entries on reply tuple collision (Florian Westphal) [2236515 2196717]


author: Chengweizheng <chengweizheng@kylinos.cn> [4.18.0-372.75.1.el8_6.ks8.01]
changelog:
  - Type: cves
  - ID:   [TASK#184509]
  - SUG:  NA
  - DESC:
  - change spec file and replace some keywords
  - add translation patches (0002~0006) and change config file for cjk
  - add patch: 0007-x86-kernel-add-hygon-family-18h.patch for Hygon CPU
  - add patch: 0008-x86-zhaoxin-patch and .config to support zhaoxin
  - add patch: 0009-add-qla2xxx-device-number-2432.patch
  - add patch: 0010-debrand-kylin-kernel-productization.patch
  - net:ipset: add the missing IP_SET_HASH_WITH_NET0 macro {CVE-2023-42753}


author: dujinxiu <dujinxiu@kylinos.cn> [4.18.0-372.75.1.el8_6.ks8.02]
changelog:
  - Type: cves
  - ID:   [TASK#625229]
  - SUG:  NA
  - DESC:
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) {CVE-2026-31431}
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)


author: wangsong <wangsong01@kylinos.cn> [4.18.0-372.75.1.el8_6.ks8.03]
changelog:
  - Type: cves
  - ID:   CVE-2026-31668、CVE-2026-43284
  - SUG:  NA
  - DESC:
  - seg6: separate dst_cache for input and output paths in seg6 lwtunnel
  - xfrm: esp: avoid in-place decrypt on shared skb frags


author: cuiyudong <cuiyudong@kylinos.cn> [4.18.0-372.75.1.el8_6.ks8.04]
changelog:
  - Type: cves
  - ID:   CVE-2026-43600
  - SUG:  NA
  - DESC:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers


author: kuangkai <kuangkai@kylinos.cn> [4.18.0-372.75.1.el8_6.ks8.05]
changelog:
  - Type: cves
  - ID:   CVE-2026-46333
  - SUG:  NA
  - DESC:
  - ptrace: slightly saner 'get_dumpable()' logic (Uwe Kleine-König) {CVE-2026-46333}


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Andreas Schneider <asn@redhat.com> - 4.15.5-5
changelog:
  - resolves: rhbz#2064325 - Fix 'create krb5 conf = yes` when a KDC has a
                             single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-8
changelog:
  - resolves: rhbz#2079303 - Fix username map for unix groups
  - resolves: rhbz#2079299 - PAM Kerberos authentication fails with a clock skew error
  - resolves: rhbz#2079304 - Fix UPNs handling in lookup_name*() calls


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-39
changelog:
  - 1941437 - cupsd doesn't log job ids when logging into journal
  - 1782216 - Print queue is paused after ipp backend ends with CUPS_BACKEND_STOP
  - 1938384 - CUPS doesn't start if sssd starts after cupsd


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-40
changelog:
  - 1955964 - PreserveJobHistory doesn't work with seconds
  - 1927452 - CVE-2020-10001 cups: access to uninitialized buffer in ipp.c [rhel-8]


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-41
changelog:
  - 2006987 - Unauthenticated users can't move print jobs in Web UI
  - 2017919 - Setting 'MaxJobTime 0' does not set a job time to unlimited
  - 1726383 - "lpadmin -p <queue> -o cupsSNMPSupplies:false" doesn't work
  - 1982891 - Printing of banner before PCL file only prints banner
  - 2006591 - Trying to restart and hold a job doesn't work
  - 1811716 - lpr to non-existent printer reports incorrect error


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18
changelog:
  - http: send payload when (proxy) authentication is done (#1918692)
  - curl: Inferior OCSP verification (CVE-2020-8286)
  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)
  - curl: trusting FTP PASV responses (CVE-2020-8284)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-19
changelog:
  - make `curl --head file://` work as expected (#1947493)
  - prevent automatic referer from leaking credentials (CVE-2021-22876)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-21
changelog:
  - fix TELNET stack contents disclosure again (CVE-2021-22925)
  - fix TELNET stack contents disclosure (CVE-2021-22898)
  - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
  - disable metalink support to fix the following vulnerabilities
      CVE-2021-22923 - metalink download sends credentials
      CVE-2021-22922 - wrong content via metalink not discarded


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-22
changelog:
  - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
  - fix protocol downgrade required TLS bypass (CVE-2021-22946)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-22.el8_6.1
changelog:
  - fix credential leak on redirect (CVE-2022-27774)
  - fix auth/cookie leak on redirect (CVE-2022-27776)
  - fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-22.el8_6.4
changelog:
  - fix HTTP compression denial of service (CVE-2022-32206)
  - fix FTP-KRB bad message verification (CVE-2022-32208)


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-6
changelog:
  - Fix handling of pmspare by vgsplit, vgmerge and vgremove.
  - Fix detection of active components of external origin volume.


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-17
changelog:
  - Add 0074-mpathpersist-fail-commands-when-no-usable-paths-exis.patch
    * Fixes bz #1984723
  - Add 0075-multipath-print-warning-if-multipathd-is-not-running.patch
    * Fixes bz #1973592
  - Add 0076-multipathd-don-t-access-path-if-it-was-deleted.patch
    * Found by coverity
  - Resolves: bz #1973592, #1984723


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-18
changelog:
  - Add 0077-multipathd.socket-add-missing-conditions-from-servic.patch
    * Fixes bz #2008101
  - Add 0078-libmulitpath-add-section-name-to-invalid-keyword-out.patch
    * Fixes bz #1918150
  - Resolves: bz #1918150, #2008101


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-20
changelog:
  - Add 0079-libmultipath-use-typedef-for-keyword-handler-and-pri.patch
  - Add 0080-libmultipath-print-the-correct-file-when-parsing-fai.patch
  - Add 0081-libmultipath-pass-file-and-line-number-to-keyword-ha.patch
  - Add 0082-libmultipath-make-set_int-take-a-range-for-valid-val.patch
  - Add 0083-libmultipath-improve-checks-for-set_str.patch
  - Add 0084-libmultipath-split-set_int-to-enable-reuse.patch
  - Add 0085-libmultipath-cleanup-invalid-config-handling.patch
  - Add 0086-libmultipath-don-t-return-error-on-invalid-values.patch
    * Above 8 patches fix bz #1900595
  - Add 0087-multipathd-avoid-unnecessary-path-read-only-reloads.patch
    * Fixes bz #2009624
  - Resolves: bz #1900595, #2009624, #2021823


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-21
changelog:
  - Add 0088-libmultipath-make-helper-function-to-trigger-path-ue.patch
  - Add 0089-multipathd-trigger-udev-change-on-path-addition.patch
  - Resolves: bz #1862032


author: Lukas Nykryn <lnykryn@redhat.com> - 049-151.git20210719
changelog:
  - Drop 51-dracut-rescue-postinst.sh entirely
  - fix(fips): add dh and ecdh ciphers
  - 35network-legacy: discard pointless RTNETLINK message
  - 95fcoe: don't install if there is no FCoE hostonly devices
  - 95nfs: set correct ownership and permissions for statd 
  - fix(dracut.sh): harden dracut against GZIP environment
  - fix(multipath): stop multipath before udev db cleanup
  - fix(dracut-functions): implement a cache for get_maj_min
  - fix(dracut-functions): get_maj_min without
  - fix(fcoe): rd.nofcoe=0 should disable fcoe
  - fix(fcoe): rename rd.nofcoe to rd.fcoe
  - fix(mdraid): remove offroot
  - fix(mdraid): add grow continue service
  - net-lib.sh: support infiniband network mac addresses
  - 95nvmf: add nvmf-autoconnect script


author: Lukas Nykryn <lnykryn@redhat.com> - 049-188.git20210802
changelog:
  - dracut-functions: fix botched backport
  - squash: unsquash the root image instead of mounting it on
  - 99squash: fail early if can't install require modules in
  - 99squash: Don't hardcode the squash sub directories
  - 99squash: improve pre-requirements check
  - Fixed some SUSE specific typos and outputs
  - 99squash: simplify the code
  - 99squash: Check require module earlier, and properly
  - fix(99squash): use kernel config instead of modprobe to check
  - kill bogus comment
  - busybox: simplify listing of supported utilities
  - fix: use find_binary
  - fix: shellcheck for modules.d/99squash/setup-squash.sh
  - fix: shellcheck for modules.d/99squash/clear-squash.sh
  - fix: shellcheck for modules.d/99squash/module-setup.sh
  - fix(squash): this module shouldn't depend on bash
  - refactor(squash): move the post install scripts into the
  - fix: revise squash module checks
  - fix(squash): post install should be the last step before
  - refactor(squash): move all setup code to init-squash.sh
  - feat(squash): install and depmod modules seperately
  - refactor(squash): don't record mount points in text file
  - lsinitrd: list squash content as well
  - refactor(squash): structure in a cleaner way
  - feat(squash): use busybox for early setup if available
  - feat: squash module follow --compress option
  - perf: disable initrd compression when squash module is
  - fix(squash): shellcheck for modules.d/99squash
  - fix(squash): don't mount the mount points if already mounted
  - feat(squash): install umount util
  - fix(squash): create relative symlinks
  - fix(dracut.sh): handle '-i' option to include files beginning
  - fix(dracut.sh): handle symlinks appropriately while using
  - fix(squash): keep ld cache under initdir
  - dracut-functions: backport block_is_* functions
  - fix(squash): fixes related to squash module rebase
  - fix(squash): remove tailing '/' when installing ld.so.conf.d


author: Pavel Valena <pvalena@redhat.com> - 049-201.git20220131
changelog:
  - ci: introduce C8S based GHA CI
  - ci: backport TEST-21-NFS-NM
  - dracut.sh: fix early microcode detection logic
  - fix(url-lib): make pre-pivot hook separetely per nfs mount
  - fix(watchdog): replace return with echo
  - fix(network): add errors and warnings when network interface
  - dracut.sh: add check for invalid configuration files
  - fips: removed false-positive 'FATAL: Module xxx not found'
  - fix(shutdown): be robust against forced shutdown
  - fix(fips): handle s390x OSTree systems


author: yueyuankun <yueyuankun@kylinos.cn> - 049-202.git20220511.el8.ks8.01
changelog:
  - Type:update
  - ID:TASK#154556
  - SUG:NA
  - DESC:add plymouth google-noto-sans-cjk-ttc-fonts and requires


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-5
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-188
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045063).


author: majian <majian@kylinos.cn> - 2.28-189.5.el8.ks8.01
changelog:
  - Type: bugfix
  - ID: [TASK#175540]
  - SUG: NA
  - DESC: Remove wrong country_name in locatedata. Kylin_fix_localesdata_countryname.patch .


author: Daiki Ueno <dueno@redhat.com> - 3.6.14-7
changelog:
  - Increase DH key bits to >= 2048 in self-tests (#1879506)
  - Implement self-tests for KDF and CMAC (#1890870)
  - Fix CVE-2020-24659: heap buffer-overflow when "no_renegotiation" alert is received (#1873959)


author: Daiki Ueno <dueno@redhat.com> - 3.6.16-1
changelog:
  - Update to upstream 3.6.16 release (#1956783)
  - Fix potential use-after-free in key_share handling (#1927597)
  - Fix potential use-after-free in pre_shared_key handling (#1927593)
  - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
  - Fix cert expiration issue in tests (#1908110)


author: Robbie Harwood <rharwood@redhat.com> - 2.06-123.el8_6.8
changelog:
  - CVE fixes for 2022-06-07
  - CVE-2022-28736 CVE-2022-28735 CVE-2022-28734 CVE-2022-28733
  - CVE-2021-3697 CVE-2021-3696 CVE-2021-3695
  - Resolves: #2031899


author: Jakub Martisko <jamartis@redhat.com> - 1.9-5
changelog:
  - Fix wrong skip size in gzexe
  - Add new test dealing with the ^^ (needs autoreconf)
  - Enable make check (needs less)
    Resolves: 1705413

   * Tue Aug 07 2018 Jakub Martisko <jamartis@redhat.com> - 1.9-4
   - Fix FTBFS bug (gnulib problems)
   - more details: https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
     Resolves 1611722


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-2
changelog:
  - Fix: dnf_context_module_install: memory leaks
  - covscan: remove unused vars, mark private func static, return values
  - DNF does not fail on non UTF-8 file names in a package


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
changelog:
  - make only_urandom a default in non-presence of configuration file
  - run the full FIPS selftests only when the library is called from
    application


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-3
changelog:
  - add CMAC selftest for FIPS POST
  - add continuous FIPS entropy test
  - disable non-approved FIPS hashes in the enforced FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
changelog:
  - new upstream version 1.8.5
  - AES performance improvements backported from master branch
  - FIPS module is implicit with kernel FIPS flag
  - always run the FIPS selftests if FIPS module is installed


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-40528 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-4
changelog:
  - Resolves: rhbz#2074648 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop [rhel-8.6.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-4.1
changelog:
  - Resolves: rhbz#2072958 - Use right sdap_domain in ad_domain_info_send [rhel-8.6.0.z]
  - Resolves: rhbz#2089244 - pam_sss_gss ceased to work after upgrade to 8.6 [rhel-8.6.0.z]


author: Martin Kutlak <mkutlak@redhat.com> - 2.9.5-10
changelog:
  - reportclient: Search for required packages recursively
  - reportclient: Find and download required debuginfo packages
  - report-client: Find debuginfos in own method
  - Resolves: rhbz#1783897


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: jiangjixiang <jiangjixiang@kylinos.cn> - 2.9.5-15.el8.ks8.02
changelog:
  - Type:bugfix
  - ID:[TASK#141171]
  - SUG:NA
  - DESC:Migrate the difference between libreport-2.9.5-10.el8.ks8.05 and libreport-2.9.5-10.el8
         Add Patch10000: 0001-Red-Hat-to-KYLIN.patch
         Don't compile centos packages
         Localization


author: liudingyao <liudingyao@kylinos.cn> - 2.9.5-15.el8.ks8.03
changelog:
  - Type:update
  - ID:NA
  - SUG:NA
  - DESC:obsolete libreport-rhel related packages
         delete libreport-rhel related packages
         skip test


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: David King <dking@redhat.com> - 2.9.7-10
changelog:
  - Fix CVE-2021-3516 (#1956976)
  - Fix CVE-2021-3517 (#1957001)
  - Fix CVE-2021-3518 (#1957028)
  - Fix CVE-2021-3537 (#1957284)


author: Xiao Ni <xni@redhat.com> - 4.1.12
changelog:
  - Update mdadm to latest upstream && change tmpfiles directory && correct changelog date
  - Resolves rhbz#1800521 and rhbz#1657265


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: zhangjun <zhangjun@kylinos.cn> - 1.3.2-1.p01
changelog:
  - Add patch:Paho-c-add-kylin-env-port-bind.patch 
  - TASK#65925 子 KMS2.2需求实现 / 解决MQTT支持的依赖
  - 本次更新将mqtt本地连接绑定环境变量KY_KMS_PORT的值 之前为随机的端口


author: zhangjun <zhangjun@kylinos.cn> - 1.3.2-1.p02
changelog:
  - Add patch:Paho-c-add-kylin-port-reuse.patch 
  - TASK#66261 子 KMS2.2需求实现 / 解决paho-c 重复端口的使用
  - 本次更新支持多个进程或者线程绑定到同一端口，提高服务器程序的性能


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Victor Stinner <vstinner@redhat.com> - 3.6.8-39
changelog:
  - Fix reentrant call to threading.enumerate() (rhbz#1959459)
  - Don't exit Python with abort() when a thread exit and there is no available
    file descriptor to load dynamically the libgcc_s.so.1 library (rhbz#1972293)


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-41
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-43
changelog:
  - Change shouldRollover() methods of logging.handlers to only rollover regular files
  Resolves: rhbz#2009200


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: wangqiang <wangqiang1@kylinos.cn> - 3.6.8-45.ks01
changelog:
  - Type: update
  - ID: [task#150111]
  - SUG: NA
  - DESC: Add patch:kylin-python-3.6.8-modify-platform-support-distribution.patch
                    kylin-python-3.6.8-backport-bpo-46811-Make-test-suite-support-Expat.patch


author: systemd maintenance team <systemd-maint@redhat.com> - 239-53
changelog:
  - sd-hwdb: allow empty properties (#2005009)
  - Update hwdb (#2005009)
  - Disable libpitc to fix CentOS Stream CI (#2017033)
  - rpm: Fix typo in /usr/lib/environment.d (#2018024)
  - rpm: Add misspelled /usr/lib/environment.d macro for temporary compatibility (#2018024)
  - rpm: emit warning when macro with typo is used (#2018024)
  - Remove unintended additions to systemd-analyze man page (#2004765)
  - core: fix SIGABRT on empty exec command argv (#2020239)
  - core/service: also check path in exec commands (#2020239)
  - mount-util: fix fd_is_mount_point() when both the parent and directory are network fs (#2015057)
  - basic: add vmware hypervisor detection from device-tree (#1959150)
  - pam: do not require a non-expired password for user@.service (#1961746)
  - udev rules: add rule to create /dev/ptp_hyperv (#1991834)
  - process-util: explicitly handle processes lacking parents in get_process_ppid() (#1977569)
  - errno-util: add ERRNO_IS_PRIVILEGE() helper (#1977569)
  - procfs-util: fix confusion wrt. quantity limit and maximum value (#1977569)
  - test-process-util: also add EROFS to the list of "good" errors (#1977569)
  - journal: refresh cached credentials of stdout streams (#1931806)
  - util-lib: introduce HAS_FEATURE_ADDRESS_SANITIZER (#2017033)
  - ci: skip test-execute on GH Actions under ASan (#2017033)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2017033)
  - test: accept that char device 0/0 can now be created witout privileges (#2017033)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2017033)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#1970945)
  - sd-event: take ref on event loop object before dispatching event sources (#1970945)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-54
changelog:
  - core: consider service with no start command immediately started (#1860899)
  - man: move description of *Action= modes to FailureAction=/SuccessAction= (#1860899)
  - core: define "exit" and "exit-force" actions for user units and only accept that (#1860899)
  - core: accept system mode emergency action specifiers with a warning (#1860899)
  - core: allow services with no commands but SuccessAction set (#1860899)
  - core: limit service-watchdogs=no to actual "watchdog" commands (#1860899)
  - units: use SuccessAction=exit-force in systemd-exit.service (#1860899)
  - units: use SuccessAction=reboot-force in systemd-reboot.service (#1860899)
  - units: use SuccessAction=poweroff-force in systemd-poweroff.service (#1860899)
  - units: allow and use SuccessAction=exit-force in system systemd-exit.service (#1860899)
  - core: do not "warn" about mundane emergency actions (#1860899)
  - core: return true from cg_is_empty* on ENOENT (#1860899)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2017033)
  - tests: add helper function to autodetect CI environments (#2017033)
  - strv: rework FOREACH_STRING() macro (#2017033)
  - test,systemctl: use "const char*" instead of "char*" (#2017033)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-55
changelog:
  - lgtm: detect uninitialized variables using the __cleanup__ attribute (#2017033)
  - lgtm: replace the query used for looking for fgets with a more general query (#2017033)
  - lgtm: beef up list of dangerous/questionnable API calls not to make (#2017033)
  - lgtm: warn about strerror() use (#2017033)
  - lgtm: complain about accept() [people should use accept4() instead, due to O_CLOEXEC] (#2017033)
  - lgtm: don't treat the custom note as a list of tags (#2017033)
  - lgtm: ignore certain cleanup functions (#2017033)
  - lgtm: detect more possible problematic scenarios (#2017033)
  - lgtm: enable more (and potentially useful) queries (#2017033)
  - test: make TEST-47 less racy (#2017033)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2036608)
  - core: Check unit start rate limiting earlier (#2036608)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2036608)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2036608)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2036608)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2036608)
  - pid1: add a manager_trigger_run_queue() helper (#2036608)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2036608)
  - Revert "Revert "sysctl: Enable ping(8) inside rootless Podman containers"" (#2037807)
  - sysctl: prefix ping port range setting with a dash (#2037807)
  - mount: don't propagate errors from mount_setup_unit() further up (#2036853)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-57
changelog:
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2039797)
  - udev/net_id: remove extraneous bracket (#2039797)
  - udev/net_id: introduce naming scheme for RHEL-8.6 (#2039797)
  - define newly needed constants (#2005008)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#2005008)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#2005008)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#2005008)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#2005008)
  - util: introduce ifname_valid_full() (#2005008)
  - rename function (#2005008)
  - udev: support AlternativeName= setting in .link file (#2005008)
  - network: make Name= in [Match] support alternative names of interfaces (#2005008)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#2005008)
  - udev: do not fail if kernel does not support alternative names (#2005008)
  - udev: introduce AlternativeNamesPolicy= setting (#2005008)
  - network: set AlternativeNamesPolicy= in 99-default.link (#2005008)
  - random-util: call initialize_srand() after fork() (#2005008)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#2005008)
  - udev: sort alternative names (#2005008)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#2005008)
  - netlink: do not fail when new interface name is already used as an alternative name (#2005008)
  - udev: do not try to reassign alternative names (#2005008)
  - Do not fail if the same alt. name is set again (#2005008)
  - mount: do not update exec deps on mountinfo changes (#2008825)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2008825)
  - core: fix unfortunate typo in unit_is_unneeded() (#2040147)
  - core: make destructive transaction error a bit more useful (#2040147)
  - tmpfiles: use a entry in hashmap as ItemArray in read_config_file() (#1944468)
  - tmpfiles: rework condition check (#1944468)
  - TEST-22-TMPFILES: add reproducer for bug with X (#1944468)
  - core: make sure we don't get confused when setting TERM for a tty fd (#2045307)
  - hash-funcs: introduce macro to create typesafe hash_ops (#2037807)
  - hash-func: add destructors for key and value (#2037807)
  - util: define free_func_t (#2037807)
  - hash-funcs: make basic hash_ops typesafe (#2037807)
  - test: add tests for destructors of hashmap or set (#2037807)
  - man: document the new sysctl.d/ - prefix (#2037807)
  - sysctl: if options are prefixed with "-" ignore write errors (#2037807)
  - sysctl: fix segfault (#2037807)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58
changelog:
  - ci: drop CentOS 8 CI (#2017033)
  - test: adapt to the new capsh format (#2017033)
  - test: ignore IAB capabilities in `test-execute` (#2017033)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.1
changelog:
  - acpi-fpdt: mark structures as packed (#2084052)
  - core/slice: make slice_freezer_action() return 0 if freezing state is unchanged (#2084052)
  - core/unit: fix use-after-free (#2084052)
  - sd-bus: fix reference counter to be incremented (#2084052)
  - sd-bus: do not read unused value (#2084052)
  - sd-bus: do not return negative errno when unknown name is specified (#2084052)
  - sd-bus: switch to a manual overflow check in sd_bus_track_add_name() (#2084052)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-58.2
changelog:
  - unit: don't emit PropertiesChanged signal if adding a dependency to a unit is a no-op (#2091590)
  - core: propagate triggered unit in more load states (#2086553)
  - core: propagate unit start limit hit state to triggering path unit (#2086553)
  - core: Move 'r' variable declaration to start of unit_start() (#2086553)
  - core: Delay start rate limit check when starting a unit (#2086553)
  - core: Propagate condition failed state to triggering units. (#2086553)


author: Cai Yinan <caiyinan@kylinos.cn> - 239-58.el8_6.3.ks8.01
changelog:
  - Type:bugfix
  - ID:#83554
  - SUG:NA
  - DESC:fix bug #83554 change "journalctl -xe" show support URL to "https://www.kylinos.cn"


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - 2028341 - CVE-2021-3984 vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow [rhel-8.6.0]
  - 2028430 - CVE-2021-4019 vim: heap-based buffer overflow in find_help_tags() in src/help.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.3
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-1
changelog:
  - rebase to 5.2.4 (rhbz#1574039), per release notes:
    https://www.mail-archive.com/xz-devel@tukaani.org/msg00295.html


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-2
changelog:
  - drop ppc64p7 hack, per fedora devel list discussion:
    https://lists.fedoraproject.org/archives/list/
    devel@lists.fedoraproject.org/thread/2OWD2QRDFBEC6HTPVQ7FMJENH32BWT54/
  - don't explicitly set _FILE_OFFSET_BITS, package uses AC_SYS_LARGEFILE


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-11
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures
  - fixed firefox crash due to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11.19
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


