# changelog

author: Paul Howarth <paul@city-fan.org> - 1.6.11-1
changelog:
  - Update to 1.6.11
    - Fix use of a NULL pointer when opening a corrupt database with 'GeoIP_open'
      (GH#87)
  - Drop EL-5 support
    - Drop redundant BuildRoot: and Group: tags
    - Drop EL5-only dependency on GeoIP-GeoLite-data
    - Drop explicit pkgconfig dependency in devel package
    - Drop buildroot cleaning in %install section
    - Drop explicit %clean section


author: Paul Howarth <paul@city-fan.org> - 1.6.12-1
changelog:
  - Update to 1.6.12
    - Populate metro and area code when performing lookups in IPv6 City
      databases; previously this was only done when using IPv4 City
      databases


author: Paul Howarth <paul@city-fan.org> - 2018.06-1
changelog:
  - IPv6 databases are still seeing updates in June 2018
  - IPv4 databases are unchanged from previous release


author: Miroslav Lichvar <mlichvar@redhat.com> - 5.18.12-7
changelog:
  - fix linking to use hardening flags (#1547522)
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - remove comment with macro


author: Javier Martinez Canillas <javierm@redhat.com> - 8.40-37
changelog:
  - grubby-bls: unset default entry if is the one being removed
    Resolves: rhbz#1668329
  - grubby-bls: error if args or remove-args is used without update-kernel
    Related: rhbz#1690765
  - grubby-bls: make --update-kernel ALL to update kernelopts var in grubenv
    Resolves: rhbz#1690765
  - grubby-bls: fix --add-kernel not working when using the --args option
    Related: rhbz#1690765


author: Javier Martinez Canillas <javierm@redhat.com> - 8.40-38
changelog:
  - grubby-bls: don't print rpm-sort error messages
    Resolves: rhbz#1731924
  - grubby-bls: remove -o option and support -c for ppc64le grub config
    Resolves: rhbz#1758598
  - grubby-bls: fix logic to check if the kernelopts var is defined in a BLS
    Resolves: rhbz#1726514
  - grubby-bls: don't update grubenv when generating grub.cfg for ppc64le
    Related: rhbz#1726514


author: Javier Martinez Canillas <javierm@redhat.com> - 8.40-39
changelog:
  - grubby-bls: strip only /boot from paths
    Resolves: rhbz#1738238
  - Make grubby to also update GRUB_CMDLINE_LINUX in /etc/default/grub
    Resolves: rhbz#1152027
  - grubby-bls: fix corner case when a kernel param value contains a '='
    Resolves: rhbz#1787584
  - grubby-bls: update man page to match options in current wrapper script
    Resolves: rhbz#1812065
  - grubby-bls: always escape the delimiter character used in sed commands
    Related: rhbz#1787584
  - grubby-bls: add a --no-etc-grub-update option
    Related: rhbz#1152027


author: Louis Abel <label@rockylinux.org> - 8.4-35
changelog:
  - Add missing CentOS provides and symlinks
  - Add centos macros for some builds to complete successfully without relying
    on random patching


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 5.0.1-5
changelog:
  - Actually, specify pagesizes according to arches, closes #1545539
  - Remove patch disabling thp as this is now handled by configure, see
    upstream issue 526


author: Paul Howarth <paul@city-fan.org> - 1.8.0-10
changelog:
  - Explicitly run the test suite in the en_US.UTF-8 locale to work around flaky
    locale settings in mock builders


author: Paul Howarth <paul@city-fan.org> - 1.8.1-1
changelog:
  - Update to 1.8.1
    - Fixed possible integer overflow when reading a specially crafted packet
      (CVE-2019-3855)
    - Fixed possible integer overflow in userauth_keyboard_interactive with a
      number of extremely long prompt strings (CVE-2019-3863)
    - Fixed possible integer overflow if the server sent an extremely large
      number of keyboard prompts (CVE-2019-3856)
    - Fixed possible out of bounds read when processing a specially crafted
      packet (CVE-2019-3861)
    - Fixed possible integer overflow when receiving a specially crafted exit
      signal message channel packet (CVE-2019-3857)
    - Fixed possible out of bounds read when receiving a specially crafted exit
      status message channel packet (CVE-2019-3862)
    - Fixed possible zero byte allocation when reading a specially crafted SFTP
      packet (CVE-2019-3858)
    - Fixed possible out of bounds reads when processing specially crafted SFTP
      packets (CVE-2019-3860)
    - Fixed possible out of bounds reads in _libssh2_packet_require(v)
      (CVE-2019-3859)
  - Fix mis-applied patch in the fix of CVE-2019-3859
    - https://github.com/libssh2/libssh2/issues/325
    - https://github.com/libssh2/libssh2/pull/327


author: Paul Howarth <paul@city-fan.org> - 1.8.2-1
changelog:
  - Update to 1.8.2
    - Fixed the misapplied userauth patch that broke 1.8.1
    - Moved the MAX size declarations from the public header


author: Paul Howarth <paul@city-fan.org> - 1.9.0-1
changelog:
  - Update to 1.9.0
    - Fixed integer overflow leading to out-of-bounds read (CVE-2019-13115)
    - Adds ECDSA keys and host key support when using OpenSSL
    - Adds ED25519 key and host key support when using OpenSSL 1.1.1
    - Adds OpenSSH style key file reading
    - Adds AES CTR mode support when using WinCNG
    - Adds PEM passphrase protected file support for libgcrypt and WinCNG
    - Adds SHA256 hostkey fingerprint
    - Adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
    - Adds explicit zeroing of sensitive data in memory
    - Adds additional bounds checks to network buffer reads
    - Adds the ability to use the server default permissions when creating sftp directories
    - Adds support for building with OpenSSL no engine flag
    - Adds support for building with LibreSSL
    - Increased sftp packet size to 256k
    - Fixed oversized packet handling in sftp
    - Fixed building with OpenSSL 1.1
    - Fixed a possible crash if sftp stat gets an unexpected response
    - Fixed incorrect parsing of the KEX preference string value
    - Fixed conditional RSA and AES-CTR support
    - Fixed a small memory leak during the key exchange process
    - Fixed a possible memory leak of the ssh banner string
    - Fixed various small memory leaks in the backends
    - Fixed possible out of bounds read when parsing public keys from the server
    - Fixed possible out of bounds read when parsing invalid PEM files
    - No longer null terminates the scp remote exec command
    - Now handle errors when Diffie Hellman key pair generation fails
    - Fixed compiling on Windows with the flag STDCALL=ON
    - Improved building instructions
    - Improved unit tests
  - Needs OpenSSL ≥ 1.0.1 now as ECC support is assumed
  - Modernize spec somewhat as EL-6 can no longer be supported


author: Paul Howarth <paul@city-fan.org> - 1.9.0-5
changelog:
  - Switch to https:// upstream URLs
  - Full groff (not just groff-base) needed for the mansyntax check


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-17
changelog:
  - Merging upstream branch-2.16 [RH git: c1145b5236]
      Commit list:
      0fd17fbb09 ipf: release unhandled packets from the batch


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-18
changelog:
  - Merging upstream branch-2.16 [RH git: a6c4770398]
      Commit list:
      27a5848a33 ovs-ctl: Add missing description for --ovs-vswitchd-options and --ovsdb-server-options to usage().
      0300d0c0c2 dpdk-stub: Change the ERR log to DBG.
      cdd6dd821d dpif-netlink: Fix feature negotiation for older kernels.
      c2682c42cb dpif-netdev: Fix pmd thread comments to include SMC.
      9377f4a465 python: idl: Avoid sending transactions when the DB is not synced up.


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-19
changelog:
  - Merging upstream branch-2.16 [RH git: 557ca689f7]
      Commit list:
      6d8190584a dpif-netdev: Fix use-after-free on PACKET_OUT of IP fragments.
      44a66cc1d0 tunnel-push-pop.at: Mask source port in tunnel header.


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-20
changelog:
  - Merging upstream branch-2.16 [RH git: d572c95f69]
      Commit list:
      458a4f75f3 ofproto-dpif-xlate: Fix zone set from non-frozen-metadata fields.


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-21
changelog:
  - Merging upstream branch-2.16 [RH git: 2546fa9646]
      Commit list:
      5c5e34603b datapath-windows: add layers when adding the deferred actions


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-22
changelog:
  - Merging upstream branch-2.16 [RH git: 29f01c4fdb]
      Commit list:
      108176ab5a github: Stick to python 3.9.


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-23
changelog:
  - Merging upstream branch-2.16 [RH git: cce913794e]
      Commit list:
      2a4c87f300 Prepare for 2.16.2.
      aaa1439b8e Set release date for 2.16.1.


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-24
changelog:
  - Merging upstream branch-2.16 [RH git: 4682b76694]
      Commit list:
      b79f0369f2 ci: Make linux-prepare trust system installs.


author: Open vSwitch CI <ovs-ci@redhat.com> - 2.16.0-25
changelog:
  - Merging upstream branch-2.16 [RH git: f5366890c5]
      Commit list:
      c221c8e613 datapath-windows:Reset PseudoChecksum value only for TX direction offload case


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-13
changelog:
  - pam_wheel: if getlogin fails fallback to PAM_RUSER: fixed malformed patch (#1866866)
  - pam_namespace: polyinstantiation refer to gdm doc (#1861841)


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-17
changelog:
  - pam_keyinit: thread-safe implementation. Resolves: #1997969
  - pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them. Resolves: #2014458


author: Jakub Jelen <jjelen@redhat.com> - 7.6-88
changelog:
  - Remove the devel subpackage (#1495181)
  - Adjust build process for recent changes (nsl separated from glibc-headers)


author: James Antill <james@fedoraproject.org> - 1.0.4-20
changelog:
  - Move doc/ustr-devel-<version> to doc/ustr-devel. BZ 993940.
  - Use -fgnu89-inline workaround for gcc5.


