# changelog

author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-1
changelog:
  - Rebase to 0.9.16 to provide the version Samba4 needs
  - Resolves: rhbz#766336
  - Drop ABI compatibility patch (no longer needed)


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.16-2
changelog:
  - Add BuildRequires on libxslt and docbook-style-xsl to enable
    building manual pages

  - Related: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.17-1
changelog:
  - Rebase to 0.9.17 to provide the version Samba4 needs
  - Drop EXCLUDE_PATTERNS workaround in specfile
  - Resolves: rhbz#766336


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.18-2
changelog:
  - Resolves: rhbz#975489 - Additional flags might have no effect
                            on 32bit architectures


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-1
changelog:
  - Rebase libtevent to 0.9.26
  - Remove upstreamed or no longer applicable patches
  - Related: rhbz#1322688


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.26-2
changelog:
  - temporarily disable make check, which keeps failing in mock despite
    working correctly on a full system
  - Related: rhbz#1322688


author: Petr Hracek <phracek@redhat.com> - 3.9.4-10
changelog:
  - This resolves several CVEs
  - CVE-2014-8127, CVE-2014-8129, CVE-2014-8130
  - CVE-2014-9330, CVE-2014-9655, CVE-2015-8781
  - CVE-2015-8784, CVE-2015-1547, CVE-2015-8683
  - CVE-2015-8665, CVE-2015-7554, CVE-2015-8668
  - Resolves: #1299919


author: Nikola Forró <nforro@redhat.com> - 3.9.4-14
changelog:
  - Merge previously released fixes for CVEs:
  - CVE-2013-1960 CVE-2013-1961 CVE-2013-4231
  - CVE-2013-4232 CVE-2013-4243 CVE-2013-4244
  - Resolves: #1335099


author: Nikola Forró <nforro@redhat.com> - 3.9.4-16
changelog:
  - Add patches for CVEs:
  - CVE-2016-3632 CVE-2016-3945 CVE-2016-3990
  - CVE-2016-3991 CVE-2016-5320
  - Related: #1335099


author: Steve Dickson <steved@redhat.com> 0.2.1-7
changelog:
  - Fixed some races in getnetconfig code (bz 1031498)
  - Remove the installation of libtirpc.a and libtirpc.la (bz 869397)


author: Steve Dickson <steved@redhat.com> 0.2.1-11
changelog:
  - Backported upstream debugging (bz 1273158)
  - Fixed memory leak in svc_vc_create (bz 1276687)
  - Fixed memory leak in svc_tli_create (bz 1276855)
  - Fixed memory leak in __svc_vc_dodestroy (bz 1276856)


author: Miloslav Trmač <mitr@redhat.com> - 0.56.11-1
changelog:
  - Update to libuser-0.56.11.
    Resolves: #454091
    Resolves: #456267
    Resolves: #456270
    Resolves: #487129


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-1
changelog:
  - Update to libuser-0.56.13.
    Resolves: #251951
    Resolves: #454079
    Resolves: #456373
    Resolves: #456382
    Resolves: #530513


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-2
changelog:
  - Allow supplying passwords from scripts
  - Allow specifying a LDAP simple bind password in libuser.conf
    Resolves: #562832


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-5
changelog:
  - Correctly mark the LDAP default password value as encrypted (CVE-2011-0002)
    Resolves: #668021
  - Default LDAP cn to username if gecos is empty
    Resolves: #670151
  - Preserve setuid and setgid bits when copying files from /etc/skel
    Resolves: #724987
  - Fix segfault when reading database files with certain sizes
    Resolves: #788521


author: Miloslav Trmač <mitr@redhat.com> - 0.56.13-7
changelog:
  - Don’t use 512-bit RSA private keys in tests
    Related: #1235518
  - Fix testsuite failures if more than one architecture is building concurrently
    Related: #1235518


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-47
changelog:
  - Revert "qemu: export disk snapshot support in capabilities" (rhbz#1149667)
  - qemu: allow restore with non-migratable XML input (rhbz#1141838)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1141838)
  - Make ABI stability issue easier to debug (rhbz#1141838)
  - domain_conf: fix domain deadlock (CVE-2014-3657)
  - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)
  - sanlock: Avoid freeing uninitialized value (rhbz#1136788)
  - virsh: Print cephx and iscsi usage (rhbz#1156327)
  - Fix bug with loading bridge name for active domain during libvirtd start (rhbz#1146310)
  - conf: Fix even implicit labels (rhbz#1138500)
  - tests: Add test cases for previous commit (rhbz#1138500)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-48
changelog:
  - networkValidate: Disallow bandwidth in portgroups too (rhbz#1115292)
  - qemu: Fix checking of ABI stability when restoring external checkpoints (rhbz#834196)
  - qemu: Use "migratable" XML definition when doing external checkpoints (rhbz#834196)
  - qemu: Fix memleak after commit 59898a88ce8431bd3ea249b8789edc2ef9985827 (rhbz#834196)
  - qemu: blkiotune: Avoid accessing non-existing disk configuration (rhbz#1131821)
  - qemu: Fix build error introduced in 653137eb957a278b556c6226424aad5395a (rhbz#1131821)
  - qemu: snapshot: Use better check when reverting external snapshots (rhbz#1124854)
  - virsh: domain: Use global constant for XML file size limit (rhbz#1134671)
  - selinux: Avoid label reservations for type = none (rhbz#1138488)
  - Clean up chardev sockets on QEMU shutdown (rhbz#1122367)
  - Don't include @LIBS@ in libvirt.pc.in file (rhbz#1134455)
  - qemu: save domain state to XML after reboot (rhbz#1169405)
  - virsh: Honour -q in domblklist, vcpupin and emulatorpin (rhbz#1135171)
  - virsh-domain: Flip logic in cmdSetvcpus (rhbz#1139114)
  - Fix possible memory leak in util/virxml.c (rhbz#1136729)
  - esx_vi: fix possible segfault (rhbz#1136729)
  - sasl: Fix authentication when using PLAIN mechanism (rhbz#1171521)
  - Fix leak in x86UpdateHostModel (rhbz#1144304)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-49
changelog:
  - nwfilter: utility function virNWFilterVarValueEqual (rhbz#1126487)
  - qemu: support live update of an interface's filter (rhbz#1126487)
  - qemu: Update fsfreeze status on domain state transitions (rhbz#1136251)
  - virsh: Fix semantics of --config for "update-device" command (rhbz#1129112)
  - virsh: Don't use legacy API if --current is used on device hot(un)plug (rhbz#1125194)
  - qemu: Avoid double serial output with RHEL 6 qemu (rhbz#1162759)
  - storage: Check the partition name against provided name (rhbz#1138523)
  - qemu: Don't unconditionally delete file in qemuOpenFileAs (rhbz#1158036)
  - conf: Don't mangle vcpu placement randomly (rhbz#1170495)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-50
changelog:
  - conf: Don't format actual network definition in migratable XML (rhbz#1186142)
  - network: don't allow multiple portgroups with the same name in a network (rhbz#1115858)
  - build: fix build with latest rawhide kernel headers (rhbz#1198698)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-51
changelog:
  - sanlock: Don't spam logs with "target pid not found" (rhbz#1189414)
  - nwfilter: fix crash when adding non-existing nwfilter (rhbz#1202703)
  - util: more verbose error when failing to create macvtap device (rhbz#1186142)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-52
changelog:
  - qemu: Keep QEMU host drive prefix in BlkIoTune (rhbz#1203633)
  - qemu: Fix name comparison in qemuMonitorJSONBlockIoThrottleInfo() (rhbz#1203633)
  - virsh: fix typos in virsh man page (rhbz#1130835)
  - schemas: Allow all generic elements and attributes for all interfaces (rhbz#1206066)
  - RNG: Allow multiple parameters to be passed to an interface filter (rhbz#1206066)
  - qemu_domain: fix startup policy for disks (rhbz#1203542)
  - Create directory for lease files if it's missing (rhbz#1200991)
  - qemu: cgroup: Properly set up vcpu pinning (rhbz#1198096)
  - cgroup: Add accessors for cpuset.memory_migrate (rhbz#1198497)
  - qemu: Fix possible crash (rhbz#1198497)
  - qemu: Migrate memory on numatune change (rhbz#1198497)
  - qemu: fix crash when removing <filterref> from interface with update-device (rhbz#1205042)
  - nwfilter: Fix rule priority problem (rhbz#1210183)
  - qemuProcessHook: Call qemuProcessInitNumaMemoryPolicy only when needed (rhbz#1198645)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-53
changelog:
  - RHEL: Avoid memory leak when virCgroupSetCpusetMemoryMigrate fails (rhbz#1198497)
  - qemu: cgroup: Fix memory leak when there's no vCPU pinning (rhbz#1198096)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-54
changelog:
  - util: set MAC address for VF via netlink message to PF+VF# when possible (rhbz#1113474)
  - util: set macvtap physdev online when macvtap is set online (rhbz#1113474)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-54.el6_7.1
changelog:
  - qemu: split out cpuset.mems setting (rhbz#1265970)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1265970)
  - virNetDev{Replace, Restore}MacAddress: Fix memory leak (rhbz#1266039)
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1266039)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1266039)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-55
changelog:
  - daemon: Suppress logging of VIR_ERR_NO_DOMAIN_METADATA (rhbz#1260864)
  - Allow <source> for type=block to have no dev (rhbz#1220197)
  - qemu: event: Properly handle spice events (rhbz#1236581)
  - qemu: event: Clean up VNC monitor handling (rhbz#1236581)
  - qemu: split out cpuset.mems setting (rhbz#1263263)
  - qemu: leave restricting cpuset.mems after initialization (rhbz#1263263)
  - virNetDev{Replace, Restore}MacAddress: Fix memory leak (rhbz#1251532)
  - util: make virNetDev(Replace|Restore)MacAddress public functions (rhbz#1251532)
  - util: don't use netlink to save/set mac for macvtap+passthrough+802.1Qbh (rhbz#1251532)
  - qemu: fix hotplugging cpus with strict memory pinning (rhbz#1263263)
  - storage: Track successful creation of LV for removal (rhbz#1232170)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-56
changelog:
  - qemu: snapshot: Fix return value of external checkpoint with no disks (rhbz#1292312)
  - qemu: snapshot: Fix modification of vm object without job (rhbz#1290647)
  - virsh-domain: Add --live, --config, --current logic to cmdAttachInterface (rhbz#1229128)
  - RHEL: virsh: remove duplicate --config for 'virsh update-device' (rhbz#1224037)
  - Update ESX driver to always use privateData (rhbz#1213348)
  - esx: Simplify VI (vSphere) API and VMware product version handling (rhbz#1213348)
  - conf: net: Correctly switch how to format address fields (rhbz#1299700)
  - qemu: Refuse to create snapshot of a disk without source (rhbz#1299411)
  - Build all binaries with PIE (rhbz#1242156)
  - Enable full RELRO mode (rhbz#1242156)
  - Don't duplicate compiler warning flags when linking (rhbz#1242156)
  - Simplify RELRO_LDFLAGS (rhbz#1242156)
  - Fix AM_LDFLAGS typo (rhbz#1242156)
  - Pass AM_LDFLAGS to driver modules too (rhbz#1242156)
  - RHEL: Enable RELRO for python modules (rhbz#1242156)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-57
changelog:
  - vmx: Relax virtualHW.version check (rhbz#1300574)
  - qemu: snapshot: Don't leak XML definition and forget to unlock job (rhbz#1305793)
  - qemu: Fix formatting flags in qemuDomainSaveImageOpen (rhbz#1307094)
  - network: Resolve some issues around vlan copying (rhbz#1300843)
  - network: fix connections count in case of allocate failure (rhbz#1300843)
  - network: consolidate connection count updates for device pool (rhbz#1300843)
  - network: consolidated info log for all network allocate/free operations (rhbz#1300843)
  - util: increase libnl buffer size (rhbz#1276478)
  - util: reduce debug log in virPCIGetVirtualFunctions() (rhbz#1276478)
  - util: improve error reporting in virNetDevVPortProfileGetStatus (rhbz#1276478)
  - util: add missing newline (rhbz#1276478)
  - util: eliminate bogus error log in virNetDevVPortProfileGetStatus (rhbz#1276478)
  - util: clean up and expand 802.1QbX negotiation logging (rhbz#1276478)
  - util: report the MAC address that couldn't be set (rhbz#1276478)
  - util: reset MAC address of macvtap passthrough physdev after disassociate (rhbz#1276478)
  - bitmap: add way to find next clear bit (rhbz#1276478)
  - Introduce virBitmapIsBitSet (rhbz#1276478)
  - util: Introduce flags field for macvtap creation (rhbz#1276478)
  - virnetdevmacvlan.c: Introduce mutex for macvlan creation (rhbz#1276478)
  - util: keep/use a bitmap of in-use macvtap devices (rhbz#1276478)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-61
changelog:
  - virsh: Properly display block job type (rhbz#1326653)
  - spec: proper soft static allocation of qemu uid (rhbz#1351792)
  - Revert "qemu: snapshot: Fix modification of vm object without job" (rhbz#1326652)
  - qemu: snapshot: Fix job handling when creating snapshots (rhbz#1326652)
  - tls: remove support for gnutls 1.x.x, require 2.2.0 (rhbz#1333415)
  - configure: allow setting default TLS priority string (rhbz#1333415)
  - rpc: allow priority string to be passed to TLS context (rhbz#1333415)
  - libvirtd: add config option for TLS priority (rhbz#1333415)
  - remote: allow TLS protocol/cipher priority override in URI (rhbz#1333415)
  - Pass config file object through to driver open methods (rhbz#1333415)
  - remote: allow TLS priority to be customized (rhbz#1333415)
  - qemu: -numa doesn't (yet) support disjoint range (rhbz#1310122)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62
changelog:
  - qemu: fix return value of qemuDomainBlockPivot on errors (rhbz#1300159)
  - qemu: Fix virsh freeze when blockcopy storage file is removed (rhbz#1300159)
  - migration: add support for migrateURI configuration (rhbz#1347389)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-62.el6_9.1
changelog:
  - util: Implement virFileReadHeaderFD (CVE-2017-5715)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-63
changelog:
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64
changelog:
  - cpu: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-64.el6_10.1
changelog:
  - cpu_x86: Do not cache microcode version (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12126, CVE-2018-12130, CVE-2018-12127)


author: Adam Jackson <ajax@redhat.com> 1.2.2-2
changelog:
  - libvorbis-1.2.2-svn16228.patch: Backport a fix from pre-1.2.3 to hopefully
    fix small sound file playback. (#505610)


author: Ville Skyttä <ville.skytta at iki.fi> - 0.2.8.4-18
changelog:
  - Split libwmflite (WMF parser) into -lite subpackage (#432651).
  - Build with dependency tracking disabled.
  - Convert docs to UTF-8.


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-18.el6
changelog:
  - CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1149086)
  - Fix html serialization error and htmlSetMetaEncoding (rhbz#1004513)


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.7.6-19.el6
changelog:
  - Stop parsing on entities boundaries errors
  - Fix missing entities after CVE-2014-3660 fix (rhbz#1149086)


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-20.1
changelog:
  - Fix a series of CVEs (rhbz#1286495)
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - Libxml violates the zlib interface and crashes


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-21.el6.8.1
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-4
changelog:
  - The devel subpackage now properly requires the base package to avoid
    multilib conflicts (#869633)


author: Petr Šabata <contyk@redhat.com> - 0.9.45-6
changelog:
  - Willing SUT retains PFC operational state from peer after peer
    stops transmitting TLV (#870578)
  - Unable to query configured PFC priorities under IEEE DCBX (#870576)


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-17
changelog:
  - fix #841520 - do not try to change owner of log if it is not needed
  - fix #848131 - fix bad umask value while creating temp file
  - fix #920030 - set SELinux context before compress files creation
  - fix #922169 - remove temp files on error
  - fix #847338 - do not overwrite create directive value by ACL setting
  - fix #847339 - fix race condition between fchmod and acl_set_fd


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-18
changelog:
  - fix #722209 - do not redirect output of logrotate to /dev/null, mark
    logrotate.conf as config
  - fix #1117189 - sort logs according to dateformat when removing the old one
  - fix #625034 - update logrotate.status atomically
  - fix #984965 - fix possible overflow in "create" directive parsing
  - fix #1012485 - use permissions 0700 for cron.daily script


author: Jan Kaluza <jkaluza@redhat.com> 3.7.8-19
changelog:
  - fix #1047899 - add support for "maxsize" directive
  - fix #1125769 - add support for "createolddir" directive


author: Jan Kaluza <jkaluza@redhat.com> 3:2.1.12-20
changelog:
  - fix #745409 - do not set Indexes in httpd configuration for public archive
  - fix #1008139 - fix traceback when list_data_dir is not a child of var_prefix


author: Jan Kaluza <jkaluza@redhat.com> 3:2.1.12-23
changelog:
  - fix #1095359 - handle update when some mailing lists have been created
    by newer Mailman than this one


author: Peter Schiffer <pschiffe@redhat.com> - 12.4-7
changelog:
  - resolves: #857120
    fixed incorrect return code when TMPDIR points to invalid path
  - resolves: #845098
    added support for alternatives


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.2-4
changelog:
  - Fix problem where mdadm allowed the creation of more arrays than
    supported by the BIOS.
  - Resolves bz1211564


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.3
changelog:
  - Retry reading sync_completed state to avoid a reshape not continuing after
    restarting a reshape
    This is an additional patch to resolve this bug.
  - Resolves bz1331331


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.4
changelog:
  - Fix problem with mdadm large device names overflowing an internal buffer,
    potentially leading to segfaults.
  - Resolves bz1347808


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.4-1.el6_8.5
changelog:
  - Fix problem with reshaping IMSM arrays, where a new reshape could be
    launched before the first reshape had fully completed, leading to
    unpected results.
  - Resolves bz1348544


author: Paul Lindner <lindner@inuus.com> - 1.4.3-1
changelog:
  - Add explicit require on memcached for memcached-devel (resolves 537046)
  - enable-threads option no longer needed
  - Update web site address


author: Paul Lindner <lindner@inuus.com> - 0:1.4.4-1
changelog:
  - Upgraded to upstream memcached-1.4.4 (http://code.google.com/p/memcached/wiki/ReleaseNotes144)
  - Add explicit Epoch to fix issue with broken devel dependencies (resolves 542001)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.4-3.el6_8.1
changelog:
  - fix vulnerabilities allowing remote code execution (CVE-2016-8704,
    CVE-2016-8705, CVE-2016-8706)


author: Petr Oros <poros@redhat.com> - 1:1.17-21
changelog:
  - Update microcode data file to 20151106 revision.
  - Resolves: #1244968
  - Remove bad file permissions on /lib/udev/rules.d/89-microcode.rules
  - Resolves: #1201276


author: Petr Oros <poros@redhat.com> - 1:1.17-24
changelog:
  - Update microcode data file to 20161104 revision.
  - Add workaround for E5-26xxv4
  - Resolves: #1346045


author: Petr Oros <poros@redhat.com> - 1:1.17-25.2
changelog:
  - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04
  - Add amd microcode_amd_fam17h.bin data file
  - Resolves: #1527357


author: Petr Oros <poros@redhat.com> - 1:1.17-27
changelog:
  - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04
  - Add amd microcode_amd_fam17h.bin data file
  - Resolves: #1527354


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.3
changelog:
  - Intel CPU microcode update to 20180703
  - Add infrastructure for handling kernel-version-dependant microcode
  - Resolves: #1574593


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.5
changelog:
  - Intel CPU microcode update to 20180807a (#1614427).
  - Add check for minimal microcode version to reload_microcode.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.13
changelog:
  - Remove disclaimer, as it is not as important now to justify kmsg/log
    pollution; its contents are partially adopted in README.caveats.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.16
changelog:
  - Revert more strict model check code, as it requires request_firmware-based
    microcode loading mechanism and breaks enabling of microcode with caveats.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.18
changelog:
  - Intel CPU microcode update to 20191112, addresses CVE-2017-5715,
    CVE-2019-0117, CVE-2019-11135, CVE-2019-11139 (#1764049, #1764062, #1764953,
      - Addition of 06-a6-00/0x80 (CML-U 6+2 A0) microcode at revision 0xc6;
    - Addition of 06-66-03/0x80 (CNL-U D0) microcode at revision 0x2a;
    - Addition of 06-55-03/0x97 (SKL-SP B1) microcode at revision 0x1000150;
    - Addition of 06-7e-05/0x80 (ICL-U/Y D1) microcode at revision 0x46;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xcc to 0xd4;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) microcode from revision 0xcc
      to 0xd4
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (AML-Y V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (CML-U 4+2 V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (WHL-U V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-G/X H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-H/S/Xeon E3 B0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xb8 to 0xc6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.20
changelog:
  - Package the publicy available microcode-20191112 release (#1755021):
    - Addition of 06-4d-08/0x1 (AVN B0/C0) microcode at revision 0x12d;
    - Addition of 06-55-06/0xbf (CSL-SP B0) microcode at revision 0x400002c;
    - Addition of 06-7a-08/0x1 (GLK R0) microcode at revision 0x16;
    - Update of 06-55-03/0x97 (SKL-SP B1) microcode from revision 0x1000150
      up to 0x1000151;
    - Update of 06-55-04/0xb7 (SKL-SP H0/M0/U0, SKL-D M1) microcode from revision
      0x2000064 up to 0x2000065;
    - Update of 06-55-07/0xbf (CSL-SP B1) microcode from revision 0x500002b
      up to 0x500002c;
    - Update of 06-7a-01/0x1 (GLK B0) microcode from revision 0x2e up to 0x32;
  - Include 06-9e-0c (CFL-H/S P0) microcode from the microcode-20190918 release.
  - Correct the releasenote file (0001-releasenote-changes-summary-fixes.patch).
  - Update README.caveats with the link to the new Knowledge Base article.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.21
changelog:
  - Update Intel CPU microcode to microcode-20191113 release:
    - Update of 06-9e-0c (CFL-H/S P0) microcode from revision 0xae up to 0xc6.
  - Drop 0001-releasenote-changes-summary-fixes.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.22
changelog:
  - Update Intel CPU microcode to microcode-20191115 release:
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4
      up to 0xd6;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision
      0xc6 up to 0xca;
    - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6
      up to 0xca;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0b/0x02 (CFL-S B0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0c/0x22 (CFL-S/Xeon E P0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0d/0x22 (CFL-H/S R0) from revision 0xc6 up to 0xca;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) from revision 0xc6 up to 0xca.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.25
changelog:
  - Update Intel CPU microcode to microcode-20200520 release (#1839193):
    - Update of 06-2d-06/0x6d (SNB-E/EN/EP C1/M0) microcode from revision 0x61f
      up to 0x621;
    - Update of 06-2d-07/0x6d (SNB-E/EN/EP C2/M1) microcode from revision 0x718
      up to 0x71a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x46
      up to 0x78.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.26
changelog:
  - Update Intel CPU microcode to microcode-20200602 release, addresses
    CVE-2020-0543, CVE-2020-0548, CVE-2020-0549 (#1795353, #1795357, #1827186):
    - Update of 06-3c-03/0x32 (HSW C0) microcode from revision 0x27 up to 0x28;
    - Update of 06-3d-04/0xc0 (BDW-U/Y E0/F0) microcode from revision 0x2e
      up to 0x2f;
    - Update of 06-45-01/0x72 (HSW-U C0/D0) microcode from revision 0x25
      up to 0x26;
    - Update of 06-46-01/0x32 (HSW-H C0) microcode from revision 0x1b up to 0x1c;
    - Update of 06-47-01/0x22 (BDW-H/Xeon E3 E0/G0) microcode from revision 0x21
      up to 0x22;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000151
      up to 0x1000157;
    - Update of 06-55-04/0xb7 (SKX-SP H0/M0/U0, SKX-D M1) microcode
      (in intel-06-55-04/intel-ucode/06-55-04) from revision 0x2000065
      up to 0x2006906;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x400002c
      up to 0x4002f01;
    - Update of 06-55-07/0xbf (CLX-SP B1) microcode from revision 0x500002c
      up to 0x5002f01;
    - Update of 06-5e-03/0x36 (SKL-H/S R0/N0) microcode from revision 0xd6
      up to 0xdc;
    - Update of 06-8e-09/0x10 (AML-Y22 H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0a/0xc0 (CFL-U43e D0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-8e-0c/0x94 (AML-Y42 V0, CML-Y42 V0, WHL-U V0) microcode
      from revision 0xca up to 0xd6;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode from revision
      0xca up to 0xd6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E3 U0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xca up to 0xd6;
    - Update of 06-9e-0c/0x22 (CFL-H/S P0) microcode from revision 0xca
      up to 0xd6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xca up to 0xd6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.27
changelog:
  - Do not update 06-4e-03 (SKL-U/Y) and 06-5e-03 (SKL-H/S/Xeon E3 v5) to revision
    0xdc, use 0xd6 by default (#1846134).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.28
changelog:
  - Enable 06-55-04 (SKL-X/W) caveat by default.
  - Enable 06-2d-07 (SNB-E/EN/EP) caveat by default (#1846024).


author: Eugene Syromiatnikov <esyr@redhat.com> - 2:1.17-33.29
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1826590):
    - Fixed a typo in the release note file.


author: Robert Relyea <rrelyea@redhat.com> - 1.0.8-14
changelog:
  - Fix 'Bugzilla Bug #797358 - mod_nss fails debug assertion' by removing
    'mod_nss-no_shutdown_if_not_init.patch' and applying
    'mod_nss-no_shutdown_if_not_init_2.patch' instead
  - The 'mod_nss-no_shutdown_if_not_init_2.patch' patch also fixes
    Bugzilla Bug #797326 - File descriptor leak after "service httpd reload"
    or httpd doesn't reload


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-15
changelog:
  - Fixes Bugzilla Bug #749408 - PK11_ListCerts called to retrieve all user
    certificates for every server (mod_nss-PK11_ListCerts.patch)
  - Fixes Bugzilla Bug #749409 - Add '--enable-ecc' option to %configure
    line under %build section of RHEL 6 spec file


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-16
changelog:
  - Fixes Bugzilla Bug #769906 - mod_nss insists on Required value
    NSSCipherSuite not set. (mod_nss-proxyvariables.patch)


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-17
changelog:
  - Fixes Bugzilla Bug #816394 - [RFE] Provide Apache 2.2 support for TLS v1.1
    via NSS through mod_nss . . .
  - Bumped version build/runtime requirements for NSPR and NSS


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-18
changelog:
  - Fixes Bugzilla Bug #835071 - [RFE] Support ability to share mod_proxy with
    other SSL providers (w/jorton, nkinder, & rcritten)


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-19
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #1030265 - mod_nss: incorrect handling of NSSVerifyClient in
    directory context [rhel-6.5.z]


author: Rob Crittenden <rcritten@redhat.com> - 1.0.8-20
changelog:
  - Resolves: CVE-2013-4566
  - Bugzilla Bug #1030267 - mod_nss: incorrect handling of NSSVerifyClient in
    directory context [rhel-6.6]


author: Matthew Harmsen <mharmsen@redhat.com> - 1.0.8-21
changelog:
  - Bumped version build/runtime requirements for 'nspr' and 'nss'
  - Added runtime dependency for 'nss-softokn'
  - Bugzilla Bug #1002733 - Apache core generated with sig 5
  - Bugzilla Bug #1016628 - mod_nss httpd segfaulting regularly
  - Bugzilla Bug #866703 - Memory error in mod_nss (eol_memmove.patch)


author: Petr Pisar <ppisar@redhat.com> - 2.0.4-12
changelog:
  - Fix CVE-2011-2767 (arbitrary Perl code execution in the context of the user
    account via a user-owned .htaccess) (bug #1626272)


author: Jan Pacner <jpacner@redhat.com> - 5:1.5.20-5.20091214hg736b6a
changelog:
  - Resolves: #1083524 (segmentation fault when sending an e-mail from a command
    line)
  - Resolves: #750929 (SIGSEGV Crash while parsing certificates file)
  - Resolves: #690409 (mutt crash; seg fault in mx_update_context)
  - Resolves: #674271 (SIGSEGV when browsing pop account)


author: Matej Muzila <mmuzila@redhat.com> - 5:1.5.20-8.20091214hg736b6a
changelog:
  - Resolves #1196787 (System default CA bundle not set as default in compiled-in
    default or config)
  - Resolves #1212646 (mutt sends e-mail with broken "From" header, which has no
    host part)


author: Tom Lane <tgl@redhat.com> 5.1.67-1
changelog:
  - Update to 5.1.67, for assorted upstream bugfixes including
    CVEs announced in January 2013
  Resolves: #901381


author: Tom Lane <tgl@redhat.com> 5.1.69-1
changelog:
  - Update to 5.1.69, for assorted upstream bugfixes including
    CVEs announced in April 2013
  Resolves: #953085


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #990796, #842052
  - Fix mysqldump failure against MySQL 5.0.x server due missing tables
    Resolves: #877557
  - Add logrotate script
    Resolves: #904061
  - Fix init script to not show failed on start even when server started
    Resolves: #884651


author: Honza Horak <hhorak@redhat.com> 5.1.71-1
changelog:
  - Update to MySQL 5.1.71, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-71.html
    Resolves: #990796


author: Jakub Dorňák <jdornak@redhat.com> - 5.1.73-1
changelog:
  - Update to MySQL 5.1.73, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-73.html
    (CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2014-0393,
    CVE-2014-0386, CVE-2014-0401, CVE-2014-0402)
    Resolves: #1055882


author: Honza Horak <hhorak@redhat.com> 5.1.73-2
changelog:
  - Make mysqld init script more robust and ignore existing but
    non-being-used unix socket file
    Resolves: #1037650


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-46
changelog:
  - fixed parsing of bulk responses (#983116)
  - added support of vzfs filesystem in hrStorageTable (#989498)
  - fixed endless loop when parsing sendmail configuration file with
    queue groups (#991213)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-49
changelog:
  - fixed snmp daemons and utilities crashing in FIPS mode (#1001830)
  - added support of btrfs filesystem in hrStorageTable (#1006706)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-50
changelog:
  - added 'diskio' option to snmpd.conf, it's possible to monitor only selected
    devices in diskIOTable (#990674)
  - fixed CVE-2014-2284: denial of service flaw in Linux implementation of
    ICMP-MIB (#1073223)
  - added cache to hrSWRunTable to provide consistent results (#1007634)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1073237)
  - fixed snmptrapd crashing on forwarding SNMPv3 traps (#1131844)
  - fixed HOST-RESOURCES-MIB::hrSystemProcesses (#1134335)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-51
changelog:
  - added faster caching into IP-MIB::ipNetToMediaTable (#789500)
  - fixed compilation with "-Werror=format-security" (#1181994)
  - added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#886468)
  - fixed error check in IP-MIB::ipAddressTable (#1012430)
  - fixed agentx client crash on failed response (#1023570)
  - fixed dashes in net-snmp-config.h (#1034441)
  - fixed crash on monitor trigger (#1050970)
  - fixed 'netsnmp_assert 1 == new_val->high failed' message in system log
    (#1065210)
  - fixed parsing of 64bit counters from SMUX subagents (#1069046)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070075)
  - fixed net-snmp-create-v3-user to have the same content on 32 and 64bit
    installations (#1073544)
  - fixed IPADDRESS value length in Python bindings (#1100099)
  - fixed hrStorageTable to contain 31 bits integers (#1104293)
  - fixed links to developer man pages (#1119567)
  - fixed storageUseNFS functionality in hrStorageTable (#1125793)
  - fixed netsnmp_set Python bindings call truncating at the first '\000'
    character (#1126914)
  - fixed log level of SMUX messages (#1140234)
  - use python/README to net-snmp-python subpackage (#1157373)
  - fixed forwarding of traps with RequestID=0 in snmptrapd (#1146948)
  - fixed typos in NET-SNMP-PASS-MIB and SMUX-MIB (#1162040)
  - fixed close() overhead of extend commands (#1188295)
  - fixed lmSensorsTable not reporting sensors with duplicate names (#967871)
  - fixed hrDeviceTable with interfaces with large ifIndex (#1195547)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-52
changelog:
  - Fixed snmptrapd crash when '-OQ' parameter is used and invalid trap is
    received (#CVE-2014-3565)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.5-55.el6
changelog:
  - Fixed 'clientaddr' option for UDPv6 client messages (#1279501)
  - Increased maximum size of AgentX packets (#1271196).
  - Fixed IP-MIB::ipSystemStatsInOctets and similar counters for IPv4
    (#1250023).
  - Fixed client utilities reporting 'read_config_store open failure on
    /var/lib/net-snmp/snmpapp.conf' (#1246568)
  - Fixed typos in NET-SNMP-AGENT-MIB.txt (#1241865)
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1227640)
  - Restored message about duplicate IP address (#1227374)
  - Fixed fd leak in sctp statistics (#1291054)


author: Josef Ridky <jridky@redhat.com> - 1:5.5-57.el6_8.1
changelog:
  - Resolves: #1363606 - An SNMPv3 request with a small max message size can lead to SNMPv1/2c bulk requests timing out


author: Josef Ridky <jridky@redhat.com> - 1:5.5-58.el6
changelog:
  - Resolves: #1315481 - An SNMPv3 request with a small max message size can lead to SNMPv1/2c bulk requests timing out


author: Steve Dickson <steved@redhat.com> 1.2.3-65
changelog:
  - nfsidmap: make sure give arguments are valid (bz 1230600)
  - nfsidmap: Display the effective NFSv4 domain name (bz 948680)
  - gssd: allow gssd and svcgssd to set the libtirpc debug level (bz 1273161)
  - gssd: select non-conventional principal (bz 1268031)
  - gssd:  Don't assume the machine account will be in uppercase (bz 1273166)
  - sm-notify: delete files in sm.bak after a NOTIFY reply (bz 1278921)


author: Steve Dickson <steved@redhat.com> 1.2.3-66
changelog:
  - svc_create: Make sure errors are logged (bz 1156647)
  - gssd: suppress error message if rpc_pipefs dir disappears (bz 1220156)
  - gssd: set $HOME to prevent recursion (bz 1223661)
  - statd: Update existing record if we receive SM_MON... (bz 1280024)
  - mountstats.man: fixed typo in man page (bz 1263968)


author: Steve Dickson <steved@redhat.com> 1.2.3-67
changelog:
  - mount.nfs: Fix fallback from tcp to udp (bz 1287894)
  - exportfs: escape path for function test_export (bz 735696)
  - nfs-utils.spec: No verification on runtime configuration files (bz 1118176)
  - idmapd: added usage statement (bz 1001439)
  - mountd: fix netgroup lookup for short hostnames (bz 1231998)
  - mountd: fix bug affecting exports of dirs with 64bit inode number (bz 994564)


author: Steve Dickson <steved@redhat.com> 1.2.3-71
changelog:
  - rpc.mountd: set libtirpc nonblocking mode to avoid DO (bz 1301581)
  - nfsidmap: Clean up other exit status cases (bz 1313603)
  - gssd: Fix inner-loop variable reuse (bz 1313090)
  - mount.nfs manpage: Add nfsmount.conf (bz 1302981)
  - nfs.init: Set exit code on restarts (bz 1205055)


author: Steve Dickson <steved@redhat.com> 1.2.3-73
changelog:
  - mountd: fix is_subdirectory to understand '/' (bz 1331207)
  - mount.nfs: Fix for the bug in v1.2.4 that breaks mount.nfs (bz 1208385)
  - mount.nfs: Removed supported flag from usage string (bz 1000990)
  - mountd.man: Update to change -P option as an alias for -p (bz 1037926)
  - exportfs: Deal with path's trailing "/" in unexportfs_parsed() (bz 1276538)
  - mount: RPC_PROGNOTREGISTERED should not be a permanent error (bz 1352856)


author: Elio Maldonado <emaldona@redhat.com> - 4.9.5-3
changelog:
  - Bump the release tag so it's higher than the one for rhel-6.4.z
  - Resolves: rhbz#919180 - Rebase to nspr-4.9.5


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-1
changelog:
  - Update Version to 4.10.0 to prevent Mozilla apps update problems as
  - reported and fixed on https://bugzilla.redhat.com/show_bug.cgi?id=981166
  - Resolves: rhbz#1002643 - Rebase RHEL 6 to NSPR 4.10 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.0-2
changelog:
  - Rebase to nspr-4.10.2
  - Resolves: rhbz#1032488 - CVE-2013-5607 (MFSA 2013-103) Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200920 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269360 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269361 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297891 - Rebase RHEL 6.8 to NSPR 4.11 in preparation for Firefox 45


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1207052 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.1
changelog:
  - Require softokn build 22 to ensure runtime compatibility.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-2
changelog:
  - Replace expired PayPal test certificate that breaks the build
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-3
changelog:
  - Restore a patch that had been mistakenly disabled
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-4
changelog:
  - Fix shell syntax error in nss/tests/all.sh
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 3.18.0-5
changelog:
  - Update and reeneable nss-646045.patch on account of the rebase
  - Resolves: Bug 1200900 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]


author: Kai Engert <kaie@redhat.com> - 3.18.0-5.3
changelog:
  - On RHEL 6.x keep the TLS version defaults unchanged.
  - Require softokn build 22 to ensure runtime compatibility.
  - Relax the requirement from pkcs11-devel to nss-softokn-freebl-devel
    to allow same or newer.
  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in NSS 3.18.1)


author: Elio Maldonado <emaldona@redhat.com> - 3.19.1-8
changelog:
  - Prevent TLS 1.2 Transcript Collision attacks against MD5 in key exchange protocol
  - Resolves: Bug 1289881


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-2
changelog:
  - Enable two additional ciphers and keep another one disabled
  - Prevent enabling extended masker key derive


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-6
changelog:
  - Fix syntax errors in patch that disables sslv2 tests
  - Resolves: Bug 1297888 - Rebase RHEL 6.8 to NSS 3.21 for Firefox 45


author: Kai Engert <kaie@redhat.com> - 3.21.3-2
changelog:
  - Mozilla #1314604 / Red Hat CVE-2016-8635
  - remove disable_hw_gcm.patch which hasn't been used since 3.16.1


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-7
changelog:
  - Add patch to check if hash algorithms are backed by a token
  - Add patch to disable TLS_ECDHE_{RSA,ECDSA}_WITH_AES_128_CBC_SHA256,
    which have never enabled in the past


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-9
changelog:
  - Update fix_multiple_open patch to fix regression in openldap client
  - Remove pk11_genobj_leak patch, which caused crash with Firefox
  - Add comment in the policy file to preserve the last empty line
  - Disable SHA384 ciphersuites when CKM_TLS12_KEY_AND_MAC_DERIVE is not
    provided by softoken; this superseds check_hash_impl patch


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-10
changelog:
  - Add patch to fix SSL CA name leaks, taken from NSS 3.27.2 release
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Add patch to remove duplicate ciphersuites entries in sslinfo.c
  - Add patch to abort selfserv/strsclnt/tstclnt on non-parsable version range
  - Build with support for SSLKEYLOGFILE


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-11
changelog:
  - Adjust the sslstress.txt filename so that it matches with the
    disableSSL2tests patch ported from RHEL 7
  - Exclude SHA384 and CHACHA20_POLY1305 ciphersuites from stress tests
  - Don't add gtests and ssl_gtests to nss_tests, unless gtests are enabled


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-1
changelog:
  - Rebase to 3.28.3
  - Remove upstreamed moz-1282627-rh-1294606.patch,
    moz-1312141-rh-1387811.patch, moz-1315936.patch, and
    moz-1318561.patch
  - Remove no longer necessary nss-duplicate-ciphers.patch
  - Disable X25519 and exclude tests using it
  - Catch failed ASN1 decoding of RSA keys, by Kamil Dudka (#1427481)


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Rebase to NSS 3.36.0 BETA
  - Remove upstreamed nss-is-token-present-race.patch
  - Revert the upstream changes that default to sql database


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Use the correct tarball of NSS 3.36 release
  - Ignore EncryptDeriveTest which only works with newer nss-softokn


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-5
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-9
changelog:
  - Backport upstream fix for CVE-2018-12384
  - Remove nss-lockcert-api-change.patch, which turned out to be a
    mistake (the symbol was not exported from libnss)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-3
changelog:
  - fix problems found by qe:
  - AC13: SSL3 "disabled"
  - AC26: Chacha20 and TLS 1.3 ciphers should be prioritized
  -   SHA-384 PRF => *_256_GCM_SHA384 ciphers should be reenabled for consistency
  - AC28: nss-policy-check is missing from packages and $PATH
  - extra: apostrophes in certutil manpage got mangled


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-23
changelog:
  - Use a static buffer for OpenLDAP callback structure
  - Resolves: rhbz#999472 - nslcd does not reconnect to alternate ldap server
                            when using SSL


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-24
changelog:
  - Apply two patches from upstream
  - Resolves: rhbz#1105382 - nslcd: error reading from client: Success


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-25
changelog:
  - Resolves: rhbz#917876 - [patch] Retry on zero length buffers rather than
                            declaring source unavailable


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-26
changelog:
  - Apply patches in prep
  - Resolves: rhbz#917876 - [patch] Retry on zero length buffers rather than
                            declaring source unavailable


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-27
changelog:
  - Resolves: rhbz#1240388 - nslcd fails to fetch member of group if that
                             members name has 19 or more character in its name


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-30
changelog:
  - Resolves: rhbz#1293564 - Segmentation fault during upstream make check
  - Also fix regressions in the tio.c module revealed by subsequent testing


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-31
changelog:
  - Resolves: rhbz#1293564 - fix doc to describe actual uri format
                             in nslcd.conf


author: Jakub Hrozek <jhrozek@redhat.com> 0.7.5-32
changelog:
  - Don't double-close the socket
  - Resolves: rhbz#1309364 - Use-after-free in case resolving hosts or
                             networks fail


author: Bob Relyea <rrelyea@redhat.com> - 3.14.3-21
changelog:
  - Require nss-softokn-freebl of at least the same version and release
  - Resolves: Bug 1182662 - nss-softokn-3.14.3-19.el6_6 breaking yum and rpm


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-23
changelog:
  - Pick up upstream freebl patch for CVE-2015-2730
  - Check for P == Q or P ==-Q before adding P and Q


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-15
changelog:
  - Fix shlibsign to return non-zero on failure
  - Resolves: Bug 587634 - shlibsign returns 0 although if fails


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-4
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Fix the required nspr version to be 4.10.6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-0.3
changelog:
  - Rebase RHEL 6.7.z to NSS-util 3.21 in preparation for Firefox 45
  - Resolves: Bug 1299874
  - Update upstream patch for CVE-2016-1950


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.21.3-1
changelog:
  - Rebase to nss-3.21.3
  - Remove patch for CVE-2016-1950, which is included in the release
  - Related: Bug 1347908


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.26.0
  - Remove upstreamed patch for CVE-2016-1950
  - Remove p-disable-md5-590364-reversed.patch for bug 1335915


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-1
changelog:
  - update to 4.2.6p5 (#654004, #641800, #714079, #714084, #716968, #819781,
    - bind broadcast client to new interfaces (#973807)
  - allow selection of cipher for private key files (#749530)
  - retry few times in ntpdate init script before giving up (#673198)
  - print synchronization distance instead of dispersion in ntpstat (#830821)
  - ignore duplicate servers from dhclient (#862983)
  - add fourth server to default ntp.conf and use iburst (#667524, #623616)
  - drop comment enabling local driver in default config (#816645)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-2
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-3
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - add nanosecond support to SHM refclock (#1117704)
  - allow creating all SHM segments with owner-only access (#1122015)
  - allow symmetric keys up to 32 bytes again (#1053551)
  - fix calculation of root dispersion (#1045376)
  - fix crash in ntpq mreadvar command (#1165141)
  - don't step clock for leap second with -x option (#1190619)
  - don't drop packets with source port below 123 (#1171630)
  - use larger RSA exponent in ntp-keygen (#1184421)
  - refresh peers on routing updates (#1193850)
  - increase memlock limit again (#1053568)
  - warn when monitor can't be disabled due to limited restrict (#1166596)
  - improve documentation of restrict command (#1069019)
  - update logconfig documentation for patched default (#1193849)
  - don't build ntpsnmpd (#995134)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-5
changelog:
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack
    (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems
    (CVE-2015-3405)
  - log when stepping clock for leap second or ignoring it with -x (#1204625)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-7
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-9
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - add option to set Differentiated Services Code Point (DSCP) (#1228314)
  - extend rawstats log (#1242895)
  - fix resetting of leap status (#1243034)
  - report clock state changes related to leap seconds (#1242937)
  - allow -4/-6 on restrict lines with mask (#1232146)
  - retry joining multicast groups (#1288534)
  - explain synchronised state in ntpstat man page (#1286969)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10
changelog:
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-10.el6_8.1
changelog:
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12.el6_9.1
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)


author: Tom Lane <tgl@redhat.com> 1.3-7
changelog:
  - Apply two upstream fixes for crasher bugs
  Resolves: #609389
  - Fix FTBFS: ImplicitDSOLinking (see Fedora bug 564783)


author: Tom Lane <tgl@redhat.com> 1.3-8
changelog:
  - Apply patches for CVE-2009-5030, CVE-2012-3358
  Resolves: #831562
  - Include -DCMAKE_INSTALL_LIBDIR in cmake call; fixes FTBFS with recent
    versions of cmake


author: Petr Hracek <phracek@redhat.com> 1.3-10
changelog:
  - Apply patch for CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052 
  Resolves: #1038987 CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052


author: Nikola Forró <nforro@redhat.com> - 1.3-16
changelog:
  - Revert previous changes in patch for CVE-2016-5159
  - Fix double free in patch for CVE-2016-5139
  - Fix memory leaks and invalid read in cio_bytein
    Related: #1419775


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-10
changelog:
  - revert previous patch (#1172296)
  - fix: crash in ldap_domain2hostlist when processing SRV record (#1164369)
  - support TLS 1.1 and later (#1160467)
  - enhancement: add ppolicy-check-password (#1155390)


author: Matúš Honěk <mhonek@redhat.com> - 2.4.40-7
changelog:
  - fix: regression: deadlock during SSL_ForceHandshake when getting connection to replica (#1267501)
    + apply (and modify a little) the patch from commit 1eeaeeb7


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-4
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1788447


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-105
changelog:
  - Fix ControlPersist option with ProxyCommand (#1160487)
  - Backport fix of ssh-keygen with error : gethostname: File name too long (#1161454)
  - Backport show remote address instead of UNKNOWN after timeout at password prompt (#1161449)
  - Fix printing of extensions in v01 certificates (#1093869)
  - Fix confusing audit trail for unsuccessful logins (#1127312)
  - Don't close fds for internal sftp sessions (#1085710)
  - Fix config parsing quotes (backport) (#1134938)
  - Enable logging in chroot into separate file (#1172224)
  - Fix auditing when using combination of ForcedCommand and PTY (#1131585)
  - Fix ssh-copy-id on non-sh remote shells (#1135521)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-106
changelog:
  - Add missing ControlPersist option to man ssh (#1197763)
  - Add sftp option to force mode of created files (#1191055)
  - Do not load RSA1 keys in FIPS mode (#1197072)
  - Add missing support for ECDSA in ssh-keyscan (#1196331)
  - Fix coverity/gcc issues (#1196063)
  - Backport wildcard functionality for PermitOpen in sshd_config file (#1159055)
  - Ability to specify an arbitrary LDAP filter in ldap.conf (#1119506)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-109
changelog:
  - Fix problems with failing persistent connections (#1131585)
  - Fix memory leaks in auditing patch (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-110
changelog:
  - Fix minor problems found by covscan/gcc (#1196063)
  - Add missing options in man ssh (#1197763)
  - Add KbdInteractiveAuthentication documentation to man sshd_config (#1109251)
  - Correct freeing newkeys structure when privileged monitor exits (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-113
changelog:
  - Fix segfaulting agent during removal of CAC credentials (#1253612)
  - Make  pam_namespace  usage consistent across system-wide (#1250069)
  - Add GSSAPIKexAlgorithms option for both server and client (#1253060)
  - ECDSA host key not loaded by sshd by default (fix man page) (#1218070)
  - Resolve segfault in pam_ssh_agent_auth in FIPS mode (#1278315)
  - Backport Match LocalAddress from OpenSSH 6.1 (#1211673)
  - Backport security patches from openssh-6.9 and 7.0 (#1281468)
  -  CVE-2015-5352: XSECURITY restrictions bypass under certain conditions
  -  CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices
  -  CVE-2015-6563: Privilege separation weakness related to PAM support
  -  CVE-2015-6564: Use-after-free bug related to PAM support
  -  weakness of agent locking (ssh-add -x) to password guessing (#1238238)
  - Clarify a keyword that appears in multiple matching Match blocks (#1219820)
  - Clarity of TERM variable in AcceptEnv and SendEnv options (#1285003)
  - Enhance AllowGroups documentation in man page (#1284997)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-114
changelog:
  - pam_ssh_agent_auth: Provide authorized_keys_command= feature (#1299555)
  - CVE-2016-1908: Prevent possible fallback from untrusted X11 forwarding (#1299048)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-116
changelog:
  - Restore functionallity of pam_ssh_agent_auth in FIPS mode (#1278315)
  - Initialize devices_done variable for challenge response (#1281468)
  - Update behaviour of X11 forwarding to match upstream (#1299048)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-119
changelog:
  - Resolve sftp force permission colision with umask (#1341747)
  - Relax bits needed check to allow hmac-sha2-512 with gss-group1-sha1- (#1353359)
  - close ControlPersist background process stderr when not in debug mode (#1335539)
  - Do not add a message "The agent has no identities." in ~/.ssh/authorized_keys (#1353410)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-120
changelog:
  - Prevent infinite loop when Ctrl+Z pressed at password prompt (#1218424)
  - Remove RC4 cipher and MD5 based MAC from the default client proposal (#1373836)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-122
changelog:
  - Allow to use ibmca crypto hardware (#1397547)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (1405374)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-34
changelog:
  - copy digest algorithm when handling SNI context switch
  - improve documentation of ciphersuites - patch by Hubert Kario
  - add support for setting Kerberos service and keytab in
    s_server and s_client


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-35
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-38
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.1
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.4
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1229871)
  - document some options of the speed command (#1197095)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.1
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.3
changelog:
  - fix CVE-2016-2177 - possible integer overflow
  - fix CVE-2016-2178 - non-constant time DSA operations
  - fix CVE-2016-2179 - further DoS issues in DTLS
  - fix CVE-2016-2180 - OOB read in TS_OBJ_print_bio()
  - fix CVE-2016-2181 - DTLS1 replay protection and unprocessed records issue
  - fix CVE-2016-2182 - possible buffer overflow in BN_bn2dec()
  - fix CVE-2016-6302 - insufficient TLS session ticket HMAC length check
  - fix CVE-2016-6304 - unbound memory growth with OCSP status request
  - fix CVE-2016-6306 - certificate message OOB reads
  - mitigate CVE-2016-2183 - degrade all 64bit block ciphers and RC4 to
    112 bit effective strength
  - replace expired testing certificates


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-52
changelog:
  - deprecate and disable verification of insecure hash algorithms
  - disallow DH keys with less than 1024 bits in TLS client
  - remove support for weak and export ciphersuites
  - use correct digest when exporting keying material in TLS1.2 (#1376741)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-12
changelog:
  - abort if selftests failed and random number generator is polled
  - mention EVP_aes and EVP_sha2xx routines in the manpages
  - add README.FIPS


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-13
changelog:
  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197)
  - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data()
    is called prematurely by application (#546707)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-14
changelog:
  - fix CVE-2009-3555 - support the safe renegotiation extension and
    do not allow legacy renegotiation on the server by default (#533125)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-15
changelog:
  - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which
    in the RHEL-5 and newer versions will crash in such case (#569774)


author: Tomas Mraz <tmraz@redhat.com> 0.9.8e-20.1
changelog:
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server
  - fix CVE-2015-3197 - SSLv2 ciphersuite enforcement
  - disable SSLv2 in the generic TLS method


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-1
changelog:
  - Update to upstream release 1.1.12-rc3
  - The CIB has O(2) better performance and updates are applied with greater reliablity
  - Transient attributes are now recorded in a truely atomic manner
  - Supports fencing agents that need the host to be unfenced at startup
  - CIB ACLs have been reimplemented and are now enabled 
  - Various bugs squashed

  - Resolves: rhbz#1020210 rhbz#1036631 rhbz#1069279
  - Resolves: rhbz#1069795 rhbz#1071995


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-2
changelog:
  - Bug rhbz#1054307 - cname pattern match should be more restrictive in init script
      Resolves: rhbz#1054307


author: Andrew Beekhof <beekhof@redhat.com> - 1.1.12-3
changelog:
  - Fix: crmd: avoid double free caused by nested hash table removal
  - Fix: ignore SIGPIPE with gnutls is in use
  - Fix: cib: cl#5222 - Prevent assert in xml_calculate_changes() on performing cib operations
      Resolves: rhbz#1071995


author: David Vossel <dvossel@redhat.com> - 1.1.12-5
changelog:
  - Properly clear shutdown transient attribute after node leaves
    membership.

    Resolves: rhbz#1198638


author: David Vossel <dvossel@redhat.com> - 1.1.12-6
changelog:
  - Fixes invalid free in attrd
  - Fixes crm_mon -E option for external script.
  - Fixes acl read-only access role assignment.

    Resolves: rhbz#1205292
    Resolves: rhbz#1208896
    Resolves: rhbz#1207621


author: Andrew Beekhof <abeekhof@redhat.com> - 1.1.12-7
changelog:
  - Ensure relevant components clear cache entries are cleared when peers leave the cluster

    Resolves: rhbz#1193499


author: David Vossel <dvossel@redhat.com> - 1.1.12-8
changelog:
  - Reduce log severity for style upgrade notice.
   - Properly export pacemaker related sysconfig variables
   - Remove warning during yum update of pacemaker packages.

    Resolves: rhbz#1163982
    Resolves: rhbz#1177821
    Resolves: rhbz#1210291


author: Klaus Wenninger <kwenning@redhat.com> - 1.1.14-1.0
changelog:
  - Update to upstream release 1.1.14
   - added README_RGManager_porting to document replacement of
       ccs2cib, ccs_flatten & disable_rgmanager
   - added patchset (0100-0111) from master to implement graceful
       stop of pacemaker_remote
   - require minimum-version 0.17.0 of libqb

    Resolves: rhbz#1193499
    Resolves: rhbz#1195500
    Resolves: rhbz#1200853
    Resolves: rhbz#1215809
    Resolves: rhbz#1219103
    Resolves: rhbz#1235316
    Resolves: rhbz#1246490
    Resolves: rhbz#1246563
    Resolves: rhbz#1252206
    Resolves: rhbz#1257333
    Resolves: rhbz#1275223
    Resolves: rhbz#1287535
    Resolves: rhbz#1297564


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.14-3
changelog:
  - prevent crmd crash after unexpected Pacemaker Remote connection takeover
   - ensure package URL is displayed correctly

    Resolves: rhbz#1252206


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-12
changelog:
  - add character sequence test to pam_cracklib
  - drop unused difignore option from pam_cracklib (#811243)
  - add enforce_for_root option to pam_cracklib (#588893)
  - mention limits.d in the limits.conf(5) manpage (#723297)
  - add ability to lock out inactive accounts to pam_lastlog
  - fix require_selinux option in pam_namespace (#750601)
  - add mntopts flag for tmpfs polyinstantiation method
  - preserve authtok_type in pam_get_authtok() (#811168)
  - fix username mismatch in pam_unix remember feature (#815516)
  - relax restriction of root in pam_pwhistory
  - relax soft nproc limit for root in 90-nproc.conf


author: Tomas Mraz <tmraz@redhat.com> 1.1.1-18
changelog:
  - pam_cracklib: improve documentation (#889233)
  - unbreak authentication if ld.so.preload is not empty
  - correct off by one error in account expiration calculation (#947011)
  - pam_console_apply: do not print error if console.perms.d is empty
  - properly handle all cases where crypt() might return NULL (#1026203)
  - pam_limits: clarify documentation of maxsyslogins limit (#1028490)
  - pam_access: call DNS resolution only when necessary and cache
    results (#1029817)
  - pam_limits: nofile applies to file descriptors not files (#1040664)
  - pam_limits: check whether the utmp login entry is valid (#1054936)
  - correct URLs in spec file (#1071770)
  - pam_userdb: correct the example in man page (#1078779)
  - pam_selinux: canonicalize username for getseuser() (#1083981)
  - pam_access: fix netgroup matching and @user@@netgroup parsing (#740233)


author: Tim Waugh <twaugh@redhat.com> 2.6-1
changelog:
  - 2.6.  No longer need stderr, suffix, stripcr, parse, allow-spaces,
    ifdef, program_name, or posix-backup patches.


author: Tim Waugh <twaugh@redhat.com> 2.6-2
changelog:
  - Applied upstream patch to prevent incorrect filename being chosen
    when adding a new file (bug #550319).


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-1
changelog:
  - Rebased to latest upstream packages
  - Fixed constraints removal and node standby/unstandby using remote GUI
  - Fixed displaying of fence / resource agent metadata in GUI
  - Added Pacemaker Resource defaults and Op defaults to 'pcs config' output
  - Fixed 'pcs resource clear' used on cloned group
  - Added support for scope option in cib commands
  - Added warning when creating a cluster with UDPU transport
  - Reload cluster.conf after node addition / removal
  - Resolves: rhbz#1185738 rhbz#1168982 rhbz#1174793 rhbz#1187488 rhbz#1190167 rhbz#1190168 rhbz#1191898 rhbz#1193433


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.139-9.el6_7.1
changelog:
  - Fixed session and cookies processing
  - Fixed command injection vulnerability
  - Resolves: rhbz#1253287 rhbz#1253291


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.146-1
changelog:
  - Rebased to latest upstream packages
  - Rubygems built with RELRO
  - Resolves: rhbz#1260021 rhbz#1242158


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.148-1
changelog:
  - Rebased to latest upstream packages
  - Fixed crashes on one-node clusters
  - Resolves: rhbz#1260021 rhbz#1283627


author: Ivan Devat <idevat@redhat.com> - 0.9.148-2
changelog:
  - Moved DISABLED_GUI option to /etc/sysconfig/pcsd
  - Added backend support for new cluster properties form in web UI
  - Fixed multilib .pyc/.pyo issue
  - Resolves: rhbz#1297782 rhbz#1298163


author: Ivan Devat <idevat@redhat.com> - 0.9.148-3
changelog:
  - Fixed updating cluster properties from older version of web UI
  - Fixed syntax error in utilization attributes functions
  - Resolves: rhbz#1298163
  - Related: rhbz#1260021


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-133
changelog:
  - Resolves: #698552 - Correct taintedness tests
  - Resolves: #825713 - Fix find2perl to translate ? glob properly
  - Resolves: #810469 - Upgrade IO-Compress, Compress-Raw-Bzip2, and
    Compress-Raw-Zlib to 2.021
  - Resolves: #819042 - Set default output for Pod::Man and Pod::Text
    parse_file() methods
  - Resolves: #905482 - Require glibc-devel, gdbm-devel, db4-devel by perl-devel


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-134
changelog:
  - Resolves: #973022 - Make non-option handler for Getopt::Long::GetOptions()
    compatible with XML::Simple


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-138
changelog:
  - Fix backslash interpolation in Locale::Maketext (bug #1025906)
  - Do not ignore single-letter-named packages by Module::Plugable (bug #1086215)
  - Run-require exact version of perl-libs by perl-suidperl (bug #1161170)


author: Paul Howarth <paul@city-fan.org> - 1.26-1
changelog:
  - Update to 1.26 (verify_hostname_of_cert matched only the prefix for the
    hostname when no wildcard was given, e.g. www.example.org matched against a
    certificate with name www.exam in it [#509819])


author: Paul Howarth <paul@city-fan.org> - 1.27-1
changelog:
  - Update to 1.27
    - various regex fixes for i18n and service names
    - fix warnings from perl -w (CPAN RT#48131)
    - improve handling of errors from Net::ssl_write_all


author: Paul Howarth <paul@city-fan.org> - 1.30-1
changelog:
  - Update to 1.30 (fix memleak when SSL handshake failed)
  - Add buildreq procps needed for memleak test


author: Paul Howarth <paul@city-fan.org> - 1.35-7
changelog:
  - update to svn trunk (rev 252), needed due to omission of MD2 functionality
    from OpenSSL 1.0.0 (CPAN RT#48916)


author: Remi Collet <rcollet@redhat.com> - 5.3.3-37
changelog:
  - gd: fix NULL pointer dereference in gdImageCreateFromXpm.
    CVE-2014-2497
  - fileinfo: fix incomplete fix for CVE-2012-1571 in
    cdf_read_property_info. CVE-2014-3587
  - core: fix incomplete fix for CVE-2014-4049 DNS TXT
    record parsing. CVE-2014-3597


author: Remi Collet <rcollet@redhat.com> - 5.3.3-38
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-39
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Remi Collet <rcollet@redhat.com> - 5.3.3-47
changelog:
  - fix wrong warning in openssl_encrypt() for missing IV
    when IV is not required #1260315
  - fix segfault's when you try and allocate an SplFixedArray
    with size >= 9999 #1071344
  - segfault in php_pgsql_meta_data CVE-2015-4644  #1234434
  - add options to enable TLS in curl #1255920
  - fix segfault in gc_collect_cycles #1122681


author: Remi Collet <rcollet@redhat.com> - 5.3.3-49
changelog:
  - fix php-soap fails to connect to HTTPS web service sporadically
    as stream_socket_enable_crypto() uses NONBLOCK #1283153


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-39
changelog:
  - Resolves #1144608 - pki-core failed to build with cmake-2.8.12.2-4.el6
  - Resolves #1037248 - pki-core FTBFS if "-Werror=format-security" flag is used
  - Resolves #1243 - Outdated selinux-policy dependency in Dogtag 9


author: Matthew Harmsen <mharmsen@redhat.com> 9.0.3-40
changelog:
  - Resolves #1171848 - IPA - port 9443 (pki-core) is vulnerable to SSLv3 POODLE
    (based upon upstream changes provided by cfu and alee)


author: Jack Magne <jmagne@redhat.com> 9.0.3-42
changelog:
  - Resolves #1221900 - pki-core: cross-site scripting flaw in the dogtag administration page (port 9180, port 9444) [rhel-6.7]


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-43
changelog:
  - Resolves #1225589 - unable to create rhel 7.1 replica from rhel 6 replica CA because subsystem user does not exist


author: Endi S. Dewata <edewata@redhat.com> 9.0.3-44
changelog:
  - Resolves #1256039 - Fixed missing subsystem user on external CA case.
  - Removed unused backup files (.p*) generated by the patches.


author: Ade Lee <alee@redhat.com> 9.0.3-48
changelog:
  - Resolves #1306989 - Crash seen with pki-common pkg during IPA server install
  - Resolves #1290535 - Check for incompatible Java at startup
  - Resolves #1313207 - ca.subsystem.certreq missing from CS.cfg


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-21
changelog:
  - fixfiles verify: do not relabel /tmp and /var/tmp dirs
  Resolves: rhbz#1113083
  - Fix semanage -S <store> -o <output>
  Resolves: rhbz#1122850


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-23
changelog:
  - Move python scripts in /usr/share/system-config-selinux to policycoreutils-python
  Resolves: rhbz#995778


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-26
changelog:
  - restorecond: treat root as a regular user
  Resolves: rhbz#1281877
  - semanage: don't skip reserver_port_t
  Resolves: rhbz#1225806
  - semanage: check if a store exists
  Resolves: rhbz#1208801
  - fixfiles: check the SELinux status
  Resolves: rhbz#1240788


author: Petr Lautrbach <plautrba@redhat.com> 2.0.83-27
changelog:
  - sandbox: Improve comments in sysconfig file
  Resolves: rhbz#1159336
  - secon, newrole: fix inconsistence between --help and man page
  Resolves: rhbz#1278811, rhbz#1278913


author: Miloslav Trmač <mitr@redhat.com> - 0.96-6
changelog:
  - Use real --help text and error messages instead of showing a man page in
    pkaction and pkcheck.  Fix description of (pkaction --action-id) in the man 
    page.
    Resolves: #628862
  - Add support for Identity=default in .pkla files
    Resolves: #812684
  - Use a consistent order for .pkla files within a directory.  Based on a patch
    by Jared Jennings <jared.jennings.ctr@eglin.af.mil>.
    Resolves: #864613
  - Build using PIE and relro
    Resolves: #927406


author: Marek Kasik <mkasik@redhat.com> - 0.12.4-4
changelog:
  - Add poppler-0.12.4-CVE-2010-3702.patch
      (Properly initialize parser)
  - Add poppler-0.12.4-CVE-2010-3703.patch
      (Properly initialize stack)
  - Add poppler-0.12.4-CVE-2010-3704.patch
      (Fix crash in broken pdf (code < 0))
  - Resolves: #639860


author: Marek Kasik <mkasik@redhat.com> - 0.12.3-3
changelog:
  - Correct %changelog
  - Correct permissions of goo/GooTimer.h
  - Convert pdftohtml.1 to utf8
  - Related: #543948


author: Marek Kasik <mkasik@redhat.com> - 0.12.3-4
changelog:
  - Fix text selection
  - Add patch poppler-0.12.3-text-selection.patch by Brian Ewins
  - Add patch poppler-0.12.3-text-selection-tables.patch by Marek Kasik
  - Make Provides/Obsoletes versioned
  - Add requirement of poppler-data
  - Resolves: #557812


author: Miroslav Lichvar <mlichvar@redhat.com> 2:2.6.6-1
changelog:
  - update to 2.6.6 (#588781)
  - move sasl config to /etc/sasl2 (#574439)
  - drop sasl v1 support
  - require Date::Calc for pflogsumm (#588726)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:2.6.6-6.1
changelog:
  - Backported patch to use long integers for message_size_limit,
    mailbox_size_limit and virtual_mailbox_limit
    Resolves: rhbz#1263265


author: Tom Lane <tgl@redhat.com> 8.4.7-2
changelog:
  - Add fix to make plpgsql cope with dropped columns in rowtypes
  Resolves: #694249
  - Add %{?_isa} to cross-subpackage Requires, per latest packaging guidelines,
    and add explicit dependencies on the -libs subpackage to pacify rpmdiff


author: Tom Lane <tgl@redhat.com> 8.4.9-1
changelog:
  - Update to PostgreSQL 8.4.9, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-9.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-8.html
    including the fix for CVE-2011-2483
  Resolves: #740736


author: Tom Lane <tgl@redhat.com> 8.4.11-1
changelog:
  - Update to PostgreSQL 8.4.11, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-10.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #812082


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830726


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852021


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017837)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065843) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-7
changelog:
  - backport PGSTARTTIMEOUT variable from latest RHSCL while reasonably
    changing wait timeout to 2 seconds by default


author: Tom Lane <tgl@redhat.com> 8.4.701-4
changelog:
  - Add patch to provide some stub functions for JDBC 4.1 compatibility
  Resolves: #816731
  - Minor modernization of specfile, eg use maven directory macros,
    remove long-obsolete minimum versions from BuildRequires


author: Tom Lane <tgl@redhat.com> 8.4.701-5
changelog:
  - Switch to noarch (non-GCJ) build so that we can BuildRequire JDK >= 1.6;
    without this we don't get a JDBC4 driver at all, let alone 4.1.
  Related: #816731


author: Tom Lane <tgl@redhat.com> 8.4.701-8
changelog:
  - Add explicit Obsoletes to get rid of old arch-specific packages,
    per discussions in bugs 821892 and 822206
  Related: #816731


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-6
changelog:
  - don't require logrotate (#922769)
  - move pppd database to /var/run/ppp to prevent SELinux AVCs (#968398)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-7
changelog:
  - ignore unrecognised radiusclient configuration directives (#906912)
  - add missing l2tp support (#815128)


author: Michal Sekletar <msekleta@redhat.com> - 2.4.5-8
changelog:
  - prevent running into issues caused by undefined behavior (pointers of incompatible types aliasing the same object)


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-26
changelog:
  - #1089817 - Return value of pgrep is incorrect
  - #950748 - /lib64/libproc.so package both in procps and procps-devel
  - #1011216 - Backport man page fix of top utility - RES = CODE + DATA
  - #1082877 - top/man: RES - physical memory a task 'has used'->'is using'
  - #1034337 - Include man pages for openproc(), readproc() and readproctab()
  - Resolves: rhbz#1089817 rhbz#950748 rhbz#1011216 rhbz#1082877 rhbz#1034337


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-27
changelog:
  - #1060681 - ps -p cycles over all PIDs instead of just one
  - #963799 - Should shared memory be accounted in cached in free output?
  - Resolves: rhbz#1060681 rhbz#963799


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-28
changelog:
  - #1105125 - Locale dependent float delay in top and watch utilities
  - #1039013 - Include an API in RHEL to return the number of opened file descriptors for a process
  - Resolves: rhbz#1105125
  - Related: rhbz#1034337


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-31
changelog:
  - #993072 - Make the "free" command a little more human friendly
  - #1172059 - ps coredump in stat2proc()
  - #1120580 - [RFE] Have sysctl -p read info from /etc/sysctl.d
  - #1123311 - RFE: "w" should have "-n" flag to suppress reverse name resolution of IP addresses
  - #1163404 - [procps] find_elf_note invalid read if setenv has been called before libproc init
  - Resolves: rhbz#993072 rhbz#1172059 rhbz#1120580 rhbz#1123311 rhbz#1163404


author: Jan Rybar <jrybar@redhat.com> - 3.2.8-43
changelog:
  - Rework of patch 91 from 3.2.8-37, stripping removed permanently, no new option
  - Resolves: rhbz#1322111


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.2
changelog:
  - fix integer overflows leading to heap overflow in file2strvec()
  - Resolves: CVE-2018-1124 CVE-2018-1126


author: Kamil Dudka <kdudka@redhat.com> - 3.2.8-45.el6_9.3
changelog:
  - drop leftover assignment in fix for CVE-2018-1124 causing a severe regression
  - Resolves: CVE-2018-1124


author: Robert Kuska <rkuska@redhat.com> - 2.6.6-59
changelog:
  - Let ConfigParse handle options without values
  - Add check phase to specfile, fix and skip relevant failing tests
  Resolves: rhbz#1031709


author: Matej Stuchlik <mstuchli@redhat.com> - 2.6.6-63
changelog:
  - Since -libs now provide python-ordered dict, added ordereddict
    dist-info to site-packages
  Resolves: rhbz#1199997


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346354


author: Tomas Orsava <torsava@redhat.com> - 2.6.6-65
changelog:
  - Fix for CVE-2016-0772 python: smtplib StartTLS stripping attack (rhbz#1303647)
    Raise an error when STARTTLS fails (upstream patch)
  - Fix for CVE-2016-5699 python: http protocol steam injection attack (rhbz#1303699)
    Disabled HTTP header injections in httplib (upstream patch)
  Resolves: rhbz#1346355


author: Karsten Hopp <karsten@redhat.com> 1.1.6-15
changelog:
  - disable sane subpackage and sane requirements for mainframes, we don't have
    sane on s390 and s390x


author: Joel Granados <jgranado@redhat.com> - 1.1.6-17
changelog:
  - Fix the shebang issue.  See https://fedoraproject.org/wiki/Features/SystemPythonExecutablesUseSystemPython


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.5-1
changelog:
  - v1.7.5 (Ernest) 19jul09
  - -----------------------
  -  * added support for ARC4 cipher and CTR block chaining (Denis Bernard)
  -  * made transport threads daemonize, to fix python 2.6 atexit behavior
  -  * support unicode hostnames, and IP6 addresses (Maxime Ripard, Shikhar
  -    Bhushan)
  -  * various small bug fixes


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server mode
    (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 1.10: https://gist.github.com/stevebeattie/0eb190004e10ba0926ad8782f89676ad
    Resolves #1557140


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-4
changelog:
  - Fix and enable tests (%check).
  - Backport a change which makes tests exit with nonzero status when they fail.
  - Add a fix for upstream tests for CVE-2018-7750 (broken in previous).


author: Marek Kasik <mkasik@redhat.com> - 2.3-3
changelog:
  - Add -fno-strict-aliasing to pass "Testsuite regressions" test
  - Make docs subpackage "noarch"
  - Resolves: #605103


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-1
changelog:
  - Switch over to using the "distribute" project; rebase to 0.6.10 (rhbz:570350)
  - Remove svn patch as upstream has chosen to go with an easier change for now.
  - Move easy_install back into the main package as the needed files have been
    moved from python-devel to the main python package.


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-2
changelog:
  - delete stray ".orig" file
  - change %define to %global ; use %{buildroot} rather than env var
  - move %check lower down
  - explicitly list executables


author: David Malcolm <dmalcolm@redhat.com> - 0.6.10-3
changelog:
  - cherrypick upstream patch for easy_install (ignore locally installed
  packages: patch0)
  - provide "python-distribute"
  - add README.txt and other .txt documentation files to the payload
  Resolves: rhbz#613138


author: Matthias Saou <http://freshrpms.net/> 8.1.0-2
changelog:
  - Update to 8.1.0.
  - Merge back changes from Paul Howarth.
  - Make sure the scriplets never return a non-zero exit status.


author: Lumír Balhar <lbalhar@redhat.com> - 8.2.0-7
changelog:
  - Fix CVE-2020-10108 HTTP request smuggling when presented with two Content-Length headers
  Resolves: rhbz#1813439
  - Remove useless macros definitions


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.471.el6
changelog:
  - kvm-aio-switch-aiocb_size-type-int-size_t.patch [bz#1069519]
  - kvm-aio-use-g_slice_alloc-for-AIOCB-pooling.patch [bz#1069519]
  - kvm-aio-rename-AIOPool-to-AIOCBInfo.patch [bz#1069519]
  - kvm-ide-ahci-Check-for-ECANCELED-in-aio-callbacks.patch [bz#1069519]
  - kvm-block-Add-refcnt-in-BlockDriverAIOCB.patch [bz#1069519]
  - kvm-block-Add-bdrv_aio_cancel_async.patch [bz#1069519]
  - kvm-block-Drop-bdrv_em_co_aiocb_info.cancel.patch [bz#1069519]
  - kvm-block-Drop-bdrv_em_aiocb_info.cancel.patch [bz#1069519]
  - kvm-posix-aio-Remove-raw_aiocb_info.cancel.patch [bz#1069519]
  - kvm-linux-aio-Convert-laio_aiocb_info.cancel-to-.cancel_.patch [bz#1069519]
  - kvm-dma-Convert-dma_aiocb_info.cancel-to-.cancel_async.patch [bz#1069519]
  - kvm-blkdebug-Drop-blkdebug_aiocb_info.cancel.patch [bz#1069519]
  - kvm-curl-Drop-curl_aiocb_info.cancel.patch [bz#1069519]
  - kvm-qed-Drop-qed_aiocb_info.cancel.patch [bz#1069519]
  - kvm-rbd-Drop-rbd_aiocb_info.cancel.patch [bz#1069519]
  - kvm-vdi-Drop-vdi_aio_cancel.cancel.patch [bz#1069519]
  - kvm-gluster-Drop-gluster_aiocb_info.cancel.patch [bz#1069519]
  - kvm-block-Drop-AIOCBInfo.cancel.patch [bz#1069519]
  - kvm-block-Rename-qemu_aio_release-qemu_aio_unref.patch [bz#1069519]
  - kvm-scsi-Drop-scsi_req_abort.patch [bz#1069519]
  - kvm-scsi-generic-Handle-canceled-request-in-scsi_command.patch [bz#1069519]
  - kvm-scsi-Unify-request-unref-in-scsi_req_cancel.patch [bz#1069519]
  - kvm-scsi-Drop-SCSIReqOps.cancel_io.patch [bz#1069519]
  - kvm-scsi-Introduce-scsi_req_cancel_complete.patch [bz#1069519]
  - kvm-scsi-Introduce-scsi_req_cancel_async.patch [bz#1069519]
  - kvm-virtio-scsi-Handle-TMF-request-cancellation-asynchro.patch [bz#1069519]
  - kvm-scsi-fix-cancellation-when-I-O-was-completed-but-DMA.patch [bz#1069519]
  - kvm-block-Fix-bdrv_aio_co_cancel_em-RHEL-only.patch [bz#1069519]
  - kvm-qcow2-Zero-write-support.patch [bz#1130014]
  - Resolves: bz#1069519
    ([FJ6.5 Bug] A KVM guest hangs up for about 30 seconds after issuing SG_IO ioctl to a virtio-scsi device.)
  - Resolves: bz#1130014
    (test case 033 and 034 of qemu-iotests fail for vmdk)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.472.el6
changelog:
  - kvm-virtio-pci-avoid-repeatedly-deassigning-notifers-of-.patch [bz#1124311]
  - Resolves: bz#1124311
    (Qemu-kvm aborted when boot with 232 virtio NICs (multiple function is on))


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.473.el6
changelog:
  - kvm-blockdev-preserve-I-O-throttling-across-drives_reope.patch [bz#1211513]
  - Resolves: bz#1211513
    (IO throttling doesn't work after migration)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.474.el6
changelog:
  - kvm-block-avoid-useless-checks-on-acb-bh.patch [bz#1130014]
  - kvm-clean-unnecessary-code-don-t-check-g_strdup-arg-for-.patch [bz#1205288]
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1205288]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1205288]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1205288]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1205288]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1205288]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1205288]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1205288]
  - Resolves: bz#1130014
    (test case 033 and 034 of qemu-iotests fail for vmdk)
  - Resolves: bz#1205288
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.475.el6
changelog:
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219268]
  - Resolves: bz#1219268
    (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-6.7])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.476.el6
changelog:
  - kvm-block-Fix-bdrv_aio_cancel-RHEL-only.patch [bz#1220674]
  - Resolves: bz#1220674
    (Received no response to QMP command 'system_reset')


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.477.el6
changelog:
  - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225887]
  - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225887]
  - Resolves: bz#1225887
    (EMBARGOED CVE-2015-3209 qemu-kvm: qemu: pcnet: multi-tmd buffer flow in the tx path [rhel-6.7])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.478.el6
changelog:
  - kvm-vdi-Avoid-direct-AIO-callback.patch [bz#1130046]
  - kvm-vdi-Initialize-acb-bh-in-vdi_aio_setup.patch [bz#1130046]
  - Resolves: bz#1130046
    (test case 084 of qemu-iotests fail for vdi)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6
changelog:
  - kvm-posix-aio-compat-fix-acb-ev_signo-race-condition.patch [bz#1233292]
  - Resolves: bz#1233292
    (qemu-kvm randomly crashes with "kill failed failed: Invalid argument")


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.1
changelog:
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248761]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248761]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248761]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248761]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248761]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248761]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248761]
  - Resolves: bz#1248761
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-6.7.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.2
changelog:
  - kvm-net-add-checks-to-validate-ring-buffer-pointers-CVE-.patch [bz#1263274]
  - Resolves: bz#1263274
    (CVE-2015-5279 qemu-kvm: qemu: Heap overflow vulnerability in ne2000_receive() function [rhel-6.7.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.3
changelog:
  - kvm-net-pcnet-add-check-to-validate-receive-data-size-CV.patch [bz#1287950]
  - kvm-pcnet-fix-rx-buffer-overflow-CVE-2015-7512.patch [bz#1287950]
  - Resolves: bz#1287950
    (CVE-2015-7504 CVE-2015-7512 qemu-kvm: various flaws [rhel-6.7.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.4
changelog:
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298045]
  - Resolves: bz#1298045
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-6.7.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.483.el6
changelog:
  - kvm-rtl8139-Fix-receive-buffer-overflow-check.patch [bz#1262866]
  - kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in.patch [bz#1262866]
  - Resolves: bz#1262866
    ([RHEL6] Package is 100% lost when ping from host to Win2012r2 guest with 64000 size)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.484.el6
changelog:
  - kvm-qga-flush-explicitly-when-needed.patch [bz#1210246]
  - kvm-qga-add-guest-set-user-password-command.patch [bz#1174181]
  - kvm-qcow2-Zero-initialise-first-cluster-for-new-images.patch [bz#1223216]
  - kvm-Documentation-Warn-against-qemu-img-on-active-image.patch [bz#1297424]
  - kvm-target-i386-warns-users-when-CPU-threads-1-for-non-I.patch [bz#1292678]
  - kvm-qemu-options-Fix-texinfo-markup.patch [bz#1250442]
  - kvm-qga-Fix-memory-allocation-pasto.patch []
  - kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work-.patch [bz#1268347]
  - Resolves: bz#1174181
    (RFE: provide QEMU guest agent command for setting root/administrator account password)
  - Resolves: bz#1210246
    ([virtagent]The 'write' content is lost if 'read' it before flush through guest agent)
  - Resolves: bz#1223216
    (qemu-img can not create qcow2 image when backend is block device)
  - Resolves: bz#1250442
    (qemu-doc.html bad markup in section 3.3 Invocation)
  - Resolves: bz#1268347
    (posix_fallocate emulation on NFS fails with Bad file descriptor if fd is opened O_WRONLY)
  - Resolves: bz#1292678
    (Qemu should report error when cmdline set threads=2 in amd host)
  - Resolves: bz#1297424
    (Add warning about running qemu-img on active VMs to its manpage)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.485.el6
changelog:
  - kvm-Change-fsfreeze-hook-default-location.patch [bz#1213233]
  - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch [bz#1290743]
  - Resolves: bz#1213233
    ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)
  - Resolves: bz#1290743
    (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.486.el6
changelog:
  - kvm-blockdev-Error-out-on-negative-throttling-option-val.patch [bz#1294619]
  - kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE.patch [bz#1298046]
  - Resolves: bz#1294619
    (Guest should failed to boot if set iops,bps to negative number)
  - Resolves: bz#1298046
    (CVE-2016-1714 qemu-kvm: Qemu: nvram: OOB r/w access in processing firmware configurations [rhel-6.8])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.487.el6
changelog:
  - kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques.patch [bz#1249740]
  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249740]
  - Resolves: bz#1249740
    (Segfault occurred at Dst VM while completed migration upon ENOSPC)


author: Miroslav Rezanina <mrezanin@redhat.com - 0.12.1.2-2.488.el6
changelog:
  - Fixed qemu-ga path configuration [bz#1213233]
  - Resolves: bz#1213233
    ([virtagent] The default path '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script doesn't exist)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.489.el6
changelog:
  - kvm-hw-qxl-qxl_send_events-nop-if-stopped.patch [bz#1290743]
  - kvm-block-mirror-fix-full-sync-mode-when-target-does-not.patch [bz#971312]
  - Resolves: bz#1290743
    (qemu-kvm core dumped when repeat system_reset 20 times during guest boot)
  - Resolves: bz#971312
    (block: Mirroring to raw block device doesn't zero out unused blocks)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.490.el6
changelog:
  - kvm-qemu-ga-implement-win32-guest-set-user-password.patch [bz#1174181]
  - kvm-util-add-base64-decoding-function.patch [bz#1174181]
  - kvm-qga-convert-to-use-error-checked-base64-decode.patch [bz#1174181]
  - kvm-qga-use-more-idiomatic-qemu-style-eol-operators.patch [bz#1174181]
  - kvm-qga-use-size_t-for-wcslen-return-value.patch [bz#1174181]
  - kvm-qga-use-wide-chars-constants-for-wchar_t-comparisons.patch [bz#1174181]
  - kvm-qga-fix-off-by-one-length-check.patch [bz#1174181]
  - kvm-qga-check-utf8-to-utf16-conversion.patch [bz#1174181]
  - Resolves: bz#1174181
    (RFE: provide QEMU guest agent command for setting root account password (Linux guest))


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.491.el6_8.1
changelog:
  - kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331407]
  - kvm-vga.h-remove-unused-stuff-and-reformat.patch [bz#1331407]
  - kvm-vga-use-constants-from-vga.h.patch [bz#1331407]
  - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patch [bz#1331407]
  - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.patch [bz#1331407]
  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331407]
  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331407]
  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331407]
  - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac.patch [bz#1331407]
  - Resolves: bz#1331407
    (EMBARGOED CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-6.8.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.491.el6_8.2
changelog:
  - kvm-vga-add-sr_vbe-register-set.patch [bz#1347192]
  - Resolves: bz#1347192
    (Regression from CVE-2016-3712: windows installer fails to start)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.491.el6_8.3
changelog:
  - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.patch [bz#1359724]
  - Resolves: bz#1359724
    (EMBARGOED CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-6.8.z])


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.497.el6
changelog:
  - kvm-vmstate-fix-breakage-by-7e72abc382b700a72549e8147bde.patch [bz#1294941]
  - Resolves: bz#1294941
    (QEMU crash on snapshot revert when using Cirrus)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.498.el6
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1392520]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1392520]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1392520]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1392520]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1392520]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1392520]
  - kvm-PATCH-1-4-e1000-pre-initialize-RAH-RAL-registers.patch [bz#1300626]
  - kvm-net-update-nic-info-during-device-reset.patch [bz#1300626]
  - kvm-net-e1000-update-network-information-when-macaddr-is.patch [bz#1300626]
  - kvm-net-rtl8139-update-network-information-when-macaddr-.patch [bz#1300626]
  - Resolves: bz#1300626
    (e1000/rtl8139: qemu mac address can not be changed via set the hardware address in guest)
  - Resolves: bz#1392520
    ([RHEL6.9] KVM guest shuts itself down after 128th reboot)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.499.el6
changelog:
  - kvm-rename-qemu_aio_context-to-match-upstream.patch [bz#876993]
  - kvm-block-stop-relying-on-io_flush-in-bdrv_drain_all.patch [bz#876993]
  - kvm-block-add-bdrv_drain.patch [bz#876993]
  - kvm-block-avoid-very-long-pauses-at-the-end-of-mirroring.patch [bz#876993]
  - Resolves: bz#876993
    (qemu-kvm: vm's become non-responsive during migrate disk load from 2 domains to a 3ed)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.500.el6
changelog:
  - kvm-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Disable-086.patch [bz#1405882]
  - kvm-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-iotests-Use-_img_info.patch [bz#1405882]
  - Resolves: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.501.el6
changelog:
  - kvm-Revert-iotests-Use-_img_info.patch [bz#1405882]
  - kvm-Revert-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-Revert-iotests-Disable-086.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-Revert-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-Revert-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-net-check-packet-payload-length.patch [bz#1398214]
  - Resolves: bz#1398214
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-6.9])
  - Reverts: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.502.el6
changelog:
  - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop.patch [bz#1418231 bz#1419417]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418231 bz#1419417]
  - Resolves: bz#1418231
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])
  - Resolves: bz#1419417
    (CVE-2017-2615 qemu-kvm-rhev: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420487 bz#1420489]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420487 bz#1420489]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420487 bz#1420489]
  - Resolves: bz#1420487
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])
  - Resolves: bz#1420489
    (EMBARGOED CVE-2017-2620 qemu-kvm-rhev: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.1
changelog:
  - kvm-vns-tls-don-t-use-depricated-gnutls-functions.patch [bz#1428750]
  - kvm-vnc-apply-display-size-limits.patch [bz#1400438 bz#1425943]
  - Resolves: bz#1400438
    (qemu-kvm coredump in vnc_refresh_server_surface [rhel-6.9.z])
  - Resolves: bz#1425943
    (CVE-2017-2633 qemu-kvm-rhev: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.9.z])
  - Resolves: bz#1428750
    (Fails to build in brew)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.2
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1443447 bz#1443449]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1443447 bz#1443449]
  - Resolves: bz#1443447
    (CVE-2017-7718 qemu-kvm: Qemu: display: cirrus: OOB read access issue [rhel-6.9.z])
  - Resolves: bz#1443449
    (CVE-2017-7718 qemu-kvm-rhev: Qemu: display: cirrus: OOB read access issue [rhel-6.9.z])
  - Resolves: bz#1447544
    (CVE-2016-9603 qemu-kvm-rhev: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.9.z] )
  - Resolves: bz#1447540
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.9.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.3
changelog:
  - kvm-cirrus-avoid-write-only-variables.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-fix-PUTPIXEL-macro.patch [bz#1444377 bz#1444379]
  - Resolves: bz#1444377
    (CVE-2017-7980 qemu-kvm: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.9.z])
  - Resolves: bz#1444379
    (CVE-2017-7980 qemu-kvm-rhev: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.9.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.503.el6_9.5
changelog:
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501296]
  - Resolves: bz#1501296
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-6.9.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.503.el6_9.6
changelog:
  - qemu-kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574067]
  - Resolves: bz#1574067
    (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-6.9.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.504.el6
changelog:
  - kvm-vns-tls-don-t-use-depricated-gnutls-functions.patch [bz#1428750]
  - kvm-vnc-apply-display-size-limits.patch [bz#1430616 bz#1430617]
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1443448 bz#1443450]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1443448 bz#1443450 bz#1447542 bz#1447545]
  - kvm-cirrus-avoid-write-only-variables.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1444378 bz#1444380]
  - kvm-cirrus-fix-PUTPIXEL-macro.patch [bz#1444378 bz#1444380]
  - Resolves: bz#1428750
    (Fails to build in brew)
  - Resolves: bz#1430616
    (CVE-2017-2633 qemu-kvm: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1430617
    (CVE-2017-2633 qemu-kvm-rhev: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.10])
  - Resolves: bz#1443448
    (CVE-2017-7718 qemu-kvm: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1443450
    (CVE-2017-7718 qemu-kvm-rhev: Qemu: display: cirrus: OOB read access issue [rhel-6.10])
  - Resolves: bz#1444378
    (CVE-2017-7980 qemu-kvm: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1444380
    (CVE-2017-7980 qemu-kvm-rhev: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.10])
  - Resolves: bz#1447542
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])
  - Resolves: bz#1447545
    (CVE-2016-9603 qemu-kvm-rhev: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.505.el6
changelog:
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [bz#1525939 bz#1528024]
  - kvm-cirrus-fix-oob-access-in-mode4and5-write-functions.patch [bz#1501298]
  - kvm-vga-stop-passing-pointers-to-vga_draw_line-functions.patch [bz#1486641]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534692]
  - Resolves: bz#1486641
    (CVE-2017-13672 qemu-kvm-rhev: Qemu: vga: OOB read access during display update [rhel-6.10])
  - Resolves: bz#1501298
    (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-6.10])
  - Resolves: bz#1525939
    (CVE-2017-5715 qemu-kvm: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1528024
    (CVE-2017-5715 qemu-kvm-rhev: hw: cpu: speculative execution branch target injection [rhel-6.10])
  - Resolves: bz#1534692
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-6.10])
  - Resolves: bz#1549152
    (qemu-kvm-rhev: remove unused patch file [rhel-6.10])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6
changelog:
  - kvm-vga-add-share_surface-flag.patch [bz#1553674]
  - kvm-vga-add-sanity-checks.patch [bz#1553674]
  - Resolves: bz#1553674
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.1
changelog:
  - qemu-kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574074]
  - qemu-kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1574074]
  - qemu-kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1574074]
  - Resolves: bz#1574074
    (CVE-2018-3639 qemu-kvm: hw: cpu: speculative store bypass [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.3
changelog:
  - kvm-target-i386-define-md-clear-bit.patch [bz#1698996]
  - Resolves: bz#1698996
    (CVE-2018-12130 qemu-kvm: hardware: MFBDS)


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.4
changelog:
  - kvm-target-i386-Sanitize-the-XSAVE-related-feature-bits.patch [bz#1673779]
  - kvm-slirp-check-sscanf-result-when-emulating-ident.patch [bz#1689790]
  - Resolves: bz#1673779
    (RHEL8 VM's do not install on RHEL6 KVM hypervisor)
  - Resolves: bz#1689790
    (CVE-2019-9824 qemu-kvm: QEMU: Slirp: information leakage in tcp_emu() due to uninitialized stack variables [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.5
changelog:
  - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch [bz#1669066]
  - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch [bz#1669066]
  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch [bz#1669066]
  - kvm-qxl-check-release-info-object.patch [bz#1712728]
  - kvm-net-Use-iov-helper-functions.patch [bz#1636415]
  - kvm-net-increase-buffer-size-to-accommodate-Jumbo-frame-.patch [bz#1636415]
  - kvm-net-ignore-packet-size-greater-than-INT_MAX.patch [bz#1636415]
  - kvm-net-drop-too-large-packet-early.patch [bz#1636415]
  - kvm-PATCH-slirp-fix-buffer-overrun.patch [bz#1586251]
  - kvm-Fix-build-from-previous-commit.patch [bz#1586251]
  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch [bz#1586251]
  - kvm-slirp-Convert-mbufs-to-use-g_malloc-and-g_free.patch [bz#1586251]
  - kvm-slirp-correct-size-computation-while-concatenating-m.patch [bz#1586251]
  - kvm-pcnet-fix-possible-buffer-overflow.patch [bz#1636774]
  - Resolves: bz#1586251
    (CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams [rhel-6.10.z])
  - Resolves: bz#1636415
    (CVE-2018-10839 qemu-kvm: Qemu: ne2000: integer overflow leads to buffer overflow issue [rhel-6])
  - Resolves: bz#1636774
    (CVE-2018-17962 qemu-kvm: Qemu: pcnet: integer overflow leads to buffer overflow [rhel-6])
  - Resolves: bz#1669066
    (CVE-2019-6778 qemu-kvm: QEMU: slirp: heap buffer overflow in tcp_emu() [rhel-6.10.z])
  - Resolves: bz#1712728
    (CVE-2019-12155 qemu-kvm: QEMU: qxl: null pointer dereference while releasing spice resources [rhel-6])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.6
changelog:
  - kvm-Fix-heap-overflow-in-ip_reass-on-big-packet-input.patch [bz#1734747]
  - kvm-Using-ip_deq-after-m_free-might-read-pointers-from-a.patch [bz#1749731]
  - kvm-tcp_emu-Fix-oob-access.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-IRC-commands.patch [bz#1791558]
  - kvm-slirp-use-correct-size-while-emulating-commands.patch [bz#1791558]
  - Resolves: bz#1734747
    (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-6.10.z])
  - Resolves: bz#1749731
    (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-6])
  - Resolves: bz#1791558
    (CVE-2020-7039 qemu-kvm: QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-6.10.z])


author: Wainer dos Santos Moschetta <wainersm@redhat.com> - 0.12.1.2-2.506.el6_10.7
changelog:
  - kvm-slirp-disable-tcp_emu.patch [bz#1791680]
  - kvm-slirp-add-slirp_fmt-helpers.patch [bz#1798966]
  - kvm-tcp_emu-fix-unsafe-snprintf-usages.patch [bz#1798966]
  - Resolves: bz#1791680
    (QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. [rhel-6])
  - Resolves: bz#1798966
    (CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages [rhel-6.10.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.506.el6_10.8
changelog:
  - kvm-qemu-kvm-QEMU-usb-check-RNDIS-message-length.patch [bz#1869684]
  - kvm-qemu-kvm-QEMU-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869684]
  - Resolves: bz#1869684
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-6.10.z])


author: Petr Hracek <phracek@redhat.com> - 1.17.2-2
changelog:
  - Update description
  - Remove other distros from SPEC
  - Changed license
  - Change Source0 to Sourceforge
  - Resolves: #981637


author: David Vossel <dvossel@redhat.com> - 3.9.5-16
changelog:
  - Fixes unreliable detection of nic device in IPaddr2
  - Fix fs-lib.sh regression in is_alive write test failure detection
  - Fix properly handle mysql when alternate user is specified.

    Resolves: rhbz#1181187
    Resolves: rhbz#1183735
    Resolves: rhbz#1183148


author: David Vossel <dvossel@redhat.com> - 3.9.5-17
changelog:
  - Fixes rgmanager lvm agent's ability to exclusively activate
    volume groups on nodes with aliases

    Resolves: rhbz#1085109


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-26
changelog:
  - Match exact Oracle SID to avoid waiting for 90 seconds and killing other databases if their names include the name of the database you're trying to stop
  - Use DAD to check for address collision instead of ping for IPv6 in rgmanager
  - MySQL wait up to "startup_wait" seconds for mysqld to create PID
  - Handle failure state during stop in orainstance.sh
  - Add Oracle resource agents for Pacemaker

    Resolves: rhbz#1200639
    Resolves: rhbz#1191247
    Resolves: rhbz#1207285
    Resolves: rhbz#1234777
    Resolves: rhbz#1070479


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-27
changelog:
  - SAP HANA add Multiple Components One System (MCOS) support
  - sap_redhat_cluster_connector add support for "-" in hostnames

    Resolves: rhbz#1200903
    Resolves: rhbz#1269897


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-28
changelog:
  - Use IPv6 DAD for collision detection in IPaddr2
  - Add RAID segment type support for HA LVM
  - Fix Tomcat SELinux failed in enforcing mode
  - Add migrate_options parameter to VirtualDomain
  - Remove not-working tmpfs "support" from fs.sh
  - Fix tmpfile leak in mysql resource agent

    Resolves: rhbz#1276698
    Resolves: rhbz#1266173
    Resolves: rhbz#1280319
    Resolves: rhbz#1286650
    Resolves: rhbz#1024505
    Resolves: rhbz#1292054


author: Jan Pokorny <jpokorny@redhat.com> - 3.9.5-31
changelog:
  - Fix up for wrongly generated RNG schema for cluster configuration
    wrt. "action" tag

    Related: rhbz#1272587


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 3.9.5-32
changelog:
  - Add portblock resource agent for Pacemaker
  - Add Oracle Data Guard resource agent for rgmanager

    Resolves: rhbz#1302545
    Resolves: rhbz#1086838


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-20
changelog:
  - rgmanager: clusvcadm: If service doesn't exist, try
    Resolves: rhbz#952729
  - rgmanager: Don't crash if a resource agent does not
    Resolves: rhbz#1018079
  - rgmanager: Fix rg_test exit status on failures
    Resolves: rhbz#1033162
  - rgmanager: resrules: make expand_time buffer-less
    Resolves: rhbz#1036652
  - rgmanager: Fix error logging when building the resource
    Resolves: rhbz#1053739


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-22
changelog:
  - rgmanager: Fix potential NULL ptr deref in clustat
    Resolves: rhbz#1079207
  - rgmanager: Log a warning when the non-critical flag is
    Resolves: rhbz#1128877
  - rgmanager: Don't restart locally if failover domain
    Resolves: rhbz#1151199


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-25
changelog:
  - rgmanager: Fix bash syntax error in clunfslock
    rgmanager: clunfslock: copy state info if it exists
    Resolves: rhbz#1278943


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.1
changelog:
  - rgmanager: Reload the resource tree after quorum is regained
    if central processing is enabled.
    Resolves: rhbz#1335412


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.2
changelog:
  - rgmanager: Forget that we were transition master if quorum is dissolved
    rgmanager: Re-init the vf key callbacks after losing and recovering quorum
    Resolves: rhbz#bz1335412
  - rgmanager: Check for NULL when attempting to access the member list
    Resolves: rhbz#bz1343345


author: Ryan McCabe <rmccabe@redhat.com> - 3.0.12.1-26.3
changelog:
  - rgmanager: Exit more gracefully if cman stops first when cpg locks are used
    Resolves: rhbz#1344640


author: Jeff Garzik <jgarzik@redhat.com> - 2-6
changelog:
  - Resolves: bz#576678
  - increase version number of rng-utils that we obsolete
  - use global rather than define, for sbindir (Fedora pkg review)
  - improve BuildRoot (Fedora pkg review)


author: David Howells <dhowells@rehdat.com> - 2-7
changelog:
  - Resolves: bz#597221
  - Fix some compiler warnings thus dealing with the SEGV
  - Make do_loop() correctly interpret the result of iter->xread()


author: Jay Fenlason <fenlason@redhat.com> - 2-9
changelog:
  - Add patch from James M. Leddy <james.leddy@redhat.com> to add
    an option to ignore FIPS failures.
    Resolves: bz#733452


author: Jeff Garzik <jgarzik@redhat.com> - 2-13
changelog:
  - Resolves: bz#751374
  - Add post/preun calls to chkconfig, during rpm install/removal
  - Remove unused rotate, resume steps from init script


author: Steve Dickson <steved@redhat.com> - 0.2.0-10
changelog:
  - Make is_loopback check more permissive (bz 731542)
  - Removed the rpcbind(3) reference in the man page (bz 813898)


author: Adam Tkac <atkac redhat com> - 0.17-60
changelog:
  - merge review related fixes (#226379)
  - remove unused patches
    - netkit-rsh-0.16-pamfix.patch
    - netkit-rsh-0.16-jbj2.patch
    - netkit-rsh-0.16-jbj3.patch


author: Michal Ruprich <mruprich@redhat.com> - 0.17-64.1
changelog:
  - Resolves: #1450821 - rlogin fails to connect rsh-server after updating util-linux-ng from version 2.17.2-12.18.el6 to 2.17.2-12.24.el6


author: Tomas Heinrich <theinric@redhat.com> 7.4.10-1
changelog:
  - initial import of rsyslog7
    changes since rsyslog-5.8.10-8:
    - rebase to 7.4.10
    - drop patches merged upstream
    - regenerate patches for rhbz820311, rhbz886117
    - add a patch to remove dependency on liblogging-stdlog
    - add a patch to fix compilation of omelasticsearch
      on platforms without atomic instructions
    - mark package as conlicting with rsyslog
    - update specification of dependencies
    - add the rsyslog-recover-qi.pl script
    - add new plugins
      imdiag, mmanon, mmjsonparse, mmsnmptrapd, omelasticsearch,
      pmaixforwardedfrom, pmcisconames, pmsnare
    - add new subpackage rsyslog-elasticsearch
    - make the build more verbose by adding 'V=1' to make
    - update conf file for new omusrmsg syntax
      for details, see http://www.rsyslog.com/doc/v6compatibility.html
    - drop default compatibility mode from SYSLOGD_OPTIONS
      for details, see http://www.rsyslog.com/doc/v6compatibility.html
    - fix typos in the spec file
    resolves: #869600


author: Tomas Heinrich <theinric@redhat.com> 7.4.10-2
changelog:
  - amend rsyslog.conf man page with information on omitting file sync
    resolves: #994127
  - add a patch to support TCP KEEPALIVE in imrelp
    resolves: #1009048
  - add a patch to fix missing note about message repetition in imuxsock
    resolves: #1020431
  - add a patch to prevent division-by-zero errors
    resolves: #996862
  - add a patch to fix the name of the PID file in man page
    resolves: #1009882
  - add a patch to remove references to Google ads from the html docs
    resolves: #1030040
  - add missing image files referenced from the html docs
    resolves: #1031673
  - add a patch to backport the mmcount module
    resolves: #1030206
  - add a patch to support arbitrary number of listeners in imuxsock
    resolves: #1096732
  - remove clean section
    resolves: #869600
  - add a list of bugs fixed by rebasing to 7.4.10
    resolves: #996857, #1007409, #1029910, #1061614, #1070689


author: - Andreas Schneider <asn@redhat.com> - 4.0.0-61.rc4
changelog:
  - resolves: #1073356 - Fix CVE-2012-6150.
  - resolves: #1073356 - Fix CVE-2013-4496.
  - resolves: #1073356 - Fix CVE-2013-6442.


author: - Guenther Deschner <gdeschner@redhat.com> - 4.0.0-62.rc4
changelog:
  - resolves: #1105502 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108843 - CVE-2014-3493: DoS in smbd with unicode path names.
  - resolves: #1105572 - CVE-2014-0178: Uninitialized memory exposure.


author: Andreas Schneider <asn@redhat.com> - 4.0.0-67.rc4
changelog:
  - resolves: #1290708 - CVE-2015-7540
  - related: #1290708 - CVE-2015-5299
  - related: #1290708 - CVE-2015-5296
  - related: #1290708 - CVE-2015-5252
  - related: #1290708 - CVE-2015-5330


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-8
changelog:
  - Synchronize patches for Samba 4.2.10 with RHEL 7.2.z
  - Resolves: #1383685 - Update samba4 to be on par with RHEL 7.2.z


author: Andreas Schneider <asn@redhat.com> - 4.0.0-67.rc4
changelog:
  - resolves: #1290709 - CVE-2015-7540
  - related: #1290709 - CVE-2015-5299
  - related: #1290709 - CVE-2015-5296
  - related: #1290709 - CVE-2015-5252
  - related: #1290709 - CVE-2015-5330


author: Nils Philippsen <nils@redhat.com> - 0.95-1
changelog:
  - ignore whitespace and empty lines when checking /etc/hosts
  - use mktemp to create temporary host file
  - add release numbers to changelog entries


author: Jan Grulich <jgrulich@redhat.com> - 0.98-1
changelog:
  - add Man-Page
  - correctly detect VMware virtual guest
  - do not write to /etc/security/limits.conf directly
  - correctly edit /etc/hosts


author: Jan Grulich <jgrulich@redhat.com> - 0.98-5
changelog:
  - add information about KVM to manpage 
    resolves: bz#1123917
  - set correct vm.max_map_count value
    resolves: bz#1168422
  - do not wait for input from keyboard and read from file instead
    resolves: bz#1173861
  - add information about sapconf version
    resolves: bz#1174321


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-20
changelog:
  - register and deregister: if there is an error registering or deregistering
    one or more collection, skip it but return non-zero return code
  - fix the problem with metapackage dependencies when BuildArch is specified


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-21
changelog:
  - fix an obscure segfault when listing collections on i386
  - fix registration to work with slash-ended paths
  - add the %scl_dependency_generators macro
  - drop recursive ownership of /usr/lib within SCL root


author: Jan Zeleny <jzeleny@redhat.com> - 20120927-22
changelog:
  - Add execution of register and deregister scripts during registration
    and deregistration if they exist.
  - Add capability to make collection nfs mountable using macro nfsmountable.
  - removed the dependency generators and all related changes
    (maintainers' demands)


author: Lubos Kardos <lkardos@redhat.com - 20120927-23
changelog:
  - Modified paths of state and conf files
  - Add owning and creating of state and conf files if nfsmountable is defined
  - Add printing file names in error messages


author: Lubos Kardos <lkardos@redhat.com> - 20120927-25
changelog:
  - Creating filelist in build subdirectory instead of build directory.
  - Removing filelist before build.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have mknod capability. It creates a special file using mknod in a brick.
   - Update rules related to glusterd_brick_t.
   - Allow glusterd to execute lvm tools in the lvm_t target domain.
   - Allow glusterd to execute xfs_growfs in the target domain.
   - Add support for /usr/sbin/xfs_growfs.
   - Allow glusterd to create samba config files if it is started by service script and running with unconfined_u.
  Resolves:#1228109
  - Fix description for ftpd_use_passive_mode boolean.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-275
changelog:
  - Allow glusterd to have transition to insmod.
  - Allow glusterd to use geo-replication gluster tool.
  - Remove gluster from permissive domains.
  Resolves:#1229605


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-276
changelog:
  - Allow gluster to manage own log files.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  - Label gluster python hooks also as bin_t.
  - Allow samba_t net_admin capability to make CIFS mount working.
  Resolves:#1229605
  - Allow ssh_keygen_t to manage keys located in /var/lib/gluster.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-278
changelog:
  - Allow logrotate get attributes of all unallocated tty device nodes.
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
  - Allow glusterd to connect to init.
  Resolves:#1230371
  - Allow gluster do dbus chat with domain running as initrc_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.1
changelog:
  - Backport gluster fixes from RHEL7
   - execute showmount in own domain
  Resolves:#1248520
   - execute nsfd in own domain
   - allow gluster to connect to all ports
   - Add support for /usr/sbin/ctdbd_wrapper.
   - nrpe needs kill capability to make gluster moniterd nodes working.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.2
changelog:
  - Allow nmbd to create pids files/dirs under /var/run/samba with correct labeling.
  Resolves:#1248520


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.6
changelog:
  - Allow qpidd to be working with MRG. It requires to manage symlinks in /var/lib/qpidd.
  Resolves:#1257318
  Resolves:#1257319


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.8
changelog:
  - Allow ipsec_mgmt_t to access netlink route socket and set attributes for /var/run/pluto directories.
  Resolves:#1289019


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-279.el6_7.9
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  Related: #1322688


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-285
changelog:
  -Allow munin apache scripts to manage munin logs and talk with httpd over unix stream socket. 
  Resolves:#1286052
  -Allow httpd to send generic signal to httpd suexec if htpasswd is invoked. Resolves:#1286007
  -Dontaudit httpd running as piranha_web_t accesses to snmp mib indexes. 
  Resolves:#1285674
  -Allow ipsec running as ipsec_t to create pluto.log with correct labeling.
  Resolves:#1267212
  -Allow whack executed by sysadm SELinux user to access /var/run/pluto/pluto.ctl. It fixes "ipsec auto --status" executed by sysadm_t. 
  Resolves:#1257591
  -Dontaudit attemps to write generic tmp_t dirs if gnome-keyring-daemon runs under passwd_t domain. 
  Resovles:#1131531


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-286
changelog:
  - arping running as netutils_t sys_module capability for removing tap devices. Dontaudit this access.
  - Allow hv_vss_daemon to write access on all mount point directories to make VSS live backup if working if there is home partition.
  - Add support for squid to be able to create temoporary files. 
  Resolves:#1291164
  - Allow usbhid-ups to access /proc/bus/usb to have it working on ppc64 machines. 
  Resolves:#1290693
  - Add support for /var/run/chronyd.sock. 
  Resolves:#1290310
  - Update apache_content_template() inteface to allow "shutdown" permissions for apache scripts on unix_stream_socket. 
  Resolves:#1286052
  - Fix label for /var/lib/graphite-web 
  Resolves:#1221934
  - Dontaudit rpm write access for prelink_mask_t Resolves:#1216907
  - Allow apcupsd_t to communicate with sssd Add default label for /var/lock/subsys/apcupsd and /var/lock/LCK.
  Resolves:#1286030
  - Allow shorewall_t to create netlink_socket 
  Resolves:#1290705


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-287
changelog:
  - Allow sssd-ifp to dbus chat with all users. 
  Resolves:#1296693
  - Allow keepalived to connect to 3306/tcp port - mysqld_port_t.
  Resolves:#1296854
  - Add support for stunnel custom log files, allow transition and label /log/stunnel* log files. 
  Resolves:#1296238
  - Provide conman_unconfined_script_exec_t/conman_unconfined_script_t SELinux types used for conman scripts.
  - Resolves:#1290565
  - Allow ctdbd trasition to smbcontrol_t when "ctdb disablescript 50.samba" is executed.
  - Resolves:#1293787
  - Label ctdbd event scripts as ctdbd_exec_t instead of bin_t. 
  Resolves:#1293787
  - Allow watchdog to read localization files. It wants to access localtime. 
  Resolves:#1267974
  - Backport rules allowing sssd_t to be able to request the kernel to load a module.
  Resolves:#1246634


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-288
changelog:
  - Allow netutils_t domain to chown capability.
  Resolves:#1298514
  - Allow all jabber domain to access SSL certs.
  Resolves:#1261145
  - Allow shorewall request kernel load module
  Resolves:#1290705
  - Allow passwd to create temporary files to support ssh logins if gnome-keyring-daemon is called by passwd and runs in passwd_t.
  Resolves:#1131531
  - Allow stunnel to write log outputs on users pty.
  Resolves:#1296238
  - Allow polkit-1/actions to get attributes for all filesytems.
  Resolves:#1301561
  - Allow p11-child to connect to apache ports. Allow p11-child  to manage authentication cache.


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292
changelog:
  - Allow smbcontrol to create a socket in /var/samba which uses for a communication with smbd, nmbd and winbind.
  Related: #1326621


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.1
changelog:
  - Allow ipc_lock capability for glusterd.
  - GlusterFS volumes of RDMA transport proceed fuse mount and requires ipc_lock capability.
  Resolves: #1388582


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-292.2
changelog:
  - Allow glusterd to manage socket files labeled as glusterd_brick_t.
  Resolves: rhbz#1393267
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs
  Resolves: rhbz#1393253


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-300
changelog:
  - Allow sblim_reposd_t domain to read cert_f files
  Resolves:rhbz#1392382
  - Allow runnig php7 in fpm mode. From selinux-policy side, we need to allow httpd to read/write hugetlbfs.
  Resolves: rhbz#1392406


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-301
changelog:
  - Allow hald_t to read nvme devices.
  Resolves: rhbz#1389982
  - Allow ftpdctl_t domain to manage own sockets
  Resolves: rhbz#1392525


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-302
changelog:
  - Label /var/lock/kdump as kdump_lock_t.
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-303
changelog:
  - Dontaudit freeipmi_bmc_watchdog_t to write to /var/lock/kdump/
  Resolves: rhbz#1288565
  - Allow guest-set-user-passwd to set users password
  Resolves: rhbz#1369699


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-304
changelog:
  - Allow _java_t domain to read systemd state.
  Resolves:rhbz#1393938
  - Allow kdumpgui to read/write to nvme filesystem.
  Resolves:rhbz#1323293


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-305
changelog:
  - Fix typo bug sepgsql_contexts file
  Resolves: rhbz#1397703
  - Allow sssd_t domain to manage samba files and dirs.
  Resolves: rhbz#1395403
  - Create conman_unconfined_script_t type for conman script stored in /use/share/conman/exec/
  Resolves: rhbz#1397117
  - Allow consolekit_t domain to manage consolekit_log_t dirs
  Resolves: rhbz#1397802


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-306
changelog:
  - Allow hostname_t domain to manage cluster_tmp_t files
  Resolves: rhbz#1400234
  - Allow ipsec_mgmt_t domain use nsswitch
  Resolves:rhbz#1401611
  - Allow conman_t domain to list conman_uconfined_script_exec_t dirs.
  Resolves:rhbz#1397117


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-307
changelog:
  - Allow glusterd_t send signals to userdomain. Label new glusterd binaries as glusterd_exec_t
  Resolves: rhbz#1404152
  - Label /usr/bin/puppet* binaries as puppet_exec_t
  Resolves: rhbz#1386181


author: Lukas Vrabec <lvrabec@redhat.com> 3.7.19-307.1
changelog:
  - Allow smbd_t domain generate debugging files under /var/run/gluster. These files are created through the libgfapi.so library that provides integration of a GlusterFS client in the Samba (vfs_glusterfs) process.
  Resolves: rhbz#1462824
  - Disable mysqld_safe_t secure mode environment cleansing.
  Resolves: rhbz#1464145


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-1
changelog:
  - new version 8.14.4 (#552078)
  - RPM attributes S, 5, T not recorded for statistics file
  - adapted patches: makemapman, dynamic, switchfile (#552078)
  - movefiles patch incorporated into aliases_dir patch
  - dropped patches (fixed upstream): exitpanic, certcnnul


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-5
changelog:
  - used noreplace for sasl config
  - used ghost instead of explicit provides
  - deffattr changed to (-,root,root,-)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-9
changelog:
  - fixed MAXHOSTNAMELEN for FQDN
    resolves: rhbz#640234
  - fixed assertion if server connection is lost while making LDAP query
    resolves: rhbz#837007
  - fixed milterfdleaks patch to check socket before using fcntl on it
    resolves: rhbz#845821
  - fixed ldap_routing macro
    resolves: rhbz#890227
  - properly set {client_port} value on little endian machines,
    patch by Kelsey Cumminngs <kgc@corp.sonic.net>
    resolves: rhbz#1106852


author: <dwalsh@redhat.com> - 3.0.47-3
changelog:
  - Sedispatch is not handling audit messages correctly, 
    this fix allows setroubleshoot to process alerts.
  Resolves: #575686


author: Miroslav Grepl <mgrepl@redhat.com> - 3.0.47-4
changelog:
  - Make sealert working if description contains parenthesis
  - Remove -H from man page
  Resolves:#788196


author: Dan Horák <dan@danny.cz> - 1.28-2
changelog:
  - include rescan-scsi-bus script 1.35
  - rebase patches and add fix for issue mentioned in #538787
  - Related: #538787


author: Dan Horák <dan@danny.cz> - 1.28-1
changelog:
  - update to version 1.28
  - added fixes from RHEL to rescan-scsi-bus.sh
  - added scsi-rescan symlink to the rescan-scsi-bus.sh script


author: Shane Bradley <sbradley@redhat.com> = 3.2-26
changelog:
  - [cluster] Scrub password from crm_report data.
    Resolves: bz1206581
  - [networking] Use the correct options for nmcli.
    Resolves: bz1206661


author: Shane Bradley <sbradley@redhat.com> = 3.2-49
changelog:
  - [sosreport] The reports were not generated.
    Resolves: bz1299892

  - [npm/nodejs] Add plugins npm and nodejs.
    The patch contained plugin classes that are not in rhel-6
    which were removed.
    Resolves: bz1368547


author: Filip Krska <fkrska@redhat.com> = 3.2-54.el6_9.1
changelog:
  [networking] iptables: check module version and do ipv6
    Resolves: bz1451784
    [cluster] Scrub passwords in pcs config
    Resolves: bz1427589


author: Filip Krska <fkrska@redhat.com> = 3.2-57
changelog:
  [policies] get package list without a timeout
    [policies/redhat] make missing 'filesystem' package non-fatal
    Resolves: bz1506596


author: Filip Krska <fkrska@redhat.com> = 3.2-63
changelog:
  [archive] compress tarball without a timeout
    Resolves: bz1439943
    [policies] stop execution on Ctrl+C during user input
    Resolves: bz1567054


author: Filip Krska <fkrska@redhat.com> = 3.2-63.1
changelog:
  [archive] Force decoding if content is bytes
    [reporting] deal with UTF-8 characters
    Resolves: bz1599234


author: Filip Krska <fkrska@redhat.com> = 3.2-63.3
changelog:
  [smartcard] Stop collecting pkcs11_inspect debug
    Resolves: bz1567063
    [satellite] don't collect /root/ssl-build
    Resolves: bz1667018


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-2
changelog:
  - Add -Wl,-z,relro to the linker flags in order to fix a rpmdiff
    error. These flags used to be provided indirectly by openssl, and after
    openssl stopped exporting them, they were added by
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch
    which was dropped during the rebase
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-3
changelog:
  - Add -Wl,-z,now as well to the link flags.  This flag was present in
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch, and
    pkgwrangler still complains about:
    File /usr/lib/libspice-client-glib-2.0.so.8.5.0 lost GNU_RELRO security
    protection on i686
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-4
changelog:
  - Fix smartcard issues after VM restart (virsh destroy/virsh start)
    Resolves: rhbz#1205171
  - Remove obsolete patches
    Related: rhbz#1185434


author: Fabiano Fidêncio <fidencio@redhat.com> 0.26-5
changelog:
  - Connecting to VM changes its resolution
    Resolves: rhbz#1242605
  - Cannot enable display 1 when it was disabled in previous session
    Resolves: rhbz#1247920
  - Windows needs to send complete monitors_config message to client
    Resolves: rhbz#1265361
  - Add Client capability for windows monitor_config messsage
    Resolves: rhbz#1265359
  - High Resolution Multi-Monitor Windows Guest freeze
    Resolves: rhbz#1247749
  - Drop isoc packages on low bandwith
    Resolves: rhbz#1276707


author: Pavel Grunt <pgrunt@redhat.com> 0.26-8
changelog:
  - Make grab session related
    Resolves: rhbz#1330652
  - Improve messages in usb redirection dialog
    Resolves: rhbz#1298772
  - Use proxy only when needed
    Resolves: rhbz#1306311


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-4
changelog:
  - Fix spice-server crash when client sends a password which is too long
    Resolves: rhbz#999839 (CVE-2013-4282)


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-5
changelog:
  - Make sure we build with -Wl,-z,relro. We used to be getting that flag
    from openssl, but this is no longer the case, and rpmdiff gave a huge
    warning about it being gone
    Related: rhbz#999839 (CVE-2013-4282)


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-8
changelog:
  - Fix bad dates in changelog
    Resolves: rhbz#1038670
  - Fix crash on migration during reboot
    Resolves: rhbz#1004443
  - Use TLS 1.0 or better
    Resolves: rhbz#1035695


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-9
changelog:
  - Fix potential infinite loop on long running VMs (> 46 days)
    Resolves: rhbz#1072700
  - Fix assertion in video streaming code
    Resolves: rhbz#1086820


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-12
changelog:
  - Fix spicevmc-related crash which could be triggered with older clients
    Resolves: rhbz#1163480
  - Fix crash when using VNC + QXL + rhel-6.0.0 machine type
    Resolves: rhbz#1135372


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-12.1
changelog:
  - Avoid race conditions reading monitor configs from guest. This race could
    trigger memory corruption host-side
    Resolves: rhbz#1239124


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.4-13
changelog:
  - Fix " qemu-kvm: spicevmc.c:324: spicevmc_red_channel_alloc_msg_rcv_buf:
    Assertion `!state->recv_from_client_buf' failed." assertion during migration
    Resolves: rhbz#1264113


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-13.1
changelog:
  - Fix heap-based memory corruption within smartcard handling
    Resolves: CVE-2016-0749
  - Fix host memory access from guest with invalid primary surface parameters
    Resolves: CVE-2016-2150


author: Victor Toso <victortoso@redhat.com> - 0.12.4-15
changelog:
  - Avoid spice assertion when changing sized stream
    Resolves: rhbz#1274575
  - Make red_client_{ref,unref} thread safe to avoid crash
    Resolves: rhbz#1361946


author: Frediano Ziglio <fziglio@redhat.com> - 0.12.4-16
changelog:
  - Fix buffer overflow in main_channel_alloc_msg_rcv_buf when reading large
    messages.
    Resolves: CVE-2016-9577
  - Fix remote DoS via crafted message.
    Resolves: CVE-2016-9578


author: Christophe Fergeau <cfergeau@redhat.com> - 0.12.4-16.2
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Christophe Fergeau <cfergeau@redhat.com> 0.14.0-5
changelog:
  - Add support for TIMESTAMP/STRING selection types, this fixes copy and paste
    issues with some applications (vncviewer for example).
    Resolves: rhbz#1117764


author: Fabiano Fidêncio <fidencio@redhat.com> 0.14.0-6
changelog:
  - randr: Make resolution changing more robust
    Resolves: rhbz#1206117, rhbz#1130080 and rhbz#1209550


author: Fabiano Fidêncio <fidencio@redhat.com> 0.14.0-8
changelog:
  - Cannot get same result enablng second monitor after it was disabled using
    Guest's "Display Preference"
    Resolves: rhbz#1086657


author: Victor Toso <victortoso@redhat.com> 0.14.0-12
changelog:
  - Do not allow file-transfer on locked session
    Resolves: rhbz#1323630
  - Do not allow file-transfer on login screen
    Resolves: rhbz#1323640


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-11
changelog:
  - Resolves: #1248855 - After updating to squid-3.1.23-9.el6,
    service squid {reload,restart} fails with "Operation not permitted"


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-13
changelog:
  - Resolves: #1230753 - insufficient check for running service in condrestart
    and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-14
changelog:
  - Related: #1248855 - After updating to squid-3.1.23-9.el6,
    service squid {reload,restart} fails with "Operation not permitted"
  - Related: #1230753 - insufficient check for running service in condrestart 
    and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.1
changelog:
  - Resolves: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.2
changelog:
  - Related: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.1.23-16.3
changelog:
  - Resolved: #1334489 - CVE-2016-4554 CVE-2016-4556 squid: various flaws
  - Related: #1330572 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-4
changelog:
  - Resolves: #1301005 - insufficient check for running service
    in condrestart and try-restart actions


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.1
changelog:
  - Resolves: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid34: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.2
changelog:
  - Related: #1330574 - CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054
    squid34: various flaws


author: Luboš Uhliarik <luhliari@redhat.com> - 7:3.4.14-9.3
changelog:
  - Resolves: #1334499 - CVE-2016-4554 CVE-2016-4555 CVE-2016-4556
    squid34: various flaws
  - Resolves: #1334506 - CVE-2016-4553 squid34: squid: Cache poisoning
    issue in HTTP Request handling


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-13
changelog:
  - RHEL-6.6 erratum
    - don't retry authentication when ctrl-c pressed
    - fix double-quote processing in Defaults options
    - fix sesh login shell argv[0]
    - handle the "(none)" hostname correctly
    - SSSD: fix ipa_hostname handling
    - SSSD: fix sudoUser netgroup specification filtering
    - SSSD: list correct user when -U <user> -l specified
    - SSSD: show rule names on long listing (-ll)
    Resolves: rhbz#1065415
    Resolves: rhbz#1078338
    Resolves: rhbz#1052940
    Resolves: rhbz#1083064
    Resolves: rhbz#1033703
    Resolves: rhbz#1006447
    Resolves: rhbz#1006463
    Resolves: rhbz#1070952


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-14
changelog:
  - RHEL-6.6 erratum
    - SSSD: fixed netgroup filter patch
    - SSSD: dropped serparate patch for #1006463, the fix is now part
      of the netgroup filter patch
    Resolves: rhbz#1006463
    Resolves: rhbz#1083064


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-15
changelog:
  - RHEL-6.6 erratum
    - SSSD: dropped the ipahostnameshort patch, as it is not
      needed. rhbz#1033703 is a configuration issue.
    Related: rhbz#1033703


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-16
changelog:
  - RHEL-6.7 erratum
    - added zlib-devel build required to enable zlib compression support
    - fixed two typos in the sudoers.ldap man page
    - fixed a hang when duplicate nss entries are specified in nsswitch.conf
    - SSSD: implemented sorting of the result entries according to the
            sudoOrder attribute
    - LDAP: fixed logic handling the computation of the "user matched" flag
    - fixed restoring of the SIGPIPE signal in the tgetpass function
    - fixed listpw, verifypw + authenticate option logic in LDAP/SSSD
    Resolves: rhbz#1106433
    Resolves: rhbz#1138267
    Resolves: rhbz#1147498
    Resolves: rhbz#1138581
    Resolves: rhbz#1142122
    Resolves: rhbz#1094548
    Resolves: rhbz#1144448


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-17
changelog:
  - RHEL-6.7 erratum
    - added patch for CVE-2014-9680
    - added BuildRequires for tzdata
    Resolves: rhbz#1200253


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-19
changelog:
  - RHEL-6.7 erratum
    - modified the authlogicfix patch to fix #1144448
    - fixed a bug in the ldapusermatchfix patch
    Resolves: rhbz#1144448
    Resolves: rhbz#1142122


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - removed defaults option requiretty from /etc/sudoers
    - backported pam_service and pam_login_service defaults options
    - implemented a new defaults option for changing netgroup processing
      semantics
    - fixed visudo's quiet cli option
    Resolves: rhbz#1248695
    Resolves: rhbz#1247231
    Resolves: rhbz#1241896
    Resolves: rhbz#1197885
    Resolves: rhbz#1233205


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - fixed ldap's and sssd's sudoOption value and remove quotes
    - fixed ldap's and sssd's sudoOption whitespaces parse problem
    Resolves: rhbz#1144422
    Resolves: rhbz#1279447


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-21
changelog:
  - RHEL-6.8 erratum
    - search also by user id when fetching rules from LDAP
    Resolves: rhbz#1135531


author: Radovan Sroka <rsroka@redhat.com> - 1.8.6p3-22
changelog:
  - RHEL-6.8 erratum
    - fixed potential getcwd failure, resulting in Null pointer exception 
    Resolves: rhbz#1284886


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-23
changelog:
  - RHEL-6.8 erratum
    - fixed handling of closefrom_override defaults option
    Resolves: rhbz#1309976


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-24
changelog:
  - RHEL-6.8 erratum
    - fixed a bug causing that non-root users can list privileges of
      other users
    Resolves: rhbz#1312481


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-25
changelog:
  - RHEL-6.9 erratum
    - Fix "sudo -l command" in the LDAP and SSS backends when the command
      is not allowed.
    Resolves: rhbz#1374410
    - Fix sudo log file wrong group ownership
    Resolves: rhbz#1330001
    - Fix sudo parsing sudoers with user's locale
    Resolves: rhbz#1318374


author: Tomas Sykora <tosykora@redhat.com> - 1.8.6p3-26
changelog:
  - RHEL-6.9 erratum
    - Fix race condition when creating /var/log/sudo-io direcotry
    Resolves: rhbz#1365156


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-25
changelog:
  - related: #921612
    reverted the boundary when the sa data files are stored in directories
    and default history value back to 28. Without the revert, backward
    compatibility could be broken in some cases.


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-26
changelog:
  - resolves: #1110851
    added sysstat(5) man page describing /etc/sysconfig/sysstat file
  - resolves: #1102603
    added possibility to set compress method in /etc/sysconfig/sysstat file


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-27
changelog:
  - resolves: #1124180
    added workaround for dyn-tick kernel feature which makes /proc/stat file
    unreliable under certain circumstances


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-28
changelog:
  - resolves: #1224878
    fixed bug when pidstat could run out of pre-allocated space for PIDs
  - resolves: #887231
    fixed segfaults on bogus localtime input
  - resolves: #1185057
    added two new columns to iostat: r_await and w_await
  - resolves: #1188612
    fixed description of %util field in sar(1) and iostat(1) man pages


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-31
changelog:
  - related: #1224878
    in some corner cases, pidstat could still output values for % CPU bigger
    than 100; this commit fixes the issue


author: Michal Sekletar <msekleta@redhat.com> - 9.0.4-32
changelog:
  - cifsiostat: report correct number of open/closed files (#1346844)
  - sar: output timestamps when running with ko_KR.UTF-8 locale (#1363947)


author: Marek Grac <mgrac@redhat.com> - 1.1.12-12
changelog:
  - Displays Logical Volumes without filesystem under 'Unitialized'
  - Resolves: rhbz#791153
  - s-c-lvm traceback on parsing "dmsetup ls" output 
  - Resolves: rhbz#815921


author: Marek Grac <mgrac@redhat.com> - 1.1.12-13
changelog:
  - s-c-lvm crash after startup on machine with many LV
  - Resolves: rhbz#840070
  - s-c-lvm crash when encounter RAID 1 created in LVM
  - Resolves: rhbz#852864
  - s-c-lvm crash on mirrored LV with mirrorlog
  - Resolves: rhbz#852864


author: Marek Grac <mgrac@redhat.com> - 1.1.12-14
changelog:
  - s-c-lv crash after startup on machine with many LV
    Resolves: rhbz#840070
  - s-c-lvm crash when encounter RAID1 created in LVM
    Resolves: rhbz#852864


author: Marek Grac <mgrac@redhat.com> - 1.1.12-17
changelog:
  - s-c-lvm crases with thin volumes
    Resolves: rhbz#878253
  - s-c-lvm GUI can not be opened from some OS
    Resolves: rhbz#953071
  - s-c-lvm does not allow online extend of ext3 fs
    Resolves: rhbz#1029755


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-6
changelog:
  - fix for uninit defect (revealed by Coverity) added with %patch11.
  - recovered traditional behaviour of '--keep-old-files' option and added new
    option '--skip-old-files' (#799252)


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-7
changelog:
  - disable tests/remfiles01.at for running as a privileged user (#687972)
  - fix undesired error exit on receiving SIGPIPE during performing --list
    operation (#807728) and related fix for test suite -- skip SIGPIPE-dependent
    tests in environments ignoring SIGPIPE


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-8
changelog:
  - fix for bad file matching during extracting concrete files from an archive
    (backported fix from fedora 14) (#841308)
  - typo - better separate comments in spec file


author: Pavel Raiskup <praiskup@redhat.com> 2:1.23-9
changelog:
  - backport also --listed-incremental crash fix, this patch is in upstream and in
    fedora from f14 (related to #841308)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.23-10
changelog:
  - backport upstream patch to make sure that file matching is done before file
    file-name transformation (#875727)


author: Pavel Raiskup <praiskup@redhat.com> - 2:1.23-11
changelog:
  - avoid crash by backporting upstream patch for internal construction of
    file-name hash table (#877769).


author: Pavel Raiskup <praiskup@redhat.com> - 1.23-12
changelog:
  - better auto-recognize xz compressed archives (#1056672)
  - fix --verify option (#923359)
  - fnmatch fixes (#1034360)


author: Pavel Raiskup <praiskup@redhat.com> - 1.23-14
changelog:
  - fix error while storing UID > 2^21 into posix format archive (rhbz#1247788)
  - don't mistakenly set default ACLs (#1220891)


author: Petr Kubat <pkubat@redhat.com> - 1.23-15
changelog:
  - fix error when compressing/listing large sparse files (#1334559)
  - improve sparse mode in genfile for build-time-testsuite purposes


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 6.17-35.el6_8.1
changelog:
  - fix regression with 'jobs' builtin output not going to stdout (bug #1357127)
  - fix several regressions in tcsh-6.17.00-quote-backslashes-properly.patch (bug #1357126)


author: Adam Tkac <atkac redhat com> 1:0.17-46
changelog:
  - changes related package review (#226484)
  - remove unused patches
    - telnet-0.17-linemode.patch
    - telnet-0.17-env-5x.patch


author: Michal Sekletar <msekleta@redhat.com> 1:0.17-48
changelog:
  - reuse utmp entries correctly
  - break out from infinite loop if we tried to bind to non-existing address (#772912)
  - mitigate possibility of self-deadlock while updating utmp or wtmp (#832059)


author: Jindrich Novy <jnovy@redhat.com> 2007-31
changelog:
  - do not conflict with dvipdfm
  - update perl requires filter
  - update latin.ldf (#469948)
  - do not provide any perl dependencies (#516350)


author: Tom "spot" Callaway <tcallawa@redhat.com> 2007-32
changelog:
  - resolve conflict between texlive-texmf (and -doc) and tetex-perltex
  - resolve conflict between texlive-texmf and tetex-prosper
  - resolve conflict between texlive-texmf and tetex-perltex


author: Jindrich Novy <jnovy@redhat.com> 2007-34
changelog:
  - fix permissions of /var/lib/texmf/web2c (#512459, #531894)
  - add IEEEconf (#495877)
  - update achemso (#521459)
  - update perltex to 2.0 from CTAN
  - obsolete tetex-perltex


author: Jindrich Novy <jnovy@redhat.com> 2007-36
changelog:
  - allow to make LaTeX format from source more than 5 years old
    (it gives a warning instead of an error)
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=531569#56


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Miloslav Trmač <mitr@redhat.com> - 2.9.16-1
changelog:
  - Update to tmpwatch-2.9.16.
  - Exclude /tmp/hsperfdata_*.
    Resolves: #527425
  - Preserve timestamps where possible.


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-95
changelog:
  - Related: rhbz#1084426 Reverting to prevent Satellite installation issues mentioned in rhbz-1302761


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-97
changelog:
  - Resolves: rhbz#1367051 CVE-2015-5174 URL Normalization issue
  - Resolves: rhbz#1367054 CVE-2016-0706 Security Manager bypass via StatusManagerServlet
  - Resolves: rhbz#1367058 CVE-2016-0714 Security Manager bypass via persistence mechanisms
  - Resolves: rhbz#1367054 CVE-2015-5345 Directory disclosure


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-98
changelog:
  - Resolves: rhbz#1362210 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368119


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-102
changelog:
  - Resolves: rhbz#1413589 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402664 CVE-2016-6816 tomcat6: tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-105
changelog:
  - Related: rhbz#1402664 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-encoded characters
  - Related: rhbz#1402664 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-96
changelog:
  - Resolves: rhbz#1327238 rpm -V tomcat6 fails due on /var/log/tomcat6/catalina.out
  - Resolves: rhbz#1347778 The security manager doesn't work correctly


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-97
changelog:
  - Resolves: rhbz#1367052 CVE-2015-5174 tomcat6: tomcat: URL Normalization issue
  - Resolves: rhbz#1367057 CVE-2016-0706 tomcat6: tomcat: directory disclosure
  - Resolves: rhbz#1367059 CVE-2016-0714 Security Manager bypass via persistence mechanisms
  - Resolves: rhbz#1367055 CVE-2015-5345 Directory disclosure


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-98
changelog:
  - Resolves: rhbz#1362211 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368120 CVE-2016-6325 tomcat6: tomcat: tomcat writable config files allow privilege escalation


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-100
changelog:
  - Resolves: rhbz#1413588 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402665 CVE-2016-6816 tomcat6: tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
  - Resolves: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update


author: Tomas Hoger <thoger@redhat.com> 0:6.0.24-105
changelog:
  - Sync with 6.8 - add CVE-2016-6816 follow-up patches and revert unreleased fixes.
  - Related: rhbz#1397484 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-encoded characters
  - Related: rhbz#1397484 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816
  - Reverts: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update
  - Reverts: rhbz#1347778 The security manager doesn't work correctly


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-106
changelog:
  - Resolves: rhbz#1441478 CVE-2017-5647 tomcat6: tomcat: Incorrect handling of pipelined requests when send file was used


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-110
changelog:
  - Resolves: rhbz#1461292 CVE-2017-5664 tomcat6: tomcat: Security constrained bypass in error page mechanism


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-111
changelog:
  * Sync with 6.9
  - Resolves: rhbz#1498342 CVE-2017-12615 CVE-2017-12617 tomcat6: various flaws
  - Resolves: rhbz#1461291 CVE-2017-5664 tomcat6: tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441479 CVE-2017-5647 tomcat6: tomcat: Incorrect handling of pipelined requests when send file was used
  - Resolves: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-112
changelog:
  - Resolves: rhbz#1806803 CVE-2020-1938 tomcat6: tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-115
changelog:
  - Resolves: CVE-2020-9484 tomcat6: tomcat: Apache Tomcat Remote Code Execution via session persistence


author: David Knox <dknox@redhat.com> 0:6.0.24-84
changelog:
  - Resolves: rhbz#1022061 Tomcat init script needs to be adjusted to kill tomcat
  - if stop is unsuccessful


author: David Knox <dknox@redhat.com> 0:6.0.24-88
changelog:
  - Related: rhbz#1022061 changed in init file. Remove test
  - in function stop for result after initial command to
  - stop.


author: Jan Vcelak <jvcelak@redhat.com> 0.2.19-7
changelog:
  - fix: apply scheduler settings to vd* devices (#725497)
  - enhancement: add virtual-host profile (#740976)
  - enhancement: add virtual-guest profile (#740977)
  - fix: diskdevstat and netdevstat command line error handling (#747210)


author: Jan Vcelak <jvcelak@redhat.com> 0.2.19-8
changelog:
  - fix: poor ping latency in 'latency-performance' profile (#714180)
  - fix: ktune breaks disks when pecifying just the device for ELEVATOR_TUNE_DEVS (#784308)
  - fix: should not disable barriers on devices with write back cache (#801561)
  - fix: /var/run/tuned/tuned.pid created with insecure permissions (#845336)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-10
changelog:
  - fix: virtual-guest profile should not deploy the nobarrier option
    resolves: rhbz#886956
  - fix: disable transparent hugepages in latency-performance profile
    resolves: rhbz#887355


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-12
changelog:
  - fix: tuned incorrectly sets readahead values when new device is inserted
    resolves: rhbz#905077
  - fix: there is a race when multiple devices are inserted
    resolves: rhbz#904062


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-13
changelog:
  - add support for upstream THP
    resolves: rhbz#912788
  - added sap profile, backported features it needs
    resolves: rhbz#910838
  - made elevator settings customizable
    resolves: rhbz#987547
  - fixed usb_autosuspend and bluetooth functions
    resolves: rhbz#982756
  - increased kernel.sched_migration_cost in virtual-host profile
    resolves: rhbz#969491
  - documented virtual-guest and virtual-host profiles
    resolves: rhbz#964187
  - fixed typo in tuned-adm help
    resolves: rhbz#963821
  - modified latency-performance profile to lock CPU to C1
    resolves: rhbz#961792
  - added support for /etc/sysctl.d
    resolves: rhbz#959732
  - fixed permissions of /var/run/tuned/pmqos-static.pid
    resolves: CVE-2013-1820
  - fixed diskdevstat labels
    resolves: rhbz#885080
  - quiet errors when remounting FS with nobarriers
    resolves: rhbz#838512


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.2.19-15
changelog:
  - dynamically changing symlinks excluded from the RPM verification
    resolves: rhbz#1017366
  - reversed reading of sysctl configuration in SYSCTL_POST to follow
    RHEL-6 behavior
    resolves: rhbz#1036049
  - fixed typo in latency-performance profile regarding SYSCTL_POST
    resolves: rhbz#1064062
  - added support for s390 block devices (/dev/dasd)
    resolves: rhbz#1129936
  - added support for Xen VS devices (/dev/xvd)
    resolves: rhbz#1159963
  - increased vm.max_map_count in sap-netweaver profile
    resolves: rhbz#1174253


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d:
    - The Egyptian Cabinet announced that DST will be cancelled for 2015.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style. This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15.
      The abbreviation remains "KST".
    - Uruguay no longer observes DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-1
changelog:
  - Rebase to 2015g
    - Turkey's 2015 fall-back transition is scheduled for Nov. 8, not Oct. 25.
    - Norfolk moves from +1130 to +1100 on 2015-10-04 at 02:00 local time.
    - Fiji's 2016 fall-back transition is scheduled for January 17, not 24.
    - Fort Nelson, British Columbia will not fall back on 2015-11-01.  It has
      effectively been on MST (-0700) since it advanced its clocks on 2015-03-08.
      New zone America/Fort_Nelson.


author: Patsy Franklin <pfrankli@redhat.com> - 2015g-3
changelog:
  - Synchronize javazic tool for OpenJDK 6 & 7 with upstream. (#1212549)
  - Fix Africa/Casablanca transitions from 2027 forward. (#1217109)


author: Patsy Franklin <pfrankli@redhat.com> - 2016a-1
changelog:
  - Rebase to 2016a
    - America/Cayman will not observe daylight saving this year after all.
      Revert our guess that it would.
    - Asia/Chita switches from +0800 to +0900 on 2016-03-27 at 02:00.
    - Asia/Tehran now has DST predictions for the year 2038 and later,
      to be March 21 00:00 to September 21 00:00.  This is likely better
      than predicting no DST, albeit off by a day every now and then.


author: Patsy Franklin <pfrankli@redhat.com> - 2016b-1
changelog:
  - Rebase to 2016b
    - New zones Europe/Astrakhan and Europe/Ulyanovsk for Astrakhan and
      Ulyanovsk Oblasts, Russia, both of which will switch from +03 to +04 on
      2016-03-27 at 02:00 local time.  They need distinct zones since their
      post-1970 histories disagree.  New zone Asia/Barnaul for Altai Krai and
      Altai Republic, Russia, which will switch from +06 to +07 on the same date
      and local time.  The Astrakhan change is already official; the others have
      passed the first reading in the State Duma and are extremely likely.
      Also, Asia/Sakhalin moves from +10 to +11 on 2016-03-27 at 02:00.
    - As a trial of a new system that needs less information to be made up,
      the new zones use numeric time zone abbreviations like "+04"
      instead of invented abbreviations like "ASTT".
    - Haiti will not observe DST in 2016.
    - Palestine's spring-forward transition on 2016-03-26 is at 01:00, not 00:00.
      Guess future transitions will be March's last
      Saturday at 01:00, not March's last Friday at 24:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST. (BZ #1425222)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1427694)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018.
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-4
changelog:
  - Brazil moved the start of DST from the first Sunday in November
    to the third Sunday in November.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018f-1
changelog:
  - Europe/Volgograd will change from UTC+3 to UTC+4 on October 28,2018.
  - Add patch to remove use of 25:00.
  - Drop previous change to DST in Brazil.  The government rescinded the
    change.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018g-1
changelog:
  - Rebase to tzdata-2018g
    - Morocco will remain at UTC+1 rather than switching back to UTC+0 as
      planned.  This change is effective Octobober 28, 2018.


author: Patsy Griffin Franklin <pfrankli@redhat.com> - 2018i-1
changelog:
  - Rebase to tzdata-2018i (includes changes from tzdata-2018h)
    - São Tomé and Príncipe changed from UTC+01 to UTC+00 on 2019-01-01.
    - Qyzylorda, Kazakhstan changed from UTC+06 to UTC+05 on 2018-12-21.
    - Created a new zone Asia/Qostanay since Qostanay, Kazakhstan didn't 
      transition with the Qyzylorda change.
    - Metlakatla, Alaska will observe PST for this winter only.
    - Predict that Morocco will continue to adjust clocks around Ramadan.
    - Also include predictions for Iran from 2038 through 2090.


author: Patsy Griffin Franklin <patsy@redhat.com> - 2019a-1
changelog:
  - Rebase to tzdata-2019a
    - Palestine will start DST on 2019-03-30, rather than 2019-03-23 as
      previously predicted.
    - Metlakatla rejoined Alaska time on 2019-01-20, ending its observances
      of Pacific standard time.


author: Patsy Griffin <patsy@redhat.com> - 2019b-1
changelog:
  - Rebase to tzdata-2019b
    - Brazil will no longer observe DST going forward.
    - The 2019 spring transition for Palestine occurred 03-29, not 03-30.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Tomas Hozza <thozza@redhat.com> - 1.4.20-20
changelog:
  - Install tmpfiles configuration into /usr/lib/tmpfiles.d (#1180995)
  - Fix root key management to comply to RFC5011 (#1180267)


author: Petr Menšík <pemensik@redhat.com> - 1.4.20-23.4
changelog:
  - Update trust anchors (#1458345)
  - Update managed keys from trigger
  - Fix periodic updates of root.key


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-27.1
changelog:
  - Fix amplifying an incoming query into a large number of queries directed to a target
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-28.1
changelog:
  - Fix unbound-1.4.20-amplifying-an-incoming-query.patch patch so it won't produce compiler warnings
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.4.20-29.1
changelog:
  - Fix segfault in unbound-1.4.20-amplifying-an-incoming-query.patch
  - Resolves: rhbz#1839171 (CVE-2020-12662), rhbz#1840257 (CVE-2020-12663)


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-5.2
changelog:
  - 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline
  - fix spec warnings about expanding macros


author: Giuseppe Scrivano <gscrivan@redhat.com> - 0.9.0-21
changelog:
  - Fix error reporting (rhbz#1093980)
  - Fix parser error when install virt-manager (rhbz#1093979)
  - Fix Preferences/Feedback UI alignment (rhbz#1094083)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 0.9.0-22
changelog:
  - Fix alignment of Preferences/VM Details (rhbz#1094083)
  - Fix description of "Source Name" in create-pool (rhbz#1094005)
  - Handle ipv6 addresses (rhbz#870383)
  - virt-manager: escape host string (rhbz#1094600)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 0.9.0-29
changelog:
  - Use correct signal and callback names to catch cpu-threads property changes (rhbz#1190641)
  - Fix crash caused by closing an unowned fd (rhbz#1174464)


author: Jiri Skala <jskala@rehat.com> - 2.2.2-9
changelog:
  - Resolves: #785084 - vsftpd can not handle square brackets in ls
  - Resolves: #785061 - vsftpd child terminates when listing files with UID/GID larger than signed in
  - Resolves: #717411 - Connection failures during upload using PORT not handled cleanly
  - Resolves: #752954 - Disabling Reverse DNS lookups in VSFTPd
  - Resolves: #745133 - vsftpd: documentation for 'max_per_ip' default setting is wrong
  - Resolves: #765757 - SITE HELP offers CHMOD even when it is disabled/unavailable
  - Resolves: #701300 - vsftpd.conf lists incorrect default value for xferlog_file
  - Resolvse: #785642 - Invalid error recovery in vsf_privop_pasv_listen()


author: Martin Osvald <mosvald@rehat.com> - 2.2.2-14
changelog:
  - Resolves: #1092877 - The vsftpd hangs in a SIGCHLD handler when the pam_exec.so is used in pam.d configuration


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.7.3-1
changelog:
  - Update to 0.7.3 - for nl80211 and background scanning (rh #713280)
  - Drop upstreamed and backported patches


author: Dan Williams <dcbw@redhat.com> - 1:0.7.3-4
changelog:
  - Fix issues with Opportunistic/Proactive Key Caching (OKC) (rh #813579)
  - Be less aggressive when choosing to roam (rh #837402)
  - Don't install manpage for wpa_gui (rh #672976)


author: Jiří Klimeš <jklimes@redhat.com> - 1:0.7.3-5
changelog:
  - Add domain_match config option from upstream (rh #1186806) (rh #1178263)
  - Include peer certificate in EAP events for use by clients
  - Add dbus signal for information about server certification
  - eapol_test: Add option for writing server certificate chain to a file


author: Lubomir Rintel <lrintel@redhat.com> - 1:0.7.3-8
changelog:
  - Enable syslog logging support (rh #822128)
  - Support run-time rotation the debug log file (rh #908306)
  - Fix scriptlet dependencies (rh #712848)
  - Enable timestampes in logs (rh #1150004)


author: Davide Caratti <dcaratti@redhat.com> - 1:0.7.3-9.1
changelog:
  - avoid key reinstallation (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
    CVE-2017-13080, CVE-2017-13081, CVE-2017-13082)


author: Kalev Lember <kalev@smartlink.ee> 3.0.1-16
changelog:
  - Reintroduce a patch for CVE-2009-1885
  - Don't build static library
  - Use parallel make
  - Spec file clean up


author: Lyude Paul <cpaul@redhat.com> 7.6.1-2
changelog:
  - Fix annoying trailing whitespace after %description
  - Update firmware license
  - Added missing firmware file TAHITI_vce.bin (#1310823)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.17.4-18
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872388), CVE-2020-14346 (#1872392),
    CVE-2020-14361 (#1872399), CVE-2020-14362 (#1872406)


author: Olivier Fourdan <ofourdan@redhat.com> 1.17.4-3
changelog:
  - Add missing hw/xfree86/Xorg.sh.in to xorg-x11-server-source package.
    This is needed to build packages depending on xorg-x11-server-source
    (e.g. tigervnc), otherwise the build will fail.


author: Adam Jackson <ajax@redhat.com> 1.17.4-7
changelog:
  - Add bug-compatibility for exposure event generation for backing store's
    Always mode, and re-enable the feature


author: Honza Horak <hhorak@redhat.com> - 2.19-23
changelog:
  - fix memory leak when malformed request is received
    Resolves: #845283
  - Fixed returned value when all entries requested and no such
    map exists
    Resolves: #790812


author: Matej Muzila <mmuzila@redhat.com> - 2.19-29
changelog:
  - Make mknetid to handle properly files with either
    empty lines or unexpected format
    Resolves: #1071962


author: Matej Muzila <mmuzila@redhat.com> - 2.19-30
changelog:
  - Make server return YP_NOMAP when NIS client asks for non-existing map
    using yp_first/yp_next RPC calls
    Resolves: #988203


author: Matej Muzila <mmuzila@redhat.com> - 2.19-31
changelog:
  - Return failure if yppassw cannot write to /etc/shadow or /etc/passwd.adjunct
    because of wrong SELinux context
  - Move domainname check from ypserv to yppasswdd
  - Resolves: #747334, #456249


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-70
changelog:
  - Add links to knowledge base articles.
  - Resolves: bug#1248686
  - Resolves: bug#1248687
  - Resolves: bug#1248690
  - Backport missing_requires to API.
  - Resolves: bug#1197245
  - Get correct rpmdb path from rpm configuration.
  - Resolves: bug#1271584


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-71
changelog:
  - Fix manpage for query_install_excludes option.
  - Resolves: bug#1248715
  - Don't traceback on xml parsing.
  - Resolves: bug#1225481
  - Respect epoch in package names.
  - Resolves: bug#1211390


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-72
changelog:
  - Add ftp_disable_epsv config option.
  - Resolves: bug#1293363
  - Honor proxy=_none_ set in yum.conf.
  - Resolves: bug#1293385


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-76
changelog:
  - Remove "username" and "password" options from yum.conf man page.
  - Resolves: bug#1367861
  - Fix reget problems with simple md filenames.
  - Resolves: bug#1155687


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 3.2.29-77
changelog:
  - Filter duplicate packages from different repos in doPackageLists(pkgnarrow='obsoletes').
  - Resolves: bug#1272828


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-33
changelog:
  - Fix yum-security manpage.
  - Resolves: bug#865694
  - Resolves: bug#1208155
  - Add libxml2-python to Requires for repo-rss.
  - Resolves: bug#1155093
  - yumdownloader: fix description of --archlist in the manpage.
  - Resolves: bug#1165661
  - Add missing options to reposync manpage.
  - Resolves: bug#1189033
  - Exclude dups from the list of security updates.
  - Resolves: bug#1209212
  - yum-config-manager: update config file specified using -c option.
  - Resolves: bug#1225753
  - yum-config-manager: require \* syntax to disable all repos.
  - Resolves: bug#1225754
  - Remove -v from repoquery man page.
  - Resolves: bug#1285748


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-34
changelog:
  - Fix 'updateinfo list available' logic and make 'updates' the default.
  - Resolves: bug#1144887
  - Fix updateinfo to exclude wrong arch updates.
  - Resolves: bug#1191313


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-36
changelog:
  - Fix performance issue when excluding dups from the list of security updates.
  - Related: bug#1209212


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-38
changelog:
  - Fix count of applicable security updates.
  - Resolves: bug#1347813
  - auto-update-debuginfo: fix check for repos in opts.
  - Resolves: bug#1293982
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1313574
  - repoquery: fix --pkgnarrow=installed.
  - Resolves: bug#1280453


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-39
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1272025
  - Update yum-verify man page.
  - Related: bug#1347813


author: Ivana Varekova <varekova@redhat.com> - 2.31-4
changelog:
  - fix "zip does not honor umask setting when creating archives"
  - fix "zip segfaults by attempt to archive big file"
  - spec file cleanup


author: Karel Klic <kklic@redhat.com> - 3.0-1
changelog:
  - New upstream version
  - Removed zip23.patch, because ZMEM is not used anyway
  - Removed zip-2.31-install.patch, problem solved in upstream
  - Removed zip23-umask.patch, upstream uses mkstemp which solves the problem
  - Removed zip-2.31-near-4GB.patch, because upstream version 
    handles large files well
  - Removed zip-2.31-configure.patch, configure is better in the current version
  - Removed zip-2.3-sf.patch, the error message doesn't exist in upstream anymore
  - Removed zip-2.31-umask_mode.patch, which fixes also removed near-4GB patch
  - Updated zip-2.31-time.patch for zip 3.0
  - Updated exec-shield.patch for zip 3.0
  - Updated zip-2.3-currdir.patch for zip 3.0


author: Kamil Dudka <kdudka@redhat.com> - 4.3.11-7
changelog:
  - fix stack-based buffer overflow in utils.c:checkmailpath() (CVE-2018-1100)
  - fix stack-based buffer overflow in gen_matches_files() (CVE-2018-1083)
  - fix buffer overrun in xsymlinks (CVE-2017-18206)
  - fix buffer overflow when scanning very long path for symlinks (CVE-2014-10072)


author: James Antill <james.antill@redhat.com> - 4.3.10-7
changelog:
  - Change {NAME:OFFSET:LENGTH} substitution feature to ignore KSH_ARRAYS option.
  - Fixup tests.
  - Resolves: rhbz#820530


author: Kamil Dudka <kdudka@redhat.com> - 4.3.10-12
changelog:
  - avoid using uninitialised memory after lexer realloc (#1146119)
  - replace an incorrect comment in /etc/zshenv (#1103697)
  - optimize matching of multiple * in wildcards (#1131172)
  - use heap rather than stack allocation for variable length arrays (#567215)
  - prevent jobs -Z from destroying environment variables (#878324)
  - shell emulation doc addition (#1104021)


