# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-17
changelog:
  - Bump version to 1.3.6.1-17
  - Resolves: Bug 1476161 - replication halt - pending list first CSN not committed, pending list increasing
  - Resolves: Bug 1476162 - Change the retrochangelog default cache size


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-18
changelog:
  - Bump version to 1.3.6.1-18
  - Require srvcore 4.1.3
  - Resolves: Bug 1479757 - dse.ldif and fsync
  - Resolves: Bug 1479755 - backup fails if changelog is enabled
  - Resolves: Bug 1479756 - Locked account provides different return code if password is correct


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.19-1
changelog:
  - Bump version to 1.3.6.19-1
  - Remove old mozldap and db4 requirements
  - Resolves: Bug 1483865 - Crash while binding to a server during replication online init


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-24
changelog:
  - Bump version to 1.3.6.1-24
  - Resolves: Bug 1508978 - replicated MODRDN fails breaking replication
  - Resolves: Bug 1511940 - heap corruption during import
  - Resolves: Bug 1510319 - [abrt] 389-ds-base: SLL_Next(): ns-slapd killed by SIGSEGV 
  - Resolves: Bug 1509347 - cleanallruv task is not logging any information


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-25
changelog:
  - Bump version to 1.3.6.1-25
  - Resolves: Bug 1526928 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1523505 - opened connection are hanging, no longer poll
  - Resolves: Bug 1523507 - IPA server replication broken, after DS stop-start, due to changelog reset


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-27
changelog:
  - Bump version to 1.3.6.1-27
  - Resolves: Bug 1536343 - Indexing of internationalized matching rules is failing
  - Resolves: Bug 1535539 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp function
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.6.1-28
changelog:
  - Bump version to 1.3.6.1-28
  - Resolves: Bug 1540105 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8


author: Matus Honek <mhonek@redhat.com> - 1.3.7.5-19
changelog:
  - Bump version to 1.3.7.5-19
  - Resolves: Bug 1563107 - IPA server is not responding, all authentication and admin tests failed [rhel-7.5.z]


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-20
changelog:
  - Bump version to 1.3.7.5-20
  - Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received 
  - Resolves: Bug 1559764 - memberof fails if group is moved into scope
  - Resolves: Bug 1554720 - "Truncated search results" pop-up appears in user details in WebUI 
  - Resolves: Bug 1553605 - ipa-server-install fails with Error: Upgrade failed with no such entry
  - Resolves: Bug 1559760 - ds-replcheck: add -W option to ask for the password from stdin instead of passing it on command line
  - Resolves: Bug 1559464 - replica_write_ruv log a failure even when it succeeds


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-21
changelog:
  - Bump version to 1.3.7.5-21
  - Resolves: Bug 1559818 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-26
changelog:
  - Bump version to 1.3.7.5-26
  - Resolves: Bug 1615924 - Fine grained password policy can impact search performance
  - Resolves: Bug 1614836 - Disable nunc-stans by default
  - Resolves: Bug 1614861 - ldapsearch with server side sort crashes the ldap server


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-28
changelog:
  - Bump version to 1.3.7.5-28
  - Resolves: Bug 1628676 - 389-ds-base: race condition on reference counter leads to DoS using persistent search
  - Resolves: Bug 1628677 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-13
changelog:
  - Bump version to 1.3.8.4-13
  - Resolves: Bug 1623949 - Crash in delete_passwdPolicy when persistent search connections are terminated unexpectedly


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-24
changelog:
  - Bump version to 1.3.8.4-24
  - Resolves: Bug 1718184 - segfault when using pam passthru and addn plugins together


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-25
changelog:
  - Bump version to 1.3.8.4-25
  - Resolves: Bug 1722828 - referint update should discard any changes if mep update fails
  - Resolves: Bug 1718689 - dse.ldif strip-off string after 1023 character
  - Resolves: Bug 1719720 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.8.4-25.1
changelog:
  - Bump version to 1.3.8.4-25.1
  - Resolves: Bug 1718689 - dse.ldif strip-off string after 1023 character (missing patch file)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-10
changelog:
  - Bump version to 1.3.9.1-10
  - Resolves: Bug 1668457 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.9.1-11
changelog:
  - Bump version to 1.3.9.1-11
  - Resolves: Bug 1748198 - EMBARGOED CVE-2019-14824 389-ds-base: Read permission check bypass via the deref plugin
  - Resolves: Bug 1754831 - After audit log file is rotated, DS version string is logged after each update
  - Resolves: Bug 1763622 - Extremely slow LDIF import with ldif2db
  - Resolves: Bug 1763627 - ns-slapd crash on concurrent SASL BINDs, connection_call_io_layer_callbacks must hold hold c_mutex
  - Resolves: Bug 1749289 - DB Deadlock on modrdn appears to corrupt database and entry cache


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-6
changelog:
  - dns: dnsmasq: avoid crash when no reverse domains exist (rh #1628576)
  - initscripts: fix ownership of ifup/ifdown executables (rh #1626517)
  - cli: fix parsing vpn secrets from password file (rh #1628946)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.12.0-7
changelog:
  - manager: accept non-null device for VPN activations (rh #1641174)
  - drop dependency of NetworkManager-ovs on openvswitch (rh #1633190)


author: Thomas Haller <thaller@redhat.com> - 1:1.18.8-1
changelog:
  - Update to 1.18.8 relase
  - ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1841397, CVE-2020-10754)
  - ifcfg-rh: handle 802-1x.pin properties.


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-2.gitee3198e672e2
changelog:
  - OvmfPkg/PlatformBootManagerLib: connect consoles unconditionally [bz#1577546]
  - build OVMF varstore template with SB enabled / certs enrolled [bz#1561128]
  - connect Virtio RNG devices again [bz#1579518]
  - Resolves: bz#1577546
    (no input consoles connected under certain circumstances)
  - Resolves: bz#1561128
    (OVMF Secure boot enablement (enrollment of default keys))
  - Resolves: bz#1579518
    (EFI_RNG_PROTOCOL no longer produced for virtio-rng)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-3.gitee3198e672e2.el7
changelog:
  - ovmf-redhat-provide-virtual-bundled-OpenSSL-in-OVMF.patch [bz#1607792]
  - Resolves: bz#1607792
    (add 'Provides: bundled(openssl) = 1.1.0h' to the spec file)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-3.gitee3198e672e2.el7_6.1
changelog:
  - ovmf-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1684006]
  - ovmf-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1684006]
  - Resolves: bz#1684006
    (CVE-2018-12180 OVMF: edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-4.gitee3198e672e2.el7
changelog:
  - ovmf-redhat-provide-firmware-descriptor-meta-files.patch [bz#1608599]
  - Resolves: bz#1608599
    ([RHEL 7.7] RFE: provide firmware descriptor meta-files for OVMF)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-5.gitee3198e672e2.el7
changelog:
  - ovmf-MdeModulePkg-Variable-Fix-Timestamp-zeroing-issue-on.patch [bz#1666586]
  - ovmf-MdePkg-Add-more-checker-in-UefiDecompressLib-to-acce.patch [bz#1666586]
  - ovmf-IntelFrameworkModulePkg-Add-more-checker-in-UefiTian.patch [bz#1666586]
  - ovmf-BaseTools-Add-more-checker-in-Decompress-algorithm-t.patch [bz#1666586]
  - ovmf-BaseTools-Fix-UEFI-and-Tiano-Decompression-logic-iss.patch [bz#1666586]
  - ovmf-MdePkg-BaseUefiDecompressLib-Fix-UEFI-Decompression-.patch [bz#1666586]
  - ovmf-IntelFrameworkModulePkg-Fix-UEFI-and-Tiano-Decompres.patch [bz#1666586]
  - ovmf-MdeModulePkg-PartitionDxe-Ensure-blocksize-holds-MBR.patch [bz#1684007]
  - ovmf-MdeModulePkg-RamDiskDxe-Restrict-on-RAM-disk-size-CV.patch [bz#1684007]
  - ovmf-redhat-openssl-update-introduce-MOCK-shorthand-for-m.patch [bz#1650390]
  - ovmf-redhat-openssl-update-enable-the-bootstrap-container.patch [bz#1650390]
  - ovmf-redhat-consume-OpenSSL-1.1.0i-from-Fedora-28.patch [bz#1650390]
  - ovmf-Upgrade-OpenSSL-to-1.1.0j.patch [bz#1650390]
  - Resolves: bz#1650390
    (CVE-2018-5407 OVMF: openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) [rhel-7])
  - Resolves: bz#1666586
    (CVE-2017-5731 CVE-2017-5732 CVE-2017-5733 CVE-2017-5734 CVE-2017-5735 CVE-2018-3613 OVMF: various flaws [rhel-7])
  - Resolves: bz#1684007
    (CVE-2018-12180 OVMF: edk2: Buffer Overflow in BlockIo service for RAM disk [rhel-7.7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20180508-6.gitee3198e672e2.el7
changelog:
  - ovmf-MdeModulePkg-HiiDatabase-Fix-potential-integer-overf.patch [bz#1691479]
  - ovmf-MdeModulePkg-HiiImage-Fix-stack-overflow-when-corrup.patch [bz#1691479]
  - ovmf-MdeModulePkg-PartitionDxe-Add-check-for-underlying-d.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Refine-boundary-checks-for-file-.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-the-read-of-F.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-for-Component.patch [bz#1691647]
  - ovmf-MdeModulePkg-UdfDxe-Add-boundary-check-for-getting-v.patch [bz#1691647]
  - ovmf-MdeModulePkg-UsbBusDxe-Fix-wrong-buffer-length-used-.patch [bz#1697534]
  - Resolves: bz#1691479
    (CVE-2018-12181 OVMF: edk2: Stack buffer overflow with corrupted BMP [rhel-7])
  - Resolves: bz#1691647
    (CVE-2019-0160 OVMF: edk2: buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media [rhel-7])
  - Resolves: bz#1697534
    (CVE-2019-0161 ovmf: edk2: stack overflow in XHCI causing denial of service [rhel-7])


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: not-rhel.patch
  -->  SL is not RHEL
  - Added Patch: pk-upgrade-distro.patch
  -->  Use /usr/sbin/sl7-upgrade rather than preupgrade
  - Added Source: PackageKit.ini
  -->  Config file for automated patch script
  - Added Patch: pk-yum-backend-for-sl.patch
  -->  Add in code to let PackageKit check dist to upgrade
  - Added Patch: use-sl-upgrade.patch
  -->  Use /usr/sbin/sl7-upgrade rather than preupgrade


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: not-rhel.patch
  -->  SL is not RHEL
  - Added Source: PackageKit.ini
  -->  Config file for automated patch script


author: Petr Pisar <ppisar@redhat.com> - 1.2.15-14
changelog:
  - Do not harness backing store by default. Export SDL_VIDEO_X11_BACKINGSTORE
    environment variable to enable it.
  - Resolves: rhbz#1245417


author: Wim Taymans <wtaymans@redhat.com> - 1.2.15-17
changelog:
  - Fix Some CVEs: CVE-2019-7572, CVE-2019-7573, CVE-2019-7574,
    CVE-2019-7575, CVE-2019-7576, CVE-2019-7577, CVE-2019-7578,
    CVE-2019-7635, CVE-2019-7636, CVE-2019-7637, CVE-2019-7638
  - Resolves: rhbz#1716201, rhbz#1716202, rhbz#1716206,
  - Resolves: rhbz#1716207, rhbz#1716208


author: Than Ngo <than@redhat.com> - 1.15-21
changelog:
  - Resolves: #1711051, CVE-2019-8383 denial of service
  - Resolves: #1710910, CVE-2019-8379 null pointer dereference


author: Radek Vykydal <rvykydal@redhat.com> - 21.48.22.146-1
changelog:
  - Revert "If someone really wants to eject the cdrom, then do it. (jkonecny)"
    Resolves: rhbz#1618408


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Patch: anaconda-context-treeinfo-DVD-72.patch
  -->  Permit selective enabling of 'addon' repos (for contexts)
  - Added Source: anaconda_spec-dont-use-rhel-bugzilla.patch
  -->  Do not configure anaconda to autoreport errors to TUV
  - Added Patch: sl-branding-bootloader-xfs.patch
  -->  Modify filesystem list in pyanaconda/bootloader.py for SL
  - Added Patch: anaconda-doesnt-use-yumvars-for-mirrorlist.patch
  -->  Anaconda doesn't use yumvars for mirrorlists in UI, do it by hand
  - Added Source: anaconda.ini
  -->  Config file for automated patch script
  - Added Patch: anaconda-expand-yumvars-in-script.patch
  -->  Anaconda doesn't use yumvars for mirrorlists in script, do it by hand
  - Added Patch: sl-branding-installclass.patch
  -->  Modify installclasses/rhel.py and installclasses/fedora.py for SL


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: anaconda-user-help.ini
  -->  Config file for automated patch script
  - Added Patch: debrand_anaconda_user_help.patch
  -->  Debrand help files


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 1.8.3-13
changelog:
  - Add BuildRequires on apache-commons-parent >= 26-7
  - Remove BuildRequires on commons-collections-testframework


author: Michael Schwendt <mschwendt@fedoraproject.org> - 1:0.3.6-7
changelog:
  - Merge upstream pull requests #42,#43,#44 from Agostino Sarubbo to fix
    security issues.  CVE-2017-6827, CVE-2017-6828,
    CVE-2017-6829, CVE-2017-6830, CVE-2017-6831,
    CVE-2017-6832, CVE-2017-6833, CVE-2017-6834, CVE-2017-6835,
    CVE-2017-6836, CVE-2017-6837, CVE-2017-6838, CVE-2017-6839


author: Wim Taymans <wtaymans@redhat.com> - 1:0.3.6-9
changelog:
  - Apply security patches. CVE-2018-17095, CVE-2018-13440
  - Resolves: rhbz#1600369, rhbz#1601014, rhbz#1637128


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: Stephan Bergmann <sbergman@redhat.com> - 1:5.3.6.1-17
changelog:
  - Resolves: rhbz#1545262 Workaround for spurious ppc64le automated testing crash
  - Resolves: rhbz#1610692 silence console warnings from print dialog


author: Michal Sekletar <msekleta@redhat.com> - 0.6.31-18
changelog:
  - create home directory for avahi-autoipd user (#1416287)
  - get rid of the dangling symlink to avahi-discover in debuginfo package (#1421229)


author: Jerome Marchand <jmarchan@redhat.com> - 0.10.0-1
changelog:
  - Rebase on bcc-0.10.0
  - Fix regression of vfscount
  - Drop tools that relies on features unavailable on RHEL 7


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-16.P2.4
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Fix invalid tsig request (CVE-2020-8617)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.1
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)


author: Petr Menšík <pemensik@redhat.com> - 32:9.9.4-72
changelog:
  - Fix automatic selinux boolean named_write_master_zones (#1569466)
  - Allow starting named with readonly home again


author: Petr Menšík <pemensik@redhat.com> - 11.1-6
changelog:
  - Bump BIND version and fix library dependecies
  - Rebuild for bind 9.11.3. Minor tweaks to compile.
  - Support for bind 9.11.5 headers


author: Nick Clifton <nickc@redhat.com> 2.27-32.base
changelog:
  - Fix seg-fault parsing DWARF-1 information.  (#1569580)
  - Fix seg-fault parsing DWARF-2 information.  (#1569891)
  - Fix seg-fault parsing COFF files.  (#1571917)


author: Nick Clifton <nickc@redhat.com> 2.27-33.base
changelog:
  - Fix seg-fault parsing ELF files.  (#1578979)
  - Fix seg-fault parsing DWARF-2 information.  (#1579065)
  - Fix seg-fault parsing DWARF-2 information.  (#1579051)
  - Fix seg-fault parsing a PE format file.  (#1579019)


author: Nick Clifton <nickc@redhat.com> 2.27-34.base
changelog:
  - Fix seg-fault parsing corrupt AOUT format files.  (#1579799)
  - Fix seg-fault parsing corrupt DWARF2 debug information.  (#1579802)
  - Fix seg-fault parsing corrupt ELF format files.  (#1579801)


author: Eric Sandeen <sandeen@redhat.com> - 1.0.5-7
changelog:
  - Add upstream cpu scalability patches (#1032368)
  - Remove "-k" option from manpage (#1300354)
  - Fix potential deadlock when calling stop_tracers (#1263189)


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.1.1.el7]
changelog:
  - [fs] nfsv4.1: Avoid false retries when RPC calls are interrupted (Benjamin Coddington) [1739077 1732427]
  - [fs] NFS4.1 handle interrupted slot reuse from ERR_DELAY (Benjamin Coddington) [1739077 1732427]
  - [fs] nfsv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY (Benjamin Coddington) [1739077 1732427]
  - [fs] cifs: fix panic in smb2_reconnect (Leif Sahlberg) [1737382 1702264]
  - [scsi] sg: protect against races between mmap() and SG_SET_RESERVED_SIZE (Ewan Milne) [1737380 1710533]
  - [scsi] sg: recheck MMAP_IO request length with lock held (Ewan Milne) [1737380 1710533]
  - [scsi] sg: reset 'res_in_use' after unlinking reserved array (Ewan Milne) [1737380 1710533]
  - [scsi] sg: protect accesses to 'reserved' page array (Ewan Milne) [1737380 1710533]
  - [netdrv] mlx4/en_netdev: allow offloading VXLAN over VLAN (Paolo Abeni) [1734333 1733671]
  - [netdrv] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1704879 1704880] {CVE-2019-9500}
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1739130 1732106]
  - [documentation] Documentation: Add swapgs description to the Spectre v1 documentation (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [documentation] Documentation: Add section about CPU vulnerabilities for Spectre (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1729810 1724510] {CVE-2019-1125}
  - [x86] x86/feature: Relocate X86_FEATURE_INVPCID_SINGLE (Waiman Long) [1729810 1724510] {CVE-2019-1125}


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: genkey.patch
  -->  Debrand certs
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: debrand_taint_cpu.patch
  -->  Rename RHEL7 to SL7
  - Added Source: sl-ldup.x509
  -->  The FNAL SL signing certificate for driver updates
  - Added Source: kernel-spec_use_our_keys.patch
  -->  Remove the TUV keys and sign with ours
  - Added Source: kernel.ini
  -->  Config file for automated patch script
  - Added Source: sl-kpatch.x509
  -->  The FNAL SL signing certificate for kpatch updates
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: kernel-spec_debrand_taint_cpu.patch
  -->  Apply our debrand patch


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.11.1.el7]
changelog:
  - [tty] TTY: serial_core, add ->install (Kenneth Yin) [1780163 1443152]
  - [net] gro: fix use-after-free read in napi_gro_frags() (Paolo Abeni) [1780033 1750810]
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Stanislaw Gruszka) [1778631 1778632]
  - [fs] userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx (Alex Gladkov) [1777351 1749766]
  - [fs] gfs2: Use async glocks for rename (Robert S Peterson) [1777297 1677686]
  - [fs] gfs2: create function gfs2_glock_update_hold_time (Robert S Peterson) [1777297 1677686]
  - [fs] gfs2: separate holder for rgrps in gfs2_rename (Robert S Peterson) [1777297 1677686]
  - [wireless] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (Stanislaw Gruszka) [1776615 1776616]
  - [x86] cpuidle-haltpoll: vcpu hotplug support (Marcelo Tosatti) [1776289 1771849]
  - [cpuidle] cpuidle-haltpoll: return -ENODEV on modinit failure (Marcelo Tosatti) [1776289 1756843]
  - [wireless] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (Stanislaw Gruszka) [1776205 1776206]
  - [wireless] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (Stanislaw Gruszka) [1776156 1776157] {CVE-2019-14901}
  - [fs] vfs: Fix EOVERFLOW testing in put_compat_statfs64 (Eric Sandeen) [1775678 1758001]
  - [x86] x86/atomic: Fix smp_mb__{before,after}_atomic() (Prarit Bhargava) [1772812 1769569]
  - [mm] mm-vmstat-reduce-zone-lock-holding-time-by-proc-pagetypeinfo-fix (Waiman Long) [1770732 1757943]
  - [mm] mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (Waiman Long) [1770732 1757943]
  - [mm] mm, vmstat: hide /proc/pagetypeinfo from normal users (Waiman Long) [1770732 1757943]
  - [md] dm rq: fix handling underlying queue busy (Ming Lei) [1770113 1767482]
  - [pci] hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers (Mohammed Gamal) [1766097 1634251]
  - [pci] hv: Detect and fix Hyper-V PCI domain number collision (Mohammed Gamal) [1766097 1634251]
  - [pci] hv: Serialize the present and eject work items (Mohammed Gamal) [1766097 1634251]
  - [netdrv] hv_netvsc: fix network namespace issues with VF support (Mohammed Gamal) [1766093 1741334]
  - [netdrv] hv_netvsc: move VF to same namespace as netvsc device (Mohammed Gamal) [1766093 1741334]
  - [netdrv] hv_netvsc: set master device (Mohammed Gamal) [1766093 1741334]
  - [pci] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it (Mohammed Gamal) [1766089 1737567]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.12.1.el7]
changelog:
  - [powerpc] powerpc/pseries: Remove confusing warning message (Gustavo Duarte) [1780148 1748306]
  - [powerpc] powerpc/pseries: Call H_BLOCK_REMOVE when supported (Gustavo Duarte) [1780148 1748306]
  - [powerpc] powerpc/pseries: Read TLB Block Invalidate Characteristics (Gustavo Duarte) [1780148 1748306]
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variable 'fh' (Nilesh Javali) [1776290 1750577]
  - [fs] SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write (Leif Sahlberg) [1767621 1764567]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.17.1.el7]
changelog:
  - [kvm] kvm: x86: always expose VIRT_SSBD to guests (Eduardo Habkost) [1797511 1744281]
  - [kvm] kvm: x86: fix reporting of AMD speculation bug CPUID leaf (Eduardo Habkost) [1797511 1744281]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.18.1.el7]
changelog:
  - [x86] x86/boot/64: Round memory hole size up to next PMD page (Frank Ramsay) [1798163 1773762]
  - [x86] x86/boot/64: Make level2_kernel_pgt pages invalid outside kernel area (Frank Ramsay) [1798163 1773762]
  - [fs] gfs2: Use d_materialise_unique instead of d_splice_alias (2) (Andreas Grunbacher) [1796431 1784550]
  - [fs] gfs2: gfs2_create_inode(): don't bother with d_splice_alias() (Andreas Grunbacher) [1796431 1784550]
  - [fs] gfs2: bugger off early if O_CREAT open finds a directory (Andreas Grunbacher) [1796431 1784550]
  - [scsi] scsi: hpsa: remove printing internal cdb on tag collision (Joseph Szczypek) [1793579 1741355]
  - [scsi] scsi: hpsa: correct scsi command status issue after reset (Joseph Szczypek) [1793579 1741355]
  - [infiniband] IB/mlx5: Fix MR registration flow to use UMR properly (Alaa Hleihel) [1792371 1741343]
  - [scsi] qedf: Initialize rport while creation of vport (Nilesh Javali) [1791825 1760746]
  - [scsi] scsi: hpsa: add missing hunks in reset-patch (Joseph Szczypek) [1791782 1761978]
  - [block] block: don't change REQ_NR_BITS (Ming Lei) [1791781 1779712]
  - [scsi] scsi: qla2xxx: Fix panic in qla_dfs_tgt_counters_show (Himanshu Madhani) [1791595 1729270]
  - [drm] drm/radeon: fix si_enable_smc_cac() failed issue (Dave Airlie) [1789744 1780026]
  - [scsi] scsi: bnx2fc: timeout calculation invalid for bnx2fc_eh_abort() (Nilesh Javali) [1784824 1772966]
  - [md] md/raid10: prevent access of uninitialized resync_pages offset (Nigel Croxon) [1781584 1767935]
  - [fs] fix inode leaks on d_splice_alias() failure exits (Miklos Szeredi) [1781159 1749390]
  - [fs] cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active (David Howells) [1780149 1765975]
  - [mm] mm: swap: clean up swap readahead (Rafael Aquini) [1780035 1725396]
  - [mm] mm: do_swap_page: clean up parameter list passing a pointer to struct vm_fault (Rafael Aquini) [1780035 1725396]
  - [mm] mm: __handle_mm_fault: introduce explicit barrier after orig_pte dereference (Rafael Aquini) [1780035 1725396]
  - [x86] kvm: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it (Paolo Bonzini) [1779766 1779768]
  - [x86] kvm: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: Mark expected switch fall-throughs (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: implement MSR_IA32_TSX_CTRL effect on CPUID (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: do not modify masked bits of shared MSRs (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: fix presentation of TSX feature in ARCH_CAPABILITIES (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1778691 1765123]
  - [net] ipv6: Rewind hlist offset on interrupted /proc/net/if_inet6 read (Stefano Brivio) [1778084 1753480]
  - [net] revert "[net] ipv6: Display all addresses in output of /proc/net/if_inet6" (Stefano Brivio) [1778084 1753480]
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Josef Oskera) [1775235 1775236] {CVE-2019-17666}
  - [md] md: improve handling of bio with REQ_PREFLUSH in md_flush_request() (Xiao Ni) [1773482 1752061]
  - [fs] fscache: Don't use a constructor function on the slab allocator (David Howells) [1793086 1739996]
  - [mm] mm: fix insert_pfn regression (Jeff Moyer) [1793088 1739889]
  - [mm] mm/page_idle.c: fix oops because end_pfn is larger than max_pfn (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mlock.c: mlockall error for flag MCL_ONFAULT (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlb: use same fault hash key for shared and private mappings (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: on restore reserve error path retain subpool reservation (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory.c: fix modifying of page protection by insert_pfn() (Rafael Aquini) [1768386 1730471]
  - [mm] mm, swap: bounds check swap_info array accesses to avoid NULL derefs (Rafael Aquini) [1768386 1730471]
  - [mm] mm/slub.c: remove an unused addr argument (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: fix races and page leaks during migration (Rafael Aquini) [1768386 1730471]
  - [mm] mm, oom: fix use-after-free in oom_kill_process (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: convert spin_lock_irq to spin_lock_irqsave (Rafael Aquini) [1768386 1730471]
  - [mm] mm/swapfile.c: use kvzalloc for swap_info_struct allocation (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! (Rafael Aquini) [1768386 1730471]
  - [mm] mm: Fix warning in insert_pfn() (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: dirty pages as they are added to pagecache (Rafael Aquini) [1768386 1730471]
  - [mm] mm/swapfile.c: fix swap_count comment about nonexistent SWAP_HAS_CONT (Rafael Aquini) [1768386 1730471]
  - [mm] slab: __GFP_ZERO is incompatible with a constructor (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix the NULL mapping case in __isolate_lru_page() (Rafael Aquini) [1768386 1730471]
  - [mm] mm/filemap.c: fix NULL pointer in page_cache_tree_insert() (Rafael Aquini) [1768386 1730471]
  - [fs] block_invalidatepage(): only release page if the full page was invalidated (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mempolicy.c: avoid use uninitialized preferred_node (Rafael Aquini) [1768386 1730471]
  - [mm] mm: pin address_space before dereferencing it while isolating an LRU page (Rafael Aquini) [1768386 1730471]
  - [fs] fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: do not rely on preempt_count in print_vma_addr (Rafael Aquini) [1768386 1730471]
  - [mm] mm, swap: fix race between swap count continuation operations (Rafael Aquini) [1768386 1730471]
  - [mm] mm: meminit: mark init_reserved_page as __meminit (Rafael Aquini) [1768386 1730471]
  - [mm] mm/vmstat.c: fix wrong comment (Rafael Aquini) [1768386 1730471]
  - [mm] mm, hugetlb: do not allocate non-migrateable gigantic pages from movable zones (Rafael Aquini) [1768386 1730471]
  - [mm] mm: always flush VMA ranges affected by zap_page_range (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mremap: fail map duplication attempts for private mappings (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack (Rafael Aquini) [1768386 1730471]
  - [mm] mm: numa: avoid waiting on freed migrated pages (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory-failure.c: use compound_head() flags for huge pages (Rafael Aquini) [1768386 1730471]
  - [fs] fs/block_dev: always invalidate cleancache in invalidate_bdev() (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: remove unused chunk_alloc parameter from pcpu_get_pages() (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages (Rafael Aquini) [1768386 1730471]
  - [mm] mm: do not access page->mapping directly on page_endio (Rafael Aquini) [1768386 1730471]
  - [mm] mm/page_alloc: fix nodes for reclaim in fast path (Rafael Aquini) [1768386 1730471]
  - [mm] mm: alloc_contig_range: allow to specify GFP mask (Rafael Aquini) [1768386 1730471]
  - [mm] mm: vmscan: scan dirty pages even in laptop mode (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mempolicy.c: do not put mempolicy before using its nodemask (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix set pageblock migratetype in deferred struct page init (Rafael Aquini) [1768386 1730471]
  - [mm] mm: delete unnecessary and unsafe init_tlb_ubc() (Rafael Aquini) [1768386 1730471]
  - [kernel] mm, mempolicy: task->mempolicy must be NULL before dropping final reference (Rafael Aquini) [1768386 1730471]
  - [mm] mm: use phys_addr_t for reserve_bootmem_region() arguments (Rafael Aquini) [1768386 1730471]
  - [mm] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check (Rafael Aquini) [1768386 1730471]
  - [mm] mm: soft-offline: check return value in second __get_any_page() call (Rafael Aquini) [1768386 1730471]
  - [include] include/linux/memblock.h: fix ordering of 'flags' argument in comments (Rafael Aquini) [1768386 1730471]
  - [mm] rmap: fix theoretical race between do_wp_page and shrink_active_list (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mremap.c: clean up goto just return ERR_PTR (Rafael Aquini) [1768386 1730471]
  - [mm] mremap should return -ENOMEM when __vm_enough_memory fail (Rafael Aquini) [1768386 1730471]
  - [mm] writeback: fix possible underflow in write bandwidth calculation (Rafael Aquini) [1768386 1730471]
  - [mm] writeback: add missing INITIAL_JIFFIES init in global_update_bandwidth() (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory.c: actually remap enough memory (Rafael Aquini) [1768386 1730471]
  - [mm] mm/compaction: fix wrong order check in compact_finished() (Rafael Aquini) [1768386 1730471]
  - [mm] mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process being killed (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix anon_vma_clone() error treatment (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: fix collapsing of hugepages on madvise (Rafael Aquini) [1768386 1730471]
  - [mm] cgroup/kmemleak: add kmemleak_free() for cgroup deallocations (Rafael Aquini) [1768386 1730471]
  - [mm] OOM, PM: OOM killed task shouldn't escape PM suspend (Rafael Aquini) [1768386 1730471]
  - [mm] mm, compaction: pass gfp mask to compact_control (Rafael Aquini) [1768386 1730471]
  - [mm] mm: page_alloc: abort fair zone allocation policy when remotes nodes are encountered (Rafael Aquini) [1768386 1730471]
  - [mm] mm: vmscan: only update per-cpu thresholds for online CPU (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: replace smp_mb after atomic_add by smp_mb__after_atomic (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: move invariant bug check out of loop in __split_huge_page_map (Rafael Aquini) [1768386 1730471]
  - [mm] thp: consolidate assert checks in __split_huge_page() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix sleeping function warning from __put_anon_vma (Rafael Aquini) [1768386 1730471]
  - [mm] mm: cleanup add_to_page_cache_locked() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: mempolicy: turn vma_set_policy() into vma_dup_policy() (Rafael Aquini) [1768386 1730471]
  - [powerpc] powerpc/pseries: correctly track irq state in default idle (Steve Best) [1767620 1751970]
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705004 1705005] {CVE-2019-11487}
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705004 1705005] {CVE-2019-11487}


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.3.1.el7]
changelog:
  - [net] Bluetooth: Fix faulty expression for minimum encryption key size check (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Fix regression with minimum encryption key size alignment (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (Gopal Tiwari) [1743084 1743085] {CVE-2019-9506}
  - [net] macvlan: Support bonding events (Davide Caratti) [1751579 1733589]
  - [wireless] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Mark expected switch fall-through (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Fix skipped vendor specific IEs (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: fix 802.11n/WPA detection (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Don't abort on small, spec-compliant vendor IEs (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Abort at too short BSS descriptor element (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Stanislaw Gruszka) [1714469 1721742 1714470 1721743] {CVE-2019-10126 CVE-2019-3846}
  - [net] sunrpc: Fix possible autodisconnect during connect due to old last_used (Dave Wysochanski) [1749290 1723537]
  - [drm] drm/ast: Fixed reboot test may cause system hanged (Dave Airlie) [1749296 1739971]
  - [block] block: blk_init_allocated_queue() set q->fq as NULL in the fail case (Ming Lei) [1739326 1739327] {CVE-2018-20856}
  - [pci] PCI: hv: Fix a use-after-free bug in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Add pci_destroy_slot() in pci_devices_present_work(), if necessary (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Add hv_pci_remove_slots() when we unload the driver (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Fix a memory leak in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: support reporting serial number as slot information (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Remove unused reason for refcount handler (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Convert hv_pci_dev.refs from atomic_t to refcount_t (Mohammed Gamal) [1748239 1732924]
  - [pci] PCI: hv: Remove the bogus test in hv_eject_device_work() (Mohammed Gamal) [1748239 1732924]
  - [fs] NFSv4: Replace closed stateids with the "invalid special stateid" (Steve Dickson) [1744946 1733347]
  - [nvme] nvme-rdma: use dynamic dma mapping per command (David Milburn) [1744444 1637693]
  - [nvme] nvme-rdma: remove redundant reference between ib_device and tagset (David Milburn) [1744444 1637693]
  - [nvme] nvme-rdma: always have a valid trsvcid (David Milburn) [1744443 1717536]
  - [nvme] nvme-rdma: use inet_pton_with_scope helper (David Milburn) [1744443 1717536]
  - [nvme] nvmet-rdma: use generic inet_pton_with_scope (David Milburn) [1744443 1717536]
  - [iommu] x86/hyper-v: add msi_setup_irq/msi_alloc_irq stubs to fix x2apic mode (Vitaly Kuznetsov) [1743324 1736750]
  - [mm] slub: make dead caches discard free slabs immediately (Aristeu Rozanski) [1741920 1649189]
  - [mm] mm: charge/uncharge kmemcg from generic page allocator paths (Aristeu Rozanski) [1741920 1649189]
  - [mm] memcg: do not account memory used for cache creation (Aristeu Rozanski) [1741920 1649189]
  - [mm] memcg: also test for skip accounting at the page allocation level (Aristeu Rozanski) [1741920 1649189]
  - [fs] kmemcg: account certain kmem allocations to memcg (Aristeu Rozanski) [1741920 1649189]
  - [mm] vmalloc: allow to account vmalloc to memcg (Aristeu Rozanski) [1741920 1649189]
  - [mm] slab: add SLAB_ACCOUNT flag (Aristeu Rozanski) [1741920 1649189]
  - [include] memcg: only account kmem allocations marked as __GFP_ACCOUNT (Aristeu Rozanski) [1741920 1649189]
  - [include] mm: get rid of __GFP_KMEMCG (Aristeu Rozanski) [1741920 1649189]
  - [mm] slb: charge slabs to kmemcg explicitly (Aristeu Rozanski) [1741920 1649189]
  - [mm] mm: rename allocflags_to_migratetype for clarity (Rafael Aquini) [1741920 1730471]
  - [x86] cpuidle-haltpoll: disable host side polling when kvm virtualized (Marcelo Tosatti) [1740192 1734501]
  - [kvm] kvm: x86: add host poll control msrs (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: add haltpoll governor (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] governors: unify last_state_idx (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: add poll_limit_ns to cpuidle_device structure (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] add cpuidle-haltpoll driver (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Fix default time limit (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Disregard disable idle states (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Revise loop termination condition (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: menu: Fix wakeup statistics updates for polling state (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Avoid invoking local_clock() too often (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: poll_state: Add time limit to poll_idle() (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Move polling state initialization code to separate file (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Remove time measurement in poll state (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: Set polling in poll_idle (Marcelo Tosatti) [1740192 1734501]
  - [cpuidle] cpuidle: dont call poll_idle_init() for every cpu (Marcelo Tosatti) [1740192 1734501]
  - [hv] hv: vmbus: Implement Direct Mode for stimer0 (Vitaly Kuznetsov) [1740188 1712344]
  - [kernel] sched: Reduce contention in update_cfs_rq_blocked_load() (Marcelo Tosatti) [1740180 1734515]
  - [ipc] ipc: drop non-RCU allocation (Vladis Dronov) [1740178 1733016]
  - [ipc] ipc/util.c: use kvfree() in ipc_rcu_free() (Vladis Dronov) [1740178 1733016]
  - [ipc] tree wide: use kvfree() than conditional kfree()/vfree() (Vladis Dronov) [1740178 1733016]
  - [ipc] standardize code comments (Waiman Long) [1740178 1373519]
  - [ipc] whitespace cleanup (Waiman Long) [1740178 1373519]
  - [fs] gfs2: gfs2_walk_metadata fix (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Inode dirtying fix (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Fix rounding error in gfs2_iomap_page_prepare (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: fix page_done callback for short writes (Andreas Grunbacher) [1737373 1724362]
  - [fs] fs: fold __generic_write_end back into generic_write_end (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: don't mark the inode dirty in iomap_write_end (Andreas Grunbacher) [1737373 1724362]
  - [fs] gfs2: Fix iomap write page reclaim deadlock (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Add a page_prepare callback (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Fix use-after-free error in page_done callback (Andreas Grunbacher) [1737373 1724362]
  - [fs] fs: Turn __generic_write_end into a void function (Andreas Grunbacher) [1737373 1724362]
  - [fs] iomap: Clean up __generic_write_end calling (Andreas Grunbacher) [1737373 1724362]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.4.2.el7]
changelog:
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.4.3.el7]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.6.1.el7]
changelog:
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746797 1746798] {CVE-2019-14821}
  - [fs] xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT (Brian Foster) [1764245 1759117]
  - [powerpc] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [powerpc] powerpc/pseries/mobility: prevent cpu hotplug during DT update (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [powerpc] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild (Desnes Augusto Nunes do Rosario) [1763625 1720930]
  - [crypto] crypto: vmx - ghash: do nosimd fallback manually (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - Remove overly verbose printk from AES init routines (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] powerpc: Create disable_kernel_{fp, altivec, vsx, spe}() (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - CTR: always increment IV as quadword (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] crypto: vmx - fix copy-paste error in CTR mode (Desnes Augusto Nunes do Rosario) [1763621 1739765]
  - [crypto] vmac - separate tfm and request context (Vladis Dronov) [1763620 1733561]
  - [crypto] crypto: blkcipher - fix crash flushing dcache in error path (Vladis Dronov) [1761804 1741525]
  - [crypto] crypto: remove direct blkcipher_walk dependency on transform (Vladis Dronov) [1761804 1741525]
  - [crypto] crypto: user - prevent operating on larval algorithms (Vladis Dronov) [1761804 1741525]
  - [netdrv] net/mlx5e: Support LAG TX port affinity distribution (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Expose new function for TIS destroy loop (Alaa Hleihel) [1759449 1724344]
  - [include] net/mlx5: Add lag_tx_port_affinity capability bit (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Re-work TIS creation functions (Alaa Hleihel) [1759449 1724344]
  - [netdrv] net/mlx5e: Disallow tc redirect offload cases we don't support (Alaa Hleihel) [1759003 1721626]
  - [netdrv] net/mlx5e: Support ndo_get_phys_port_name for PF under switchdev mode (Alaa Hleihel) [1759003 1721626]
  - [netdrv] net/mlx5e: Expose same physical switch_id for all representors (Alaa Hleihel) [1759003 1721626]
  - [net] tcp: reset sk_send_head in tcp_write_queue_purge (Marcelo Leitner) [1748357 1748358] {CVE-2019-15239}
  - [x86] kvm: x86: vmx: fix vpid leak (Vitaly Kuznetsov) [1755781 1716188]
  - [kvm] kvm/x86: Move MSR_IA32_ARCH_CAPABILITIES to array emulated_msrs (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts (Paul Lai) [1757757 1708465]
  - [kvm] kvm: vmx: Tell the nested hypervisor to skip L1D flush on vmentry (Paul Lai) [1757757 1708465]
  - [kvm] kvm: vmx: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Introduce kvm_get_msr_feature() (Paul Lai) [1757757 1708465]
  - [kvm] kvm: x86: Add a framework for supporting MSR-based features (Paul Lai) [1757757 1708465]
  - [nvme] nvme: don't ask blk-mq to handle timed-out request (Ming Lei) [1758051 1750202]
  - [block] blk-mq: mark request as REQ_TIMEOUT when .timeout() is called (Ming Lei) [1758051 1750202]
  - [block] blk-mq: introduce blk_mq_clear_rq_complete() (Ming Lei) [1758051 1750202]
  - [block] blk-mq: remove 'sync' argument from __blk_mq_complete_request() (Ming Lei) [1758051 1750202]
  - [nvme] blk-mq: remove blk_mq_complete_request_sync (Ming Lei) [1763624 1730922]
  - [nvme] nvme: wait until all completed request's complete fn is called (Ming Lei) [1763624 1730922]
  - [nvme] nvme: don't abort completed request in nvme_cancel_request (Ming Lei) [1763624 1730922]
  - [block] blk-mq: introduce blk_mq_tagset_wait_completed_request() (Ming Lei) [1763624 1730922]
  - [block] blk-mq: introduce blk_mq_request_completed() (Ming Lei) [1763624 1730922]
  - [scsi] scsi: qla2xxx: Use correct size in call to dma_free_coherent() in qla2400_sp_unmap() (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Fix different size DMA Alloc/Unmap (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Fix DMA unmap leak (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: qla2xxx: Prevent memory leak for CT req/rsp allocation (Himanshu Madhani) [1759447 1668767]
  - [scsi] scsi: fnic: fix msix interrupt allocation (Govindarajulu Varadarajan) [1754836 1745053]
  - [scsi] scsi: fnic: print port speed only at driver init or speed change (Govindarajulu Varadarajan) [1754836 1745053]
  - [nvme] nvme-scsi: updating struct nvme_ctrl (Gopal Tiwari) [1752423 1749524]


author: Bruno Meneguele <bmeneg@redhat.com> [3.10.0-1062.7.1.el7]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756815 1756816] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756882 1756883] {CVE-2019-0155}
  - [x86] tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] tsx: Add "auto" option to the tsx= cmdline parameter (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a "tsx=" cmdline option with TSX disabled by default (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [x86] msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766539 1766540] {CVE-2019-11135}
  - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [virt] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1733009 1690343] {CVE-2018-12207}
  - [kernel] sched/fair: Fix endless loop in idle_balance() (Phil Auld) [1766087 1740941]
  - [kernel] sched: Skip double execution of pick_next_task_fair() (Phil Auld) [1766098 1750819]
  - [kernel] sched/fair: Prevent throttling in early pick_next_task_fair() (Phil Auld) [1756267 1740038]
  - [kernel] sched: Check for stop task appearance when balancing happens (Phil Auld) [1756267 1740038]
  - [kernel] sched/core: Fix endless loop in pick_next_task() (Phil Auld) [1756267 1740038]
  - [kernel] sched/fair: Push down check for high priority class task into idle_balance() (Phil Auld) [1756267 1740038]
  - [kernel] sched/rt: Fix picking RT and DL tasks from empty queue (Phil Auld) [1756267 1740038]
  - [kernel] sched/core: Allow __sched_setscheduler() in interrupts when PI is not used (Phil Auld) [1756265 1722234]
  - [kernel] sched, dl: Convert switched_{from, to}_dl() / prio_changed_dl() to balance callbacks (Phil Auld) [1756265 1722234]
  - [kernel] sched,dl: Remove return value from pull_dl_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched, rt: Convert switched_{from, to}_rt() / prio_changed_rt() to balance callbacks (Phil Auld) [1756265 1722234]
  - [kernel] sched,rt: Remove return value from pull_rt_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Allow balance callbacks for check_class_changed() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Use replace normalize_task() with __sched_setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Handle priority boosted tasks proper in setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix broken setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Consider pi boosting in setscheduler() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Replace post_schedule with a balance callback list (Phil Auld) [1756265 1722234]
  - [kernel] sched: Guarantee task priority in pick_next_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Remove some #ifdeffery (Phil Auld) [1756265 1722234]
  - [kernel] sched: Clean up idle task SMP logic (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix hotplug task migration (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Remove idle_balance() declaration in sched.h (Phil Auld) [1756265 1722234]
  - [kernel] sched: Push down pre_schedule() and idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Optimize cgroup pick_next_task_fair() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Clean up the __clear_buddies_*() functions (Phil Auld) [1756265 1722234]
  - [kernel] sched: Push put_prev_task() into pick_next_task() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Move rq->idle_stamp up to the core (Phil Auld) [1756265 1722234]
  - [kernel] sched: Fix race in idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched: Remove 'cpu' parameter from idle_balance() (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Reset se-depth when task switched to FAIR (Phil Auld) [1756265 1722234]
  - [kernel] sched/fair: Track cgroup depth (Phil Auld) [1756265 1722234]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-1061.el7]
changelog:
  - [linux] efi: Disable local interrupts across efi run-time calls (Lenny Szubowicz) [1716252]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1723032]
  - [net] tcp: provide TCP_FRAG_IN_WRITE/RTX_QUEUE for tcp_fragment use (Florian Westphal) [1723032]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.12.1.el7]
changelog:
  - [x86] x86/speculation: Prevent deadlock on ssb_state::lock (Waiman Long) [1841121 1836322]
  - [vfio] vfio-pci: Invalidate mmaps and block MMIO access on disabled memory (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio-pci: Fault mmaps to enable vma tracking (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Support faulting PFNMAP vmas (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/pci: call irq_bypass_unregister_producer() before freeing irq (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio_pci: Enable memory accesses before calling pci_map_rom (Alex Williamson) [1837297 1820632] {CVE-2020-12888}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.13.1.el7]
changelog:
  - [x86] x86/speculation: Support old struct x86_cpu_id & x86_match_cpu() kABI (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [cpufreq] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header (Waiman Long) [1827187 1827188] {CVE-2020-0543}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.18.1.el7]
changelog:
  - [fs] locks: allow filesystems to request that ->setlease be called without i_lock (Jeff Layton) [1838602 1830606]
  - [fs] locks: move fasync setup into generic_add_lease (Jeff Layton) [1838602 1830606]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.18.2.el7]
changelog:
  - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837429 1837430] {CVE-2020-10713}
  - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837429 1837430] {CVE-2020-10713}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.10.1.el7]
changelog:
  - [md] dm-mirror: provide the merge method (Mikulas Patocka) [1890059]
  - [nvme] nvme-rdma: cancel async events before freeing event struct (David Milburn) [1857397]
  - [s390] dasd: Use struct_size() helper (Sterling Alexander) [1886477]
  - [s390] dasd: fix inability to use DASD with DIAG driver (Sterling Alexander) [1886477]
  - [hv] hv_utils: drain the timesync packets on onchannelcallback (Vitaly Kuznetsov) [1884735]
  - [hv] hv_utils: return error if host timesysnc update is stale (Vitaly Kuznetsov) [1884735]
  - [x86] cpu: Re-apply forced caps every time CPU caps are re-read (Herbert Xu) [1886792]
  - [x86] cpu: Factor out application of forced CPU caps (Herbert Xu) [1886792]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.11.1.el7]
changelog:
  - [netdrv] hdlc_ppp: add range checks in ppp_cp_parse_cr() (Guillaume Nault) [1882078] {CVE-2020-25643}
  - [fs] ext4: fix potential negative array index in do_split() (Pavel Reichl) [1846164] {CVE-2020-14314}
  - [fs] nfsd: apply umask on fs without ACL support ("J. Bruce Fields") [1870215] {CVE-2020-24394}
  - [kernel] watchdog/core: Remove the park_in_progress obfuscation (Waiman Long) [1860661]
  - [mm] swap_slots: recheck cache->slots_ret under spin_lock_irq() protection (Rafael Aquini) [1862915]
  - [netdrv] ethernet: i40e: Set RX_ONLY mode for unicast promiscuous on VLAN (Stefan Assmann) [1845677]
  - [infiniband] mlx5: Fix use-after-free in dereg_mr() (Alaa Hleihel) [1880184]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.15.1.el7]
changelog:
  - [fs] ceph: quota: fix null pointer dereference in quota check (Jeff Layton) [1890386]
  - [netdrv] revert "mlx5e: ethtool, Remove unsupported SFP EEPROM high pages query" (Alaa Hleihel) [1896756]
  - [kernel] timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion (Waiman Long) [1890911]
  - [kernel] exit: Optimize forget_original_parent() for large thread group exiting (Waiman Long) [1872110]
  - [kernel] exit: reparent: call forget_original_parent() under tasklist_lock (Waiman Long) [1872110]
  - [kernel] Disable tasklist_waiters when qrwlock is enabled (Waiman Long) [1872110]
  - [fs] cifs: handle ERRBaduid for SMB1 (Leif Sahlberg) [1847041]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.1.1.el7]
changelog:
  - [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1869751]
  - [scsi] scsi: ses: don't ask for diagnostic pages repeatedly during probe (Maurizio Lombardi) [1855324]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.1.el7]
changelog:
  - [edac] EDAC/i10nm: Update driver to support different bus number config register offsets (Aristeu Rozanski) [1840276]
  - [edac] EDAC, {skx, i10nm}: Make some configurations CPU model specific (Aristeu Rozanski) [1840276]
  - [net] test nouarg before dereferencing zerocopy pointers (Patrick Talbert) [1862273]
  - [net] packet: copy user buffers before orphan or clone (Patrick Talbert) [1862273]
  - [netdrv] net/mlx5e: Fix deallocation of non-fully init encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Allow concurrent creation of encap entries (Alaa Hleihel) [1874101]
  - [netdrv] net/mlx5e: Protect encap hash table with mutex (Alaa Hleihel) [1874101]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.2.2.el7]
changelog:
  - [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
  - [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.20.1.el7]
changelog:
  - [md] Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1889372]
  - [md] improve variable names in md_flush_request() (Xiao Ni) [1889372]
  - [kernel] timer: Fix potential bug in requeue_timers() (Waiman Long) [1914011]
  - [x86] kvm: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Vitaly Kuznetsov) [1890669]
  - [x86] kvm: avoid incorrect writes to host MSR_IA32_SPEC_CTRL (Vitaly Kuznetsov) [1890669]
  - [md] dm-mirror: fix a crash if the underlying block device doesn't have merge_bvec_fn (Mikulas Patocka) [1916407]
  - [gpu] drm/i915: Fix use-after-free when destroying GEM context (Dave Airlie) [1814731] {CVE-2020-7053}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.21.1.el7]
changelog:
  - [pinctrl] devicetree: Avoid taking direct reference to device name string (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [pinctrl] Delete an error message (Aristeu Rozanski) [1922902] {CVE-2020-0427}
  - [tty] vt: keyboard, reorder user buffer handling in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, rename i to kb_func in vt_do_kdgkb_ioctl (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, extend func_buf_lock to readers (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: keyboard, simplify vt_kdgkbsent (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] keyboard, do not speculate on func_table index (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [tty] vt: fix write/write race in ioctl(KDSKBSENT) handler (Aristeu Rozanski) [1896775] {CVE-2020-25656}
  - [iommu] amd: return error on real irq alloc failure (Jerry Snitselaar) [1918273]
  - [iommu] amd: Set DTE[IntTabLen] to represent 512 IRTEs (Jerry Snitselaar) [1921187]
  - [iommu] amd: Increase interrupt remapping table limit to 512 entries (Jerry Snitselaar) [1921187]
  - [scsi] lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1875961]
  - [scsi] lpfc: Fix ADISC reception terminating login state if a NVME target (Dick Kennedy) [1875961]
  - [netdrv] i40e: revert "i40e: don't report link up for a VF who hasn't enabled queues" (Stefan Assmann) [1901064]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.5.1.el7]
changelog:
  - [x86] x86/PCI: Mark Intel C620 MROMs as having non-compliant BARs (Myron Stowe) [1849223]
  - [kernel] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression (Oleg Nesterov) [1861396]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859468] {CVE-2020-14331}
  - [pci] hv: Retry PCI bus D0 entry on invalid device state (Mohammed Gamal) [1846667]
  - [pci] hv: Fix the PCI HyperV probe failure path to release resource properly (Mohammed Gamal) [1846667]
  - [x86] xen: Add call of speculative_store_bypass_ht_init() to PV paths (Vladis Dronov) [1882468]
  - [powerpc] powerpc/smp: Use nid as fallback for package_id (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add Power9 scheduler topology (Desnes Augusto Nunes do Rosario) [1826306]
  - [kernel] sched: Add a new SD_SHARE_POWERDOMAIN for sched_domain (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] sched, powerpc: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] sched, s390: Create a dedicated topology table (Desnes Augusto Nunes do Rosario) [1826306]
  - [s390] s390/topology: Remove call to update_cpu_masks() (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Add cpu_l2_cache_map (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Rework CPU topology construction (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc/smp: Use cpu_to_chip_id() to find core siblings (Desnes Augusto Nunes do Rosario) [1826306]
  - [powerpc] powerpc, hotplug: Avoid to touch non-existent cpumasks (Desnes Augusto Nunes do Rosario) [1826306]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1160.6.1.el7]
changelog:
  - [net] netfilter: nf_queue: place bridge physports into queue_entry struct (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: do not release refcouts until nf_reinject is done (Florian Westphal) [1885682]
  - [net] netfilter: nf_queue: make nf_queue_entry_release_refs static (Florian Westphal) [1885682]
  - [net] bluetooth: l2cap: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888253] {CVE-2020-12351}
  - [net] bluetooth: a2mp: Fix not initializing all members (Gopal Tiwari) [1888797] {CVE-2020-12352}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1159.el7]
changelog:
  - [kernel] modsign: Import certificates from optional MokListRT (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862840]
  - [crypto] crypto/pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1862840]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-1160.el7]
changelog:
  - [kernel] modsign: Add nomokvarconfig kernel parameter (Lenny Szubowicz) [1867857]
  - [firmware] modsign: Add support for loading certs from the EFI MOK config table (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Move import of MokListRT certs to separate routine (Lenny Szubowicz) [1867857]
  - [kernel] modsign: Avoid spurious error message after last MokListRTn (Lenny Szubowicz) [1867857]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.1.2.el7]
changelog:
  - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}
  - [net] Add variants of capable for use on on sockets (Jiri Benc) [1639635 1630694] {CVE-2018-14646}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.9.1.el7]
changelog:
  - [input] psmouse: fix button reporting for basic protocols (Benjamin Tissoires) [1662848 1658669]
  - [input] psmouse: add support for 2nd wheel on A4Tech Dual-Scroll wheel mice (Benjamin Tissoires) [1662848 1658669]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.10.1.el7]
changelog:
  - [fs] revert "[fs] nfs: Don't write back further requests if there is a pending write error" (Benjamin Coddington) [1672510 1656674]
  - [fs] cifs: connect to servername instead of IP for IPC$ share (Leif Sahlberg) [1672448 1647844]
  - [acpi] nfit: Fix command-supported detection (Charles Rose) [1671743 1665811]
  - [acpi] nfit: Block function zero DSMs (Charles Rose) [1671743 1665811]
  - [x86] efi-bgrt: Replace early_memremap() with memremap() (Lenny Szubowicz) [1671745 1481667]
  - [x86] efi-bgrt: Replace ioremap() with early_memremap() (Lenny Szubowicz) [1671745 1481667]
  - [scsi] libiscsi: Allow sd_shutdown on bad transport (Chris Leech) [1670680 1630979]
  - [block] blk-mq: punt failed direct issue to dispatch list (Ming Lei) [1670511 1656654]
  - [block] blk-mq: fix corruption with direct issue (Ming Lei) [1670511 1656654]
  - [powerpc] rtas: Fix a potential race between CPU-Offline & Migration (Steve Best) [1669044 1650249]
  - [powerpc] pseries: Disable CPU hotplug across migrations (Steve Best) [1669044 1650249]
  - [md] Add split counter for raid1 write request in the right place (Xiao Ni) [1668208 1659951]
  - [lib] string_helpers.c: fix infinite loop in string_get_size() (Ewan Milne) [1667989 1660565]
  - [kernel] stop_machine: Atomically queue and wake stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption after queueing stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption when waking two stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Make cpu_stop_queue_work() and stop_one_cpu_nowait() return bool (Phil Auld) [1667328 1557061]
  - [fs] proc: restrict kernel stack dumps to root (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] proc: use "unsigned int" for /proc/*/stack (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] libceph: fall back to sendmsg for slab pages (Ilya Dryomov) [1665814 1647460]
  - [scsi] csiostor: remove flush_scheduled_work() (Arjun Vynipadath) [1665370 1660882]
  - [pci] shpchp: Separate existence of SHPC and permission to use it (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Manage SHPC unconditionally on non-ACPI systems (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Fix AMD POGO identification (Myron Stowe) [1663241 1633873]
  - [mm] memcontrol: factor out reclaim iterator loading and updating (Aristeu Rozanski) [1663114 1595932]
  - [net] xfrm: policy: init locks early (Herbert Xu) [1660887 1641866]
  - [kernel] mm: clear __GFP_FS when PF_MEMALLOC_NOIO is set (Rafael Aquini) [1660392 1657714]
  - [nvme] flush namespace scanning work just before removing namespaces (Ewan Milne) [1659937 1622487]
  - [fs] fuse: don't need GETATTR after every READ (Miklos Szeredi) [1657921 1648781]
  - [fs] fuse: don't invalidate attrs when not using atime (Miklos Szeredi) [1657921 1648781]
  - [net] Set sk_prot_creator when cloning sockets to the right proto (Andrea Claudi) [1657351 1657352] {CVE-2018-9568}
  - [kernel] bpf: 32-bit RSH verification must truncate input before the ALU op (Jiri Olsa) [1641387 1641388] {CVE-2018-18445}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.11.1.el7]
changelog:
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1686766 1648965]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: skip clash resolution if nat is in place (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce clash resolution on insertion race (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: fix race between confirmation and flush (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce nf_ct_acct_update() (Florian Westphal) [1686766 1648965]
  - [netdrv] hv_netvsc: Fix a network regression after ifdown/ifup (Mohammed Gamal) [1679997 1661632]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.1.el7]
changelog:
  - [kernel] locking/rwsem: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Use smp_store_release() in mark_wake_futex() (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Fix wakeup ordering for wake_q (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Document wake_q_add() (Waiman Long) [1690323 1547078]
  - [scsi] mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5 controllers when HBA supports more than 16 MSI-x vectors (Tomas Henzl) [1689379 1649288]
  - [x86] cpu: avoid crash in get_cpu_cache_id() (David Arcari) [1689120 1626279]
  - [net] igmp: Allow user-space configuration of igmp unsolicited report interval (Hangbin Liu) [1686771 1663941]
  - [net] igmp: Don't flush routing cache when force_igmp_version is modified (Hangbin Liu) [1686771 1663941]
  - [net] igmp: fix incorrect unsolicit report count after link down and up (Hangbin Liu) [1688225 1623359]
  - [net] igmp: fix incorrect unsolicit report count when join group (Hangbin Liu) [1688225 1623359]
  - [net] igmp: make function __ip_mc_inc_group() static (Hangbin Liu) [1688225 1623359]
  - [net] igmp: Reduce Unsolicited report interval to 1s when using IGMPv3 (Hangbin Liu) [1688225 1623359]
  - [netdrv] cxgb4: Mask out interrupts that are not enabled (Arjun Vynipadath) [1687487 1678729]
  - [acpi] apci / watchdog: enable acpi_watchdog_uses_rtc (David Arcari) [1683078 1663637]
  - [watchdog] simplify getting .drvdata (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt on Lenovo Z50-70 (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: properly initialize resources (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Fix init failure with overlapping register regions (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Print out error number when device creation fails (David Arcari) [1683079 1666393]
  - [net] netfilter: nat: limit port clash resolution attempts (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: remove l4 protocol port rovers (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: cope with negative port range (Florian Westphal) [1683093 1654777]
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1678221 1651416]
  - [nvme] nvme-rdma: fix possible double free of controller async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: fix possible free of a non-allocated async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: stop admin queue before freeing it (David Milburn) [1678214 1659532]
  - [nvme] rdma: fix double freeing of async event data (David Milburn) [1678216 1655786]
  - [md] fix memleak for mempool (Nigel Croxon) [1678215 1599780]
  - [md] Memory leak when flush bio size is zero (Nigel Croxon) [1678215 1599780]
  - [md] fix lock contention for flush bios (Nigel Croxon) [1678215 1599780]
  - [net] ipv6: rate-limit probes for neighbourless routes (Sabrina Dubroca) [1677179 1637821]
  - [net] ipv6: Re-arrange code in rt6_probe() (Sabrina Dubroca) [1677179 1637821]
  - [netdrv] cxgb4: update supported DCB version (Arjun Vynipadath) [1673821 1668570]
  - [netdrv] cxgb4: when disabling dcb set txq dcb priority to 0 (Arjun Vynipadath) [1673821 1668570]
  - [kvm] kvm: fix kvm_ioctl_create_device() reference counting (Paolo Bonzini) [1671922 1671923] {CVE-2019-6974}
  - [kvm] KVM: nVMX: unconditionally cancel preemption timer in free_nested (Paolo Bonzini) [1671905 1671906] {CVE-2019-7221}
  - [mm] page-writeback.c: fix range_cyclic writeback vs writepages deadlock (Brian Foster) [1673281 1591574]
  - [fs] rbd: avoid corruption on partially completed bios (Ilya Dryomov) [1672514 1613493]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.2.el7]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] x86/speculation/mds: Add mds=full,nosmt cmdline option (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [base] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/msr-index: Cleanup bit defines (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Rework SMT state change (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Expose sched_smt_present static key (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Make sched_smt_present track topology (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add casting to fix compilation error (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.2.el7]
changelog:
  - [security] xattr: use RH_KABI_CONST to avoid security_inode_init_security checksum change (Cestmir Kalina) [1702286 1710633]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.3.el7]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.27.1.el7]
changelog:
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1718690 1704810]
  - [x86] perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1721611 1696764]
  - [x86] perf/amd: Resolve race condition when disabling PMC (David Arcari) [1721611 1696764]
  - [edac] amd64: Set maximum channel layer size depending on family (Gary Hook) [1720266 1705210]
  - [edac] amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1720266 1705210]
  - [edac] amd64: Recognize x16 symbol size (Gary Hook) [1720266 1705210]
  - [edac] amd64: Support more than two Unified Memory Controllers (Gary Hook) [1720266 1705210]
  - [edac] amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1720266 1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1720266 1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1720266 1670608]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721604 1543509]
  - [x86] Mark AMD EPYC guests as supported (David Arcari) [1721604 1664507]
  - [x86] mark amd rome as unsupported (David Arcari) [1721604 1638504]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.27.2.el7]
changelog:
  - [x86] hyper-v: fix hyperv.h UAPI header (Vitaly Kuznetsov) [1727109 1692492]
  - [iommu] hyper-v: Add Hyper-V stub IOMMU driver (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Set x2apic destination mode to physical when x2apic is available (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Consolidate code for converting cpumask to vpset (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Fix the circular dependency in IPI enlightenment (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Refactor hv_irq_unmask() to use cpumask_to_vpset() (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Replace hv_vp_set with hv_vpset (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Add __aligned(8) to struct retarget_msi_interrupt (Vitaly Kuznetsov) [1727109 1661654]
  - [hwmon] k10temp: Add support for AMD family 17h, model 30h CPUs (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add PCI device IDs for family 17h, model 30h (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add support for newer PCI topologies (Gary Hook) [1728000 1643292]
  - [hwmon] k10temp, x86/amd_nb: Consolidate shared device IDs (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Use API function to access System Management Network (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add support for Raven Ridge CPUs (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Add support for AMD Ryzen w/ Vega graphics (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Add temperature offset for Ryzen 2700X (Gary Hook) [1728000 1643292]
  - [x86] cpu/amd: Apply the Erratum 688 fix when the BIOS doesn't (Gary Hook) [1728000 1643292]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.4.1.el7]
changelog:
  - [net] macsec: let the administrator set UP state even if lowerdev is down (Sabrina Dubroca) [1658970 1626004]
  - [net] macsec: update operstate when lower device changes (Sabrina Dubroca) [1658970 1626004]
  - [fs] nfsv4.x: fix lock recovery during delegation recall (Steve Dickson) [1657840 1634086]
  - [fs] cifs: Fix autonegotiate security settings mismatch (Leif Sahlberg) [1657841 1650148]
  - [md] raid1: panic because of using freed memory (Xiao Ni) [1656500 1632575]
  - [pci] Match Root Port's MPS to endpoint's MPSS as necessary (Myron Stowe) [1656395 1524000]
  - [pci] Skip MPS logic for Virtual Functions (VFs) (Myron Stowe) [1656395 1524000]
  - [x86] kvm: vmx: re-add ple_gap module parameter (Gary Hook) [1656393 1652933]
  - [iommu] vt-d: Fix iotlb psi missing for mappings (Peter Xu) [1653592 1623856]
  - [iommu] vt-d: Introduce __mapping_notify_one() (Peter Xu) [1653592 1623856]
  - [scsi] libfc: retry PRLI if we cannot analyse the payload (Chris Leech) [1655045 1631130]
  - [scsi] libfc: Do not drop down to FLOGI for fc_rport_login() (Chris Leech) [1655044 1625721]
  - [scsi] libfc: Do not login if the port is already started (Chris Leech) [1655044 1625721]
  - [scsi] libfc: don't advance state machine for incoming FLOGI (Chris Leech) [1655044 1625721]
  - [gpu] drm/i915: Add short HPD IRQ storm detection for non-MST systems (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Clarify flow for disabling IRQs on storms (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix threshold check in intel_hpd_irq_storm_detect() (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix possible race in intel_dp_add_mst_connector() (Lyude Paul) [1654733 1608704]
  - [iommu] amd: Clear memory encryption mask from physical address (Gary Hook) [1649025 1643293]
  - [security] Make [un]register_lsm_notifier() null ops if !selinux_enabled (Don Dutile) [1648811 1621072]
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Jarod Wilson) [1648294 1641660]
  - [block] nvme: do not require GENERIC_HARDIRQ interfaces on s390 (Hendrik Brueckner) [1648239 1637637]
  - [nvme] nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event (David Milburn) [1648240 1630481]
  - [x86] kprobes: Use 5-byte NOP when the code might be modified by ftrace (Josh Poimboeuf) [1647816 1577050]
  - [fs] userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.5.1.el7]
changelog:
  - [fs] revert "[fs] sunrpc: Ensure we always close the socket after a connection shuts down" (Dave Wysochanski) [1660784 1657399]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-956.el7]
changelog:
  - [block] blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug (Ming Lei) [1619988]
  - [nvme] nvme-pci: unquiesce dead controller queues (Ming Lei) [1632424]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-957.el7]
changelog:
  - [mm] mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT) (Rafael Aquini) [1633059]


author: Pavel Raiskup <praiskup@redhat.com> - 3.1.2-11
changelog:
  - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
  - fix crash on crafted 7zip archives (CVE-2019-1000019)
  - fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-8
changelog:
  - Disable iterate-10 test which fails intermitently (#1596161)
  - Add BuildRequires for running autoreconf


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-9
changelog:
  - Remove patch to pass _PROXY, _proxy, LANG and LC_* environment
    variables to helpers. The root cause was a bug in IPA (#1596161)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-6
changelog:
  - Add ibendport ocontext handling
  - Add support for ibendportcon labels
  - Add ibpkey ocontext handling
  - Add support for ibpkeycon labels
  - Add binary module support for xperms


author: Miroslav Rezanina <mrezanin@redhat.com> - 18.2-1.el7_6.1
changelog:
  - ci-Adding-systemd-mount-options-to-wait-for-cloud-init.patch [bz#1633282]
  - ci-Azure-Ignore-NTFS-mount-errors-when-checking-ephemer.patch [bz#1633282]
  - ci-azure-Add-reported-ready-marker-file.patch [bz#1633282]
  - ci-Adding-disk_setup-to-rhel-cloud.cfg.patch [bz#1633282]
  - Resolves: bz#1633282
    ([Azure] cloud-init fails to mount /dev/sdb1 after stop(deallocate)&&start VM)


author: Miroslav Rezanina <mrezanin@redhat.com> - 18.2-1.el7_6.2
changelog:
  - ci-azure-Filter-list-of-ssh-keys-pulled-from-fabric.patch [bz#1684038]
  - Resolves: bz#1684038
    (EMBARGOED cloud-init: wrong list of ssh keys added to authorized_keys [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-5.el7
changelog:
  - ci-Remove-race-condition-between-cloud-init-and-Network-v2.patch [bz#1748015]
  - ci-cc_mounts-fix-incorrect-format-specifiers-316.patch [bz#1772505]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1772505
    ([RHEL7] swapon fails with "swapfile has holes" when created on a xfs filesystem by cloud-init)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-6.el7
changelog:
  - ci-Use-reload-or-try-restart-instead-of-try-reload-or-r.patch [bz#1748015]
  - ci-ec2-Do-not-log-IMDSv2-token-values-instead-use-REDAC.patch [bz#1821999]
  - Resolves: bz#1748015
    ([cloud-init][RHEL7] /etc/resolv.conf lose config after reboot (initial instance is ok))
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Miroslav Rezanina <mrezanin@redhat.com> - 19.4-7.el7
changelog:
  - ci-ec2-only-redact-token-request-headers-in-logs-avoid-.patch [bz#1821999]
  - Resolves: bz#1821999
    ([RHEL7.9] Do not log IMDSv2 token values into cloud-init.log)


author: Martin Pitt <mpitt@redhat.com> 173.1-1
changelog:
  - Crash fixes spotted by coverity rhbz#1644345
  - Fix race condition with fslist channels rhbz#1644346
  - Fix remotectl crash on errors rhbz#1644348


author: Jan Grulich <jgrulich@redhat.com> - 0.23-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1568618


author: Jan Grulich <jgrulich@redhat.com> - 0.26-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1668355


author: Jarod Wilson <jarod@redhat.com> - 1.10.7-3
changelog:
  - Update openmpi3 sub-package to OpenMPI v3.1.3
  - Resolves: #1637247
  - Rebuild against latest opensm
  - Resolves: #1670688


author: Honggang Li <honli@redhat.com> - 3.3.15-3
changelog:
  - Package up libosmcomp.so.3* to fix dependency issue after rebase
    opensm to release 3.3.21
  - Resolves: bz1670692


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-2
changelog:
  - Resolves: rhbz#1536219

  - logging: Make blackbox configurable (rhbz#1536219)
  - merge upstream commit 8af39f66e56e319b6b93804c0400e6e29737a90f (rhbz#1536219)
  - logging: Close before and open blackbox after fork (rhbz#1536219)
  - merge upstream commit 995ed0bd814ff3eacf6c09534841e6ce39ab6614 (rhbz#1536219)


author: Jeff Law <law@redhat.com> 4.8.5-26
changelog:
  - Avoid red zone probing for zero residual dynamic allocation (#1469697)
  - Avoid bogus CFIs for probes in noreturn fucntions on x86/x86_64 (#1469697)


author: Marek Polacek <polacek@redhat.com> 4.8.5-28
changelog:
  - Minor testsuite fixes to clean up test results (#1469697)
  - retpoline support for spectre mitigation (#1535655)


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-2
changelog:
  - patch: stop LUKS2 auto-recovery if device is no longer LUKS
    type
  - patch: update cryptsetup man page for --type option
  - patch: rephrase error message for invalid --type option in
    convert action
  - Resolves: #1599281 #1601477 #1601481


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-3
changelog:
  - Add expected permissions explicitly for locking directory.
  - Reinstate sed script removing library rpath from libtool
    script due to bug in upstream sources distribution.
  - Resolves: #1609847 #1610379


author: Isaac Boukris <iboukris@redhat.com> - 4.10.16-2
changelog:
  - resolves: #1828354 - add additioanl hostnames to the keytab
  - resolves: #1836427 - add dnshostname option net-ads-join


author: Andreas Schneider <asn@redhat.com> - 4.10.16-8
changelog:
  - resolves: #1878205 - Fix restarting winbind on package upgrade
  - resolves: #1892632 - Fix CVE-2020-14318
  - resolves: #1891687 - Fix CVE-2020-14323
  - resolves: #1879834 - Fix CVE-2020-1472
  - resolves: #1892313 - Fix memory leak in winbindd (wbinfo -u)
  - resolves: #1868917 - Fix %U substitution for 'valid users' option
  - resolves: #1853272 - Fix 'require_membership_of' documentation in
                         pam_winbind{.conf} manpage


author: Andreas Schneider <asn@redhat.com> - 4.6.2-10
changelog:
  - resolves: #1484423 - Require at least krb5 version 1.15.1
  - resolves: #1484713 - Fix password changes for users via smbpasswd
  - resolves: #1484723 - Be more graceful on FSCTL_VALIDATE_NEGOTIATE_INFO
                         returned errors


author: Andreas Schneider <asn@redhat.com> - 4.8.3-4
changelog:
  - resolves: #1614132 - Fix delete-on-close after smb2_find
  - resolves: #1614265 - Fix CVE-2018-1139
  - resolves: #1614269 - Fix CVE-2018-10858


author: Andreas Schneider <asn@redhat.com> - 4.9.1-4
changelog:
  - resolves: #1690222 - Fix --max-protocol documentation of smbclient
  - resolves: #1518353 - Fix 'net ads join -Uadmin@forestdomain'
  - resolves: #1696524 - Fix CVE-2019-3880


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-50
changelog:
  - remove dead code, detected by Coverity Analysis
  - remove unused variable, detected by GCC and Clang


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
  - prevent curl --rate-limit from hanging on file URLs (#1281969)
  - fix NTLM password overflow via integer overflow (CVE-2018-14618)
  - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
  - backport options to force TLS 1.3 in curl and libcurl (#1672639)
  - prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Jeff Moyer <jmoyer@redhat.com> - 62-1
changelog:
  - Rebase to v62 (Jeff Moyer)
    - a new monitor command / daemon
    - an ndctl udev rule for recording the unsafe shutdown count
    - smart error injection
    - create-namespace fix for fragmented namespaces
  - Resolves: bz#1610649 bz#1611833 bz#1456320


author: Marek Kasik <mkasik@redhat.com> - 0.28.0-3
changelog:
  - Check mtimes of files in /etc/dconf/db/*.d/ directories
  - when running "dconf update"
  - Resolves: #1570569


author: Marek Kasik <mkasik@redhat.com> - 3.22.3-2
changelog:
  - Import dconf-editor package from Fedora 25
  - Add Conflicts tag
  - Version BuildRequires
  - Update License field
  - Resolves: #1388931


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: dhcp.ini
  -->  Config file for automated patch script
  - Removed Patch: dhcp-4.2.0-errwarn-message.patch
  -->  Remove patch containing instructions to report bugs to bugzilla.redhat.com


author: Petr Menšík <pemensik@redhat.com> - 2.76-16.1
changelog:
  - Accept responses only on correct sockets (CVE-2020-25684)
  - Use strong verification on queries (CVE-2020-25685)
  - Handle multiple identical DNS queries better (CVE-2020-25686)
  - Link against nettle for sha256 hash implementation


author: Petr Menšík <pemensik@redhat.com> - 2.76-2
changelog:
  - Fix a few coverity warnings
  - package is dual-licensed GPL v2 or v3
  - don't include /etc/dnsmasq.d in triplicate, ignore RPM backup files instead


author: Petr Menšík <pemensik@redhat.com> - 2.76-2.1
changelog:
  - Fix CVE-2017-14491
  - Fix CVE-2017-14492
  - Fix CVE-2017-14493
  - Fix CVE-2017-14494
  - Fix CVE-2017-14496
  - Fix CVE-2017-14495
  - extra fixes


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-3
changelog:
  - fix global ACL directory configuration search path (#1630380)
  - update first/last_valid_gid range patch (#1630409)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-3.1
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1751383)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5
changelog:
  - fix CVE-2019-3814: improper certificate validation (#1674369)
  - fix CVE-2019-7524: buffer overflow in indexer-worker process resulting in privilege 
    escalation (#1700398)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1741787)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6.1
changelog:
  - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1871841)
  - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1871843)
  - fix CVE-2020-12674 crash due to assert in RPA implementation (#1871842)


author: Than Ngo <than@redhat.com> - 1:1.8.5-4
changelog:
  - Resolves: #1483569, incorrect processing of code blocks
  - Resolves: #1724173 - CVE-2016-10245, cross-site scripting


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Eliminated rpmbuild "bogus date" error due to inconsistent weekday,
    by assuming the date is correct and changing the weekday.


author: Peter Jones <pjones@redhat.com> - 17-2
changelog:
  - Try to make covscan actually complete the scan...
    Related: rhbz#1570032
    Related: rhbz#1558937
    Related: rhbz#1520533


author: Peter Jones <pjones@redhat.com> - 36-10
changelog:
  - Work around platform ACPI PCI(e) root drivers that don't fill in the
    "driver" symlink in sysfs.
    Resolves: rhbz#1614944


author: Peter Jones <pjones@redhat.com> - 36-11
changelog:
  - Fix device probing with no matching probes where HD() will work
    Resolves: rhbz#1613698
  - Detect partitiond md devices correctly
    Resolves: rhbz#1602414
    Resolves: rhbz#1613370


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - New upstream release (#1676504)
    CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
    CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402,
    CVE-2018-16403, CVE-2018-18310, CVE-2018-18521, CVE-2018-18520.


author: Jan Synáček <jsynacek@redhat.com> - 1:24.3-21
changelog:
  - fix libjpeg detection fails with gcc7 (#1487557)
  - fix Emacs GUI Toolbar icons missing (#1477745)
  - fix hardening: TLS certificate warnings should be hard errors (#1403643)


author: Petr Stodulka <pstodulk@redhat.com> - 1.8.3.1-13
changelog:
  - fall back to Basic auth if Negotiate fails
    Resolves: #1490998
  - handle request-pull when multiple tags point to the same commit
    Resolves: #1192146


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
  - Backport fix for CVE-2018-1123
  - Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Sebastian Kisela <skisela@redhat.com> - 1.8.3.1-19
changelog:
  - Fix httpd modules path to be independent from system architecture.
  Upstream commit: 1976311aa285549599e5a451d7ad72b55a2b60e2
  Resolves: #1213059


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-20
changelog:
  - Fix CVE-2018-17456: arbitrary code execution via .gitmodules
    Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Ondrej Pohorelsky <opohorel@redhat.com> - 1.8.3.1-21
changelog:
  - Fix CVE-2019-1387: remote code execution in recursive clones with nested
    submodules
    Resolves: CVE-2019-1387


author: Vít Ondruch <vondruch@redhat.com> - 1.8.3.1-23
changelog:
  - Prevent crafted URL containing new lines, empty host or lacks a scheme
    to cause credential leak.
    Resolves: CVE-2020-11008


author: Debarshi Ray <rishi@fedoraproject.org> - 3.12.12-4
changelog:
  - Fix certificate validation (use reference identities, handle validation
    failures correctly, fixed the test suite)
  - Resolves: #1386616


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-8
changelog:
  - Do not free EvDocumentInfo in ev_window_save_print_settings(),
  - it is freed in EvDocument's destructor
  - Resolves: #1541358


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-3
changelog:
  - Fix patch fixing crash in EvMediaPlayerKeys
  - Fix building of comics backend with libarchive 3.1.2
  - Resolves: #1567186


author: Marek Kasik <mkasik@redhat.com> - 3.28.2-4
changelog:
  - Change requires as requested by RPMDiff
  - Check returned size for negative value (CovScan)
  - Resolves: #1567186


author: Milan Crha <mcrha@redhat.com> - 3.28.5-6
changelog:
  - Add patch for RH bug #1753122 (GalA11yETableItem: Incorrect implementation of AtkObjectClass::ref_child())


author: Milan Crha <mcrha@redhat.com> - 3.28.5-4
changelog:
  - Add patch for RH bug #1392567 (Sync CategoryList with mail Labels)
  - Add patch for RH bug #1764669 (Send meeting change notifications only if being the organizer)


author: Nikola Forró <nforro@redhat.com> - 2.2.0-9
changelog:
  - Fix CVE-2017-18233
    resolves: #1574865
  - Fix CVE-2017-18234
    resolves: #1656011
  - Fix CVE-2017-18236
    resolves: #1574905
  - Fix CVE-2017-18238
    resolves: #1572270
  - Fix CVE-2018-7730
    resolves: #1572631


author: Jan Grulich <jgrulich@redhat.com> - 0.26-2
changelog:
  - Fix heap-based buffer over-read in Exiv2::Image::byteSwap4 in image.cpp
    Resolves: bz#1547207

    Fix heap-based buffer over-read in Exiv2::getULong function in types.cpp
    Resolves: bz#1545232


author: Jan Grulich <jgrulich@redhat.com> - 0.26-3
changelog:
  - Fix uncontrolled recursion in image.cpp:Exiv2::Image::printIFDStructure() which can allow a
    remote attacker to cause a denial of service via a crafted tif file
    Resolves: bz#1548410


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-41.1
changelog:
  - fence_lpar: fix issue with long username, hostname, etc not
    working when the command run by the agent exceeds 80 characters
  - fence_evacuate: enable evacuation of instances using private flavors

    Resolves: rhbz#1860545
    Resolves: rhbz#1862024


author: Jan Horak <jhorak@redhat.com> - 60.1.0-8
changelog:
  - Fixed homepage and bookmarks (rhbz#1606778)
  - Fixed missing file associations in RHEL6 (rhbz#1613565)


author: Jan Horak <jhorak@redhat.com> - 60.1.0-9
changelog:
  - Do not set user agent (rhbz#1608065)
  - GTK dialogs are localized now (rhbz#1619373)
  - JNLP association works again (rhbz#1607457)


author: Ray Strode <rstrode@redhat.com> - 0.8.8-2
changelog:
  - Fix crasher in xdg-desktop-portal
    Resolves: #1503579
  - Tweak spec file so it still builds even though we need to
    autoreconf.


author: Akira TAGOH <tagoh@redhat.com> - 2.13.0-4.1
changelog:
  - Rebase to 2.13.0 (#1576501)
  - Rename fc-cache binary to fc-cache-{32,64} for multilib. (#1568968)
  - backport some fixes related to Flatpak.
  - Drop new syntax in config for compatibility.
  - Requires dejavu-sans-fonts instead of font(:lang=en) (#1484094)


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
  - Fix double free in rlm_sql acct_redundant
    Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                          unknown value" when using module sql rlm_sql


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-10
changelog:
  - Fixes two EAP-PWD security issues
    Resolves: bz#1699413 authentication bypass with an invalid curve attack


author: Alexander Scheel <ascheel@redhat.com> - 3.0.13-15
changelog:
  - Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
    Resolves: bz#1818808

    * Fri Feb 7 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.13-14
  - Fixes receiving of multiple RADIUS packets under load
    Resolves: bz#1630684


author: Ondrej Holy <oholy@redhat.com> - 2.0.0-4.rc4
changelog:
  - CVE-2020-11521: Fix out-of-bounds write in planar.c (#1837621)
  - CVE-2020-11523: Fix integer overflow in region.c (#1837622)
  - CVE-2020-11524: Fix out-of-bounds write in interleaved.c (#1837623)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: fwupdate.ini
  -->  Config file for automated patch script
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate
  - Added Source: fwupdate-spec-use_our_keys.patch
  -->  Remove the TUV keys and sign with ours


author: Filip Januš <fjanus@redhat.com> - 2.0.35-27
changelog:
  - Fix CVE-2016-5766
  - Resolves: #1356813
  - Upstream patch: https://github.com/libgd/libgd/commit/aba3db8


author: Ray Strode <rstrode@redhat.com> - 3.28.2-15
changelog:
  - sync AllowMultipleSessionsPerUser patch from 7.6 branch
    Resolves: #1664353
  - Create dconf dirs by default
    Resolves: #1664284


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29
changelog:
  - Fix rare Segmentation fault when converting PDF to PNG (bug #1473337)
  - Raise the default VMThreshold from 1Mb to 8Mb (bug #1479852)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-29.el7_5.1
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621156)
    - CVE-2018-15910 (bug #1621157)
    - CVE-2018-16542 (bug #1621380)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.07-31
changelog:
  - Added security fixes for:
    - CVE-2018-16509 (bug #1621158)
    - CVE-2018-15910 (bug #1621160)
    - CVE-2018-16542 (bug #1621382)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.1
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1621159 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621381 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.8
changelog:
  - Resolves: #1667442 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.10
changelog:
  - Resolves: #1673915 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - Resolves: #1678171 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680025 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.11
changelog:
  - Resolves: #1673398 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - fix for pdf2dsc regression added


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.1
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621383 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649721 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621159 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621381 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.4
changelog:
  - Resolves: #1651149 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650060 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652935 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.5
changelog:
  - Resolves: #1654621 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650210 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645516 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648891 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643115 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655937 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.6
changelog:
  - Resolves: #1657822 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)


author: Martin Osvald <mosvald@redhat.com> - 9.07-31.el7_6.7
changelog:
  - Resolves: #1665919 pdf2ps reports an error when reading from stdin
  - Resolves: #1657333 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660569 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660828 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661278 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)


author: Martin Osvald <mosvald@redhat.com> - 9.07-32
changelog:
  - Remove as many non-standard operators as possible to make the codebase
    closer to upstream for later CVEs
  - Resolves: #1621385 - CVE-2018-16511 ghostscript: missing type check in type
    checker (699659)
  - Resolves: #1649722 - CVE-2018-16539 ghostscript: incorrect access checking
    in temp file handling to disclose contents of files (699658) 
  - Resolves: #1621162 - CVE-2018-15908 ghostscript: .tempfile file permission
    issues (699657)
  - Resolves: #1621384 - CVE-2018-15909 ghostscript: shading_param incomplete
    type checking (699660)
  - Resolves: #1652902 - CVE-2018-16863 ghostscript: incomplete fix for
    CVE-2018-16509
  - Resolves: #1654045 ghostscript update breaks xdvi (gs: Error: /undefined in flushpage)
  - Resolves: #1651150 - CVE-2018-15911 ghostscript: uninitialized memory
    access in the aesdecode operator (699665)
  - Resolves: #1650061 - CVE-2018-16802 ghostscript: Incorrect "restoration of
    privilege" checking when running out of stack during exception handling
  - Resolves: #1652936 - CVE-2018-19409 ghostscript: Improperly implemented
    security check in zsetdevice function in psi/zdevice.c
  - Resolves: #1654622 - CVE-2018-16541 ghostscript: incorrect free logic in
    pagedevice replacement (699664)
  - Resolves: #1650211 - CVE-2018-17183 ghostscript: User-writable error
    exception table
  - Resolves: #1645517 - CVE-2018-18073 ghostscript: saved execution stacks
    can leak operator arrays
  - Resolves: #1648892 - CVE-2018-17961 ghostscript: saved execution stacks
    can leak operator arrays (incomplete fix for CVE-2018-17183)
  - Resolves: #1643117 - CVE-2018-18284 ghostscript: 1Policy operator
    allows a sandbox protection bypass
  - Resolves: #1655939 - CVE-2018-19134 ghostscript: Type confusion in
    setpattern (700141)
  - Resolves: #1657694 - ghostscript: Regression: Warning: Dropping incorrect
    smooth shading object (Error: /rangecheck in --run--)
  - Resolves: #1661210 pdf2ps reports an error when reading from stdin
  - Resolves: #1657334 - CVE-2018-16540 ghostscript: use-after-free in
    copydevice handling (699661)
  - Resolves: #1660570 - CVE-2018-19475 ghostscript: access bypass in
    psi/zdevice2.c (700153)
  - Resolves: #1660829 - CVE-2018-19476 ghostscript: access bypass in
    psi/zicc.c
  - Resolves: #1661279 - CVE-2018-19477 ghostscript: access bypass in
    psi/zfjbig2.c (700168)
  - Resolves: #1667443 - CVE-2019-6116 ghostscript: subroutines within
    pseudo-operators must themselves be pseudo-operators
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata


author: Martin Osvald <mosvald@redhat.com> - 9.25-1
changelog:
  - Rebase to latest upstream version (bug #1636115)
  - Resolves: #1673399 - CVE-2019-3839 ghostscript: missing attack vector
    protections for CVE-2019-6116
  - Resolves: #1678172 - CVE-2019-3835 ghostscript: superexec operator
    is available (700585)
  - Resolves: #1680026 - CVE-2019-3838 ghostscript: forceput in DefineResource
    is still accessible (700576)
  - Resolves: #1670443 - ghostscript: Regression: double comment chars
    '%' in gs_init.ps leading to missing metadata
  - fix for pdf2dsc regression added to allow fix for CVE-2019-3839


author: Martin Osvald <mosvald@redhat.com> - 9.25-2.2
changelog:
  - Resolves: #1744008 - CVE-2019-14811 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator (701445)
  - Resolves: #1744012 - CVE-2019-14812 ghostscript: Safer Mode Bypass by .forceput Exposure in setuserparams (701444)
  - Resolves: #1744003 - CVE-2019-14813 ghostscript: Safer Mode Bypass by .forceput Exposure in setsystemparams (701443)
  - Resolves: #1744228 - CVE-2019-14817 ghostscript: Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures (701450)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-221
changelog:
  - CVE-2018-1000001: Fix realpath() buffer underflow (#1534635)
  - i386: Fix unwinding for 32-bit C++ application (#1529982)
  - Reduce thread and dynamic loader stack usage (#1527904)
  - x86-64: Use XSAVE/XSAVEC more often during lazy symbol binding (#1528418)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-258
changelog:
  - Fix dynamic string token substitution in DT_RPATH etc. (#1447808, #1540480)
  - Additional robust mutex fixes (#1401665)


author: Patsy Franklin <pfrankli@redhat.com> - 2.17-260
changelog:
  - Update glibc-rh1560641.patch to initialize pad outside
    the conditional eliminating an uninitialized byte warning from
    valgrind. (#1560641)


author: Carlos O'Donell <carlos@redhat.com> - 2.17-321
changelog:
  - CVE-2020-10029: Prevent stack corruption from crafted input in cosl, sinl,
    sincosl, and tanl function. (#1812119)


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
  - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
    bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  * Mon Aug 27 2018 Milind Changire <mchangir@redhat.com> - 3.12.2-18
  - fixes bugs bz#1524336 bz#1622029 bz#1622452


author: Bastien Nocera <bnocera@redhat.com> - 1:3.28.1-1
changelog:
  + gnome-bluetooth-3.28.1-1
  - Work-around bluez bug that would leave adapters on Discoverable
    when exiting
  - Resolves: #1567381


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.5-1
changelog:
  - Update to 3.28.5
  - Fix the libgovirt requirement
  - Revert to using Python 2 and Tracker 1.0
  - Resolves: #1567399


author: Florian Müllner <fmuellner@redhat.com> - 3.28.1-3
changelog:
  - Fix a couple of regressions from the rebase:
    - add back classic overview style
    - update dash-to-dock to a compatible version
    Related: #1569717


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.1-1
changelog:
  - Update to 3.28.1
  - Rebased downstream patches
  - Revert to using Python 2 and Tracker 1.0
  - Resolves: #1568171


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-1
changelog:
  - Update to 3.28.2
  - Rebased downstream patches
  - Fix crash on right-click on local collection
    Resolves: #1611565


author: Ray Strode <rstrode@redhat.com> - 3.28.1-5
changelog:
  - Fix gnome-disk-utility timeout at startup
    Resolves: #1593215
  - add back session properties icons
    Related: #1568620


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-9
changelog:
  + gnome-settings-daemon-3.26.2-9
  - Revert automatic suspend after inactivity, it was rejected
  - Related: #1449171


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: gnome-shell_spec-use-our-artwork.patch
  -->  Brand this with SL colors
  - Added Source: gnome-shell.ini
  -->  Config file for automated patch script


author: Debarshi Ray <rishi@fedoraproject.org> - 3.28.2-2
changelog:
  - Backport fix for client-side memory error (GNOME/gnome-terminal#1)
  - Bump BuildRequires versions
  - Drop the dark theme override
  - Rebase and restore the scroll speed patches
  - Rebase and restore the patch to allow old ISO 8895 charsets
  - Restore the GConf migration tool
  - Resolves: #1568632


author: Milan Crha <mcrha@redhat.com> - 3.28.1-6
changelog:
  - Resolves: #1460768 (Cannot hide desktop icons in classic mode)
  - Resolves: #1607839 (Invisible panel is made visible on click between Setting and Toggle button)


author: Peter Jones <pjones@redhat.com> - 3.0.5-9
changelog:
  - Just don't build the .i686 package at all.  After a scratch build, it's
    clear that "strip -p" is not good enough, because our different builders
    have non-matching UIDs for the build process, and -p adds uid/gid to the
    archive.  So there's no way to fix the multiarch conflict here without
    either fixing that or fixing strip(1) with:
    https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=patch;h=7a093a78
    We don't strictly need the .i686 package anyway, since we've moved to
    making the dependent binaries all build the ia32 bits on x86_64 for
    other reasons.  Related: rhbz#1310782


author: Tomáš Mráz <tmraz@redhat.com> - 2.0.22-4
changelog:
  - allow import of RSA-E and RSA-S keys (patch by Marcel Kolaja) (#1233182)
  - do not abort when missing hash algorithm in FIPS mode (#1078962)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Bastien Nocera <bnocera@redhat.com> - 0.3.4-3
changelog:
  - Fix size reporting in Apple Trailers source
  - Add compatibility layer to allow building with lua 5.1
  Resolves: #1477129


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.82
changelog:
  - Prepend prefix when HTTP path is relative
  - efi/http: Export {fw,http}_path variables to make them global
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails


author: Peter Jones <pjones@redhat.com> - 2.02-0.86
changelog:
  - Fix several CVEs:
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: grub2_spec-force-efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: secureboot.cer
  -->  Not using upstream Key
  - Replaced Source: securebootca.cer
  -->  Don't recognize upstream CA
  - Added Source: grub2.ini
  -->  Config file for automated patch script


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-0.87.e7.2
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Ondrej Holy <oholy@redhat.com> - 1.36.2-2
changelog:
  - Prevent spawning new daemons if outgoing operation exists (#1632960)
  - CVE-2019-3827: Prevent access if any authentication agent isn't available (#1673887)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-6
changelog:
  - Resolves: rhbz#1666381 - CVE-2018-12121 http-parser: nodejs: Denial of
                             Service with large HTTP headers [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-7
changelog:
  - Resolves: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                             allowed for spaces inside Content-Length header
                             values [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.7.1-8
changelog:
  - Backport needed test fixes
  - Related: rhbz#1666024 - CVE-2018-7159 http-parser: nodejs: HTTP parser
                            allowed for spaces inside Content-Length header
                            values [rhel-7]


author: Sergio Correia <scorreia@redhat.com> - 2.7.1-8.1
changelog:
  - Resolves: CVE-2019-15605 http-parser: nodejs: HTTP request
                             smuggling using malformed Transfer-Encoding header


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-67.2
changelog:
  - Resolves: #1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw()
    authentication bypass
  - Resolves: #1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
  - Resolves: #1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
  - Resolves: #1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread
  - Resolves: #1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection
    in mod_auth_digest


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl7\2
  -->  Modify release string to note changes
  - Added Source: httpd-spec_sl_index.html.sl7.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Ran Regex: (Release: .*)%{\?dist}(.*) => \1.sl7\2
  -->  Modify release string to note changes
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: httpd-sl_index.html.sl.patch
  -->  This patch removes TUV branding from the default index.html
  - Added Source: httpd-spec_sl_index.html.sl7.patch
  -->  The index.html file is outside of the source tarball, so we need to patch it in the install step
  - Added Source: httpd.ini
  -->  Config file for automated patch script


author: Lubos Uhliarik <luhliari@redhat.com>
changelog:
  - Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
    in mod_auth_digest
  - Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
    bypass due to race condition
  - Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.6-94
changelog:
  - Resolves: #1565491 - CVE-2017-15715 httpd: <FilesMatch> bypass with a trailing
    newline in the file name
  - Resolves: #1747283 - CVE-2019-10098 httpd: mod_rewrite potential open redirect
  - Resolves: #1724879 - httpd terminates all SSL connections using an abortive
    shutdown
  - Resolves: #1715981 - Backport of SessionExpiryUpdateInterval directive
  - Resolves: #1565457 - CVE-2018-1303 httpd: Out of bounds read in
    mod_cache_socache can allow a remote attacker to cause a denial of service
  - Resolves: #1566531 - CVE-2018-1283 httpd: Improper handling of headers in 
    mod_session can allow a remote user to modify session data for CGI applications


author: Doug Ledford <dledford@redhat.com> - 1.5.7-12
changelog:
  - Change ExclusiveArch to ExcludeArch instead so we don't have
    the same problem again in the future
  - Update to the git repo tarball that we shipped in rhel6.6
  - Related: bz1123998


author: Jiri Vanek <jvanek@redhat.com> 1.7.2-16
changelog:
  - added patch1, patch4 and patch11 to fix CVE-2019-10182
  - added patch2 to fix CVE-2019-10181
  - added patch3 and patch33 to fix CVE-2019-10185
  - Resolves: rhbz#1724958 
  - Resolves: rhbz#1725928 
  - Resolves: rhbz#1724989


author: Mike FABIAN <mfabian@redhat.com> - 50.2-2
changelog:
  - Fix rpmdiff failure: File /usr/src/debug/icu/source/i18n/unicode/selfmt.h
    relaxed permissions from 0644 to 0755 on all architectures
  - Related: rhbz#1677092


author: Mike FABIAN <mfabian@redhat.com> - 50.2-4
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808235


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-9.el7
changelog:
  - Resolves: #1624755 Re-installing replica on the same system displays 'WARNING: cannot check if port 443 is already configured'
    - ipa-replica-install: properly use the file store
  - Resolves: #1623486 PKINIT configuration did not succeed message is received during Replica-install
    - ipa-replica-install: fix pkinit setup
  - Related: #1624289 AVC denials noticed during test execution for SUB-CA test-suite in FIPS mode
    - Update minimum selinux-policy to 3.13.1-224


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.4-10.el7
changelog:
  - Resolves: 1630361 PKINIT fails in FIPS mode
    - Ensure that public cert and CA bundle are readable
    - Always make ipa.p11-kit world-readable
    - Make /etc/httpd/alias world readable & executable
    - Fix permission of public files in upgrader


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: ipa-spec-debrand.patch
  -->  remove TUV's Artwork
  - Added Source: ipa-spec-fix-osrelease.patch
  -->  Force use of rhel as the ipaplatform
  - Added Source: ipa.ini
  -->  Config file for automated patch script


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7_7.3
changelog:
  - Resolves: #1756914 - Sub-CA key replication failure
    - Handle missing LWCA certificate or chain
    - Fix CustodiaClient ccache handling
    - CustodiaClient: use ldapi when ldap_uri not specified
    - CustodiaClient: fix IPASecStore config on ipa-4-7
    - Bump krb5 min version


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.5-11.el7_7.4
changelog:
  - Resolves: #1781153 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents
  - Resolves: #1777303 - CVE-2019-10195 ipa: batch API logging user passwords to /var/log/httpd/error_log
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773953 - User incorrectly added to negative cache when backend is reconnecting to IPA service / timed out: error code 32 'No such object'
    - extdom: unify error code handling especially LDAP_NO_SUCH_OBJECT
    - ipa-extdom-extop: test timed out getgrgid_r
  - Resolves: #1770728 - Issue with adding multiple RHEL 7 IPA replica to RHEL 6 IPA master
    - DL0 replica install: fix nsDS5ReplicaBindDN config 
  - Resolves: #1767300 - CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf()
    - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-10.el7
changelog:
  - Resolves: #1728123 - EMBARGOED CVE-2019-10195 ipa: FreeIPA: batch API logging user passwords to /var/log/httpd/error_log [rhel-7]
    - CVE-2019-10195: Don't log passwords embedded in commands in calls using batch
  - Resolves: #1773550 - IPA upgrade fails for latest ipa package when adtrust is installed
    - Do not run trust upgrade code if master lacks Samba bindings
  - Resolves: #1767302 - EMBARGOED CVE-2019-14867 ipa: Denial of service in IPA server due to wrong use of ber_scanf() [rhel-7.8]
    - Make sure to have storage space for tag


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.6-11.el7
changelog:
  - Resolves: #1778777 - After upgrade AD Trust Agents were removed from LDAP
    - trust upgrade: ensure that host is member of adtrust agents


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-4.el7
changelog:
  - Resolves: #1842950 ipa-adtrust-install fails when replica is offline
    - ipa-adtrust-install: avoid failure when replica is offline
  - Resolves: #1831856 CVE-2020-11022 ipa: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
    - WebUI: Apply jQuery patch to fix htmlPrefilter issue


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7
changelog:
  - Resolves: #1826659 IPA: Ldap authentication failure due to Kerberos principal expiration UTC timestamp
    -  ipa-pwd-extop: use timegm() instead of mktime() to preserve timezone offset


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.6.8-5.el7_9.4
changelog:
  - Resolves: #1897253 IPA WebUI inaccessible after upgrading to RHEL 8.3.- idoverride-memberof.js missing
    - wgi/plugins.py: ignore empty plugin directories
  - Resolves: #1895197 improve IPA PKI susbsystem detection by other means than a directory presence, use pki-server subsystem-find
    - Improve PKI subsystem detection
    - ipatests: add test for PKI subsystem detection
    - ipatest: fix test_upgrade.py::TestUpgrade::()::test_kra_detection
  - Resolves: #1892793 Authentication and login times are over several seconds due to unindexed ipaExternalMember
    - Add more indices
  - Resolves: #1884819 IdM Web UI shows users as disabled
    - fix cert-find errors in CA-less deployment
  - Resolves: #1863619 CA-less install does not set required permissions on KDC certificate
    - CAless installation: set the perms on KDC cert file
    - ipatests: check KDC cert permissions in CA less install
  - Resolves: #1859248 CVE-2020-11023 ipa: jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
    - WebUI: Fix jQuery DOM manipulation issues
  - Resolves: #1846349 cannot issue certs with multiple IP addresses corresponding to different hosts
    - fix iPAddress cert issuance for >1 host/service


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - netr: Add Netronome TC flower firmware (rhbz 1518900)
  - Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
  - nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
  - chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180717-67.git8d69bab
changelog:
  - Update to latest upstream linux-firmware image for assorted netdrv updates
  - chelsio: update firmware to revision 1.20.8.0 (rhbz 1523202)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20180911-68.git85c5d90
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - nvidia: update firmware for Pascal GPUs (rhbz 1625514)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190225-70.git80dee31
changelog:
  - cxgb4: update firmware to revision 1.22.9.0 (rhbz 1671610)
  - nfp: update Agilio SmartNIC flower firmware to rev AOTC-2.10.A.13 (rhbz 1637996)
  - linux-firmware: Update firmware patch for Intel Bluetooth 8260 (rhbz 1649148)
  - qed: Add 8.37.7.0 firmware image (rhbz 1654809)
  - liquidio: fix GPL compliance issue (rhbz 1622521)
  - Update Intel OPA hfi1 firmware (rhbz 1637240)
  - qed: Add firmware 8.37.7.0 (rhbz 1643554)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190318-71.git283373f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.3.0 (rhbz 1642422)


author: Bruno E. O. Meneguele <bmeneg@redhat.com> - 20190429-72.gitddde598
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: update firmware to revision 1.23.4.0 (rhbz 1690727)
  - linux-firmware: Add firmware file for Intel Bluetooth 22161 (rhbz 1622438)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.141-2.6.10.5
changelog:
  - make to use latest c-j-c and so fix persisting issues with java.security and other configfiles
  - aligned with this change, applied repackReproduciblePolycies.sh
  - 1183793 is missing blocker
  - Resolves: rhbz#1448880


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.1
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Drop 7177216 merge fix which is applied upstream.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Add missing implementation of Matcher::pass_original_key_for_aes() on AArch64 (PR3497)
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Extend pr3393-rh1273760.patch so Token.getMechanismInfo can handle CK_MECHANISM
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Update to new tarball with AArch64 return value fixes, dropping local patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Fix missing return statement in src/os_cpu/linux_zero/vm/os_linux_zero.cpp (non-LP64 only)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.3
changelog:
  - Bump release number to an unused one as rhel-7.5-z-java-unsafe-candidate wrongly using .el7
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
changelog:
  - added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.1
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.0
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Regenerate pr3393-rh1273760-support_rsaandmgf1_with_sha_in_pkcs11.patch against current sources
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.0
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.261-2.6.22.1
changelog:
  - Add release notes from IcedTea.
  - Mark license files with appropriate macro.
  - Resolves: rhbz#1810557


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - Reverting to java-1.7.0-openjdk on AArch64 as rhel-7.4-z-java-unsafe-candidate using wrong suffix.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-0.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
  - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.181-7.b13
changelog:
  - Update to aarch64-jdk8u181-b13 and aarch64-shenandoah-jdk8u181-b13.
  - Remove 8187577/PR3578 now applied upstream.
  - Resolves: rhbz#1594249


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b10.
  - Drop 8146115/PR3508/RH1463098 applied upstream.
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-0
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
    - JDK-8210647/RH1632174
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b08-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b08.
  - Adjust PR3083/RH134640 to apply after JDK-8182999
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
  - Update version logic to handle -shenandoah* tag suffix.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b08.
  - Remove local copies of JDK-8031111 & JDK-8132111 as replaced by upstream versions.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.252.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1810557


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b09.
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.1.ea
changelog:
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Delay tzdata 2020b dependency until tzdata update has shipped.
  - Adjust JDK-8062808/PR3548 following constantPool.hpp context change in JDK-8243302
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-1
changelog:
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.1.13-4
changelog:
  - Update to shenandoah-jdk-11.0.1+13-20190101
  - Update tarball generation script in preparation for PR3681/RH1656677 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Fix remove-intree-libraries.sh to not exit early and skip SunEC handling.
  - Fix PR1983 SunEC patch so that ecc_impl.h is patched rather than added
  - Add missing RH1022017 patch to reduce curves reported by SSL to those we support.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.2.7-0
changelog:
  - Update to shenandoah-jdk-11.0.2+7 (January 2019 CPU)
  - Make tagsuffix optional and comment it out while unused.
  - Drop JDK-8211105/RH1628612/RH1630996 applied upstream.
  - Drop JDK-8209639/RH1640127 applied upstream.
  - Re-generate JDK-8210416/RH1632174 following JDK-8209786
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.3.6-0
changelog:
  - Update to shenandoah-jdk-11.0.3+6 (April 2019 EA)
  - Drop JDK-8210416/RH1632174 applied upstream.
  - Drop JDK-8210425/RH1632174 applied upstream.
  - Drop JDK-8210647/RH1632174 applied upstream.
  - Drop JDK-8210761/RH1632174 applied upstream.
  - Drop JDK-8210703/RH1632174 applied upstream.
  - Add cast to resolve s390 ambiguity in call to log2_intptr
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.4.11-0
changelog:
  - Update to shenandoah-jdk-11.0.4+11 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.5.10-0
changelog:
  - Update to shenandoah-jdk-11.0.5+10 (GA)
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.1-0.1.ea
changelog:
  - Update to shenandoah-jdk-11.0.6+1 (EA)
  - Switch to EA mode for 11.0.6 pre-release builds.
  - Add support for jfr binary.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.6.10-0
changelog:
  - Update to shenandoah-jdk-11.0.6+10 (GA)
  - Switch to GA mode for final release.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.9-0.0.ea
changelog:
  - Update to shenandoah-jdk-11.0.8+9 (EA)
  - Update release notes for 11.0.8 release.
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-0
changelog:
  - Update to shenandoah-jdk-11.0.8+10 (GA)
  - Switch to GA mode for final release.
  - Update release notes with last minute fix (JDK-8248505).
  - This tarball is embargoed until 2020-07-14 @ 1pm PT.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-0
changelog:
  - Update to jdk-11.0.9+11
  - Update release notes for 11.0.9 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-10
changelog:
  - Bugzilla #1506710 - JSS throws ObjectNotFoundException without message
    (edewata)
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-11
changelog:
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)
  - Bugzilla #1533667 - Add: standard algorithm names for all ECC signature
    types (cfu,dstutzman)
  - Bugzilla #1534761 - SignerInfo class inserts wrong version # into the
    resulting structure (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-12
changelog:
  - Bugzilla #1579202 - JSS has wrong encoding for ecdsa with sha*
    AlgorithmIdentifier [rhel-7.5.z] (cfu)


author: Dogtag PKI Team <pki-devel@redhat.com> 4.4.6-2
changelog:
  - Bugzilla #1747966 - CVE 2019-14823 jss: OCSP policy "Leaf and Chain" implicitly trusts the root certificate


author: Jan Grulich <jgrulich@redhat.com> - 4.11-19-13
changelog:
  - Sanitise notification HTML
    Resolves: bz#1568853

  - Increase cpu buffer size in ksysguard
    Resolves: bz#1611762


author: Jan Grulich <jgrulich@redhat.com> - 19-23.9
changelog:
  - Check if we have write access to home directory before creating default folders
    Resolves: bz#1579764


author: Jan Grulich <jgrulich@redhat.com> - 6:4.14.8-9
changelog:
  - Do not fork konsole process when opening terminal from apps using dolphin-part
    Resolves: bz#1710362


author: Rafael Aquini <aquini@redhat.com> [3.10.0-693.el7]
changelog:
  - [x86] crypto: sha1-ssse3 - Disable avx2 (Benjamin Coddington) [1346106]
  - [net] geneve: fix hlist corruption (Jiri Benc) [1464292]
  - [net] vxlan: fix hlist corruption (Jiri Benc) [1464292]
  - [net] vxlan: fix use-after-free on deletion (Jiri Benc) [1464292]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.1.1.el7]
changelog:
  - [fs] dentry name snapshots (Miklos Szeredi) [1471131 1470403] {CVE-2017-7533}
  - [fs] fix the regression from "direct-io: Fix negative return from dio read beyond eof" (Eric Sandeen) [1475669 1473549]
  - [fs] direct-io: Fix negative return from dio read beyond eof (Eric Sandeen) [1475669 1473549]


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: genkey.patch
  -->  Debrand certs
  - Ran Regex: Red Hat Enterprise => Scientific
  -->  This RPM shouldn't say it is upstream's product
  - Added Source: debrand_taint_cpu.patch
  -->  Rename RHEL7 to SL7
  - Added Source: sl-ldup.x509
  -->  The FNAL SL signing certificate for driver updates
  - Added Source: kernel.ini
  -->  Config file for automated patch script
  - Added Source: sl-kpatch.x509
  -->  The FNAL SL signing certificate for kpatch updates
  - Added Source: fnal-sl.cer
  -->  The FNAL SL signing certificate


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.10.1.el7]
changelog:
  - [mm] mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() (Rafael Aquini) [1505164 1472460]
  - [mm] fix invalid node in alloc_migrate_target() (Rafael Aquini) [1505164 1472460]
  - [mm] add !pte_present() check on existing hugetlb_entry callbacks (Rafael Aquini) [1505164 1472460]
  - [fs] ceph: avoid accessing freeing inode in ceph_check_delayed_caps() (Ilya Dryomov) [1505163 1489426]
  - [fs] nfsd: Fix general protection fault in release_lock_stateid() (J. Bruce Fields) [1505160 1500815]
  - [fs] cifs: Reconnect expired SMB sessions (Leif Sahlberg) [1501526 1477052]
  - [fs] cifs: Separate SMB2 header structure (Leif Sahlberg) [1501526 1429710]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.5.el7]
changelog:
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Andrea Arcangeli) [1519795 1519798]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.6.el7]
changelog:
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.16.1.el7]
changelog:
  - [x86] smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (Prarit Bhargava) [1533022 1519503]
  - [x86] topology: Add topology_max_smt_threads() (Prarit Bhargava) [1533022 1519503]
  - [powerpc] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Jon Masters) [1519800 1519801] {CVE-2017-5754}
  - [s390] add ppa to system call and program check path (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [s390] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [s390] introduce CPU alternatives (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Andrea Arcangeli) [1533373 1533250]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Andrea Arcangeli) [1533373 1533250]
  - [fs] userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1533372 1531287]
  - [x86] kaiser/efi: unbreak tboot (Andrea Arcangeli) [1519795 1532989 1519798 1531559] {CVE-2017-5715}
  - [x86] spec_ctrl: don't call ptrace_has_cap in the IBPB ctx switch optimization (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/efi: unbreak EFI old_memmap (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpuidle_idle_call: fix double local_irq_enable() (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf sorting part #2 (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf for IBPB feature (Paolo Bonzini) [1519795 1519798]
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Andrea Arcangeli) [1519795 1519798]
  - [x86] mm/kaiser: disable global pages by default with KAISER (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/mm/kaiser: Disable global pages by default with KAISER" (Andrea Arcangeli) [1519795 1519798]
  - [x86] ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Andrea Arcangeli) [1519800 1519801]
  - [x86] kaiser/mm: fix pgd freeing in error path (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1519795 1519798]
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] kvm: pad RSB on VM transition (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [misc] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [perf] x86/intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [fs] userfaultfd: non-cooperative: fix fork use after free (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.2.1.el7]
changelog:
  - [nvme] nvmet-rdma: occasionally flush ongoing controller teardown (Slava Shwartsman) [1479850 1467998]
  - [nvme] Free bio_aux struct when done with bio (David Milburn) [1474679 1455553]
  - [mm] thp: respect MPOL_PREFERRED policy with non-local node (Larry Woodman) [1479763 1476709]
  - [char] ipmi: use rcu lock around call to intf->handlers->sender() (Tony Camuso) [1479761 1419765]
  - [x86] vmware: Use tsc_khz value for calibrate_cpu() (Prarit Bhargava) [1479246 1475716]
  - [netdrv] cxgb4: reduce resource allocation in kdump kernel (Sai Vemuri) [1478255 1379762]
  - [netdrv] cxgb4: fix a NULL dereference (Sai Vemuri) [1478255 1379762]
  - [netdrv] cxgb4: fix BUG() on interrupt deallocating path of ULD (Mauricio Oliveira) [1475671 1465554]
  - [netdrv] bonding: Fix transmit load balancing in balance-alb mode (Jarod Wilson) [1475670 1473481]
  - [fs] xfs: use ->b_state to fix buffer I/O accounting release race (Brian Foster) [1478254 1452228]
  - [net] dst: Fix an intermittent pr_emerg warning about lo becoming free (Xin Long) [1475675 1458111]
  - [powerpc] eeh: Fix partial hotplug criterion (Gustavo Duarte) [1475672 1458508]
  - [powerpc] eeh: Fix wrong argument passed to eeh_rmv_device() (Gustavo Duarte) [1475672 1458508]
  - [crypto] api - Move alg ref count init to crypto_check_alg (Herbert Xu) [1475668 1473593]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.2.2.el7]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489788 1489789] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.21.1.el7]
changelog:
  - [x86] platform/uv: Mark tsc_check_sync as an init function (Frank Ramsay) [1547870 1526066]
  - [x86] platform/uv: Add check of TSC state set by UV BIOS (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Provide a means to disable TSC ART (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Drastically reduce the number of firmware bug warnings (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Skip TSC test and error messages if already unstable (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Add option that TSC on Socket 0 being non-zero is valid (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Remove the TSC_ADJUST clamp (Frank Ramsay) [1547870 1526066]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.5.1.el7]
changelog:
  - [netdrv] i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq (Stefan Assmann) [1491972 1484232]
  - [netdrv] i40e: avoid NVM acquire deadlock during NVM update (Stefan Assmann) [1491972 1484232]
  - [mm] Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]
  - [fs] nfsv4: Ensure we don't re-test revoked and freed stateids (Dave Wysochanski) [1491969 1459733]
  - [netdrv] bonding: commit link status change after propose (Jarod Wilson) [1491121 1469790]
  - [mm] page_alloc: ratelimit PFNs busy info message (Jonathan Toppins) [1491120 1383179]
  - [netdrv] cxgb4: avoid crash on PCI error recovery path (Gustavo Duarte) [1489872 1456990]
  - [scsi] Add STARGET_CREATED_REMOVE state to scsi_target_state (Ewan Milne) [1489814 1468727]
  - [net] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Davide Caratti) [1488341 1487061] {CVE-2017-14106}
  - [net] tcp: fix 0 divide in __tcp_select_window() (Davide Caratti) [1488341 1487061] {CVE-2017-14106}
  - [net] sctp: Avoid out-of-bounds reads from address storage (Stefano Brivio) [1484356 1484355] {CVE-2017-7558}
  - [net] udp: consistently apply ufo or fragmentation (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] udp: account for current skb length when deciding about UFO (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] udp: avoid ufo handling on IP payload compression packets (Stefano Brivio) [1490263 1464161]
  - [pci] hv: Use vPCI protocol version 1.2 (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Add vPCI version protocol negotiation (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Use page allocation for hbus structure (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Fix comment formatting and use proper integer fields (Vitaly Kuznetsov) [1478256 1459202]
  - [net] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (Stefano Brivio) [1477007 1477010] {CVE-2017-7542}
  - [net] ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca) [1477007 1477010] {CVE-2017-7542}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Hannes Frederic Sowa) [1435672 1435670] {CVE-2017-7184}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Hannes Frederic Sowa) [1435672 1435670] {CVE-2017-7184}
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489788 1489789] {CVE-2017-1000251}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.5.2.el7]
changelog:
  - [mm] page_cgroup: Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]
  - Revert: [mm] Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.11.5.el7]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.6.el7]
changelog:
  - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.3.el7]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}
  - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.4.el7]
changelog:
  - [scsi] Revert: lpfc: Fix port initialization failure (Radomir Vrbovsky) [1605235 1584377]
  - [scsi] Revert: qla2xxx: Fix NULL pointer access for fcport structure (Radomir Vrbovsky) [1597546 1547714]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.2.el7]
changelog:
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.3.el7]
changelog:
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.1.el7]
changelog:
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573173 1571162]
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.2.el7]
changelog:
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.3.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.2.el7]
changelog:
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: vmx: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: svm: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Add filter flag to opt-out of SSB mitigation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] prctl: Add force disable speculation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.3.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-861.el7]
changelog:
  - [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1554590]
  - [nvme] validate admin queue before unquiesce (David Milburn) [1549733]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-862.el7]
changelog:
  - [netdrv] i40e: Fix attach VF to VM issue (Stefan Assmann) [1528123]
  - [netdrv] ixgbevf: Add check for ixgbe_mbox_api_13 to ixgbevf_probe when setting max_mtu (Ken Cox) [1556696]
  - [md] dm btree: fix serious bug in btree_split_beneath() (Mike Snitzer) [1557849]
  - [x86] pti: Disable PTI user page table update in EFI virtual mode (Waiman Long) [1540061]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8-1
changelog:
  - Resolves: rhbz#1673716 - Rebase k-h-c-i to version 0.8
  - The rebase also includes fixes for:
    - rhbz#1533190 - CVE-2017-15111 keycloak-httpd-client-install: unsafe
                     /tmp log file in --log-file option in keycloak_cli.py
    - rhbz#1533202 - CVE-2017-15112 keycloak-httpd-client-install: unsafe
                     use of -p/--admin-password on command line


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-20
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1510058


author: - Andy Walsh <awalsh@redhat.com> 6.1.1.125-4
changelog:
  - Attempt to unload modules and print a warning if unable to.
  - Resolves: rhbz#1553420
  - Fixed a hang when recovering a VDO volume with a physical size larger than
    16TB.
  - Resolves: rhbz#1628316


author: - Andy Walsh <awalsh@redhat.com> 6.1.2.41-5
changelog:
  - Reduced and rate limited error logging in order to avoid kernel soft-lockups.
    - Resolves: rhbz#1687005


author: - Andy Walsh <awalsh@redhat.com> 6.1.3.4-5
changelog:
  - Reduced and rate limited more error logging in order to avoid kernel
    soft-lockups.
    - Resolves: rhbz#1706196
  - Fixed a bug in the handling of re-used bios. This bug resulted in a
    kernel panic when rebooting a system after a crash with a VDO device on
    USB attached storage.
    - Resolves: rhbz#1676643


author: - Andy Walsh <awalsh@redhat.com> 6.1.3.7-5
changelog:
  - Fixed a rare bug which would log an assertion failure when shutting down
    a VDO device.
    - Resolves: rhbz#1749000


author: Stephan Wiesand <stephan wiesand desy de> 1.6.23-289.SLx
changelog:
  - update to release 1.6.23 (security release)
  - addresses OPENAFS-SA-2018-001, OPENAFS-SA-2018-002, OPENAFS-SA-2018-003


author: Stephan Wiesand <stephan wiesand desy de> 1.6.24-290.SLx
changelog:
  - update to release 1.6.24 (security release)
  - addresses OPENAFS-SA-2019-001, OPENAFS-SA-2019-002, OPENAFS-SA-2019-003
  - fix build on EL 6.10


author: Stephan Wiesand <stephan wiesand desy de> 1.6.20-256.SLx
changelog:
  - update to security release 1.6.20
  - added RemainAfterExit=true in afs.service, to fix the case where only
    kernel threads remain after the client has started


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-32
changelog:
  - Include preauth name in trace output if possible
  - Update cert generation scripts to work on modern openssl
  - Fix per-request preauth scoping
  - Add test case for PKINIT DH renegotiation
  - Echo KDC cookies in preauth tryagain
  - Fall back to other preauth mechanisms after failures
  - Resolves: #1540130


author: Matthew Harmsen <mharmsen@redhat.com> 0:4.19-5
changelog:
  - Fix build for CentOS 7 (mharmsen)
  - Resolves rhbz#1465103 - Missing getter methods in JDAPFilter classes
    (edewata)


author: Michal Ruprich - 4.4.8-10
changelog:
  - Related: #1374653 - File size decreases when synchronizing folders with a sftp account using lftp
                      - Patch edited so that it corresponds to upstream


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-11
changelog:
  - Resolves: #1514815 - lftp doesn't seems to consider 'set net:max-retries'
  - Resolves: #1556675 - "get" command with lftp does not fail on net:max-retries


author: Michal Ruprich <mruprich@redhat.com> - 4.4.8-12
changelog:
  - Resolves: #1611641 - CVE-2018-10916 lftp: particular remote file names may lead to current working directory erased


author: Michal Židek <mzidek@redhat.com> - 0.6.1-30
changelog:
  - Adopting to use Downstream Helper for bellow BZ backport
  - Related: rhbz#1507607 - ding-libs: libini_config: `ini_config_augment` reports errors on match failure


author: Michal Židek <mzidek@redhat.com> - 0.6.1-31
changelog:
  - Resolves: rhbz#1507607 - ding-libs: libini_config: `ini_config_augment` reports errors on match failure


author: Michal Židek <mzidek@redhat.com> - 0.6.1-32
changelog:
  - Previous change in spec file broke the application of downstream only patch
  - Related: rhbz#1507607 - ding-libs: libini_config: `ini_config_augment` reports errors on match failure


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.0-1
changelog:
  - Make more space for CI status image (vtrefny)
  - Include limits.h to make sure ULONG_MAX is defined (vpodzime)
  - Remove extra 'is' in two docstrings (vpodzime)
  - Properly support 64bit operands (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.1-1
changelog:
  - Add NEWS.rst file (vtrefny)
  - Fix source and url in spec file (vtrefny)
  - Use only one git tag for new releases (vtrefny)
  - Actually translate the units when expected (vpodzime)
  - Add two temporary test files to .gitignore (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.2-1
changelog:
  - Use only version as a tag of the last release (vpodzime)
  - Do not require the glib-2.0 pkgconfig package (vpodzime)
  - Do not lie about tag creation (vpodzime)


author: Debarshi Ray <rishi@fedoraproject.org> - 0.10.4-4
changelog:
  - Ensure that the new exiv2 soname is used during the build
  - Adapt to Exiv2::BasicIo API change
    Resolves: rhbz#1486570


author: Adam Jackson <ajax@redhat.com> - 1.0.1-0.6.git5baa1e5
changelog:
  - Enable %check for all but ppc64 and s390x, which has known but low-impact
    failures
  - Simplify %release


author: Kalev Lember <klember@redhat.com> - 3.21.92-1
changelog:
  - Update to 3.21.92
  - Don't set group tags
  - Use make_install macro
  - Use license macro for COPYING
  - Use desktop-file-validate instead of desktop-file-install
  - Tighten -devel deps with the _isa macro


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 0.3.3-5
changelog:
  - New storage format added in oVirt 4.1
    Resolves: rhbz#1346215
  - Check if operation was cancelled before disconnecting signal
    Resolves: rhbz#1431275


author: Christophe Fergeau <cfergeau@redhat.com> - 0.3.4-1
changelog:
  - Rebase to latest 0.3.4 upstream release. Still quite a few patches as
    there was no 0.3.5 release yet
    Resolves: rhbz#1584266


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 0.3.4-2
changelog:
  - Parse XML nodes automatically
    Related: rhbz#1427467
  - Set detailed error message for async call
    Related: rhbz#1427467


author: Lukas Nykryn <lnykryn@redhat.com> - 219-42.5
changelog:
  - unmount: Pass in mount options when remounting read-only (#1312002)
  - shutdown: don't remount,ro network filesystems. (#6588) (#1312002)
  - shutdown: fix incorrect fscanf() result check (#6806) (#1312002)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1619743)
  - cryptsetup-generator: don't return error if target directory already exists (#1619743)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1619743)
  - Make sure the mount units pulled by 'RequiresMountsFor=' are loaded (if they exist) (#1619743)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.2
changelog:
  - journald: do not store the iovec entry for process commandline on stack (#1657788)
  - journald: set a limit on the number of fields (1k) (#1657792)
  - journal-remote: set a limit on the number of fields in a message (#1657792)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-62.4
changelog:
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667870)
  - Allocate temporary strings to hold dbus paths on the heap (#1667870)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-65
changelog:
  - backport fd_is_fs_type (#1663143)
  - backport chase_symlinks (#1663143)
  - fs-util: add new CHASE_SAFE flag to chase_symlinks() (#1663143)
  - fs-util: add new chase_symlinks() flag CHASE_OPEN (#1663143)
  - sd-dameon: also sent ucred when our UID differs from EUID (#1663143)
  - notify: add new --uid= command (#1663143)
  - core: be stricter when handling PID files and MAINPID sd_notify() messages (#1663143)
  - journald: respect KeepFree= as well as MaxUse= values (#1361893)
  - shutdown: in_container was used before its definition (#1693716)
  - core: Fix edge case when processing /proc/self/mountinfo (#1691511)
  - sd-bus: deal with cookie overruns (#1693559)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1667871)
  - Allocate temporary strings to hold dbus paths on the heap (#1667871)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1667871)
  - udev: check if the spawned PID didn't exit after reaping unexpected PID (#1697909)
  - udev: call poll() again after killing the spawned process (#1697909)
  - udev: check age against both timeouts to prevent integer wraparound (#1697909)
  - avoid possible hang if our child process hangs (#1697909)
  - missing: when adding syscall replacements, use different names (#1694605)
  - include sys/sysmacros.h in more places (#1694605)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-66
changelog:
  - sd-bus: unify three code-paths which free struct bus_container (#1643394)
  - hashmap: don't use mempool (#1609349)
  - man: be more explicit about thread safety of sd_journal (#1609349)
  - selinux: don't log SELINUX_INFO and SELINUX_WARNING messages to audit (#1240730)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-76
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1775291)
  - core: rework StopWhenUnneeded= logic (#1775291)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-77
changelog:
  - core: coldplug possible nop_job (#1829754)
  - core: make sure to restore the control command id, too (#1828953)


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-2
changelog:
  - Fix for handling guest filenames with invalid or incomplete
    multibyte or wide characters
    resolves: rhbz#1301593


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-3
changelog:
  - Fix for CVE-2019-9755
    (heap-based buffer overflow leads to local root privilege escalation)
    resolves: rhbz#1698502


author: Marek Kasik <mkasik@redhat.com> - 0.3.0-2
changelog:
  - Ensure gxps_archive_read_entry() fills the GError in case of failure
  - Handle errors returned by archive_read_data()
  - Resolves: #1574844


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.6
changelog:
  - Add a patch that was missed in 1.15.2-50.4
  - Related: rhbz#1489290 - samba shares with sssd authentication broken
                            on 7.4 [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.7
changelog:
  - Resolves: rhbz#1506142 - SSSD can crash due to ABI changes in
                             libldb >= 1.2.0 (1.1.30) [rhel-7.4.z]
  - Resolves: rhbz#1506682 - sssd_client: add mutex protected call to the
                             PAC responder [rhel-7.4.z]
  - Resolves: rhbz#1499658 - CVE-2017-12173 sssd: unsanitized input when
                             searching in local cache database [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.15.2-50.8
changelog:
  - Resolves: rhbz#1508972 - Accessing IdM kerberos ticket fails while id
                             mapping is applied [rhel-7.4.z]
  - Resolves: rhbz#1509177 - Race condition between refreshing the cr_domain
                             list and a request that is using the list can
                             cause a segfault is sssd_nss [rhel-7.4.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.2-12
changelog:
  - Resolves: rhbz#1610667 - sssd_ssh leaks file descriptors when more than one certificate is converted into an SSH key
  - Resolves: rhbz#1583360 - The IPA selinux provider can return an error if SELinux is completely disabled


author: Jakub Hrozek <jhrozek@redhat.com> - 1.16.2-13
changelog:
  - Resolves: rhbz#1593756 - sssd needs to require a newer version of
                             libtalloc and libtevent to avoid an issue
                             in GPO processing


author: Michal Židek <mzidek@redhat.com> - 1.16.4-21
changelog:
  - Resolves: rhbz#1714952 - [sssd] RHEL 7.7 Tier 0 Localization
  - Rebuild japanese gmo file explicitly


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-8
changelog:
  - Resolves: rhbz#1553784 - Document how to prevent invalid selinux context for default home directories in SSSD-AD direct integration.
  - Resolves: rhbz#1836910 - Rhel7.7 server have an issue regarding dyndns update for PTR-records which is done by sssd on active directory DNS servers.
                             It is done in two steps (two different nsupdate messages).


author: Alexey Tikhonov <Alexey Tikhonov> 1.16.5-10
changelog:
  - Resolves: rhbz#1804005 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1773409 - sssd is failing to discover other subdomains in the forest if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1551077 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1507683 - GDM password prompt when cert mapped to multiple users and promptusername is False


author: Nikola Forró <nforro@redhat.com> - 1.2.90-7
changelog:
  - Fix CVE-2018-11212 (#1586062)
  - Fix CVE-2016-3616 (#1318509), CVE-2018-11213 (#1589091)
    and CVE-2018-11214 (#1589110)
  - Fix CVE-2018-11813 (#1591203)


author: Jiri Vymazal <jvymazal@redhat.com> 2.0.2-2
changelog:
  RHEL 7.6 erratum
  - added patch with skipempty support
    resolves: rhbz#1565219
  - removed no longer used patch file


author: Rui Matos <rmatos@redhat.com> - 2.5.2-11
changelog:
  - Resolves: CVE-2017-13738, CVE-2017-13740, CVE-2017-13741,
    CVE-2017-13742, CVE-2017-13743, CVE-2017-13744, CVE-2014-8184


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.4.alpha
changelog:
  - Avoid 'test/md5.c:126:3: warning: dereferencing type-punned pointer
    will break strict-aliasing rules' by adding -fno-strict-aliasing flag.


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-0.6.alpha
changelog:
  - Fixes for CVE-2018-14679 CVE-2018-14680 CVE-2018-14681 CVE-2018-14682
  - resolves: rhbz#1611550 rhbz#1611551 rhbz#1611552 rhbz#1611553


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.1.0-3
changelog:
  - Resolves: rhbz#1712458 - [machines] The function of 'Auto-detect guest
                             operating system' is not available on rhel 7.7


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.1.0-4
changelog:
  - Resolves: rhbz#1727842 - CVE-2019-13313 libosinfo: osinfo-install-script
                             option leaks password via command line argument


author: Petr Hracek <phracek@redhat.com> - 2:1.5.13-7
changelog:
  - Security fix for CVE-2015-8126
  - Changing png_ptr to info_ptr base on upstream
  - Related: #1283575


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.1-7
changelog:
  Prevent crashes when client truncates SHM segment
    I've reverted the patch for 1459276 which is no longer needed as this
    is a proper fix.
    Resolves: rhbz#1473695


author: Colin Walters <tmlcoch@redhat.com> - 1.7.16-1
changelog:
  - Add LRI_LOWSPEEDTIME and LRI_LOWSPEEDLIMIT
  - downloader: Don't consider CURLE_RECV_ERROR and CURLE_SEND_ERROR as fatal errors (RhBug: 1219817)
  - test_repoconf: Fix SIGSEGV in repoconf_assert_na (RhBug: 1222471)
  - repoconf: Proper handling of gint64 and guint64 types
  - build: Be compatible with cmake 2.8
  - handle: Do not free temporary error msg if there is no one (RhBug: 1219822)
  - utils/make_rpm.sh: Accept rpmbuild options as second argument (Issue #49)
  - Python: call lr_global_init() during module initialization
  - Add global function log_set_file that allow user to set a file where logs will be written (Issue #53)
  - util: Honor RFC 3986 (Issue #55)


author: Marek Blaha <mblaha@redhat.com> - 1.8.1-1
changelog:
  - Add yumrecord substitution mechanism (mluscon)
  - Fix a memory leak in signature verification (cwalters)
  - Add new option LRO_FTPUSEEPSV
  - downloader prepare_next_transfer(): simplify long line
  - downloader prepare_next_transfer(): add missing error check
  - downloader prepare_next_transfer(): cleanup error path
  - downloader prepare_next_transfer() - fix memory leak on error path (Alan Jenkins)
  - handle: Don't use proxy cache for downloads of metalink/mirrorlist
  - handle: Don't set CURLOPT_HTTPHEADER into curl handle immediately when specified
  - downloader: Implement logic for no_cache param in LrDownloadTarget (RhBug: 1297762)
  - Add no_cache param to LrDownloadTarget and lr_downloadtarget_new()
  - New test: always try to download from the fastest mirror (Alexander Todorov)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-10
changelog:
  - Add missing av_permission values (#1025931)
  - Set an appropriate errno in booleans.c (#1402140)
  - Change matchpathcon usage to match with matchpathcon manpage (#1412797)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-9
changelog:
  - Update semanage to allow runtime labeling of Infiniband Pkeys (#1466274)
  - Update semanage to allow runtime labeling of ibendports (#1466274)
  - Keep copy of file_contexts.homedirs in policy store (#1409813)
  - Add support for listing fcontext.homedirs file (#1409813)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-12
changelog:
  - Do not change file mode of seusers and users_extra (#1512639)
  - Improve warning for installing disabled module (#1337199)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-14
changelog:
  - Include user name in ROLE_REMOVE audit events (#1622045)
  - Improve "reset umask before creating directories"


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-8.1
changelog:
  - Define nnp_nosuid_transition policy capability (rhbz#1480519)
  - use IN6ADDR_ANY_INIT to initialize IPv6 addresses
  - Allow runtime labeling of ibendports (rhbz#1464489)
  - Allow runtime labeling of Infiniband Pkeys (rhbz#1464489)
  - Add IB end port handling to CIL (rhbz#1464489)
  - Add ibendport ocontext handling (rhbz#1464489)
  - Add support for ibendportcon labels (rhbz#1464489)
  - Add Infiniband Pkey handling to CIL (rhbz#1464489)
  - Add ibpkey ocontext handling (rhbz#1464489)
  - Add support for ibpkeycon labels (rhbz#1464489)
  - Remove unused attribute on a used argument from avrule_read() (rhbz#1464489)
  - Add binary module support for xperms
  - Add support for converting extended permissions to CIL


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6
changelog:
  - Fix memory leak in expand.c
  - Fix invalid read when policy file is corrupt
  - Fix possible use of uninitialized variables


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-7
changelog:
  - Define cgroup_seclabel policy capability (rhbz#1493517)
  - Fix unitialized jmp and invalid dereference


author: Peter Jones <pjones@redhat.com> - 2.3.3-6
changelog:
  - Pull in all the coverity fixes we sent upstream.  I had thought these
    made it in to this release; they did not, but the 2.4.0 release they are
    in is also the python 3 switchover, so we need these as patches.
    Related: rhbz#1463329


author: Peter Jones <pjones@redhat.com> - 2.3.3-8
changelog:
  - Fix smbios-sys-info-lite crashes when an asset tag is not set
    Resolves: rhbz#1562440
  - Fix vestigial c++ artifacts included in the package
    Resolves: rhbz#1562440


author: Jaroslav Mracek <jmracek@redhat.com> - 0.6.34-3
changelog:
  - Make sure that targeted updates don't do reinstalls
  - Resolves: bug#1668256
  - Fix NULL pointer dereference (CVE-2018-20532, CVE-2018-20533)
  - Resolves: bug#1669562
  - Resolves: bug#1669576
  - Fix illegal address access in pool_whatprovides (CVE-2018-20534)
  - Resolves: bug#1670453


author: Milan Crha <mcrha@redhat.com> - 2.62.2-2
changelog:
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c: get_cookies() on empty hostnames
  - Resolves: #1598838


author: Jan Grulich <jgrulich@redhat.com> - 1.4.4-11.20101004cvs
changelog:
  - Fix global buffer overflow
    Resolves: bz#1301202

  - Fix improper handling of CSRC count and extension header length in RTP header
    Resolves: bz#1323705

  - Fix buffer overflow in application of crypto profiles
    Resolves: bz#1141897


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
  - session: avoid printing misleading debug messages (#1503294)
  - scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12.el7_6.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12.el7_6.3
changelog:
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.9-1
changelog:
  - Rebase to libtalloc 2.1.9
  - Resolves: rhbz#1393811 - Rebase libtalloc to enable samba rebase to
                             version 4.6.x


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.10-1
changelog:
  - Rebase to libtalloc 2.1.10
  - Resolves: rhbz#1470053 - Rebase libtalloc to enable samba rebase to
                             version 4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.12-2
changelog:
  - Resolves: rhbz#1441231 - The tdb robust mutexes runtime check is not thread safe and ends in a deadlock


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.15-1
changelog:
  - Resolves: rhbz#1470049 - Rebase libtdb to enable samba rebase to
                             version 4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.33-1
changelog:
  - Resolves: #1470054 - Rebase libtevent to enable samba rebase to version
                         4.7.x


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.34-1
changelog:
  - Resolves: #1512414 - tevent can cause a Samba file corruption bug under
                         heavy threaded load


author: Vojtech Trefny <vtrefny@redhat.com> - 2.7.3-7
changelog:
  - core: Add Encrypted.Resize method
    Resolves: rhbz#1567992
  - Fix checking for distribution and version in integration tests
    Resolves: rhbz#1508385
  - Do not skip integration tests on CentOS/RHEL
    Resolves: rhbz#1511974
  - Fix failing MDRAID integration test
    Resolves: rhbz#1511986


author: Tomas Bzatek <tbzatek@redhat.com> - 2.7.3-9
changelog:
  - Build udisks2-lsm subpackage (#1672664)
  - Fix sigint source removal on daemon exit (#1643350)
  - CVE-2018-17336: Fix format string vulnerability in udisks_log (#1637427)
  - Describe command options in the udisksctl man page (#1568269)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.5
changelog:
  - qemu: block commit: Don't overwrite error when rolling back disk labels (rhbz#1516717)
  - qemu: block commit: Determine relative path of images before initializing (rhbz#1516717)
  - qemu: domain: Don't call namespace setup for storage already accessed by vm (rhbz#1516717)


author: Jiri Denemark <jdenemar@redhat.com> - 3.2.0-14.el7_4.6
changelog:
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - cpu_x86: Rename virCPUx86MapInitialize (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.3
changelog:
  - qemu_cgroup: Fix 'rc' argument on virDomainAuditCgroupPath() calls (rhbz#1564996)
  - util: Introduce virStringListMerge (rhbz#1564996)
  - util: Introduce virDevMapperGetTargets (rhbz#1564996)
  - qemu_cgroup: Handle device mapper targets properly (rhbz#1564996)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.4
changelog:
  - lxc: Drop useless check in live device update (rhbz#1557922)
  - Pass oldDev to virDomainDefCompatibleDevice on device update (rhbz#1557922)
  - qemu: Fix updating device with boot order (rhbz#1557922)
  - conf: Fix crash in virDomainDefCompatibleDevice (rhbz#1557922)
  - vmx: check for present/enabled devices earlier (rhbz#1566524)
  - vmx: allocate space for network interfaces if needed (rhbz#1566524)
  - internal: add STRCASEPREFIX (rhbz#1566524)
  - vmx: convert any amount of NICs (rhbz#1566524)
  - qemu: Use dynamic buffer for storing PTY aliases (rhbz#1566525)
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748) (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064) (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.6
changelog:
  - logging: Don't inhibit shutdown in system daemon (rhbz#1573268)
  - util: don't check for parallel iteration in hash-related functions (rhbz#1581364)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)
  - virNumaGetHugePageInfo: Return page_avail and page_free as ULL (rhbz#1582418)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-8
changelog:
  - storage: Add --shrink to qemu-img command when shrinking vol (rhbz#1613746)
  - access: Fix nwfilter-binding ACL access API name generation (rhbz#1611320)
  - qemu: mdev: Use vfio-pci 'display' property only with vfio-pci mdevs (rhbz#1624735)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-9
changelog:
  - virDomainDefCompatibleDevice: Relax alias change check (rhbz#1621910)
  - virDomainDetachDeviceFlags: Clarify update semantics (rhbz#1621910)
  - virDomainNetDefCheckABIStability: Check for MTU change too (rhbz#1623157)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.8
changelog:
  - cpu_x86: Do not cache microcode version (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130)
  - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.10
changelog:
  - virnwfilterbindingobj: Introduce and use virNWFilterBindingObjStealDef (rhbz#1702173)
  - admin: reject clients unless their UID matches the current UID (CVE-2019-10132)
  - locking: restrict sockets to mode 0600 (CVE-2019-10132)
  - logging: restrict sockets to mode 0600 (CVE-2019-10132)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.12
changelog:
  - api: disallow virDomainSaveImageGetXMLDesc on read-only connections (CVE-2019-10161)
  - api: disallow virDomainManagedSaveDefineXML on read-only connections (CVE-2019-10166)
  - api: disallow virConnectGetDomainCapabilities on read-only connections (CVE-2019-10167)
  - api: disallow virConnect*HypervisorCPU on read-only connections (CVE-2019-10168)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-10.el7_6.7
changelog:
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2630 v4 (rhbz#1687515)
  - cputest: Add data for Intel(R) Core(TM) i7-7600U (rhbz#1687515)
  - cputest: Add data for Intel(R) Xeon(R) CPU E7540 (rhbz#1687515)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2650 (rhbz#1687515)
  - cputest: Add data for Intel(R) Core(TM) i7-8700 (rhbz#1687515)
  - cpu_x86: Separate signature parsing from x86ModelParse (rhbz#1687515)
  - cpu_x86: Add x86ModelCopySignatures helper (rhbz#1687515)
  - cpu_x86: Store CPU signature in an array (rhbz#1687515)
  - cpu_x86: Allow multiple signatures for a CPU model (rhbz#1687515)
  - cpu_map: Add hex representation of signatures (rhbz#1687515)
  - cpu_map: Add more signatures for Conroe CPU model (rhbz#1687515)
  - cpu_map: Add more signatures for Penryn CPU model (rhbz#1687515)
  - cpu_map: Add more signatures for Nehalem CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Westmere CPU model (rhbz#1687515)
  - cpu_map: Add more signatures for SandyBridge CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for IvyBridge CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Haswell CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Broadwell CPU models (rhbz#1687515)
  - cpu_map: Add more signatures for Skylake-Client CPU models (rhbz#1687515)
  - cpu: Don't access invalid memory in virCPUx86Translate (rhbz#1687515)
  - cpu_x86: Log decoded CPU model and signatures (rhbz#1687515)
  - util: Modify virStorageFileGetSCSIKey return (rhbz#1687715)
  - storage: Rework virStorageBackendSCSISerial (rhbz#1687715)
  - util: Introduce virStorageFileGetNPIVKey (rhbz#1687715)
  - storage: Fetch a unique key for vHBA/NPIV LUNs (rhbz#1687715)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-22
changelog:
  - qemu: Drop cleanup label from qemuProcessInitCpuAffinity() (rhbz#1718172)
  - qemu: Fix NULL pointer access in qemuProcessInitCpuAffinity() (rhbz#1718172)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-34
changelog:
  - vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk() (rhbz#1815269)
  - vmx: make 'fileName' optional for CD-ROMs (rhbz#1815269)
  - RHEL: Fix migration on AMD hosts with old QEMU (rhbz#1815572)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35
changelog:
  - qemu: don't take agent and monitor job for shutdown (CVE-2019-20485)
  - qemu: don't hold a monitor and agent job for reboot (CVE-2019-20485)
  - qemu: don't hold monitor and agent job when setting time (CVE-2019-20485)
  - qemu: remove use of qemuDomainObjBeginJobWithAgent() (CVE-2019-20485)
  - qemu: remove qemuDomainObjBegin/EndJobWithAgent() (CVE-2019-20485)
  - storage: Fix daemon crash on lookup storagepool by targetpath (CVE-2020-10703)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
  - virDevMapperGetTargetsImpl: Be tolerant to kernels without DM support (rhbz#1823976)
  - virDevMapperGetTargetsImpl: quit early if device is not a devmapper target (rhbz#1823976)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.1
changelog:
  - qemu: end the agent job in qemuDomainSetTimeAgent (rhbz#1844952)
  - util: string: Introduce macro for automatic string lists (rhbz#1839992)
  - util: Rework virStringListAdd (rhbz#1839992)
  - qemu: Create multipath targets for PRs (rhbz#1839992)
  - util: Move virIsDevMapperDevice() to virdevmapper.c (rhbz#1839992)
  - virDevMapperGetTargetsImpl: Check for dm major properly (rhbz#1839992)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36.el7_9.3
changelog:
  - rpc: gendispatch: handle empty flags (CVE-2020-25637)
  - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
  - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
  - conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1868549)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-10
changelog:
  - Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157671)
  - Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
    (bug #1157671)
  - Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
    handling) (bug #1157671)
  - Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
    (bug #1157671)
  - Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
    handling) (bug #1157671)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-11
changelog:
  - Fix a crash in the VNC server library on connecting an IPv4 client if the
    server could not start listening on an IPv6 socket (bug #1314814)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-13
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662995)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-13
changelog:
  - Fix CVE-2018-15127 (Heap out-of-bounds write in
    rfbserver.c:rfbProcessFileTransferReadBuffer()) (bug #1662996)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.3-4.git4391e5c
changelog:
  - Explicitly disable build of java bindings
    Resolves: #1540723
  - Add support for ECDH key exchange algorithm
    Resolves: #1547144


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.3-6.git4391e5c
changelog:
  - Update the fix for CVE-2019-3816
    Resolves: #1668657
  - Remove Dist Tag from the oldest changelog entry


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.6.3-6.git4391e5c
changelog:
  - Update the fix for CVE-2019-3816
    Resolves: #1668658
  - Remove Dist Tag from the oldest changelog entry


author: Peter Hutterer <peter.hutterer@redhat.com> 0.7.1-2
changelog:
  - Fixes for
    CVE-2018-15864, CVE-2018-15863, CVE-2018-15862, CVE-2018-15861,
    CVE-2018-15859  CVE-2018-15857, CVE-2018-15856, CVE-2018-15855,
    CVE-2018-15854, CVE-2018-15853


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
  - Fix a series of CVEs (rhbz#1286496)
  - CVE-2015-7941 Stop parsing on entities boundaries errors
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - CVE-2015-1819 Enforce the reader to run in constant memory


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
  - Fix CVE-2015-8035 (#1595697)
  - Fix CVE-2018-14404 (#1602817)
  - Fix CVE-2017-15412 (#1729857)
  - Fix CVE-2016-5131 (#1714050)
  - Fix CVE-2017-18258 (#1579211)
  - Fix CVE-2018-1456 (#1622715)


author: David King <dking@redhat.com> - 2.9.1-6.5
changelog:
  - Fix CVE-2019-19956 (#1793000)
  - Fix CVE-2019-20388 (#1810057)
  - Fix CVE-2020-7595 (#1810073)
  - Fix xsd:any schema validation (#1812145)


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-1
changelog:
  - Rebase to 5.5.56
    That release also fixes the following security issues:
    CVE-2016-5617/CVE-2016-6664 CVE-2017-3312 CVE-2017-3238 CVE-2017-3243
    CVE-2017-3244 CVE-2017-3258 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318
    CVE-2017-3291 CVE-2017-3302 CVE-2016-5483/CVE-2017-3600 CVE-2017-3308
    CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464
    Resolves: #1458933
    New deps required by upstream: checkpolicy and policycoreutils-python
    License text removed by upstream: COPYING.LESSER
    Do not ignore test-suite failure
    Downstream script mariadb-prepare-db-dir fixed for CVE-2017-3265
    Resolves: #1458940


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-2
changelog:
  - Do not fix context and change owner if run by root in mariadb-prepare-db-dir
    Related: #1458940
  - Check properly that datadir includes only expected files
    Related: #1356897


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.60-1
changelog:
  - Rebase to 5.5.60
  - CVE's fixed: #1558256, #1558260, #1559060
    CVE-2017-3636 CVE-2017-3641 CVE-2017-3653 CVE-2017-10379
    CVE-2017-10384 CVE-2017-10378 CVE-2017-10268 CVE-2018-2562
    CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668
    CVE-2018-2755 CVE-2018-2819 CVE-2018-2817 CVE-2018-2761
    CVE-2018-2781 CVE-2018-2771 CVE-2018-2813
  - Resolves: #1535217, #1491833, #1511982, #1145455, #1461692


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.64-1
changelog:
  - Rebase to 5.5.64
  - Resolves: #1490398
  - CVE's fixed: #1610986
    CVE-2018-3058 CVE-2018-3063 CVE-2018-3066 CVE-2018-3081
  - CVE's fixed: #1664043
    CVE-2018-3282 CVE-2019-2503
  - CVE's fixed: #1701686
    CVE-2019-2529


author: Honza Horak <hhorak@redhat.com> - 1:5.5.65-1
changelog:
  - Rebase to 5.5.65
    Also fixes:
    CVE-2019-2737 CVE-2019-2739 CVE-2019-2740 CVE-2019-2805
    Resolves: #1741357
  - Revert upstream changes that make the mysql_install_db relocatable
    because it broke mysql_install_db when run without --rpm arg
    Resolves: #1731062
  - Add openssl BR that was missing for the tests


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: mariadb.ini
  -->  Config file for automated patch script
  - Added Patch: MDEV-21416.patch
  -->  Fix date test, BZ#1820269


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.68-1
changelog:
  - Rebase to 5.5.68
    This is the last upstream release. This major version reached upstream EOL
  - Related to: rhbz#1834835


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-47.1
changelog:
  - Intel CPU microcode update to 20190312.
  - Add "Provides:" tags generation.
  - Fix %postun script.
  - Resolves: #1704374.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-61.5
changelog:
  - Update Intel CPU microcode to microcode-20200602 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1827189):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.
  - Change the URL in the intel-microcode2ucode.8 to point to the GitHub
    repository since the microcode download section at Intel Download Center
    does not exist anymore.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826589):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.1
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:2.1-73.2
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893261, #1893249, #1893229):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
      0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
      to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
      to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
      to 0xde;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
      up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
      up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
      to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
      to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
      to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
      up to 0xa0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
      up to 0xe0.


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-2.2
changelog:
  - Resolves: rhbz#1697487 - mod_auth_mellon Cert files name wrong when
                             hostname contains a number


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-2.3
changelog:
  - Resolves: rhbz#1697488 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7] [rhel-7.6.z]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-2.4
changelog:
  - Actually apply the patch in the previous build
  - Resolves: rhbz#1697488 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-6
changelog:
  - Apply the patch from the previous commit
  - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect
                             in logout url when using URLs with backslashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-7
changelog:
  - Resolves: rhbz#1727789 - mod_auth_mellon fix for AJAX header name
                             X-Requested-With


author: Jakub Hrozek <jhrozek@redhat.com> - 0.14.0-8
changelog:
  - Resolves: rhbz#1731052 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via
                             the login?ReturnTo= substring which could facilitate
                             information theft [rhel-7]


author: John Dennis <jdennis@redhat.com> - 1.8.8-3
changelog:
  - fix unit test failure caused by apr_jwe_decrypt_content_aesgcm()
    failing to null terminate decrypted string
    Resolves: bug#1292561 New package: mod_auth_openidc


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-4
changelog:
  - Resolves: rhbz#1626299 - CVE-2017-6059 mod_auth_openidc: Shows
                             user-supplied content on error pages [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
changelog:
  - Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
                             OIDCAuthNHeader not skipped in an "AuthType oauth20"
                             configuration [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
changelog:
  - Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                             issue exists in URLs with slash and backslash [rhel-7]
  - Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
                             in logout url when using URLs with leading slashes
                             [rhel-7]


author: Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
changelog:
  - Fix a regression in the previous patches
  - Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
                            issue exists in URLs with slash and backslash [rhel-7]


author: Joe Orton <jorton@redhat.com> - 1.7.14-13
changelog:
  - fix mod_authz_svn regression with mod_auth_kerb (#1306431)
  - fix "svn diff" property handling (#1378178)
  - fix permissions of /run/svnserve to match tmpfiles (#1496243)


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.21-27
changelog:
  - Resolves #1388511 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1388512 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.21-29
changelog:
  - Fix IMAP header caching path traversal vulnerability
  - Resolves: #1608011
  - Resolves: CVE-2018-14355


author: Richard W.M. Jones <rjones@redhat.com> - 1.8.0-3
changelog:
  - Fix for CVE-2019-14850 denial of service due to premature opening
    of back-end connection
    resolves: rhbz#1757261


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: nbdkit.ini
  -->  Config file for automated patch script
  - Added Patch: 0001-Rebase-off-of-https-github.com-libguestfs-nbdkit.patch
  -->  Fix use of write -u


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-49
changelog:
  - add missing part of memory leak patch (#1794168)
  - fix if_inet6 messages floood (#1765449)
  - revert bz#1486733 (#1771050)
  - fix issue for process status when process name contains whitespace (#1782180)


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-7
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-2
changelog:
  - Skip sysinit gtests properly
  - Fix shell syntax error in tests/ssl/ssl.sh
  - Regenerate manual pages


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-6
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Daiki Ueno <dueno@redhat.com> - 3.53.1-3
changelog:
  - Disable dh timing test because it's unreliable on s390 (from Bob Relyea)
  - Explicitly enable upgradedb/sharedb test cycles


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-14
changelog:
  - Resolves: rhbz#1288429 - /etc/tmpfiles.d/nss-pam-ldapd.conf shipped when
                             /etc/tmpfiles.d is reserved for the local
                             administrator


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-15
changelog:
  - Resolves: rhbz#1204202 - fix doc to describe actual uri format in
                             nslcd.conf


author: Jakub Hrozek <jhrozek@redhat.com> - 0.8.13-16
changelog:
  - Resolves: rhbz#1151675 - NSLCD WRAPS LDAP USER UIDNUMBER > 2^31 SO UID
                             IS WRONG (AND A NEGATIVE NUMBER)


author: Bob Relyea <rrelyea@redhat.com> - 3.53.1-6
changelog:
  - turn of ALTIVEC instruction for powerpc because they require
    power8 and we need to support power7 on RHEL7 still.
  - Fix typo in measure.
  - Make sure only 2048 and greater primes are used in FIPS mode
    for dh.


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-26
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29.el7_8.2
changelog:
  - don't update transmission time on invalid response (CVE-2020-11868)
  - randomize transmit timestamp in client requests (CVE-?, #1813787)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-22
changelog:
  - Fix CVE-2020-12243 openldap: denial of service via nested boolean expressions in LDAP search filters (#1838405)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-1
changelog:
  - Rebase to new upstream release (#1656791)
    - Add Support for HID Crescendo 144K (#1612372)
    - Add Support for CAC Alt tokens (#1645581)
    - Fix usage detection from certificates (#1672898)
    - Fix security issues:
      - CVE-2018-16391
      - CVE-2018-16392
      - CVE-2018-16393
      - CVE-2018-16418
      - CVE-2018-16419
      - CVE-2018-16420
      - CVE-2018-16421
      - CVE-2018-16422
      - CVE-2018-16423
      - CVE-2018-16426
      - CVE-2018-16427


author: Jan Černý <jcerny@redhat.com> - 1.2.17-10
changelog:
  - Fix segfault in systemdunitdependency probe (RHBZ#1478285)
  - Build and ship HTML manual (RHBZ#1465661)
  - Fix oscap-ssh with --sudo (RHBZ#1803114)
  - Change category of verbose message (RHBZ#1640522)
  - Fix segfault in CVRF module (RHBZ#1642283)


author: Jan Černý <jcerny@redhat.com> - 1.2.17-3
changelog:
  - Fix unwanted recursion into mounted remote filesystems (#1655943)
  - Evaluate SCAP 1.3 datastreams without downloading remote data (#1709423)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1:2.0.0-8
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1781701


author: Jakub Jelen <jjelen@redhat.com> - 7.4p1-15 + 0.10.3-2
changelog:
  - Do not hang if SSH AuthorizedKeysCommand output is too large (#1496467)
  - Do not segfault pam_ssh_agent_auth if keyfile is missing (#1494268)
  - Do not segfault in audit code during cleanup (#1488083)
  - Add WinSCP 5.10+ compatibility (#1496808)
  - Clatch between ClientAlive and rekeying timeouts (#1480510)
  - Exclude dsa and ed25519 from default proposed keys in FIPS mode (#1456853)
  - Add enablement for openssl-ibmca and openssl-ibmpkcs11 (#1478035)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16.1
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 - EC signature local timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-1
changelog:
  - Resolves: rhbz#1737367 - Update to latest upstream release
  - Resolves: rhbz#1737369 - Add 7.8 to the osinfo-db which will be used on 7.8


author: Fabiano Fidêncio <fidencio@redhat.com> - 20190805-2
changelog:
  - Resolves: rhbz#1750807 - Fedora/RHEL/CentOS JeOS kickstart files for
                             unattended installation are broken


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.3
changelog:
  - Fix regression in crm_resource --refresh
  - Order resource moves after remote connection starts
  - Resolves: rhbz#1664242
  - Resolves: rhbz#1664243


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.19-8.5
changelog:
  - Improve clients' authentication of IPC servers (CVE-2018-16877)
  - Fix use-after-free with potential information disclosure (CVE-2019-3885)
  - Improve pacemakerd authentication of running subdaemons (CVE-2018-16878)
  - Resolves: rhbz#1694555
  - Resolves: rhbz#1700704
  - Resolves: rhbz#1700705


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.22-1
changelog:
  - Show correct disabled resource count in status display
  - Run-time option for Pacemaker Remote bind address
  - Avoid restart loop when migration is left dangling
  - Improve help for clean-up option
  - Do not overweight group colocation scores
  - Rebase on upstream 1.1.22+63d2d79
  - Resolves: rhbz#1458953
  - Resolves: rhbz#1743373
  - Resolves: rhbz#1757951
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1760669
  - Resolves: rhbz#1792492


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.23-1
changelog:
  - Improve help for clean-up option
  - Avoid pending DC fencing getting "stuck" in status display
  - Rebase on upstream 1.1.23-rc1
  - Resolves: rhbz#1758969
  - Resolves: rhbz#1787749
  - Resolves: rhbz#1792492


author: Than Ngo <than@redhat.com> - 2.7.1-11
changelog:
  - Fixed CVE-2016-10713 - Out-of-bounds access in pch_write_line function 
  - Fixed CVE-2018-6952 - Double free of memory
  - Resolves: #1626473, honor new file mode 100755 when applying patches
  - Resolves: #1653294, Added virtual provides for bundled gnulib library


author: Nathan Scott <nathans@redhat.com> - 4.3.2-7
changelog:
  - Fix hugepage metrics in pmdalinux (BZ 1730107)
  - Fix NUMA nodes instance domain in pmdalinux (BZ 1730492)
  - Several selinux policy fixes (BZs 1749870, 1756252, 1760750)
  - Fix pcp-atopsar sample count command line argument (BZ 1764748)
  - Fix pcp-atop sigsegv with certain process state changes (BZ 1765641)
  - Add pcp-zeroconf pmieconf rule to enable per-thread logging (BZ 1775373)


author: Nathan Scott <nathans@redhat.com> - 4.3.2-8
changelog:
  - Fix rpm %post privilege escalation CVEs (BZs 1815249, 1815528)
  - Resolve an selinux policy issue with pmlogger (BZ 1792859)


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
  - Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
  - Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
  - Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Removed Source: HAM-logo.png
  -->  Remove TUV's branding logo
  - Added Source: pcs.ini
  -->  Config file for automated patch script
  - Added Patch: 99999-Use-SL-Favicon.patch
  -->  Remove TUV's branding logo
  - Added Source: HAM-logo.png
  -->  Add SL branding


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
  - Add SSL support to Net::SMTP (bug #1557574)
  - Do not overload ".." in Math::BigInt (bug #1497734)
  - Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Remi Collet <rcollet@redhat.com> - 5.4.16-43
changelog:
  - gd: fix DoS vulnerability in gdImageCreateFromGd2Ctx() CVE-2016-10167
  - gd: Signed Integer Overflow gd_io.c CVE-2016-10168


author: Remi Collet <rcollet@redhat.com> - 5.4.16-41
changelog:
  - gd: fix integer overflow in _gd2GetHeader() resulting in
    heap overflow CVE-2016-5766
  - gd: fix integer overflow in gdImagePaletteToTrueColor()
    resulting in heap overflow CVE-2016-5767
  - mbstring: fix double free in _php_mb_regex_ereg_replace_exec
    CVE-2016-5768


author: Remi Collet <rcollet@redhat.com> - 5.4.16-47
changelog:
  - fix stack-buffer-overflow while parsing HTTP response CVE-2018-7584
  - fix out-of-bounds read in base64_decode_xmlrpc CVE-2019-9024
  - fix reflected XSS in phar 404 page CVE-2018-5712
  - fix reflected XSS in phar 403 and 404 error pages CVE-2018-10547


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-1
changelog:
  - Updated jss dependencies
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1633422 - Rebase pki-core from 10.5.1 to 10.5.16 (RHEL) 
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-2
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1491453 - Need Method to Include SKI in CA Signing
    Certificate Request [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - # Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.16-3
changelog:
  - ##########################################################################
  - # RHEL 7.7:
  - ##########################################################################
  - Bugzilla Bug #1638379 - PKI startup initialization process should not
    depend on LDAP operational attributes [ftweedal]
  - ##########################################################################
  - # RHCS 9.5:
  - ##########################################################################
  - Bugzilla Bug #1633423 - Rebase redhat-pki, redhat-pki-theme, pki-core, and
    pki-console to 10.5.16 in RHCS 9.5


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-11
changelog:
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.18-12
changelog:
  - Change variable 'TPS' to 'tps'
  - ##########################################################################
  - # RHEL 7.9:
  - ##########################################################################
  - Bugzilla Bug 1883639 - Add KRA Transport and Storage Certificates
    profiles, audit for IPA (edewata)
  - ##########################################################################
  - # Backported CVEs (ascheel):
  - ##########################################################################
  - Bugzilla Bug 1724697 - CVE-2019-10180 pki-core: unsanitized token
    parameters in TPS resulting in stored XSS [certificate_system_9-default]
    (edewata, ascheel)
  - Bugzilla Bug 1725128 - CVE-2019-10178 pki-core: stored Cross-site
    scripting (XSS) in the pki-tps web Activity tab
    [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1791100 - CVE-2020-1696 pki-core: Stored XSS in TPS profile
    creation [certificate_system_9-default] (edewata, ascheel)
  - Bugzilla Bug 1724688 - CVE-2019-10146 pki-core: Reflected Cross-Site
    Scripting in 'path length' constraint field in CA's Agent page
    [rhel-7.9.z] (dmoluguw, ascheel)
  - Bugzilla Bug 1789843 - CVE-2019-10221 pki-core: reflected cross site
    scripting in getcookies?url= endpoint in CA [rhel-7.9.z]
    (dmoluguw, ascheel)
  - Bugzilla Bug 1724713 - CVE-2019-10179 pki-core: pki-core/pki-kra:
    Reflected XSS in recoveryID search field at KRA's DRM agent page in
    authorize recovery tab [rhel-7.9.z] (ascheel)
  - Bugzilla Bug 1798011 - CVE-2020-1721 pki-core: KRA vulnerable to
    reflected XSS via the getPk12 page [rhel-7.9.z] (ascheel,jmagne)
  - ##########################################################################
  - Update to jquery v3.4.1 (ascheel)
  - Update to jquery-i18n-properties v1.2.7 (ascheel)
  - Update to backbone v1.4.0 (ascheel)
  - Upgrade to underscore v1.9.2 (ascheel)
  - Update to patternfly v3.59.3 (ascheel)
  - Update to jQuery v3.5.1 (ascheel)
  - Upgrade to bootstrap v3.4.1 (ascheel)
  - Link in new Bootstrap CSS file (ascheel)
  - ##########################################################################
  - # RHCS 9.7:
  - ##########################################################################
  - # Bugzilla Bug #1733588 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-20
changelog:
  - setfiles: Mention customizable types in restorecon man page (#1260238)
  - sepolicy: do not fail when file_contexts.local or .subs do not exist (#1512590)
  - semanage: Fix export of ibendport entries (#1471809)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-22
changelog:
  - semanage: Fix fcontext help message (#1499259)
  - semanage: Improve semanage-user.8 man page (#1079946)
  - semodule: Improve man page (#1337192)


author: Marek Kasik <mkasik@redhat.com> - 0.26.5-38
changelog:
  - Constrain number of cycles in rescale filter
  - Compute correct coverage values for box filter
  - Resolves: #1688417


author: Petr Kubat <pkubat@redhat.com> - 9.2.21-1
changelog:
  - update to 9.2.21 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-21.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-20.html
    http://www.postgresql.org/docs/9.2/static/release-9-2-19.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.22-1
changelog:
  - update to 9.2.22 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-22.html


author: Petr Kubat <pkubat@redhat.com> - 9.2.23-1
changelog:
  - update to 9.2.23 per release notes
    http://www.postgresql.org/docs/9.2/static/release-9-2-23.html


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Chris Lumens <clumens@redhat.com> - 1.99.66.18-1
changelog:
  - Add tests for the new firewall option. (clumens)
    Related: rhbz#1526486
  - Use RHEL7_Firewall instead of F28_Firewall. (clumens)
    Related: rhbz#1526486
  - Port the F20 firewall test from master. (clumens)
    Related: rhbz#1526486
  - firewall: add --use-system-defaults arg to command (dusty)
    Resolves: rhbz#1526486


author: David Cantrell <dcantrell@redhat.com> - 1.99.66.19-1
changelog:
  - Add use action to nvdimm command. (rvykydal)
    Resolves: rhbz#1590319
  - Add nvdimm command (rvykydal)
    Resolves: rhbz#1590319


author: Tomas Orsava <torsava@redhat.com> - 2.7.5-68
changelog:
  - Add Conflicts tag with old virtualenv versions due to new behaviour of
    httplib (patch 295)
  Resolves: rhbz#1483438


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-74
changelog:
  - Fix OSERROR 17 due to _multiprocessing/semaphore.c assuming
    a one-to-one Pid -> process mapping
  Resolves: rhbz#1579432


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-84
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1704362 and rhbz#1703530


author: Charalampos Stratakis <cstratak@redhat.com> - 2.7.5-90
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481


author: Mohamed El Morabity <melmorabity@fedoraproject.org> - 2.0.0-2
changelog:
  - Use python2- prefix for Fedora dependencies if possible
  - Use parallel make to build documentation


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.0.0-3
changelog:
  - Remove examples-directory from Source tarball due to possible
    licensing issues
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511222


author: David Lehman <dlehman@redhat.com> - 0.61.15.70-1
changelog:
  - Deactivate incomplete VGs along with everything else. (dlehman)
    Resolves: rhbz#1554224
  - Work around udev timing issues. (dlehman)
    Resolves: rhbz#1592253
    Resolves: rhbz#1592191
  - nvdimm: don't crash on non-block devices (rvykydal)
    Related: rhbz#1280500
  - Add NVDIMM detection to "addUdevDiskDevice" (vtrefny)
    Related: rhbz#1558942
  - Add 'NVDIMMNamespaceDevice' device representing NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a function for identifying NVDIMM namespaces (vtrefny)
    Related: rhbz#1558942
  - Add a singleton for NVDIMM namespaces management (vtrefny)
    Resolves: rhbz#1558942
  - Backport DependencyGuard from master (vtrefny)
    Related: rhbz#1558942
  - Ignore nvdimm devices unless configured in kickstart (rvykydal)
    Related: rhbz#1280500
  - Do not ignore nvdimm (pmemX) devices (rvykydal)
    Related: rhbz#1280500


author: David Lehman <dlehman@redhat.com> - 0.61.15.71-1
changelog:
  - Remove dependency on libblockdev-nvdimm (vtrefny)
    Resolves: rhbz#1601557
  - Do not try to load NVDIMM plugin on non-x86_64 architectures (vtrefny)
    Related: rhbz#1601557
  - Add version to the LUKS format (vtrefny)
    Resolves: rhbz#1607830


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.72-1
changelog:
  - Install ndctl when NVDIMMs are used. (dlehman)
    Related: rhbz#1600496
  - Escape dots in lvm filter devices (vtrefny)
    Resolves: rhbz#1614039


author: David Lehman <dlehman@redhat.com> - 0.61.15.74-1
changelog:
  - Handle exceptions raised from parted.Disk ctor. (dlehman)
    Related: rhbz#1677383
  - Recommend DASD disk label for disks with an existing DASD label (vtrefny)
    Resolves: rhbz#1677383


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.75-1
changelog:
  - Always set default key size to 512 bits for ciphers with XTS mode (vtrefny)
    Resolves: rhbz#1716674


author: Vojtech Trefny <vtrefny@redhat.com> - 0.61.15.76-1
changelog:
  - edd: Fix UnboundLocalError when trying to close fd in collect_mbrs (vtrefny)
    Related: rhbz#1879920
  - Close fd if it fails to read the device (nashok)
    Resolves: rhbz#1879920


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.4.6-4
changelog:
  - Append python-botocore and python-jmespath bundled directories to
    search path where needed

    Resolves: rhbz#1509439


author: Bohuslav Kabrda <bkabrda@redhat.com> - 2.7.2-1
changelog:
  - Reverted flawed patch for #1051427 (this reintroduces #1052102).
  - Spec cleanup (removed rhel < 7 specific stuff).
  - Update to 2.7.2.
  Resolves: rhbz#1052777


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.4.16-3
changelog:
  - Bundle python-keyring
  - Append python-keyring bundled directory to search path where needed

    Resolves: rhbz#1511228


author: Pavel Vomacka <pvomacka@redhat.com> - 0.7.5-8
changelog:
  - Resolves: #1438668 DNS forwarder address added during IPA installation
    shouldn't add IP-Address '0.0.0.0'


author: Pavel Cahyna <pcahyna@redhat.com> - 2.1.1-4
changelog:
  - Add a dependency on python2-pyasn1. It used to be a dependency
    of python2-cryptography, but it is not the case with newer versions.
    (RHBZ #1559133)


author: Jake Hunsaker <jhunsake@redhat.com> - 2.1.1-9
changelog:
  - Fix a security flaw (CVE-2018-1000805) in Paramiko's server
    mode (does not effect client mode).
    Backported from 2.1.6
    Resolves rhbz#1637366


author: Lumír Balhar <lbalhar@redhat.com> - 3-31
changelog:
  - Converting specfile from F28 to RHEL7
  - Move the macros to the standard RHEL7 macro location at /etc/rpm/,
    instead of Fedora's location at /usr/lib/rpm/macros.d/
  - Import the macros.python{,2} files from the python-devel package where they
    resided until now, and Conflict with that old version of python-devel
  - Import the macros.pybytecompile from Fedora rawhide / RHEL8
  Resolves: rhbz#1660579


author: Miro Hrončok <mhroncok@redhat.com> - 3-32
changelog:
  - %python_provide: Obsolete and provide python36- from python3-
  - %python_provide: Provide python3- from python36-
  Resolves: rhbz#1702719


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 0.1.13-1
changelog:
  - Fix "python2-s3transfer" from EPEL issue by adding it to Obsoletes
  - Rebase to v0.1.13 to fix missing "max_bandwidth" issue

    Resolves: rhbz#1576985
    Resolves: rhbz#1578083


author: Lumír Balhar <lbalhar@redhat.com> - 12.1.0-7
changelog:
  - Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
  Resolves: rhbz#1813439 rhbz#1813447
  - Remove useless macros definitions


author: Charalampos Stratakis <cstratak@redhat.com> - 15.1.0-1
changelog:
  - Rebase to version 15.1.0
  - Disable automatic downloads from pypi on new venv creation
  Resolves: rhbz#1461154


author: Lumír Balhar <lbalhar@redhat.com> - 15.1.0-3
changelog:
  - Add three new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1643829


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.2.6-10
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
  - Disallow control chars in http URLs
  - Fixes CVE-2019-9740 and CVE-2019-9947
  Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-3
changelog:
  - Converting pip specfile from F28 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled building of docs, because we don't ship its build dependencies in
    RHEL7
  - Updated to a newer version of tests to match the package version
  - Backported Patch3 and Patch4 from Fedora
  Resolves: rhbz#1660573


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 6-2
changelog:
  - Modifying python-rpm-generators from F29 to be used in RHEL7
  - The regex in pythondist.attr has been modified to only match Python 3
    modules, so that we do not affect the building of python2 files in RHEL7 at
    this late stage
  - Removed python.attr and pythondeps.sh files, because they are contained in
    rpm-build in RHEL7 and we do not want to modify them
  - the pythondist.attr and pythondistdeps.py are completely new, therefore we
    don't need to conflict with anything in RHEL7
  Resolves: rhbz#1660578


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
  - SRPM renamed from python-setuptools to python3-setuptools
  - Package prepared to contain only Python 3 version
  Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 0.31.1-4
changelog:
  - Converting specfile from F29 to RHEL7
  - Disabled building of the Python 2 subpackage
  - Disabled tests (by setting the bootstrap on - see note)
  - Removed python-wheel-wheel package with the wheel of wheel
  Resolves: rhbz#1660574


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-140.el7
changelog:
  - kvm-spice-fix-spice_chr_add_watch-pre-condition.patch [bz#1456983]
  - Resolves: bz#1456983
    (Character device regression due to missing patch)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7
changelog:
  - kvm-Fix-memory-slot-page-alignment-logic-bug-1455745.patch [bz#1455745]
  - kvm-Do-not-hang-on-full-PTY.patch [bz#1452067]
  - kvm-serial-fixing-vmstate-for-save-restore.patch [bz#1452067]
  - kvm-serial-reinstate-watch-after-migration.patch [bz#1452067]
  - kvm-nbd-Fully-initialize-client-in-case-of-failed-negoti.patch [bz#1451614]
  - kvm-nbd-Fix-regression-on-resiliency-to-port-scan.patch [bz#1451614]
  - Resolves: bz#1451614
    (CVE-2017-9524 qemu-kvm: segment fault when private user nmap qemu-nbd server [rhel-7.4])
  - Resolves: bz#1452067
    (migration can confuse serial port user)
  - Resolves: bz#1455745
    (Backport fix for broken logic that's supposed to ensure memory slots are page aligned)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.1
changelog:
  - kvm-qemu-nbd-Ignore-SIGPIPE.patch [bz#1468107]
  - Resolves: bz#1468107
    (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.2
changelog:
  - kvm-virtio-net-dynamic-network-offloads-configuration.patch [bz#1482468]
  - kvm-Workaround-rhel6-ctrl_guest_offloads-machine-type-mi.patch [bz#1482468]
  - Resolves: bz#1482468
    (KVM: windows guest migration from EL6 to EL7 fails. [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.3
changelog:
  - kvm-bswap.h-Remove-cpu_to_32wu.patch [bz#1501294]
  - kvm-hw-use-ld_p-st_p-instead-of-ld_raw-st_raw.patch [bz#1501294]
  - kvm-vga-Start-cutting-out-non-32bpp-conversion-support.patch [bz#1501294]
  - kvm-vga-Remove-remainder-of-old-conversion-cruft.patch [bz#1501294]
  - kvm-vga-Separate-LE-and-BE-conversion-functions.patch [bz#1501294]
  - kvm-vga-Rename-vga_template.h-to-vga-helpers.h.patch [bz#1501294]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1501294]
  - kvm-vga-drop-line_offset-variable.patch [bz#1501294]
  - kvm-vga-Add-mechanism-to-force-the-use-of-a-shadow-surfa.patch [bz#1501294]
  - kvm-vga-handle-cirrus-vbe-mode-wraparounds.patch [bz#1501294]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501294]
  - Resolves: bz#1501294
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.4
changelog:
  - kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501120]
  - Resolves: bz#1501120
    (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-141.el7_4.5
changelog:
  - kvm-vfio-pci-Only-mmap-TARGET_PAGE_SIZE-regions.patch [bz#1515110]
  - Resolves: bz#1515110
    (Regression in QEMU handling for sub-page MMIO BARs for vfio-pci devices [rhel-7.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-154.el7
changelog:
  - kvm-virtio-net-validate-backend-queue-numbers-against-bu.patch [bz#1460872]
  - kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1411490]
  - kvm-qxl-add-migration-blocker-to-avoid-pre-save-assert.patch [bz#1536883]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
  - Resolves: bz#1460872
    (Aborted(core dumped) when booting guest with "-netdev tap....vhost=on,queues=32")
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-155.el7
changelog:
  - kvm-qdev-Fix-assert-in-PCI-address-property-when-used-by.patch [bz#1538866]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534691]
  - kvm-savevm-Improve-error-message-for-blocked-migration.patch [bz#1536883]
  - kvm-savevm-fail-if-migration-blockers-are-present.patch [bz#1536883]
  - Resolves: bz#1534691
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)
  - Resolves: bz#1538866
    (qemu will coredump after executing info qtree)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7
changelog:
  - kvm-vnc-Fix-qemu-crashed-when-vnc-client-disconnect-sudd.patch [bz#1527405]
  - kvm-fix-full-frame-updates-for-VNC-clients.patch [bz#1527405]
  - kvm-vnc-update-fix.patch [bz#1527405]
  - kvm-vnc-return-directly-if-no-vnc-client-connected.patch [bz#1527405]
  - kvm-buffer-add-buffer_move_empty.patch [bz#1527405]
  - kvm-buffer-add-buffer_move.patch [bz#1527405]
  - kvm-vnc-kill-jobs-queue-buffer.patch [bz#1527405]
  - kvm-vnc-jobs-move-buffer-reset-use-new-buffer-move.patch [bz#1527405]
  - kvm-vnc-zap-dead-code.patch [bz#1527405]
  - kvm-vnc-add-vnc_width-vnc_height-helpers.patch [bz#1527405]
  - kvm-vnc-factor-out-vnc_update_server_surface.patch [bz#1527405]
  - kvm-vnc-use-vnc_-width-height-in-vnc_set_area_dirty.patch [bz#1527405]
  - kvm-vnc-only-alloc-server-surface-with-clients-connected.patch [bz#1527405]
  - kvm-ui-fix-refresh-of-VNC-server-surface.patch [bz#1527405]
  - kvm-ui-move-disconnecting-check-to-start-of-vnc_update_c.patch [bz#1527405]
  - kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527405]
  - kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527405]
  - kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527405]
  - kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527405]
  - kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527405]
  - kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527405]
  - kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527405]
  - kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527405]
  - kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527405]
  - kvm-io-skip-updates-to-client-if-websocket-output-buffer.patch [bz#1518711]
  - Resolves: bz#1518711
    (CVE-2017-15268 qemu-kvm: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
  - Resolves: bz#1527405
    (CVE-2017-15124 qemu-kvm: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.1
changelog:
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1567913]
  - kvm-vga-fix-region-calculation.patch [bz#1567913]
  - Resolves: bz#1567913
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.2
changelog:
  - kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574075]
  - Resolves: bz#1574075
    (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.3
changelog:
  - kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1584363]
  - kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1584363]
  - Resolves: bz#1584363
    (CVE-2018-3639 qemu-kvm: hw: cpu: AMD: speculative store bypass [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.4
changelog:
  - kvm-target-i386-introduce-kvm_put_one_msr.patch [bz#1596302]
  - kvm-apic-fix-2.2-2.1-migration.patch [bz#1596302]
  - kvm-x86-lapic-Load-LAPIC-state-at-post_load.patch [bz#1596302]
  - kvm-apic-drop-debugging.patch [bz#1596302]
  - kvm-apic-set-APIC-base-as-part-of-kvm_apic_put.patch [bz#1596302]
  - Resolves: bz#1596302
    (Windows 2012 Guest hangs after live migration with RTC clock stopped. [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.5
changelog:
  - kvm-multiboot-bss_end_addr-can-be-zero.patch [bz#1549824]
  - kvm-multiboot-Remove-unused-variables-from-multiboot.c.patch [bz#1549824]
  - kvm-multiboot-Use-header-names-when-displaying-fields.patch [bz#1549824]
  - kvm-multiboot-fprintf-stderr.-error_report.patch [bz#1549824]
  - kvm-multiboot-Reject-kernels-exceeding-the-address-space.patch [bz#1549824]
  - kvm-multiboot-Check-validity-of-mh_header_addr.patch [bz#1549824]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586248]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586248]
  - Resolves: bz#1549824
    (CVE-2018-7550 qemu-kvm: Qemu: i386:  multiboot OOB access while loading kernel image [rhel-7.5.z])
  - Resolves: bz#1586248
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7
changelog:
  - kvm-scsi-disk-support-reporting-of-rotation-rate.patch [bz#1583807]
  - kvm-ide-support-reporting-of-rotation-rate.patch [bz#1583807]
  - kvm-ide-avoid-referencing-NULL-dev-in-rotational-rate-se.patch [bz#1583807]
  - kvm-slirp-Correct-size-check-in-m_inc.patch [bz#1586253]
  - Resolves: bz#1583807
    ([DELL EMC 7.6 FEAT] option to mark virtual block device as rotational/non-rotational)
  - Resolves: bz#1586253
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-7.6])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7_6.1
changelog:
  - kvm-i386-Deprecate-arch-facilities-and-make-it-block-liv.patch [bz#1664792]
  - Resolves: bz#1664792
    (mode="host-model" VMs include broken "arch-facilities" flag name [qemu-kvm] [rhel-7.6.z])


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 1.5.3-160.el7_6.2
changelog:
  - kvm-target-i386-define-md-clear-bit-rhel.patch
  - Resolves: bz#1693216
    (qemu-kvm: hardware: Microarchitectural Store Buffer Data Sampling)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-160.el7_6.3
changelog:
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1669067]
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669067]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669067]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669067]
  - Resolves: bz#1669067
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-7.6.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-165.el7
changelog:
  - kvm-Fix-eax-for-cpuid-leaf-0x40000000.patch [bz#1709495]
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669068]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669068]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669068]
  - Resolves: bz#1669068
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-7.7])
  - Resolves: bz#1709495
    (Change CPUID[0x40000000].EAX from 0 to KVM_CPUID_FE...ATURES (0x40000001))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-166.el7
changelog:
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7
changelog:
  - Reverting kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.1
changelog:
  - kvm-qxl-check-release-info-object.patch [bz#1732337]
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734748]
  - Resolves: bz#1732337
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-7] [rhel-7.7.z])
  - Resolves: bz#1734748
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.2
changelog:
  - kvm-target-i386-Merge-feature-filtering-checking-functio.patch [bz#1730606]
  - kvm-target-i386-Isolate-KVM-specific-code-on-CPU-feature.patch [bz#1730606]
  - kvm-i386-Add-new-MSR-indices-for-IA32_PRED_CMD-and-IA32_.patch [bz#1730606]
  - kvm-i386-Add-CPUID-bit-and-feature-words-for-IA32_ARCH_C.patch [bz#1730606]
  - kvm-Add-support-to-KVM_GET_MSR_FEATURE_INDEX_LIST-an.patch [bz#1730606]
  - kvm-x86-Data-structure-changes-to-support-MSR-based-feat.patch [bz#1730606]
  - kvm-x86-define-a-new-MSR-based-feature-word-FEATURE_WORD.patch [bz#1730606]
  - kvm-Use-KVM_GET_MSR_INDEX_LIST-for-MSR_IA32_ARCH_CAP.patch [bz#1730606]
  - kvm-i386-kvm-Disable-arch_capabilities-if-MSR-can-t-be-s.patch [bz#1730606]
  - kvm-Remove-arch-capabilities-deprecation.patch [bz#1730606]
  - Resolves: bz#1730606
    ([Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.3
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771960]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771960]
  - Resolves: bz#1771960
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-167.el7_7.4
changelog:
  - kvm-target-i386-add-MDS-NO-feature.patch [bz#1755333]
  - Resolves: bz#1755333
    ([Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm [rhel-7.7.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-171.el7
changelog:
  - kvm-i386-Add-new-model-of-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-Disable-OSPKE-on-Cascadelake-Server.patch [bz#1638471]
  - kvm-i386-remove-the-INTEL_PT-CPUID-bit-from-Cascadelake-.patch [bz#1638471]
  - kvm-Add-missing-brackets-to-CPUID-0x80000008-code.patch [bz#1760607]
  - Resolves: bz#1638471
    ([Intel 7.8 Feat] qemu-kvm Introduce Cascade Lake (CLX) cpu model)
  - Resolves: bz#1760607
    (Corrupted EAX values due to missing brackets at CPUID[0x800000008] code)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-172.el7
changelog:
  - kvm-target-i386-Export-TAA_NO-bit-to-guests.patch [bz#1771961]
  - kvm-target-i386-add-support-for-MSR_IA32_TSX_CTRL.patch [bz#1771961]
  - Resolves: bz#1771961
    (CVE-2019-11135 qemu-kvm: hw: TSX Transaction Asynchronous Abort (TAA) [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7
changelog:
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791560]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791560]
  - Resolves: bz#1791560
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-7.8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-173.el7_8.1
changelog:
  - kvm-util-add-slirp_fmt-helpers.patch [bz#1798970]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798970]
  - Resolves: bz#1798970
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.8.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-174.el7
changelog:
  - kvm-util-add-slirp_fmt-helpers2.patch [bz#1800515]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages2.patch [bz#1800515]
  - kvm-slirp-disable-tcp_emu.patch [bz#1791679]
  - kvm-gluster-Handle-changed-glfs_ftruncate-signature.patch [bz#1802215]
  - kvm-gluster-the-glfs_io_cbk-callback-function-pointer-ad.patch [bz#1802215]
  - kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch [bz#1618503]
  - Resolves: bz#1618503
    (qemu-kvm: Qemu: seccomp: blacklist is not applied to all threads [rhel-7])
  - Resolves: bz#1791679
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-7])
  - Resolves: bz#1800515
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-7.9])
  - Resolves: bz#1802215
    (Add support for newer glusterfs)


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-vnc-fix-memory-leak-when-vnc-disconnect.patch [bz#1810408]
  - Resolves: bz#1810408
    (CVE-2019-20382 qemu-kvm: QEMU: vnc: memory leakage upon disconnect [rhel-7])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7
changelog:
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1837565]
  - kvm-usb-check-RNDIS-message-length.patch [bz#1869693]
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869693]
  - Resolves: bz#1837565
    (CVE-2020-1983 qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-7])
  - Resolves: bz#1869693
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.2
changelog:
  - kvm-hw-net-vmxnet_tx_pkt-fix-assertion-failure-in-vmxnet.patch [bz#1860960]
  - kvm-hw-core-loader-Fix-possible-crash-in-rom_copy.patch [bz#1842923]
  - Resolves: bz#1842923
    (CVE-2020-13765 qemu-kvm: QEMU: loader: OOB access while loading registered ROM may lead to code execution [rhel-7.9.z])
  - Resolves: bz#1860960
    (CVE-2020-16092 qemu-kvm: QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c [rhel-7.9.z])


author: Jon Maloy <jmaloy@redhat.com> - 1.5.3-175.el7_9.3
changelog:
  - kvm-Suppress-prototype-warning-for-nss-headers.patch [bz#1884997]
  - Resolves: bz#1884997
    (qemu-kvm FTBFS on rhel7.9)


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-14
changelog:
  * Mon May 02 2016 Jan Grulich <jgrulich@redhat.com> - 1:4.8.5-13
  - Prefer adwaita-qt theme over gtk
    Resolves: bz#1332094


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-1
changelog:
  - Update to 4.8.7 (+ sync with Fedora)
    Resolves: bz#1484361

  - Don't close Qt apps in Gnome on shutdown dialog
    Resolves: bz#1378865


author: Jan Grulich <jgrulich@redhat.com> - 1:4.8.7-8
changelog:
  - Fix QImage allocation failure in qgifhandler
    Resolves: bz#1667863

  - Fix QTgaFile CPU exhaustion
    Resolves: bz#1667879

  - Fix QBmpHandler segmentation fault on malformed BMP file
    Resolves: bz#1667862


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-3
changelog:
  - Fix multilib issue with qtcore-config.h header file
    Resolves: bz#1534528

  - Move libQt5EglFSDeviceIntegration lib into correct subpackage
    Resolves: bz#1792680


author: Jan Grulich <jgrulich@redhat.com> - 5.9.7-4
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814740
    Resolves: bz#1814685


author: Michal Sekletar <msekleta@redhat.com> - 0.99.22.4-4
changelog:
  - fix link to upstream tarball (#1059219)
  - reference pidfiles of quagga daemons in service files (#842309)


author: Ondřej Lysoněk <olysonek@redhat.com> - 0.99.22.4-5
changelog:
  - Fixed CVE-2018-5379 - Double free vulnerability in bgpd when processing
    certain forms of UPDATE message allowing to crash or potentially execute
    arbitrary code
  - Resolves: rhbz#1546015


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: redhat-rpm-config.ini
  -->  Config file for automated patch script
  - Added Patch: redhat-rpm-config-recognize-scientific-linux.patch
  -->  Scientific Linux is an Enterprise Linux, modify the script to know this


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-61.1
changelog:
  - gcp-vpc-move-vip: add support for multiple alias IPs
  - sybaseASE: run verify action during start action only
  - azure-events: handle exceptions in urlopen

    Resolves: rhbz#1846732
    Resolves: rhbz#1848673
    Resolves: rhbz#1862121


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.3-31
changelog:
  - Backport missing infra for --noconfig option (#1406611)
  - As a side-effect, this also makes --noghost work as intended


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-36
changelog:
  RHEL 7.7 ERRATUM
  - added patch fixing mmkubernetes halt after pod deletition
    resolves: rhbz#1622767


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-37
changelog:
  RHEL 7.7 ERRATUM
  - edited patch fixing mmkubernetes halt after pod deletition
    (covscan found an issue in previous version)
    resolves: rhbz#1622767
  - added patch stopping flooding logs with journald errors
    resolves: rhbz#1632211
  - added patch stopping flooding logs with symlink false-positives
    resolves: rhbz#1685901
  - added patch stopping memory leak when processing internal msgs
    resolves: rhbz#1666365
  - added documentation patch with info about CRI-O to mmkubernetes
    resolves: rhbz#1625935


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-38
changelog:
  RHEL 7.7 ERRATUM
  - added patch increasing max path size preventing buffer overflow
    with too long paths
    resolves: rhbz#1656860


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-48
changelog:
  RHEL 7.8 ERRATUM
  - added patch resolving crash on wrong MsgProperty
    resolves: rhbz#1549706
  - added patch resolving CVE in pmaixforward module
    resolves: rhbz#1768320
  - added patch resolving CVE in pmcisconames module
    resolves: rhbz#1768323
  - added patch implementing file ID for imfile
    resolves: rhbz#1763746
  - added patch fixing omelasticsearch with ES 6.X
    resolves: rhbz#1600171


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-49
changelog:
  RHEL 7.8 ERRATUM
  - fixed fsync patch to actually revognize the new option
    resolves: rhbz#1696686 (failedQA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-52
changelog:
  RHEL 7.8 ERRATUM
  - edited patch file ID for imfile to not log useless errors
    also improved file-id behavior to adress newly found problems
    resolves: rhbz#1763746


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-31
changelog:
  - Fix unsafe object deserialization in RubyGems (CVE-2017-0903).
    * ruby-2.4.3-CVE-2017-0903-Fix-unsafe-object-deserialization
        -vulnerability.patch
    Resolves: CVE-2017-0903
  - Fix an ANSI escape sequence vulnerability (CVE-2017-0899).
    Resolves: CVE-2017-0899
  - Fix a DOS vulernerability in the query command (CVE-2017-0900).
    Resolves: CVE-2017-0900
  - Fix a vulnerability in the gem installer that allowed a malicious gem
      to overwrite arbitrary files (CVE-2017-0901).
    Resolves: CVE-2017-0901
  - Fix a DNS request hijacking vulnerability (CVE-2017-0902).
    * ruby-2.2.8-lib-rubygems-fix-several-vulnerabilities-in-RubyGems.patch
    Resolves: CVE-2017-0902
  - Fix buffer underrun vulnerability in Kernel.sprintf (CVE-2017-0898).
    * ruby-2.2.8-Buffer-underrun-vulnerability-in-Kernel.sprintf.patch
    Resolves: CVE-2017-0898
  - Escape sequence injection vulnerability in the Basic
      authentication of WEBrick (CVE-2017-10784).
    * ruby-2.2.8-sanitize-any-type-of-logs.patch
    Resolves: CVE-2017-10784
  - Arbitrary heap exposure during a JSON.generate call (CVE-2017-14064).
    * ruby-2.2.8-Fix-arbitrary-heap-exposure-during-a-JSON.generate-call.patch
    Resolves: CVE-2017-14064
  - Command injection vulnerability in Net::FTP (CVE-2017-17405).
    * ruby-2.2.9-Fix-a-command-injection-vulnerability-in-Net-FTP.patch
    Resolves: CVE-2017-17405
  - Buffer underrun in OpenSSL ASN1 decode (CVE-2017-14033).
    * ruby-2.2.8-asn1-fix-out-of-bounds-read-in-decoding-constructed-objects.patch
    Resolves: CVE-2017-14033
  - Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code
      execution(CVE-2017-17790).
    * ruby-2.5.0-Fixed-command-Injection.patch
    Resolves: CVE-2017-17790


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
  - Add Psych.safe_load
    * ruby-2.1.0-there-should-be-only-one-exception.patch
    * ruby-2.1.0-Adding-Psych.safe_load.patch
    Related: CVE-2017-0903
  - Disable Tokyo TZ tests broken by recen tzdata update.
    * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
    Related: CVE-2017-0903


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-35
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
  - Fix escape sequence injection vulnerability in API response handling.
  - Prohibit arbitrary code execution when installing a malicious gem.
  - Fix escape sequence injection vulnerability in errors.
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch
    Resolves: rhbz#1699283


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
  - Kill bundled certificates.
  - Add macros to edit files lists in .gemspec
  - Fix buffer under-read in String#unpack
    Resolves: CVE-2018-8778
  - Fix HTTP response splitting in WEBrick
    Resolves: CVE-2017-17742
  - Fix DoS by large request in WEBrick
    Resolves: CVE-2018-8777
  - Fix directory traversal by poisoned NULL byte in Dir.
    Resolves: CVE-2018-8780
  - Fix file and directory creation with directory traversal.
    Resolves: CVE-2018-6914
  - Fix socket creation by poisoned NULL byte.
    Resolves: CVE-2018-8779
  - Fix: return default path with nonexistent home dir
  - Fix flags not propagated in Array#pack and String#unpack.
    Resolves: CVE-2018-16396
  - Fix strictly interpret octal fields in tar headers.
    Resolves: CVE-2018-1000075
  - Fix a security error for duplicate files in a package.
    Resolves: CVE-2018-1000076
  - Enforce URL validation on spec homepage attribute.
    Resolves: CVE-2018-1000077
  - Mitigate XSS vulnerability in homepage attribute.
    Resolves: CVE-2018-1000078
  - Prevent Path Traversal issue during gem installation.
    Resolves: CVE-2018-1000079
  - Fix unsafe Object Deserialization Vulnerability in gem owner.
    Resolves: CVE-2018-1000074
  - Refresh expired certificates.
  - Fix path traversal when writing to a symlinked basedir outside of the root
    Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
  - Introduce `Gem::UserInteraction#verbose` method as precondition to fix
    CVE-2019-8321.
    * rubygems-2.3.0-refactor-checking-really_verbose.patch
  - Fix escape sequence injection vulnerability in verbose.
  - Fix escape sequence injection vulnerability in gem owner.
    Resolves: CVE-2019-8322
  - Fix escape sequence injection vulnerability in API response handling.
    Resolves: CVE-2019-8323
  - Prohibit arbitrary code execution when installing a malicious gem.
    Resolves: CVE-2019-8324
  - Fix escape sequence injection vulnerability in errors.
    Resolves: CVE-2019-8325
    * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Jan Černý <jcerny@redhat.com> - 0.1.43-12
changelog:
  - Make aide and smart card rules not applicable to containers (RHBZ#1711893)
  - Added rule dconf_db_up_to_date to ensure dconf databases are up-to-date (RHBZ#1631378)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: scap-security-guide_spec-add-all-el-stigs.patch
  -->  Package all EL scap guidelines, not just TUV
  - Added Source: scap-security-guide.ini
  -->  Config file for automated patch script
  - Added Patch: 0004-revert-drop-rebuilds.patch
  -->  Upstream droped rebuilds, put them back in


author: Watson Sato <wsato@redhat.com> - 0.1.49-12
changelog:
  - CIS Profile (RHBZ#1821633)
    - Make sure boot target is multi-user.target when xorg package is removed
    - Add CIS Profile content attribution to Center for Internet Security


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: scap-security-guide_spec-add-all-el-stigs.patch
  -->  Package all EL scap guidelines, not just TUV
  - Added Source: scap-security-guide.ini
  -->  Config file for automated patch script
  - Added Patch: 0005-rename-in-new-location.patch
  -->  Make sure the branding is right


author: Gabriel Becker <ggasparb@redhat.com> - 0.1.52-1
changelog:
  - Update to the latest upstream release (RHBZ#1665233)
  - Update RHEL7 DISA STIG to V2R8 (RHBZ#1665233)


author: Rui Matos <rmatos@redhat.com> - 3.8.0-5
changelog:
  - Fix for "seahorse-nautilus broken by glib2 regression related to
    SIGCHLD warnings"
  - Resolves: #1093123


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.6
changelog:
  - Allow tomcat domain to connect to mssql port
  Resolves: rhbz#1500697
  - Add keepalived domain setpgid capability
  Resolves: rhbz#1500813


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-166.7
changelog:
  - Allow cluster_t domain creating bundles directory with label var_log_t instead of cluster_var_log_t
  Resolves: rhbz:#1513075


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-227
changelog:
  - Add interface apache_read_tmp_dirs()
  - Allow dirsrvadmin_script_t domain to list httpd_tmp_t dirs
  Resolves: rhbz#1622602


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-228
changelog:
  - Allow tomcat_domain to read /dev/random
  Resolves: rhbz#1631666
  - Allow neutron_t domain to use pam
  Resolves: rhbz#1630318


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.3
changelog:
  - Run ganesha as ganesha_t domain again, revert changes where ganesha is running as nfsd_t
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.4
changelog:
  - Allow staff_t userdomain and confined_admindomain attribute to allow use generic ptys because of new sudo feature 'io logging'
  Resolves: rhbz#1638427


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.5
changelog:
  - Remove disabling ganesha module in pre install phase of installation new selinux-policy package where ganesha is again standalone module
  Resolves: rhbz#1638257


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-229.6
changelog:
  - Allow nova_t domain to use pam
  Resolves: rhbz:#1645270
  - sysstat: grant sysstat_t the search_dir_perms set
  Resolves: rhbz#1645271


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-252.4
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command.
  Resolves: rhbz#1766095


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-267
changelog:
  - Allow chronyd_t domain to exec shell
  Resolves: rhbz#1775573
  - Allow pmie daemon to send signal pcmd daemon
  Resolves: rhbz#1770123
  - Allow auditd poweroff or switch to single mode
  Resolves: rhbz#1780332


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268
changelog:
  - Allow rhsmd read process state of all domains and kernel threads
  Resolves: rhbz#1837461
  - Allow ipa-adtrust-install restart sssd and dirsrv services
  Resolves: rhbz#1820298
  - Allow nagios_plugin_domain execute programs in bin directories
  Resolves: rhbz#1824625
  - selinux policy: add the right context for org.freeipa.server.trust-enable-agent
  Related: rhbz#1820298


author: Zdenek Pytela <zpytela@redhat.com> - 3.13.1-268.2
changelog:
  - Allow certmonger add new entries in a generic certificates directory
  Resolves: rhbz#1879496
  - Allow slapd add new entries in ldap certificates directory
  Resolves: rhbz#1879496
  - Add miscfiles_add_entry_generic_cert_dirs() interface
  Resolves: rhbz#1879496


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-8
changelog:
  - fix group id for tape in /etc/group (should be 33) (#1433020)
  - provide a way how to override set envvars through sh.local file(#1344007)
  - provide a way how to override set ennvars through csh.local file


author: Ondrej Vasik <ovasik@redhat.com> - 2.8.71-10
changelog:
  - fix crudp name in /etc/protocols (#1566469)
  - do not list /sbin/nologin and /usr/sbin/nologin in /etc/shells
    (#1571104)


author: Bastien Nocera <bnocera@redhat.com> - 1.8-3
changelog:
  + shared-mime-info-1.8-3
  - Remove triggers, they're not supported in RHEL 7.4's RPM
  Resolves: #1433916


author: Bastien Nocera <bnocera@redhat.com> - 1.8-4
changelog:
  + shared-mime-info-1.8-4
  - Fix CSV files being associated with LibreOffice Math instead
    of LibreOffice Calc
  - Resolves: #1438589


author: Peter Jones <pjones@redhat.com> - 15-6
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: shim-spec_efidir.patch
  -->  hardcode efidir for compat with 7.0-7.5
  - Replaced Source: securebootca.cer
  -->  Use the FNAL SL signing certificate
  - Added Source: shim.ini
  -->  Config file for automated patch script


author: Peter Jones <pjones@redhat.com> - 15-8.el7
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1862045
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Jake Hunsaker <jhunsake@redhat.com> - 1.5-3
changelog:
  - Resolve race condition in cluster profile loading
  - Quote all options globally
  - RHBZ#1633515
  - RHBZ#1647955


author: Jiri Kucera <jkucera@redhat.com> - 14.4.1-7
changelog:
  - Fix CVE-2017-18189
    Upstream patch: https://sourceforge.net/p/sox/code/ci/09d7388c8ad5701ed9c59d1d600ff6154b066397/
    Resolves: #1553590


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-3
changelog:
  - Fix CVE-2018-11781 - Local user code injection in the meta rule syntax
  - Fix CVE-2017-15705 - Certain unclosed tags in crafted emails allow for
  - scan timeouts and resulting denial of service
  - Resolves: rhbz#1632998


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632998


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-4
changelog:
  - Add missing Requires for perl(XSLoader) and perl(ExtUtils::MakeMaker),
  - which are no longer auto-generated due to a (expected) change in rpm-build
  - Related: rhbz#1632999


author: Victor Toso <victortoso@redhat.com> - 0.35-5
changelog:
  - Keepalive fix
    Resolves: rhbz#1719736
  - Fix hang on migration after password expired
    Resolves: rhbz#1761776


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-2.3
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1572489


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-5
changelog:
  - Don't mute Record channel on client reconnection
    Resolves: rhbz#1549132
  - Allow to configure TLS protocol versions and ciphers which SPICE will use for
    TLS communications
    Resolves: rhbz#1562213
  - Enable ECDH ciphers with OpenSSL 1.0
    Resolves: rhbz#1566597


author: Victor Toso <victortoso@redhat.com> - 0.14.0-17
changelog:
  - Fix 'Dependency failed for Activation socket' message
    Resolves: rhbz#1545212
  - Fix socket leak
    Resolves: rhbz#1650596


author: Victor Toso <victortoso@redhat.com> - 0.14.0-18
changelog:
  - Fix clipboard logs on requests for targets on grab from client
    Resolves: rhbz#1594876
  - Make some clipboard logs debug instead of error
    Resolves: rhbz#1686008


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15
changelog:
  - Resolves: #1690551 - Squid cache_peer DNS lookup failed when not all lower
    case
  - Resolves: #1680022 - squid can't display download/upload packet size for HTTPS
    sites
  - Resolves: #1717430 - Excessive memory usage when running out of descriptors
  - Resolves: #1676420 - Cache siblings return wrongly cached gateway timeouts
  - Resolves: #1729435 - CVE-2019-13345 squid: XSS via user_name or auth parameter
    in cachemgr.cgi
  - Resolves: #1582301 - CVE-2018-1000024 CVE-2018-1000027 squid: various flaws


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-15.1
changelog:
  - Resolves: #1828359 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828360 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow
  - Resolves: #1829772 - CVE-2019-12525 squid: parsing of header
    Proxy-Authentication leads to memory corruption


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17
changelog:
  - Resolves: #1828361 - CVE-2020-11945 squid: improper access restriction upon
    Digest Authentication nonce replay could lead to remote code execution
  - Resolves: #1828362 - CVE-2019-12519 squid: improper check for new member in
    ESIExpression::Evaluate allows for stack buffer overflow [rhel


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.2
changelog:
  - Resolves: #1802516 - CVE-2020-8449 squid: Improper input validation issues
    in HTTP Request processing
  - Resolves: #1802515 - CVE-2020-8450 squid: Buffer overflow in a Squid acting
    as reverse-proxy
  - Resolves: #1853129 - CVE-2020-15049 squid: request smuggling and poisoning
    attack against the HTTP cache
  - Resolves: #1802517 - CVE-2019-12528 squid: Information Disclosure issue in
    FTP Gateway


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.4
changelog:
  - Resolves: #1872349 - CVE-2020-24606 squid: Improper Input Validation could
    result in a DoS
  - Resolves: #1872327 - CVE-2020-15810 squid: HTTP Request Smuggling could
    result in cache poisoning
  - Resolves: #1872342 - CVE-2020-15811 squid: HTTP Request Splitting could
    result in cache poisoning


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
  - RHEL-7.7 erratum
    Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
    Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Resolves: #1664648 - tcpdump post creates user and groups unconditionally, raising alerts in corporate environment


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - more clear formulation of man page note - previous note was a bit ambiguous


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Jan Grulich <jgrulich@redhat.com> - 1.8.0-20
changelog:
  - Fix stack buffer overflow in CMsgReader::readSetCursor
    Resolves: bz#1791773

  - Fix heap buffer overflow in DecodeManager::decodeRect
    Resolves: bz#1791768

  - Fix heap buffer overflow in TightDecoder::FilterGradient
    Resolves: bz#1791763

  - Fix heap-based buffer overflow triggered from CopyRectDecoder
    Resolves: bz#1791747

  - Fix stack use-after-return due to incorrect usage of stack memory in ZRLEDecoder
    Resolves: bz#1791759

  - Add option to fallback to empty port when the specified one is taken
    Resolves: bz#1791996


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
  - Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
  - Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
  - Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
  - Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  - Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
  - Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
  - Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
  - Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
  - Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
  - Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
  - Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
  - Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-2
changelog:
  - Resolves: rhbz#1459747 CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441481 CVE-2017-5647 tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-3
changelog:
  - Resolves: rhbz#1498344 CVE-2017-12615 CVE-2017-12617 tomcat: various flaws
  - Resolves: rhbz#1495654 CVE-2017-7674 tomcat: Vary header not added by CORS filter leading to cache poisoning
  - Resolves: rhbz#1470596 CVE-2017-5647 Add follow up revision


author: Matthew Harmsen <mharmsen@redhat.com> 7.2.1-7
changelog:
  - Updated jss build and runtime dependencies
  - Bugzilla Bug #1596769 - Tomcatjss: Add support for TLS_*_SHA384
    ciphers (cfu)


author: Jack Magne <jmagne@redhat.com> 7.2.1-8
changelog:
  - Bugzilla Bug #1632618 - CC: tomcatjss: unable to enable OCSP checking
    from peer AIA extension [rhel-7.6.z] (jmagne)


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a.
    - Mongolia no longer observes DST. (BZ #1425214)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1414829)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018. 
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds. 
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018e-4
changelog:
  - Brazil moved the start of DST from the first Sunday in November
    to the third Sunday in November.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-3
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
  - Do not search for DNSSEC info when domain-insecure is set
    for stub zone (#1678550)
  - Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
  - rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
  - make linking flags configurable from the specc file
  - set linking flags to use relro hardening
    Related: #1531116


author: Bastien Nocera <bnocera@redhat.com> - 0.99.7-1
changelog:
  - Update to 0.99.7
  - Add Bluetooth LE battery support
  - Fix critical action after resume from hibernate
    Resolves: #1584245


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.111-3
changelog:
  - Added support for issuing fullness warnings via dmeventd
  - rhbz#1519307
  - Provided missing error code to text translation for vdoDumpConfig.
  - Resolves: rhbz#1595129
  - Improved error reporting when using pvcreate in the vdo script to check
    for pre-existing devices when creating a VDO volume.
  - Resolves: rhbz#1557464


author: - Andy Walsh <awalsh@redhat.com> - 6.1.1.120-3
changelog:
  - Improved error messages in the vdo script when failing to stop a device.
  - Resolves: rhbz#1511106
  - Improved man pages.
  - Resolves: rhbz#1572640
  - Modified vdo script to ignore (but preserve) unrecognised parameters in
    the vdo config file so that config files are compatible across versions.
  - Resolves: rhbz#1604060
  - Updated Ansible module to change block map cache size on existing volumes
  - Resolves: rhbz#1541170


author: - Andy Walsh <awalsh@redhat.com> - 6.1.2.38-3
changelog:
  - Fixed more error path memory leaks.
    - Resolves: rhbz#1609426
  - Improved man pages.
    - Resolves: rhbz#1636047
  - Improved checking for existing LVM physical volumes when formatting a new
    VDO volume.
    - Resolves: rhbz#1687797
  - Fixed a bug which would cause the default logical size to be 480 KB
    smaller than it could be without causing over-provisioning.
    - Resolves: rhbz#1532697
  - Removed extraneous man pages.
    - Resolves: rhbz#1643284
  - Allowed VDO backing devices to be specified by major:minor device number.
    - Resolves: rhbz#1637762
  - Improved behavior when attempting to create a VDO volume whose name conflicts
    with an existing dm target.
    - Resolves: rhbz#1588140
  - Modified vdo script to report fewer errors when removing a VDO which
    sits atop a missing device.
    - Resolves: rhbz#1535476


author: - Andy Walsh <awalsh@redhat.com> - 6.1.2.41-4
changelog:
  - Removed the VDO Ansible module and associated examples from this package.
    - Resolves: rhbz#1536515
  - Improved error messages from the vdo script.
    - Resolves: rhbz#1688481


author: - Andy Walsh <awalsh@redhat.com> - 6.1.3.4-4
changelog:
  - Added UUID filtering of underlying devices when running vdo create with
    the --force flag as this failed when run on certain PVs.
    - Resolves: rhbz#1707481


author: Ondrej Holy <oholy@redhat.com> - 3.22.0-6
changelog:
  - Do not restart service after unclean exit code
  - Do not listen all if invalid interface is provided
  - Resolves: #1546043, #1580577


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-1
changelog:
  - Update to 2.20.4
  - Resolves: rhbz#1576544
  - WebKitWebProcess crashes when a11y is active
  - Resolves: rhbz#1591638


author: Tomas Popela <tpopela@redhat.com> - 2.20.4-2
changelog:
  - webkitgtk4: Crash on Google login page when a11y is active
  - Resolves: rhbz#1503624
  - Revert patch causing rendering glitches


author: Tomas Popela <tpopela@redhat.com> - 2.20.5-1
changelog:
  - Update to 2.20.5 - technically it was not necessary as the only difference
    between 2.20.4 and .5 was the revert of one change, that we already reverted
    while building 2.20.4. But it's better to stay with upstream.
  - Update the labels patch with the version that was pushed upstream.
  - Resolves: rhbz#1576544


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
  - Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
  - Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-10
changelog:
  - Fix memory leak when macsec MKA/PSK is used (rh #1500442)
  - Fix authentication failure when the MAC is updated externally (rh #1490885)
  - Let the kernel discard EAPOL if packet type is PACKET_OTHERHOST (rh #1434434)
  - Don't restart wpa_supplicant.service on package upgrade (rh #1505404)
  - Don't own a directory in /run/ (rh #1507919)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5
changelog:
  - macsec: Fix segmentation fault in case macsec.ko is not loaded (rh #1440646)
  - nl80211: Fix race condition in detecting MAC change (rh #1447073)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.6-5.1
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086,
    CVE-2017-13087, CVE-2017-13088)


author: Peter Hutterer <peter.hutterer@redhat.com> 2.24-1
changelog:
  - xkeyboard-config 2.24 (#1564615)
  - Revert the high-keycode patches to avoid conflicts with xkbcomp < 1.4


author: Peter Hutterer <peter.hutterer@redhat.com> 0.25.0-2
changelog:
  - Don't provide xorg-x11-drv-synaptics (#1413811)
  - Don't reassign libinput to wacom touchpads, that's left to the user
  - Don't assign to wacom tablets, tablets behave differently on RHEL7.4


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


author: Scientific Linux Auto Patch Process <SCIENTIFIC-LINUX-DEVEL@LISTSERV.FNAL.GOV>
changelog:
  - Added Source: xorg-x11-server.ini
  -->  Config file for automated patch script
  - Replaced Source: 0001-linux-Make-platform-device-probe-less-fragile.patch
  -->  Resolve BZ1650634


author: Adam Jackson <ajax@redhat.com> - 1.20.4-11
changelog:
  - Fix a crash when moving an animated cursor between screens
  - Be case-insentive when matching extension names to enable or disable


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.4-12
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872389), CVE-2020-14346 (#1872393),
    CVE-2020-14361 (#1872400), CVE-2020-14362 (#1872407)
  - Temporarily revert fixes from 1.20.4-11 build for delivery of CVE fixes


author: Adam Jackson <ajax@redhat.com> - 7.5-21
changelog:
  - Sync with F25: xdpyinfo 1.3.2, xev 1.2.2, xlsatoms 1.1.2, xlsclients 1.1.3,
    xlsfonts 1.0.5, xvinfo 1.1.3


author: Hans de Goede <hdegoede@redhat.com> - 1.3.2-14
changelog:
  - Xclients: only try to start gnome classic session if installed
  - Resolves: rhbz#1078948
  - startx: Only specify vt argument automatically when run from a vt
  - Resolves: rhbz#1083188


author: Hans de Goede <hdegoede@redhat.com> - 1.3.4-1
changelog:
  - xinit 1.3.4
  - Drop xorg-x11-xinit-1.3.2-systemd-logind.patch (included upstream in 1.3.4)
  - Add patches from Fedora to fix automatically finding a free display-number
  - Resolves: rhbz#1194894


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 1.1.31-44
changelog:
  - Add pre-transaction-actions plugin.
  - Resolves: bug#1470647
  - yum-builddep: add --define option.
  - Resolves: bug#1437636
  - verifytree: handle no @core group gracefully.
  - Resolves: bug#1349433
  - verifytree: fix handling of missing comps.
  - Resolves: bug#1333353


author: Kamil Dudka <kdudka@redhat.com> - 5.0.2-30
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix stack-based buffer overflow in exec.c:hashcmd() (CVE-2018-1071)
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix NULL dereference in cd (CVE-2017-18205)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)
  - fix buffer overflow for very long fds in >& fd syntax (CVE-2014-10071)


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-9
changelog:
  - Fix covscan warning
  - "Variable "file" going out of scope leaks the storage it points to."
    has been introduced by the original version of 0001-fix-CVE-2018-7725.patch
  - Related: 1558596


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-11
changelog:
  - Fix CVE-2018-6541
  - Part of the original patch has already been applied in the past (CVE-2018-7726),
    so the bug should not be reproducible in a way described in the github 
    issue, even without this commit. Applying the rest of the original patch anyway.
  - https://github.com/gdraheim/zziplib/issues/16
  - Related: CVE-2018-6541


author: Jakub Martisko <jamartis@redhat.com> - 0.13.62-12
changelog:
  - Fix a directory traversal bug
  - unzip-mem should now strip all "../" prefixes from the archived files
  - Resolves: CVE-2018-17828


