# changelog

author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-1
changelog:
  - Update to 1.18.8 relase
  - ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841397, CVE-2020-10754)
  - ifcfg-rh: handle 802-1x.pin properties.


author: Wim Taymans <wtaymans@redhat.com> - 1.2.15-17
changelog:
  - Fix Some CVEs: CVE-2019-7572, CVE-2019-7573, CVE-2019-7574,
    CVE-2019-7575, CVE-2019-7576, CVE-2019-7577, CVE-2019-7578,
    CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638
  - Resolves: rhbz#1716201, rhbz#1716202, rhbz#1716206,
  - Resolves: rhbz#1716207, rhbz#1716208


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-7
changelog:
  - Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix
    security issues.  CVE-2017-6827, CVE-2017-6828,
    CVE-2017-6829, CVE-2017-6830, CVE-2017-6831,
    CVE-2017-6832, CVE-2017-6833, CVE-2017-6834, CVE-2017-6835,
    CVE-2017-6836, CVE-2017-6837, CVE-2017-6838, CVE-2017-6839


author: Wim Taymans <wtaymans@redhat.com> - 1:0.3.6-9
changelog:
  - Apply security patches. CVE-2018-17095, CVE-2018-13440
  - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128


author: Jerome Marchand <jmarchan@redhat.com> - 0.10.0-1
changelog:
  - Rebase on bcc-0.10.0
  - Fix regression of vfscount
  - Drop tools that relies on features unavailable on RHEL 7


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.1
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.10.1.el7]
changelog:
  - [md] dm-mirror: provide the merge method (Mikulas Patocka) [1890059]
  - [nvme] nvme-rdma: cancel async events before freeing event struct (David Milburn) [1857397]
  - [s390] dasd: Use struct_size() helper (Sterling Alexander) [1886477]
  - [s390] dasd: fix inability to use DASD with DIAG driver (Sterling Alexander) [1886477]
  - [hv] hv_utils: drain the timesync packets on onchannelcallback (Vitaly Kuznetsov) [1884735]
  - [hv] hv_utils: return error if host timesysnc update is stale (Vitaly Kuznetsov) [1884735]
  - [x86] cpu: Re-apply forced caps every time CPU caps are re-read (Herbert Xu) [1886792]
  - [x86] cpu: Factor out application of forced CPU caps (Herbert Xu) [1886792]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.11.1.el7]
changelog:
  - [netdrv] hdlc_ppp: add range checks in ppp_cp_parse_cr() (Guillaume Nault) [1882078] {CVE-2020-25643}
  - [fs] ext4: fix potential negative array index in do_split() (Pavel Reichl) [1846164] {CVE-2020-14314}
  - [fs] nfsd: apply umask on fs without ACL support ("J. Bruce Fields") [1870215] {CVE-2020-24394}
  - [kernel] watchdog/core: Remove the park_in_progress obfuscation (Waiman Long) [1860661]
  - [mm] swap_slots: recheck cache->slots_ret under spin_lock_irq() protection (Rafael Aquini) [1862915]
  - [netdrv] ethernet: i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (Stefan Assmann) [1845677]
  - [infiniband] mlx5: Fix use-after-free in dereg_mr() (Alaa Hleihel) [1880184]


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: genkey.patch
  -->  Debrand certs
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: debrand_taint_cpu.patch
  -->  Rename RHEL7 to SL7
  - Added Source: sl-ldup.x509
  -->  The FNAL SL signing certificate for driver updates
  - Added Source: kernel-spec_use_our_keys.patch
  -->  Remove the TUV keys and sign with ours
  - Added Source: kernel.ini
  -->  Config file for automated patch script
  - Added Source: sl-kpatch.x509
  -->  The FNAL SL signing certificate for kpatch updates
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: kernel-spec_debrand_taint_cpu.patch
  -->  Apply our debrand patch


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.15.1.el7]
changelog:
  - [fs] ceph: quota: fix null pointer dereference in quota check (Jeff Layton) [1890386]
  - [netdrv] revert "mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query" (Alaa Hleihel) [1896756]
  - [kernel] timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion (Waiman Long) [1890911]
  - [kernel] exit: Optimize forget_original_parent() for large thread group exiting (Waiman Long) [1872110]
  - [kernel] exit: reparent: call forget_original_parent() under tasklist_lock (Waiman Long) [1872110]
  - [kernel] Disable tasklist_waiters when qrwlock is enabled (Waiman Long) [1872110]
  - [fs] cifs: handle ERRBaduid for SMB1 (Leif Sahlberg) [1847041]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1154.el7]
changelog:
  - [fs] gfs2: move privileged user check to gfs2_quota_lock_check (Robert S Peterson) [1798713]
  - [fs] gfs2: Fix problems regarding gfs2_qa_get and _put (Robert S Peterson) [1798713]
  - [fs] gfs2: don't call quota_unhold if quotas are not locked (Robert S Peterson) [1798713]
  - [fs] gfs2: Remove unnecessary gfs2_qa_{get, put} pairs (Robert S Peterson) [1798713]
  - [fs] gfs2: Split gfs2_rsqa_delete into gfs2_rs_delete and gfs2_qa_put (Robert S Peterson) [1798713]
  - [fs] gfs2: Change inode qa_data to allow multiple users (Robert S Peterson) [1798713]
  - [fs] gfs2: eliminate gfs2_rsqa_alloc in favor of gfs2_qa_alloc (Robert S Peterson) [1798713]
  - [fs] gfs2: Switch to list_{first,last}_entry (Robert S Peterson) [1798713]
  - [fs] gfs2: Clean up inode initialization and teardown (Robert S Peterson) [1798713]
  - [fs] gfs2: Minor gfs2_alloc_inode cleanup (Robert S Peterson) [1798713]
  - [fs] gfs2: Fix busy-on-umount in gfs2_atomic_open() (Andrew Price) [1812558]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1155.el7]
changelog:
  - [x86] Revert "x86: respect memory size limiting via mem= parameter" (Joel Savitz) [1851576]
  - [mm] Revert "mm/memory_hotplug.c: only respect mem= parameter during boot stage" (Joel Savitz) [1851576]
  - [fs] nfsd: only WARN once on unmapped errors ("J. Bruce Fields") [1850430]
  - [powerpc] pci/of: Fix OF flags parsing for 64bit BARs (Greg Kurz) [1840114]
  - [fs] cifs: fix NULL dereference in match_prepath (Leif Sahlberg) [1759852]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1156.el7]
changelog:
  - [fs] gfs2: Fix regression due to unwanted gfs2_qa_put (Robert S Peterson) [1798713]
  - [include] signal: Unfairly acquire tasklist_lock in send_sigio() if irq disabled (Waiman Long) [1838799]
  - [fs] signal: Don't take tasklist_lock if PID type is PIDTYPE_PID (Waiman Long) [1838799]
  - [vfio] vfio/pci: Fix SR-IOV VF handling with MMIO blocking (Alex Williamson) [1820632] {CVE-2020-12888}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1159.el7]
changelog:
  - [kernel] modsign: Import certificates from optional MokListRT (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1862840]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.el7]
changelog:
  - [kernel] modsign: Add nomokvarconfig kernel parameter (Lenny Szubowicz) [1867857]
  - [firmware] modsign: Add support for loading certs from the EFI MOK config table (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Move import of MokListRT certs to separate routine (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Avoid spurious error message after last MokListRTn (Lenny Szubowicz) [1867857]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.1.1.el7]
changelog:
  - [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1869751]
  - [scsi] scsi: ses: don't ask for diagnostic pages repeatedly during probe (Maurizio Lombardi) [1855324]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.1.el7]
changelog:
  - [edac] EDAC/i10nm: Update driver to support different bus number config register offsets (Aristeu Rozanski) [1840276]
  - [edac] EDAC, {skx, i10nm}: Make some configurations CPU model specific (Aristeu Rozanski) [1840276]
  - [net] test nouarg before dereferencing zerocopy pointers (Patrick Talbert) [1862273]
  - [net] packet: copy user buffers before orphan or clone (Patrick Talbert) [1862273]
  - [netdrv] net/mlx5e: Fix deallocation of non-fully init encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Allow concurrent creation of encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Protect encap hash table with mutex (Alaa Hleihel) [1874101]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.2.el7]
changelog:
  - [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
  - [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.20.1.el7]
changelog:
  - [md] Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1889372]
  - [md] improve variable names in md_flush_request() (Xiao Ni) [1889372]
  - [kernel] timer: Fix potential bug in requeue_timers() (Waiman Long) [1914011]
  - [x86] kvm: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Vitaly Kuznetsov) [1890669]
  - [x86] kvm: avoid incorrect writes to host MSR_IA32_SPEC_CTRL (Vitaly Kuznetsov) [1890669]
  - [md] dm-mirror: fix a crash if the underlying block device doesn't have merge_bvec_fn (Mikulas Patocka) [1916407]
  - [gpu] drm/i915: Fix use-after-free when destroying GEM context (Dave Airlie) [1814731] {CVE-2020-7053}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.21.1.el7]
changelog:
  - [pinctrl] devicetree: Avoid taking direct reference to device name string (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [pinctrl] Delete an error message (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [tty] vt: keyboard, reorder user buffer handling in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, rename i to kb_func in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, extend func_buf_lock to readers (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, simplify vt_kdgkbsent (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] keyboard, do not speculate on func_table index (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: fix write/write race in ioctl(KDSKBSENT) handler (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [iommu] amd: return error on real irq alloc failure (Jerry Snitselaar) [1918273]
  - [iommu] amd: Set DTE[IntTabLen] to represent 512 IRTEs (Jerry Snitselaar) [1921187]
  - [iommu] amd: Increase interrupt remapping table limit to 512 entries (Jerry Snitselaar) [1921187]
  - [scsi] lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix ADISC reception terminating login state if a NVME target (Dick Kennedy) [1875961]
  - [netdrv] i40e: revert "i40e: don't report link up for a VF who hasn't enabled queues" (Stefan Assmann) [1901064]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.5.1.el7]
changelog:
  - [x86] x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs (Myron Stowe) [1849223]
  - [kernel] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression (Oleg Nesterov) [1861396]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859468] {CVE-2020-14331}
  - [pci] hv: Retry PCI bus D0 entry on invalid device state (Mohammed Gamal) [1846667]
  - [pci] hv: Fix the PCI HyperV probe failure path to release resource properly (Mohammed Gamal) [1846667]
  - [x86] xen: Add call of speculative_store_bypass_ht_init() to PV paths (Vladis Dronov) [1882468]
  - [powerpc] powerpc/smp: Use nid as fallback for package_id (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add Power9 scheduler topology (Desnes Augusto Nunes do Rosario) [1826306]
  - [kernel] sched: Add a new SD_SHARE_POWERDOMAIN for sched_domain (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] sched, powerpc: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] sched, s390: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] s390/topology: Remove call to update_cpu_masks() (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add cpu_l2_cache_map (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Rework CPU topology construction (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Use cpu_to_chip_id() to find core siblings (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc, hotplug: Avoid to touch non-existent cpumasks (Desnes Augusto Nunes do Rosario) [1826306]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.6.1.el7]
changelog:
  - [net] netfilter: nf_queue: place bridge physports into queue_entry struct (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: do not release refcouts until nf_reinject is done (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: make nf_queue_entry_release_refs static (Florian Westphal) [1885682]
  - [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
  - [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-5.el7
changelog:
  - ci-Remove-race-condition-between-cloud-init-and-Network-v2.patch [bz#1748015]
  - ci-cc_mounts-fix-incorrect-format-specifiers-316.patch [bz#1772505]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1772505
    ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-6.el7
changelog:
  - ci-Use-reload-or-try-restart-instead-of-try-reload-or-r.patch [bz#1748015]
  - ci-ec2-Do-not-log-IMDSv2-token-values-instead-use-REDAC.patch [bz#1821999]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-7.el7
changelog:
  - ci-ec2-only-redact-token-request-headers-in-logs-avoid-.patch [bz#1821999]
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Isaac Boukris <iboukris@redhat.com> - 4.10.16-2
changelog:
  - resolves: #1828354 - add additioanl hostnames to the keytab
  - resolves: #1836427 - add dnshostname option net-ads-join


author: Andreas Schneider <asn@redhat.com> - 4.10.16-8
changelog:
  - resolves: #1878205 - Fix restarting winbind on package upgrade
  - resolves: #1892632 - Fix CVE-2020-14318
  - resolves: #1891687 - Fix CVE-2020-14323
  - resolves: #1879834 - Fix CVE-2020-1472
  - resolves: #1892313 - Fix memory leak in winbindd (wbinfo -u)
  - resolves: #1868917 - Fix %U substitution for 'valid users' option
  - resolves: #1853272 - Fix 'require_membership_of' documentation in
                         pam_winbind{.conf} manpage


author: Petr Menšík <pemensik@redhat.com> - 2.76-16.1
changelog:
  - Accept responses only on correct sockets (CVE-2020-25684)
  - Use strong verification on queries (CVE-2020-25685)
  - Handle multiple identical DNS queries better (CVE-2020-25686)
  - Link against nettle for sha256 hash implementation


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
    by assuming the date is correct and changing the weekday.


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-8
changelog:
  - Do not free EvDocumentInfo in ev_window_save_print_settings(),
  - it is freed in EvDocument's destructor
  - Resolves: #1541358


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-41.1
changelog:
  - fence_lpar: fix issue with long username, hostname, etc not
    working when the command run by the agent exceeds 80 characters
  - fence_evacuate: enable evacuation of instances using private flavors

    Resolves: rhbz#1860545
    Resolves: rhbz#1862024


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-15
changelog:
  - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
    Resolves: bz#1818808

    * Fri Feb 7 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.13-14
  - Fixes receiving of multiple RADIUS packets under load
    Resolves: bz#1630684


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
  - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
  - CVE-2020-11523: Fix integer overflow in region.c (#1837622)
  - CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: fwupdate.ini
  -->  Config file for automated patch script
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: fwupdate-spec-use_our_keys.patch
  -->  Remove the TUV keys and sign with ours


author: Filip Januš <fjanus@redhat.com> - 2.0.35-27
changelog:
  - Fix CVE-2016-5766
  - Resolves: #1356813
  - Upstream patch: https://github.com/libgd/libgd/commit/aba3db8


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
  - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
    sincosl, and tanl function. (#1812119)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: grub2_spec-force-efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: secureboot.cer
  -->  Not using upstream Key
  - Replaced Source: securebootca.cer
  -->  Don't recognize upstream CA
  - Added Source: grub2.ini
  -->  Config file for automated patch script


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.87.e7.2
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd-spec_sl_index.html.sl7.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: ipa-spec-debrand.patch
  -->  remove TUV's Artwork
  - Added Source: ipa-spec-fix-osrelease.patch
  -->  Force use of rhel as the ipaplatform
  - Added Source: ipa.ini
  -->  Config file for automated patch script


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-0
changelog:
  - Update to jdk-11.0.9+11
  - Update release notes for 11.0.9 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Stephan Wiesand <stephan wiesand desy de> 1.6.23-289.SLx
changelog:
  - update to release 1.6.23 (security release)
  - addresses OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, OPENAFS-SA-2018-003


author: Stephan Wiesand <stephan wiesand desy de> 1.6.24-290.SLx
changelog:
  - update to release 1.6.24 (security release)
  - addresses OPENAFS-SA-2019-001, OPENAFS-SA-2019-002, OPENAFS-SA-2019-003
  - fix build on EL 6.10


author: Michal Židek <mzidek@redhat.com> - 0.6.1-30
changelog:
  - Adopting to use Downstream Helper for bellow BZ backport
  - Related: rhbz#1507607 - ding-libs: libini_config: `ini_config_augment` reports errors on match failure


author: Michal Židek <mzidek@redhat.com> - 0.6.1-31
changelog:
  - Resolves: rhbz#1507607 - ding-libs: libini_config: `ini_config_augment` reports errors on match failure


author: Michal Židek <mzidek@redhat.com> - 0.6.1-32
changelog:
  - Previous change in spec file broke the application of downstream only patch
  - Related: rhbz#1507607 - ding-libs: libini_config: `ini_config_augment` reports errors on match failure


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-8
changelog:
  - Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
  - Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
                             It is done in two steps (two different nsupdate messages).


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-10
changelog:
  - Resolves: rhbz#1804005 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.6.alpha
changelog:
  - Fixes for CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682
  - resolves: rhbz#1611550 rhbz#1611551 rhbz#1611552 rhbz#1611553


author: Petr Hracek <phracek@redhat.com> - 2:1.5.13-7
changelog:
  - Security fix for CVE-2015-8126
  - Changing png_ptr to info_ptr base on upstream
  - Related: #1283575


author: Colin Walters <tmlcoch@redhat.com> - 1.7.16-1
changelog:
  - Add LRI_LOWSPEEDTIME and LRI_LOWSPEEDLIMIT
  - downloader: Don't consider CURLE_RECV_ERROR and CURLE_SEND_ERROR as fatal errors (RhBug: 1219817)
  - test_repoconf: Fix SIGSEGV in repoconf_assert_na (RhBug: 1222471)
  - repoconf: Proper handling of gint64 and guint64 types
  - build: Be compatible with cmake 2.8
  - handle: Do not free temporary error msg if there is no one (RhBug: 1219822)
  - utils/make_rpm.sh: Accept rpmbuild options as second argument (Issue #49)
  - Python: call lr_global_init() during module initialization
  - Add global function log_set_file that allow user to set a file where logs will be written (Issue #53)
  - util: Honor RFC 3986 (Issue #55)


author: Marek Blaha <mblaha@redhat.com> - 1.8.1-1
changelog:
  - Add yumrecord substitution mechanism (mluscon)
  - Fix a memory leak in signature verification (cwalters)
  - Add new option LRO_FTPUSEEPSV
  - downloader prepare_next_transfer(): simplify long line
  - downloader prepare_next_transfer(): add missing error check
  - downloader prepare_next_transfer(): cleanup error path
  - downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
  - handle: Don't use proxy cache for downloads of metalink/mirrorlist
  - handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
  - downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
  - Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
  - New test: always try to download from the fastest mirror (Alexander Todorov)


author: Jan Grulich <jgrulich@redhat.com> - 1.4.4-11.20101004cvs
changelog:
  - Fix global buffer overflow
    Resolves: bz#1301202

  - Fix improper handling of CSRC count and extension header length in RTP header
    Resolves: bz#1323705

  - Fix buffer overflow in application of crypto profiles
    Resolves: bz#1141897


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-34
changelog:
  - vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (rhbz#1815269)
  - vmx: make 'fileName' optional for CD-ROMs (rhbz#1815269)
  - RHEL: Fix migration on AMD hosts with old QEMU (rhbz#1815572)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35
changelog:
  - qemu: don't take agent and monitor job for shutdown (CVE-2019-20485)
  - qemu: don't hold a monitor and agent job for reboot (CVE-2019-20485)
  - qemu: don't hold monitor and agent job when setting time (CVE-2019-20485)
  - qemu: remove use of qemuDomainObjBeginJobWithAgent() (CVE-2019-20485)
  - qemu: remove qemuDomainObjBegin/EndJobWithAgent() (CVE-2019-20485)
  - storage: Fix daemon crash on lookup storagepool by targetpath (CVE-2020-10703)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
  - virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support (rhbz#1823976)
  - virDevMapperGetTargetsImpl: quit early if device is not a devmapper target (rhbz#1823976)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.1
changelog:
  - qemu: end the agent job in qemuDomainSetTimeAgent (rhbz#1844952)
  - util: string: Introduce macro for automatic string lists (rhbz#1839992)
  - util: Rework virStringListAdd (rhbz#1839992)
  - qemu: Create multipath targets for PRs (rhbz#1839992)
  - util: Move virIsDevMapperDevice() to virdevmapper.c (rhbz#1839992)
  - virDevMapperGetTargetsImpl: Check for dm major properly (rhbz#1839992)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.3
changelog:
  - rpc: gendispatch: handle empty flags (CVE-2020-25637)
  - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
  - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
  - conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1868549)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.3-6.git4391e5c
changelog:
  - Update the fix for CVE-2019-3816
    Resolves: #1668658
  - Remove Dist Tag from the oldest changelog entry


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
  - Fix CVE-2015-8035 (#1595697)
  - Fix CVE-2018-14404 (#1602817)
  - Fix CVE-2017-15412 (#1729857)
  - Fix CVE-2016-5131 (#1714050)
  - Fix CVE-2017-18258 (#1579211)
  - Fix CVE-2018-1456 (#1622715)


author: David King <dking@redhat.com> - 2.9.1-6.5
changelog:
  - Fix CVE-2019-19956 (#1793000)
  - Fix CVE-2019-20388 (#1810057)
  - Fix CVE-2020-7595 (#1810073)
  - Fix xsd:any schema validation (#1812145)


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.68-1
changelog:
  - Rebase to 5.5.68
    This is the last upstream release. This major version reached upstream EOL
  - Related to: rhbz#1834835


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826589):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.1
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893261, #1893249, #1893229):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
      0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
      to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
      to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
      to 0xde;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
      up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
      up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
      to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
      to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
      to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
      up to 0xa0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
      up to 0xe0.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
changelog:
  - Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
                             OIDCAuthNHeader not skipped in an "AuthType oauth20"
                             configuration [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
changelog:
  - Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                             issue exists in URLs with slash and backslash [rhel-7]
  - Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
                             in logout url when using URLs with leading slashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
changelog:
  - Fix a regression in the previous patches
  - Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                            issue exists in URLs with slash and backslash [rhel-7]


author: Joe Orton <jorton@redhat.com> - 1.7.14-13
changelog:
  - fix mod_authz_svn regression with mod_auth_kerb (#1306431)
  - fix "svn diff" property handling (#1378178)
  - fix permissions of /run/svnserve to match tmpfiles (#1496243)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
  - add missing part of memory leak patch (#1794168)
  - fix if_inet6 messages floood (#1765449)
  - revert bz#1486733 (#1771050)
  - fix issue for process status when process name contains whitespace (#1782180)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-2
changelog:
  - Skip sysinit gtests properly
  - Fix shell syntax error in tests/ssl/ssl.sh
  - Regenerate manual pages


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-5
changelog:
  - Fix pkix name constraints processing to only process the common name if the
    certusage you are checking is IPSEC or SSL Server.


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-8
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
  - Explicitly enable upgradedb/sharedb test cycles


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-3
changelog:
  - include patches for CVE-2020-6829, CVE-2020-12400,
    and CVE-2020-12401 from upstream (ECC constant time issues).
  - include patches for CVE-2020-12403 from upstream
    (CHACHA issues).
  - include self-tests for kdfs and cmac.


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
  - Fix segfault in systemdunitdependency probe (RHBZ#1478285)
  - Build and ship HTML manual (RHBZ#1465661)
  - Fix oscap-ssh with --sudo (RHBZ#1803114)
  - Change category of verbose message (RHBZ#1640522)
  - Fix segfault in CVRF module (RHBZ#1642283)


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
  - Improve help for clean-up option
  - Avoid pending DC fencing getting "stuck" in status display
  - Rebase on upstream 1.1.23-rc1
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1787749
  - Resolves: rhbz#1792492


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
  - Fix hugepage metrics in pmdalinux (BZ 1730107)
  - Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
  - Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
  - Fix pcp-atopsar sample count command line argument (BZ 1764748)
  - Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
  - Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
  - Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
  - Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
  - Resolves: bz#1791560
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
  - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
  - kvm-slirp-disable-tcp_emu.patch [bz#1791679]
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
  - Resolves: bz#1791679
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
  - Resolves: bz#1800515
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
  - Resolves: bz#1802215
    (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
  - Resolves: bz#1810408
    (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-168.el7
changelog:
  - kvm-qxl-check-release-info-object.patch [bz#1712703]
  - kvm-bswap.h-Remove-cpu_to_be16wu.patch [bz#1270166]
  - kvm-net-Transmit-zero-UDP-checksum-as-0xFFFF.patch [bz#1270166]
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734749]
  - Resolves: bz#1270166
    (UDP packet checksum is not converted from 0x0000 to 0xffff with Qemu e1000 emulation.)
  - Resolves: bz#1712703
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7])
  - Resolves: bz#1734749
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-169.el7
changelog:
  - kvm-target-i386-Support-invariant-tsc-flag.patch [bz#1626871]
  - kvm-target-i386-block-migration-and-savevm-if-invariant-.patch [bz#1626871]
  - kvm-i386-Don-t-copy-host-virtual-address-limit.patch [bz#1706658]
  - Resolves: bz#1626871
    ([RFE] request for using TscInvariant feature with qemu-kvm.)
  - Resolves: bz#1706658
    ([Intel 7.8 Bug] qemu-kvm fail with "err:kvm_init_vcpu() invalidate argumant" on ICX platform)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-170.el7
changelog:
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749735]
  - kvm-target-i386-Merge-feature-filtering-checking-functio.patch [bz#1709971]
  - kvm-target-i386-Isolate-KVM-specific-code-on-CPU-feature.patch [bz#1709971]
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1709971]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1709971]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1709971]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1709971]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1709971]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1709971]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1709971]
  - kvm-Remove-arch-capabilities-deprecation.patch [bz#1709971]
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1714791]
  - Resolves: bz#1709971
    ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm)
  - Resolves: bz#1714791
    ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm)
  - Resolves: bz#1749735
    (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-171.el7
changelog:
  - kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638471]
  - kvm-Add-missing-brackets-to-CPUID-0x80000008-code.patch [bz#1760607]
  - Resolves: bz#1638471
    ([Intel 7.8 Feat] qemu-kvm Introduce Cascade Lake (CLX) cpu model)
  - Resolves: bz#1760607
    (Corrupted EAX values due to missing brackets at CPUID[0x800000008] code)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
  - Resolves: bz#1771961
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
  - kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
  - Resolves: bz#1837565
    (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
  - Resolves: bz#1869693
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
  - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
  - kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
  - Resolves: bz#1842923
    (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
  - Resolves: bz#1860960
    (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
  - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
  - Resolves: bz#1884997
    (qemu-kvm FTBFS on rhel7.9)


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Watson Sato <wsato@redhat.com> - 0.1.49-12
changelog:
  - CIS Profile (RHBZ#1821633)
    - Make sure boot target is multi-user.target when xorg package is removed
    - Add CIS Profile content attribution to Center for Internet Security


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: scap-security-guide_spec-add-all-el-stigs.patch
  -->  Package all EL scap guidelines, not just TUV
  - Added Source: scap-security-guide.ini
  -->  Config file for automated patch script
  - Added Patch: 0005-rename-in-new-location.patch
  -->  Make sure the branding is right


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.52-1
changelog:
  - Update to the latest upstream release (RHBZ#1665233)
  - Update RHEL7 DISA STIG to V2R8 (RHBZ#1665233)


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: shim-spec_efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: securebootca.cer
  -->  Use the FNAL SL signing certificate
  - Added Source: shim.ini
  -->  Config file for automated patch script


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632999


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
  - Keepalive fix
    Resolves: rhbz#1719736
  - Fix hang on migration after password expired
    Resolves: rhbz#1761776


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-4
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1567944


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
  - Don't mute Record channel on client reconnection
    Resolves: rhbz#1549132
  - Allow to configure TLS protocol versions and ciphers which SPICE will use for
    TLS communications
    Resolves: rhbz#1562213
  - Enable ECDH ciphers with OpenSSL 1.0
    Resolves: rhbz#1566597


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-7
changelog:
  - Fix off-by-one error during guest-to-host memory address conversion
    Resolves: CVE-2019-3813
  - Add patch for upstream commit 48179332d9da0. This should help with corrupted
    spice-html5 displays
    Resolves: rhbz#1573739
  - Add missing minimum openssl version Requires for patch #24
    Resolves: rhbz#1627693


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-16
changelog:
  - Resolves: #1738582 - CVE-2019-12525 squid: parsing of header 
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-3
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


