# changelog

author: Ray Strode <rstrode@redhat.com> - 0.6.55-10
changelog:
  - Synchronize permissions and group ownership for icon and users dirs
    between rpm file manifest and daemon expectations.
    Resolves: #2057576


author: Sandro Mani <manisandro@gmail.com> - 5.2.1-5
changelog:
  - Fix several defects found by Coverity scan
  - Generate HTML docs with consistent section IDs to avoid multilib difference


author: Neal Gompa <ngompa@centosproject.org> - 0.15.5-2
changelog:
  - Create symlinks manually to make it build
    (the symlinks were not created because of reverting the patch to
    upgrade to Meson 0.62)


author: Neal Gompa <ngompa@centosproject.org> - 0.16.1-1
changelog:
  - Rebase to 0.16.1
    Resolves: rhbz#2169103
  - Drop unneeded downstream hacks to build with older Meson


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.6.0-6
changelog:
  - Gating rebuild [bz#1974188]
  - Resolves: bz#1974188
    (Define tests, including gating tests, for dtc)


author: Arjun Shankar <arjun@redhat.com> - 2.6.4-6
changelog:
  - Re-work flex subpackages and provide shared libraries (#1327851):
  - Remove and obsolete the flex-devel subpackage containing static libraries
  - Provide shared libraries in a new subpackage named libfl2
  - Provide development files in a new subpackage named libfl-devel
  - Provide static libraries in a new subpackage named libfl-static


author: Kalev Lember <klember@redhat.com> - 0.12.2-2
changelog:
  - Remove no longer needed ldconfig_scriptlets macro call
  - Remove explicit byte compilation as the automatic works for flatpak builds now


author: Tomas Orsava <torsava@redhat.com> - 5.8.0-5
changelog:
  - Remove unnecessary test dependency on python3-mock
  - Remove unnecessary macro __provides_exclude_from


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 5.8.0-12
changelog:
  - Add automatically generated Obsoletes tag with the python39- prefix
    for smoother upgrade from RHEL8
  - Related: rhbz#1990421


author: Vladis Dronov <vdronov@redhat.com> - 24.02.0-1
changelog:
  - Update to qatlib 24.02.0 (RHEL-40921)
  - Add zuc_sample to qatlib-tests package
  - Use proper SPDX license identifiers


author: Brian C. Lane <bcl@redhat.com> - 3.4-4
changelog:
  - Fix issues that covscan classifies as important
    Resolves: rhbz#1938836
  - Work around a mkswap bug


author: Charalampos Stratakis <cstratak@redhat.com> - 2.13.1-1
changelog:
  - Update to 2.13.1 (#1831402)
  - Fix docs build failures with Sphinx 3 (#1823532)
  - Use make macros: https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro


author: David King <amigadave@amigadave.com> - 1.68.0-6
changelog:
  - Add Requires on python-markdown for g-ir-doc-tool (#1979144)
  - Add license texts and documentation files (#1979144)


author: Richard Hughes <richard@hughsie.com> 0.3.8-1
changelog:
  - New upstream version
  - Add new API requested by fwupd
  - Add the GUsbEndpoint methods to the docs
  - Fix hotplug handling and signal emission during enumerate
  - Do not double-reference USB devices
  - Resolves: rhbz#1965885


author: Michal Srb <michal@redhat.com> - 1.51.0-16
changelog:
  - Drop bundled expat and build against libxml2
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25236


author: Peter Hutterer <peter.hutterer@redhat.com> 1.0.1-2
changelog:
  - xf86-input-libinput 1.0.1 (#1951879)
  - Fix the upstream source URL
  - Use autosetup instead of manual patch handling


author: Filip Januš <fjanus@redhat.com> - 1.18.1-3
changelog:
  - Resolves: #1799391
  - After upgrade GCC to version gcc version 10.0.1 build fails
  - Patch gdbm_gcc_10.patch was added


author: Mike FABIAN <mfabian@redhat.com> - 0.9.10-12
changelog:
  - Fix memory leak in vasnprint. Resolves: rhbz#1938800
    (Backported from upstream: https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=4d288a80bf7ebe29334b9805cdcc70eacb6059c1)


author: Parag Nemade <pnemade AT redhat DOT com> - 0.31.1-61
changelog:
  - Resolves: CVE-2019-19004 : integer overflow in input-bmp.c
  - Resolves: CVE-2019-19005 : fix bitmap double free in main.c


author: Parag Nemade <pnemade AT redhat DOT com> - 0.31.1-65
changelog:
  - Resolves: rhbz#2121828 Fix the gating tests by using only local test
    Upstream testsuite will not work as this package code is very old


author: Hans de Goede <hdegoede@redhat.com> - 1:3.2.7b-1
changelog:
  - New upstream release 3.2.7b
  - Add patch fixing CVE-2019-19746 (rhbz#1787040)
  - Add patch fixing CVE-2019-19797 (rhbz#1786726)


author: Ondrej Dubaj <odubaj@redhat.com> - 1:3.2.7b-7
changelog:
  - Fixed CVE-2020-21681 (#1998350)
  - Fixed CVE-2020-21683 (#1998594)
  - Fixed CVE-2020-21680 (#1998306)
  - Fixed CVE-2020-21684 (#2000747)
  - Fixed CVE-2020-21678 (#2000741)
  - Fixed CVE-2020-21676 (#2000751)
  - Fixed CVE-2020-21682 (#2000738)


author: Ondrej Dubaj <odubaj@redhat.com> - 1:3.2.7b-8
changelog:
  - Fixed CVE-2020-21529 (#2005518)
  - Fixed CVE-2020-21532 (#2006007)
  - Fixed CVE-2020-21531 (#2006002)


author: Paul Howarth <paul@city-fan.org> - 2:1.52-1
changelog:
  - Update to 1.52
    - Added a $dt->is_between($dt1, $dt2) method (based on GH#97)
    - Simplify the calculation of leap seconds in XS (GH#91); this is a little
      more efficient for most use cases (anything with future or recent past
      datetimes)


author: Tom Stellard <tstellar@redhat.com> - 4.0.2-2
changelog:
  - Use make macros
    https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
  - Disable Go tests


author: Jitka Plesnikova <jplesnik@redhat.com> - 1:0.81-1
changelog:
  - Update to 0.81
    - Breaking Change: Set $YAML::XS::LoadBlessed default to false to make it
      more secure


author: Paul Howarth <paul@city-fan.org> - 1:0.82-1
changelog:
  - Update to 0.82
    - Updated libyaml sources to 0.2.4; changes affecting YAML::XS are:
      - Output '...' at the stream end after a block scalar with trailing empty
        lines
      - Accept '%YAML 1.2' directives (they are ignored and do not change
        behaviour though)


author: Dan Čermák <dan.cermak@cgc-instruments.com> - 0.7.1-5
changelog:
  - BuildRequire python3-setuptools besides python3-devel
    (see https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/GCPGM34ZGEOVUHSBGZTRYR5XKHTIJ3T7/)


author: Dominik 'Rathann' Mierzejewski <rpm@greysector.net> 1.0.12-1
changelog:
  - update to 1.0.12 (#1827949)
  - drop obsolete patch
  - fixes CVE-2020-11863, CVE-2020-11864, CVE-2020-11865, CVE-2020-11866


author: Tomas Popela <tpopela@redhat.com> - 1.0.2-8
changelog:
  - Package woff2_decompress, woff2_compress and woff2_info in a tools subpackage.
    Thanks to Tomasz Gąsior <kontakt@tomaszgasior.pl>


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-101
changelog:
  - resolves: rhbz#2216712 - Fix broken symlink for libwbclient
  - resolves: rhbz#2214327 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2211605 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2207692 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-100
changelog:
  - resolves: rhbz#2222895 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-100
changelog:
  - related: rhbz#2190415 - Update to version 4.18.6
  - resolves: rhbz#2211617 - Fix the rpcclient dfsgetinfo command


author: Andreas Schneider <asn@redhat.com> - 4.19.3-100
changelog:
  - resolves: RHEL-16476 - Update to version 4.19.3
  - resolves: RHEL-11362 - Fix security issues:
    CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-18030 - Logging Format Enhancement
  - resolves: RHEL-1960 - Fix smbget issues with DFS shares
  - resolves: RHEL-2118 - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-16875 - Fix memory corruption in libnss_winbind
  - resolves: RHEL-19243 - Fix smbget password interactive authentication


author: Andreas Schneider <asn@redhat.com> - 4.19.4-100
changelog:
  - related: RHEL-16476 - Update to version 4.19.4
  - resolves: RHEL-2109 - Add support for certificate auto enrollment
  - resolves: RHEL-20761 - Add missing requirements for samba-gpupdate
  - resolves: RHEL-19566 - Fix smbget interactive authentication
  - resolves: RHEL-21001 - Fix samba-gpupdate paths for RHEL


author: Andreas Schneider <asn@redhat.com> - 4.19.4-102
changelog:
  - resolves: RHEL-22157 - Don't require NDES for samba-gpupdate
  - resolves: RHEL-20897 - Fix site name fetching for samba-gpupdate


author: Jan Friesse <jfriesse@redhat.com> - 3.1.5-3
changelog:
  - Resolves: rhbz#2024652
  - Resolves: rhbz#2024657

  - totem: Add cancel_hold_on_retransmit config option (rhbz#2024652)
  - merge upstream commit cdf72925db5a81e546ca8e8d7d8291ee1fc77be4 (rhbz#2024652)
  - totemsrp: Switch totempg buffers at the right time (rhbz#2024657)
  - merge upstream commit e7a82370a7b5d3ca342d5e42e25763fa2c938739 (rhbz#2024657)


author: Jan Friesse <jfriesse@redhat.com> - 3.1.5-4
changelog:
  - Resolves: rhbz#2070623

  - logrotate: Use copytruncate method by default (rhbz#2070623)
  - merge upstream commit 04362046c4a9d7307feb5b68341d567b7d0b94d6 (rhbz#2070623)


author: Christine Caulfield <ccaulfie@redhat.com> - 1.24-2
changelog:
  - Fix libnozzle tests failing & covscan warning on api_knet_handle_new test
    Resolves: rhbz#2024090


author: Christine Caulfield <ccaulfie@redhat.com> - 1.28-1
changelog:
  Rebase to 1.28 for startup and performance fixes
     threads: add config check to match min value with pong timeouts
     rx: allow links to be active faster
     links: fix ping interval and pong timeout value checking
     crypto: Try crypt and decrypt on crypto_init
     tx: Remove expensive memsets
     log: Add a TRACE log level
    Resolves: #RHEL-11787


author: Hans de Goede <hdegoede@redhat.com> - 5.56-3
changelog:
  - Drop obsolete udev rule + systemd service to call btattach on BT-HCIs
    connected via UART from userspace, this is all handled in the kernel now
  - Add the btmgmt util to the packaged files


author: Jan Grulich <jgrulich@redhat.com> - 0.27.4-4
changelog:
  - Fix out-of-bounds read in Exiv2::Jp2Image::printStructure
    Resolves: bz#1993247

  - Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    Resolves: bz#1993284


author: Jan Grulich <jgrulich@redhat.com> - 0.27.5-1
changelog:
  - Exiv2 0.27.5
    Resolves: bz#2018421

    Fix stack exhaustion issue in the printIFDStructure function leading to DoS
    Resolves: bz#2003670


author: Adam Jackson <ajax@redhat.com> - 1.3.5-9
changelog:
  - Remove BuildRequires xprop entirely. If present, the configure script will call
    it looking for a property on the root window that Fedora's X server does not
    set, and which would not work anyway since there is no X server running in the
    buildroot, so we can just remove the dependency.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-3
changelog:
  - Fix tzdata requirement copy-and-paste error that led to two BuildRequires and no Requires
  - Resolves: rhbz#2224420


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
changelog:
  - Update to jdk-11.0.20.1+1 (GA)
  - Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
  - Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
  - Update openjdk_news script to specify subdirectory last
  - Add missing discover_trees script required by openjdk_news
  - Resolves: rhbz#2236590


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
changelog:
  - Update to jdk-11.0.21+9 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Re-generate FIPS patch against 11.0.21+1 following backport of JDK-8155246
  - Re-generate SHA3 patch following backport of JDK-8242151
  - Bump libpng version to 1.6.39 following JDK-8305815
  - Bump HarfBuzz version to 7.2.0 following JDK-8307301
  - Bump freetype version to 2.13.0 following JDK-8306881
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Apply all patches using -p1
  - Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12214
  - Resolves: RHEL-13526
  - Resolves: RHEL-13529
  - Resolves: RHEL-13532
  - Resolves: RHEL-13536
  - Resolves: RHEL-13539


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
changelog:
  - Update to jdk-11.0.22+7 (GA)
  - Sync the copy of the portable specfile with the latest update
  - Drop local copy of JDK-8312489 which is now included upstream
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-20991


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
changelog:
  - Update to jdk-11.0.23+9 (GA)
  - Update release notes to 11.0.23+9
  - Switch to GA mode for release
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-30920


author: Anton Bobrov <abobrov@redhat.com> - 1:11.0.24.0.8-1
changelog:
  - Update to jdk-11.0.24+8 (GA)
  - Update release notes to 11.0.24+8
  - Adjusted DTLS & RPATH NEWS entries to match OpenJDK 17 & 21 release notes
  - Switch to GA mode for release
  - Fix Provides to reflect up to date component versions
  - Add zlib build required or bundled version (1.3.1), depending on system_libs setting
  - Resolves: RHEL-45202
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.7-0.2.ea
changelog:
  - Update to jdk-17.0.11+7 (EA)
  - Update buildjdkver to match the featurever
  - Use featurever macro to specify fips patch
  - Explain patchN syntax situation in a comment
  - Sync generate_source_tarball.sh
  - Require tzdata 2023d (JDK-8322725)
  - openjdk_news.sh: Use grep -E instead of egrep
  - Remove RH1649512 patch for libjpeg-turbo FAR macro
  - Move pcsc-lite-libs patch to in-need-of-upstreaming section
  - Related: RHEL-30939


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-2
changelog:
  - Update to jdk-17.0.11+9 (GA)
  - Add openjdk-17.0.11+9.tar.xz to .gitignore
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Update buildver from 7 to 9
  - Update portablerelease from 1 to 3
  - Change is_ga from 0 to 1 to enable GA mode for release
  - Update tzdata Requires comment to mention that 2024a is not yet in the buildroot
  - Update tzdata BuildRequires comment to mention that 2024a is not yet in the buildroot
  - Update tzdata BuildRequires from 2023c to 2023d
  - Update sources from openjdk-17.0.11+7-ea.tar.xz to openjdk-17.0.11+9.tar.xz
  - Resolves: RHEL-30939
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Update to jdk-17.0.12+6 (EA)
  - Add openjdk-17.0.12+6-ea.tar.xz to .gitignore
  - Set updatever to 12
  - Set buildver to 6
  - Set rpmrelease to 1
  - Set is_ga to 0
  - Update sources to openjdk-17.0.12+6-ea.tar.xz
  - Require tzdata-java 2024a at runtime and for build (JDK-8325150)
  - Update lcms2 bundled provides to 2.16.0
  - Add zlib 1.3.1 bundled provides and zlib-devel build requirement (OPENJDK-3065)
  - Label as error a designator mismatch
  - Change a fix-me comment to a note instead
  - Sync generate_source_tarball.sh from Fedora rawhide


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Cleanup message issued when checkout already exists
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
  - Move maintenance scripts to a scripts subdirectory
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
  - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
  - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck


author: Anton Bobrov <abobrov@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - generate_source_tarball.sh: Use tar exclude options for VCS files
  - generate_source_tarball.sh: Improve VCS exclusion


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Delete fips-17u-d63771ea660.patch
  - Add fips-17u-e893be00150.patch
  - Update fipsver to e893be00150


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Add upstream patch that removes illegal RLO Unicode characters (JDK-8332174)
  - Sync the copy of the portable specfile with the latest update


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
changelog:
  - Add debuginfo section to rpminspect.yaml (OPENJDK-2904)
  - Add unicode section to rpminspect.yaml (OPENJDK-2904)


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.7-2
changelog:
  - Update to jdk-17.0.12+7 (GA)
  - Update .gitignore to ignore openjdk-17.0.12+7.tar.xz
  - Sync java-17-openjdk-portable.specfile
  - Set buildver to 7
  - Set portablerelease 1
  - Set is_ga to 1
  - Update sources to openjdk-17.0.12+7.tar.xz
  - Resolves: RHEL-46641
  - Resolves: RHEL-47019
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **


author: Michal Ruprich <mruprich@redhat.com> - 1.4.3-1
changelog:
  - Update to 1.4.3
  - Resolves: #1758843 - libmaxminddb-devel i686 can't be installed in parallel to x86_64
  - Fix for CVE-2020-28241


author: Thomas Haller <thaller@redhat.com> - 1.8.28-1
changelog:
  - Update to 1.8.28 release
  - move org.gnome.nm-applet.gschema.xml from network-manager-applet to here.
  - introduce wireless security dialogs


author: Tomáš Mráz <tmraz@redhat.com> 1.4.3-1
changelog:
  - Multiple translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer


author: Paul Wouters <pwouters@redhat.com> - 1.4.4-2
changelog:
  - Resolves rhbz#1919026 libpwquaily rpm requires cracklib-dict to function but RPM missing requirement


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.22-1
changelog:
  - Update to 0.7.22
  - support strict repository priorities new solver flag: SOLVER_FLAG_STRICT_REPO_PRIORITY
  - support zstd compressed control files in debian packages
  - add an ifdef allowing to rename Solvable dependency members ("requires" is a keyword in C++20)
  - support setting/reading userdata in solv files new functions: repowriter_set_userdata, solv_read_userdata
  - support queying of the custom vendor check function new function: pool_get_custom_vendorcheck
  - support solv files with an idarray block
  - allow accessing the toolversion at runtime
  - support parsing of Debian's Multi-Arch indicator
  - fix segfault on conflict resolution when using bindings
  - fix split provides not working if the update includes a forbidden vendor change
  - reworked choice rule generation to cover more usecases
  - support SOLVABLE_PREREQ_IGNOREINST in the ordering code


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.24-1
changelog:
  - Update to 0.7.24
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-10
changelog:
  - Fix CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576
  - Resolves: CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-11
changelog:
  - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175
  - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450


author: Wolfgang Ulbrich <fedora@raveit.de> - 40.0-2
changelog:
  - revert https://gitlab.gnome.org/GNOME/libwnck/-/commit/3456b74
  - fixes rhbz #1971048
  - and https://github.com/mate-desktop/mate-panel/issues/1230


author: François Cami <fcami@fedoraproject.org> - 1.19.1-9
changelog:
  - Fix FTBFS (rhbz#1865148)
  - Set __cmake_in_source_build
  - BR qt5-qtbase-devel to keep the GUI frontend


author: Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
changelog:
  - Added some linker hardening flags to pass annocheck
    Related: rhbz#2031802

    * Tue Dec 14 2021 Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
  - Added gating
    Related: rhbz#2031794


author: Michael Petlan <mpetlan@redhat.com> - 1.2.0-2
changelog:
  - Update to upstream 1.2.0 -- fix opencsd_tag
    Related: rhbz#2041578

    * Fri Jan 21 2022 Michael Petlan <mpetlan@redhat.com> - 1.2.0-1
  - Update to upstream 1.2.0
    Related: rhbz#2041578


author: Benjamin A. Beasley <code@musicinmybrain.net> - 2.42.2-3
changelog:
  - Use pkgconfig to BR the required cairomm API/ABI version 1.0 (vs. 1.16); use
    cairomm1.0, which may be a virtual Provides, in the manual lib Requires


author: Petr Pisar <ppisar@redhat.com> - 8.43-3
changelog:
  - Make erroroffset initializion in a POSIX wrapper thread-safe
    (upstream bug #2447)
  - Fix an integer overflow when parsing numbers after "(?C" (upstream bug #2463)
  - Fix shifting integer bits and a NULL pointer dereferce in pcretest tool
    (upstream bug #2380)


author: Debarshi Ray <rishi@fedoraproject.org> - 0.64.2-1
changelog:
  - Update to 0.64.2
  - Add missing _VTE_CXX_NOEXCEPT to downstream patches (#1973174)
  - Fix the License fields and ship the correct license texts (#1973299)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.29-7
changelog:
  - compile without sha1 and md5
  - Resolves: rhbz#1936682 - xmlsec1 implements and/or uses the deprecated
                             SHA-1 algorithm by default


author: Bruno Meneguele <bmeneg@redhat.com> - 1.3.2-9
changelog:
  - Use upstream accepted patch for the memory leak
  - Make SHA-256 the default hash algorithm (rhbz#1934949)


author: Bruno Meneguele <bmeneg@redhat.com> - 1.4-1
changelog:
  - Modify some pieces to get closer to Fedora's specfile
  - Remove patch handling memory leak: solved in the rebase
  - Remove patch handling SHA-256 default hash: solved in the rebase
  - Rebase to upstream release v1.4 (rhbz#2026028)


author: Björn Esser <besser82@fedoraproject.org> - 0.14-2
changelog:
  - Add a patch to backport fixes applied on upstream master branch
  - Re-enable RDRAND as json-c can detect broken implementations in CPUs now
  - Disable -Werror during build


author: Björn Esser <besser82@fedoraproject.org> - 0.14-6
changelog:
  - Build using Ninja instead of Make
  - Add a patch to move Doxyfile into doc subdir
  - Remove pre-built html documentation
  - Update Doxyfile during %prep
  - Add a patch to apply some optimizations to arraylist
  - Hardlink the files in %_pkgdocdir


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: John Eckersberg <jeckersb@redhat.com> - 0.2.5-4
changelog:
  - Add BuildRequires for make
    (re: https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.4-1
changelog:
  - Rebase to current version from Fedora (#2017828)
  - Use of upstrea polkit policy preventing unneeded prompts


author: Miro Hrončok <mhroncok@redhat.com> - 0.29.22-2
changelog:
  - Remove an obsoleted patch
  - Remove old Obsoletes and Conflicts
  - Update description
  - Provide cython, python3-cython


author: Parag Nemade <pnemade AT redhat DOT com> - 20201107-1
changelog:
  - Update to 20201107 version (#1895648)
  - removed %gittag0 macro, as it cause problem to automated package update script


author: Remi Collet <remi@remirepo.net> - 1.1.0-5
changelog:
  - fix missing HAVE_SSIZE_T macro using patch from
    https://github.com/awesomized/libmemcached/pull/117


author: Paul Howarth <paul@city-fan.org> - 1.14-1
changelog:
  - Update to 1.14
    - Remove MAP_TARGET from Makefile.PL (CPAN RT#91590)
    - Fix for Solaris setuid when root running as other user (CPAN RT#88271)
    - Add strict/warnings to Tty.pm
    - Fix pod errors
    - Typo: s/dependend/dependent/
    - Prevent spurious warning from get_winsize()
    - Fix usage of setsid
    - Github actions testing; Windows is off of course
    - Make README.md
  - Use author-independent source URL
  - Fix permissions verbosely


author: Paul Howarth <paul@city-fan.org> - 1.14-5
changelog:
  - Fix FTBFS due to false detection of strlcpy() and _getpty()
    https://github.com/toddr/IO-Tty/pull/24
  - Modernize spec using %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 1.15-1
changelog:
  - Update to 1.15
    - Skip winsize test on Solaris and QNX NTO (GH#22)
    - Make function tests more robust (GH#24)
    - Work around a header name collision on util.h; this is breaking on recent
      OSX (GH#26)


author: Paul Howarth <paul@city-fan.org> - 1.16-1
changelog:
  - Update to 1.16
    - Switch to GitHub for issue tracker
    - Switch to testsuite CI workflow
    - Tidy


author: Paul Howarth <paul@city-fan.org> - 0.008-1
changelog:
  - Update to 0.008
    - Make unread by :crlf on top of :utf8_strict reliable
  - Use author-independent source URL


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.2.ea
changelog:
  - Update to shenandoah-jdk8u402-b06 (GA)
  - Update release notes for shenandoah-8u402-b06.
  - Sync NEWS with vanilla branch version.
  - Sync the copy of the portable specfile with the latest update
  - Drop local copy of JDK-8312489 which is now included upstream
  - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
  - Resolves: RHEL-17918
  - Resolves: RHEL-20987


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Related: RHEL-30934


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.2.ea
changelog:
  - Turn off xz multi-threading on i686 as it fails with an out of memory error
  - Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
  - generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
  - generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
  - generate_source_tarball.sh: Adapt version logic to work with 8u
  - generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - Remove obsolete file generate_singlerepo_source_tarball.sh
  - Remove obsolete file get_sources.sh
  - Remove obsolete file update_main_sources.sh
  - generate_source_tarball.sh: Handle an existing checkout
  - generate_source_tarball.sh: Sync indentation with java-21-openjdk version
  - generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
  - Sync patch set with portable build
  - Related: RHEL-30934


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u412-b07 (EA)
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-30934


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-2
changelog:
  - Update to shenandoah-jdk8u412-b08 (GA)
  - Update release notes for shenandoah-8u412-b08.
  - Complete release note for Certainly roots
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-32409


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b01-0.1.ea
changelog:
  - Update to shenandoah-jdk8u422-b01 (EA)
  - Update release notes for shenandoah-8u422-b01.
  - Switch to EA mode.
  - Sync the copy of the portable specfile with the latest update
  - Update NEWS file and rename remove-intree-libraries.sh so portable can be rebuilt
  - Document policy repacking script and rename to correct spelling and style
  - Limit Java only tests to one architecture using jdk_test_arch
  - Temporarily include Zero-based architectures in jdk_test_arch until they are portable
  - Related: RHEL-46860
  - Resolves: RHEL-47069
  - Resolves: RHEL-47090


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
changelog:
  - Update to shenandoah-jdk8u422-b05 (GA)
  - Update release notes for shenandoah-8u422-b05.
  - Rebase PR2462 patch following patched hunk being removed by JDK-8322106
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - Actually require tzdata 2024a now it is available in the buildroot
  - Add missing build dependencies on zlib-devel and tar
  - Update LCMS version to match JDK-8245400
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-46860
  - Resolves: RHEL-47011


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.30-1
changelog:
  - Update to MySQL 8.0.30
  - Remove patches now upstream:
    chain certs, OpenSSL 3, s390 and robin hood
  - Add a new plugin


author: Lars Tangvald <lars.tangvald@oracle.com> - 8.0.34-1
changelog:
  - Update to MySQL 8.0.34
  - Add patch from upstream bug#110569
  - Add patch to fix binlog format issue
  - Use --skip-combinations over --binlog-format=mixed
  - Add alignment patch upstream bug#110752


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.48.4-4
changelog:
  - New API: guestfs_inspect_get_build_id
  - Add support for detecting Windows >= 10, returned through osinfo
    resolves: rhbz#2012658


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.50.1-4
changelog:
  - Rebase libguestfs to 1.50.1
    resolves: rhbz#2168625
  - Use q35 machine type for libguestfs appliance
    resolves: rhbz#2168578
  - Run SELinux relabelling in parallel [for virt-v2v]
    resolves: rhbz#2190276


author: Laszlo Ersek <lersek@redhat.com> - 1:1.50.1-5
changelog:
  - let "guestfish -i" recognize "--key /dev/mapper/VG-LV:key:password"
  - reenable quickcheck; we now use "-cpu max" (upstream 30f74f38bd6e)
    resolves: rhbz#2209279


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.50.1-7
changelog:
  - Add --key all:... selector
    resolves: RHEL-19367
  - Add miscellaneous other upstream fixes since 1.50.1


author: Adrian Reber <adrian@lisas.de> - 3.14.0-6
changelog:
  - Reintroduce the emacs subpackage to avoid file conflicts between
    protobuf-compiler.x86_64 and protobuf-compiler.i686
  - Disable LTO to fix annobin errors


author: Jonathan Wakely <jwakely@redhat.com> - 1.75.0-7
changelog:
  - Build with zstd support (#2091041)
  - Fix rpminspect CI warnings about missing versioned dependencies


author: Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:16.1.0-0.5.snapshot
changelog:
  - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb)
  -  rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13


author: Paul Howarth <paul@city-fan.org> - 0.002-2
changelog:
  - Incorporate feedback from package review (#1776513)
    - BR: findutils
    - BR: perl(CPAN::Meta::Prereqs)
    - Need perl(ExtUtils::MakeMaker) >= 6.76
    - Add reference to upstream ticket about unnecessary build requirements
      https://github.com/atoomic/XString/issues/2
    - Add run-time dependency on perl(XSLoader)


author: Paul Howarth <paul@city-fan.org> - 0.005-1
changelog:
  - Update to 0.005
    - Fix cstring for Perl 5.32 (GH#6, GH#7)
    - Remove unneeded module dependencies (GH#2)
    - Add compatibility with Perl 5.8 (GH#9)


author: Richard W.M. Jones <rjones@redhat.com> - 1.28.5-1
changelog:
  - Rebase to new stable branch version 1.28.5
    resolves: rhbz#2011709
  - Move nbdkit-null-plugin to nbdkit-server package
    resolves: rhbz#2021154
  - Add asynchronous support in nbdkit-vddk-plugin
  - Drop obsolete documentation related to thread model in vddk plugin
    resolves: rhbz#2018463
  - Switch to xorriso (instead of genisoimage)
  - Distribute README.VDDK in nbdkit-vddk-plugin subpackage
  - Fix nbdkit-cow-filter cow-block-size=4096
  - file: Fix implementation of cache=none for writes
    resolves: rhbz#2029751
  - vddk: Implement VMDK creation


author: Richard W.M. Jones <rjones@redhat.com> - 1.30.8-1
changelog:
  - Rebase to new stable branch version 1.30.8
    resolves: rhbz#2059289
  - Add automatic provides generator and subpackage nbdkit-srpm-macros
    resolves: rhbz#2059291
  - New filters: blocksize-policy, protect, retry-request
  - Fix license of bash-completion subpackage
  - vddk: Fix use of uninitialized memory when computing block size
    resolves: rhbz#2066655
  - Skip vsock tests unless the vsock_loopback module is loaded
    resolves: rhbz#2069558
  - Add support for ssh create remote file.
  - Suppress excess messages from nbdkit-nbd-plugin
    resolves: rhbz#2083498
  - Suppress incorrect VDDK error when converting guests from vCenter
    resolves: rhbz#2083617
  - Backport new readahead filter from 1.32.
  - Backport new LUKS filter from 1.32.
  - Backport new scan filter from 1.32.
  - Add new Python binding for nbdkit_parse_size from 1.32
  - Add new rate filter burstiness setting from 1.32
  - vddk: Suppress new VDDK "phone home" messages
    resolves: rhbz#2104720
  - vddk: Clearer error message when thumbprint is wrong
    resolves: rhbz#1905772
  - Fix memory allocator=malloc,mlock=true
    resolves: rhbz#2044432
  - Fix multiple Coverity problems
  - Fix bounds error in nbdkit-checkwrite-filter
    resolves: rhbz#2108545


author: Richard W.M. Jones <rjones@redhat.com> - 1.32.5-4
changelog:
  - Rebase to new stable branch version 1.32.5
    resolves: rhbz#2135765
  - Move stats filter to new subpackage.
  - Improve error message when PasswordAuthentication is set to 'no'
    resolves: rhbz#2158300
  - luks: Avoid crash when image does not contain a LUKS header
    resolves: rhbz#2159581
  - curl: Enable multi-conn for read-only connections
    resolves: rhbz#2166686


author: Richard W.M. Jones <rjones@redhat.com> - 1.34.2-1
changelog:
  - Rebase to 1.34.2
    resolves: rhbz#2168629
  - Backport nbdkit-curl-plugin "multi" interface support
    resolves: rhbz#2228131


author: Richard W.M. Jones <rjones@redhat.com> - 1.36.2-1
changelog:
  - Rebase to 1.36.2
    resolves: RHEL-14475
  - partition: Suggest alternate partition-sectorsize
    resolves: RHEL-19815


author: Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-8
changelog:
  - Resolves: rhbz#2134759 Untrusted Macros
  - Resolves: rhbz#2134757 Weak Master Keys
  - Resolves: rhbz#2134755 Static Initialization Vector
  - Resolves: rhbz#2134761 Macro URL arbitrary script execution


author: Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11
changelog:
  - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Richard W.M. Jones <rjones@redhat.com> - 1.10.5-1
changelog:
  - Rebase to new stable branch version 1.10.5
    resolves: rhbz#2011708
  - Map uint32_t to OCaml int64 to avoid signedness problems
    resolves: rhbz#2040610
  - CVE-2022-0485 nbdcopy destination image corruption
  - New upstream API to control initialization of pread buffer
    resolves: rhbz#2046194


author: Richard W.M. Jones <rjones@redhat.com> - 1.12.6-1
changelog:
  - Rebase to new stable branch version 1.12.6
    resolves: rhbz#2059288
  - New tool: nbddump
  - nbdcopy: Use preferred block size for copying
    related: rhbz#2047660
  - Fix remote TLS failures
    resolves: rhbz#2111524
    (and 2111813)


author: Paul Howarth <paul@city-fan.org> - 0.26-1
changelog:
  - Update to 0.26
    - %DB::sub is now populated correctly for sub names with wide characters or
      nulls (GH#9)
    - Better Perl 5.6 compatibility by lowering prereqs of core modules
    - Test for renaming lexical subs, which should work on Perl 5.22+ (GH#10)
    - Small internal changes to bring implementation in line with changes to
      Sub::Util
    - Fix "Undefined symbol "DPPP_my_croak_xs_usage"" error on some perls
      (CPAN RT#125158)
  - Use author-independent source URL
  - Fix permissions verbosely


author: Marek Polacek <polacek@redhat.com> 11.3.1-4
changelog:
  - update from releases/gcc-11-branch (#2117632)
    - PRs analyzer/105252, analyzer/105365, analyzer/105366, c++/65211,
  	c++/82980, c++/86193, c++/90107, c++/97296, c++/101442, c++/101698,
  	c++/102071, c++/102177, c++/102300, c++/102307, c++/102479,
  	c++/102629, c++/104066, c++/104142, c++/104646, c++/104669,
  	c++/105245, c++/105265, c++/105289, c++/105304, c++/105321,
  	c++/105386, c++/105398, c++/105725, c++/105761, c++/105774,
  	c++/105795, c++/105852, c++/105925, c++/106024, c++/106361,
  	c++/107358, c/41041, c/106016, c/106981, c/107001, d/106139,
  	d/106638, debug/106261, fortran/82868, fortran/100029, fortran/100040,
  	fortran/100097, fortran/100098, fortran/100132, fortran/100136,
  	fortran/100245, fortran/103413, fortran/103504, fortran/103693,
  	fortran/103694, fortran/104313, fortran/104849, fortran/105012,
  	fortran/105230, fortran/105243, fortran/105310, fortran/105633,
  	fortran/105691, fortran/105813, fortran/105954, fortran/106121,
  	fortran/106817, fortran/106857, fortran/106985, fortran/106986,
  	fortran/107054, ipa/100413, ipa/105600, ipa/105739, libgomp/106045,
  	libstdc++/65018, libstdc++/84110, libstdc++/93602, libstdc++/96592,
  	libstdc++/99290, libstdc++/100823, libstdc++/101709, libstdc++/102447,
  	libstdc++/103664, libstdc++/103848, libstdc++/103853,
  	libstdc++/103911, libstdc++/103992, libstdc++/104217,
  	libstdc++/104443, libstdc++/104602, libstdc++/104731,
  	libstdc++/105128, libstdc++/105284, libstdc++/105375,
  	libstdc++/105502, libstdc++/105671, libstdc++/105915,
  	libstdc++/106162, libstdc++/106248, libstdc++/106320,
  	libstdc++/106607, libstdc++/106695, lto/106334, lto/106540,
  	middle-end/103193, middle-end/104869, middle-end/104966,
  	middle-end/105140, middle-end/105998, middle-end/106027,
  	middle-end/106030, middle-end/106144, middle-end/106331,
  	middle-end/106492, preprocessor/97498, preprocessor/105732,
  	rtl-optimization/104637, rtl-optimization/105041,
  	rtl-optimization/105333, rtl-optimization/105559,
  	rtl-optimization/106032, rtl-optimization/106187, sanitizer/105396,
  	sanitizer/105729, target/96072, target/99184, target/99685,
  	target/101322, target/101891, target/102059, target/102146,
  	target/103197, target/103353, target/104257, target/104829,
  	target/105147, target/105162, target/105209, target/105292,
  	target/105339, target/105349, target/105463, target/105472,
  	target/105854, target/105879, target/105970, target/105981,
  	target/106017, target/106091, target/106355, target/106491,
  	target/106721, target/107061, target/107064, target/107183,
  	target/107248, target/107304, target/107364, target/107748,
  	testsuite/105095, testsuite/105266, testsuite/105433,
  	testsuite/106345, tree-optimization/103116, tree-optimization/105148,
  	tree-optimization/105163, tree-optimization/105173,
  	tree-optimization/105250, tree-optimization/105263,
  	tree-optimization/105312, tree-optimization/105368,
  	tree-optimization/105431, tree-optimization/105437,
  	tree-optimization/105528, tree-optimization/105618,
  	tree-optimization/105726, tree-optimization/105860,
  	tree-optimization/106112, tree-optimization/106131,
  	tree-optimization/106189, tree-optimization/106513,
  	tree-optimization/106892, tree-optimization/106934
  - fix the detection of Sapphire Rapids in host_detect_local_cpu
  - fix -Wmismatched-dealloc documentation (#2116635)


author: Marek Polacek <polacek@redhat.com> 11.4.1-2
changelog:
  - update from releases/gcc-11-branch (#2193180)
    - GCC 11.4 release
    - PRs bootstrap/90543, c++/53932, c++/69410, c++/92752, c++/98056,
  	c++/98821, c++/100295, c++/100474, c++/101118, c++/101869,
  	c++/102780, c++/103871, c++/104527, c++/105406, c++/105996,
  	c++/106188, c++/106675, c++/106713, c++/106740, c++/107065,
  	c++/107163, c++/107179, c++/107558, c++/107579, c++/107864,
  	c++/108138, c++/108180, c++/108365, c++/108468, c++/108474,
  	c++/108607, c++/108975, c++/108998, c++/109096, c++/109164, c/107127,
  	c/107465, c/109151, d/107592, d/108050, d/108877, d/109108,
  	debug/106719, debug/108573, debug/108716, debug/108967, driver/106624,
  	fortran/85877, fortran/95107, fortran/96024, fortran/96025,
  	fortran/99036, fortran/103259, fortran/104332, fortran/106209,
  	fortran/106945, fortran/107576, fortran/107872, fortran/108131,
  	fortran/108349, fortran/108420, fortran/108421, fortran/108451,
  	fortran/108453, fortran/108501, fortran/108502, fortran/108527,
  	fortran/108529, fortran/108609, fortran/108937, fortran/109186,
  	fortran/109511, fortran/109846, ipa/105685, ipa/106124, ipa/107944,
  	libquadmath/87204, libquadmath/94756, libstdc++/91456,
  	libstdc++/103934, libstdc++/104866, libstdc++/104875,
  	libstdc++/105844, libstdc++/106183, libstdc++/107801,
  	libstdc++/107814, libstdc++/108030, libstdc++/108118,
  	libstdc++/108265, libstdc++/108636, libstdc++/108856,
  	libstdc++/108952, libstdc++/109064, libstdc++/109261,
  	libstdc++/109949, lto/109263, middle-end/104450, middle-end/104464,
  	middle-end/106190, middle-end/107317, middle-end/108237,
  	middle-end/108264, middle-end/108435, middle-end/108459,
  	middle-end/108546, middle-end/108625, middle-end/108685,
  	middle-end/108854, other/108560, other/109306,
  	rtl-optimization/106751, rtl-optimization/107482,
  	rtl-optimization/108193, rtl-optimization/108596,
  	rtl-optimization/109585, target/70243, target/90458, target/96373,
  	target/98776, target/100758, target/104871, target/104921,
  	target/105554, target/105599, target/106736, target/106875,
  	target/107568, target/107714, target/107863, target/108272,
  	target/108348, target/108589, target/108699, target/108807,
  	target/108812, target/108881, target/109067, target/109140,
  	target/109276, testsuite/47334, testsuite/103823, testsuite/108151,
  	testsuite/108973, testsuite/108985, tree-optimization/105484,
  	tree-optimization/106809, tree-optimization/107107,
  	tree-optimization/107212, tree-optimization/107254,
  	tree-optimization/107323, tree-optimization/107451,
  	tree-optimization/107554, tree-optimization/107898,
  	tree-optimization/107997, tree-optimization/108068,
  	tree-optimization/108076, tree-optimization/108095,
  	tree-optimization/108199, tree-optimization/108498,
  	tree-optimization/108688, tree-optimization/108692,
  	tree-optimization/108821, tree-optimization/108950,
  	tree-optimization/109176, tree-optimization/109410,
  	tree-optimization/109473, tree-optimization/109491,
  	tree-optimization/109502, tree-optimization/109573,
  	tree-optimization/109724, tree-optimization/109778
    - PRs fortran/100607, libstdc++/109822, target/109954,
  	tree-optimization/109505


author: Marek Polacek <polacek@redhat.com> 11.4.1-2.1
changelog:
  - fix ICE on pr96024.f90 on big-endian hosts (PR fortran/96024, #2213211)
  - use -fno-stack-protector to fix bit-field aarch64 tests (#2213221)


author: Marek Polacek <polacek@redhat.com> 11.4.1-3
changelog:
  - update from releases/gcc-11-branch (RHEL-17638)
    - PRs c++/106310, c++/106890, c++/109666, c++/109761, c++/111357,
  	c++/111512, c++/112795, d/108842, d/110359, d/110511, d/110516,
  	debug/110295, fortran/95947, fortran/103506, fortran/107397,
  	fortran/110288, fortran/110585, fortran/110658, fortran/111837,
  	fortran/111880, libstdc++/95048, libstdc++/99327, libstdc++/104161,
  	libstdc++/104242, libstdc++/108178, libstdc++/111050,
  	libstdc++/111511, libstdc++/112314, libstdc++/112491,
  	middle-end/110200, middle-end/111699, middle-end/111818,
  	middle-end/112733, rtl-optimization/110237, sanitizer/112727,
  	target/96762, target/101177, target/101469, target/105325,
  	target/109800, target/109932, target/110011, target/110044,
  	target/110170, target/110309, target/110741, target/111001,
  	target/111340, target/111367, target/111408, target/111815,
  	target/112672, target/112816, target/112837, target/112845,
  	target/112891, testsuite/66005, tree-optimization/110298,
  	tree-optimization/110731, tree-optimization/110914,
  	tree-optimization/111015, tree-optimization/111614,
  	tree-optimization/111764, tree-optimization/111917
  - use -fno-stack-protector in some aarch64 tests


author: Florian Weimer <fweimer@redhat.com> - 2.34-100.2
changelog:
  - CVE-2024-33599: nscd: buffer overflow in netgroup cache (RHEL-34318)
  - CVE-2024-33600: nscd: null pointer dereferences in netgroup cache
  - CVE-2024-33601: nscd: crash on out-of-memory condition
  - CVE-2024-33602: nscd: memory corruption with NSS netgroup modules


author: Patsy Griffin <patsy@redhat.com> - 2.34-100.3
changelog:
  - elf: Avoid some free (NULL) calls in _dl_update_slotinfo
  - elf: Support recursive use of dynamic TLS in interposed malloc (RHEL-39993)


author: Petr Menšík <pemensik@redhat.com> - 1.7.1-2
changelog:
  - Use make_build and make_install macro instead of make
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make


author: Richard Lescak <rlescak@redhat.com> - 1.7.1-9
changelog:
  - Fix for CVE-2020-19860 ldns: heap overread vulnerability (#2051211)
  - Added also patch for deprecated distutils Python module used in build


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.2-1
changelog:
  - tests: Add a test case for the NVMe module (vtrefny)
    Resolves: RHEL-11543
    Resolves: RHEL-11544
  - Add a simple NVMe module for NVMe Fabrics support (vtrefny)
    Resolves: RHEL-11543
    Resolves: RHEL-11544
  - network: ignore BOOTIF connections when creating device configurations
    (rvykydal)
    Resolves: RHEL-4766
  - network: ignore BOOTIF connections when looking for initramfs bond ports
    (rvykydal)
    Resolves: RHEL-4766


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.3-1
changelog:
  - Fix missing emit of zfcp kickstart statements (maier)
    Related: RHEL-11384
  - DeviceTreeViewer: Add path-id attribute to zfcp-attached SCSI disks (maier)
    Related: RHEL-11384
  - Fix missing WWID values for multipath devices in advanced storage UI
    (#2046654) (maier)
    Resolves: RHEL-11384
  - rescue: Don't allow to mount systems without a root device (vponcova)
    Resolves: RHEL-14696
  - Do not crash on default None values of ostreecontainer command (rvykydal)
    Related: RHEL-2250
  - Fix wrong dracut timeout message (jkonecny)
    Resolves: RHEL-5638
  - Move rpm-ostree deps from Lorax to Anaconda (#2125655) (jkonecny)
    Related: RHEL-2250
  - Implement needs_network for rpm_ostree_container (#2125655) (jkonecny)
    Related: RHEL-2250
  - Add tests for RPM Ostree payload with source from container (#2125655)
    (rvykydal)
    Related: RHEL-2250
  - Enable RPM OSTree from container source in payload (#2125655) (rvykydal)
    Resolves: RHEL-2250
  - Add RPM OSTree source from container (#2125655) (rvykydal)
    Related: RHEL-2250


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.5-1
changelog:
  - bootupd: Use --write-uuid (walters)
    Related: RHEL-17205
  - bootloader: Detect bootupd and skip regular install (vslavik)
    Related: RHEL-17205
  - ostree: Use bootupd if installed by payload (vslavik)
    Resolves: RHEL-17205
  - bootloader: Create an installation task for collecting kernel arguments
    (vponcova)
    Related: RHEL-17205
  - bootloader: Add the collect_arguments method (vponcova)
    Related: RHEL-17205
  - bootloader: Remove the install_boot_loader function (vponcova)
    Related: RHEL-17205
  - Apply the bootloader options before the installation (vponcova)
    Related: RHEL-17205


author: Martin Kolman <mkolman@redhat.com> - 34.25.4.6-1
changelog:
  - Disable bug reporting to Bugzilla from anaconda (kkoukiou)
    Resolves: RHEL-24419
  - Fixed file-write operation to a public directory (ataf)
    Resolves: RHEL-23345


author: Jiri Konecny <jkonecny@redhat.com> - 34.25.4.7-1
changelog:
  - Lower log file permission in /tmp (jkonecny)
    Resolves: RHEL-23345
  - Add utility function to set file mode (jkonecny)
    Related: RHEL-23345


author: Jaroslav Škarvada <jskarvad@redhat.com> - 6.1-8
changelog:
  - Dropped explicit brlapi dependency (brltty) and relaxed brltty
    dependency (brlapi)
    Related: rhbz#1765611


author: systemd maintenance team <systemd-maint@redhat.com> - 252-31
changelog:
  - bootctl: rework random seed logic to use open_mkdir_at() and openat() (RHEL-16952)
  - bootctl: properly sync fs before/after moving random seed file into place (RHEL-16952)
  - bootctl: when updating EFI random seed file, hash old seed with new one (RHEL-16952)
  - sha256: add helper than hashes a buffer *and* its size (RHEL-16952)
  - random-seed: don't refresh EFI random seed from random-seed.c anymore (RHEL-16952)
  - bootctl: downgrade graceful messages to LOG_NOTICE (RHEL-16952)
  - units: rename/rework systemd-boot-system-token.service → systemd-boot-random-seed.service (RHEL-16952)
  - bootctl: split out setting of system token into function of its own (RHEL-16952)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-32.2
changelog:
  - coredump: generate stacktraces also for processes running in containers w/o coredump forwarding (RHEL-34061)
  - test: add a couple of tests for systemd-coredump (RHEL-34061)
  - test: don't expand the subshell expression prematurely (RHEL-34061)
  - coredump filter: fix stack overflow with =all (RHEL-34061)
  - coredump filter: add mask for 'all' using UINT32_MAX, not UINT64_MAX (RHEL-34061)
  - test: add coverage for CoredumpFilter=all (RHEL-34061)
  - test: rotate journal before storing coredumps (RHEL-34061)
  - test: sync with the fake binary before killing it (RHEL-34061)
  - test: check coredump handling in containers & namespaces (RHEL-34061)
  - ukify: make the test happy with the latest OpenSSL (RHEL-34061)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-32.6
changelog:
  - cryptsetup: do not assert when unsealing token without salt (RHEL-40119)
  - cryptsetup: check the existence of salt by salt_size > 0 (RHEL-40119)
  - bootspec: fix null-dereference-read (RHEL-40119)


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-1
changelog:
  - Import into RHEL
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jan Vcelak <jvcelak@fedoraproject.org>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jeff Law <law@redhat.com>
        Lukas Zachar <lzachar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tom Stellard <tstellar@redhat.com>


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-3
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Charalampos Stratakis <cstratak@redhat.com> - 0.29.32-1
changelog:
  - Initial package
  - Fedora contributions by:
        Alex Cobb <alex.cobb@smart.mit.edu>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jesse Keating <jkeating@fedoraproject.org>
        Kevin Fenzi <kevin@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        nbecker <ndbecker2@gmail.com>
        Neal D. Becker <ndbecker2@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Scott Talbert <swt@techie.net>
        serge-sans-paille <sguelton@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio くらとみ <toshio@fedoraproject.org>


author: Charalampos Stratakis <cstratak@redhat.com> - 2.9.3-1
changelog:
  - Initial package
  - Fedora contributions by:
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Devrim GÜNDÜZ <devrim@fedoraproject.org>
        Filip Januš <fjanus@redhat.com>
        Honza Horak <hhorak@redhat.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jason Tibbitts <tibbs@math.uh.edu>
        Jesse Keating <jkeating@fedoraproject.org>
        Jozef Mlich <jmlich@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Ondřej Sloup <ondrej.sloup@protonmail.com>
        Patrik Novotný <panovotn@redhat.com>
        Pavel Raiskup <praiskup@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Kubat <pkubat@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Todd Zullinger <tmz@fedoraproject.org>
        Tomas Hrnciar <thrnciar@redhat.com>
        Tom Lane <tgl@fedoraproject.org>


author: Dodji Seketeli <dodji@redhat.com> - 2.1-1
changelog:
  - Update to upstream 2.1 release.
  - Remove the now useless text about getting the source from git.
  - Update the license reference.
  - Resolves: rhbz#1944096


author: Dodji Seketeli <dodji@redhat.com> - 2.3-1
changelog:
  - Update to upstream 2.3
  - Remove the dos2unix surgery as it's now useless
  - Update for the soname bump
  - Resolves: RHELPLAN-154803


author: Dodji Seketeli <dodji@redhat.com> - 2.4-1
changelog:
  - Update to upstream 2.4
  - Use SPDX licensing naming
  - Build BTF support
  - Add BuildRequires: libbpf-devel
  - Update for SONAME bump
  - Show details about the check and check-self-targets targets
    separatly.
  - Resolves: RHEL-12491


author: Dodji Seketeli <dodji@redhat.com> - 2.4-2
changelog:
  - Apply patch: 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch
    Resolves: https://issues.redhat.com/browse/RHEL-16614
  - Apply patch: 0002-suppression-Add-has_strict_flexible_array_data_membe.patch
    Resolves: https://issues.redhat.com/browse/RHEL-16629
  - Add git as a build requirement as we need git to apply the patches
    aboves that apply binaries.
  - Use %autosetup to handle applying the patches using git.
  - autoreconf after the patches touched at least one Makefile.am file.


author: Miroslav Rezanina <mrezanin@redhat.com> - 20230524-4
changelog:
  - edk2-OvmfPkg-ResetVector-Fix-assembler-bit-test-flag-chec.patch [RHEL-9943]
  - Resolves: RHEL-9943
    ([EDK2][AMDSERVER Bug] OvmfPkg/ResetVector: Fix assembler bit test flag check [rhel-9.3.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-1
changelog:
  - Rebase to edk2-stable202311 [RHEL-12323]
  - Switch to OpenSSL 3.0 [RHEL-49]
  - Resolves: RHEL-12323
    (Rebase EDK2 for RHEL 9.4)
  - Resolves: RHEL-49
    (consume / bundle RHEL-9 OpenSSL (version 3.0.x) in RHEL-9 edk2)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-2
changelog:
  - edk2-OvmfPkg-RiscVVirt-use-gEfiAuthenticatedVariableGuid-.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch [RHEL-20963]
  - Resolves: RHEL-20963
    ([rhel9] guest fails to boot due to ASSERT error)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-3
changelog:
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch [RHEL-21155]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch [RHEL-21155]
  - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21155]
  - Resolves: RHEL-21155
    (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-4
changelog:
  - edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch [RHEL-20963]
  - edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch [RHEL-20963]
  - Resolves: RHEL-20963
    ([rhel9] guest fails to boot due to ASSERT error)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-5
changelog:
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21157]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21157]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch [RHEL-21157]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-411-3.patch [RHEL-21157]
  - edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch [RHEL-21157]
  - edk2-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch [RHEL-21704]
  - edk2-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch [RHEL-21704]
  - edk2-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch [RHEL-21704]
  - edk2-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch [RHEL-21704]
  - Resolves: RHEL-21157
    (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-9])
  - Resolves: RHEL-21704
    (vGPU VM take several minutes to show tianocore logo if firmware is ovmf)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6
changelog:
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - edk2-NetworkPkg-Updating-SecurityFixes.yaml.patch [RHEL-21841 RHEL-21843 RHEL-21845 RHEL-21847 RHEL-21849 RHEL-21851 RHEL-21853]
  - Resolves: RHEL-21841
    (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-9])
  - Resolves: RHEL-21843
    (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-9])
  - Resolves: RHEL-21845
    (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-9])
  - Resolves: RHEL-21847
    (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-9])
  - Resolves: RHEL-21849
    (TRIAGE CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-9])
  - Resolves: RHEL-21851
    (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-9])
  - Resolves: RHEL-21853
    (TRIAGE CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6.el9_4.1
changelog:
  - edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-30156]
  - edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-30156]
  - Resolves: RHEL-30156
    (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-9.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6.el9_4.2
changelog:
  - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch [RHEL-40270 RHEL-40272]
  - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch [RHEL-40270 RHEL-40272]
  - edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch [RHEL-40270 RHEL-40272]
  - edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch [RHEL-40270 RHEL-40272]
  - edk2-SecurityPkg-RngDxe-add-rng-test.patch [RHEL-40270 RHEL-40272]
  - edk2-OvmfPkg-wire-up-RngDxe.patch [RHEL-40270 RHEL-40272]
  - edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch [RHEL-40270 RHEL-40272]
  - edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch [RHEL-40270 RHEL-40272]
  - Resolves: RHEL-40270
    (CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-9.4.z])
  - Resolves: RHEL-40272
    (CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-9.4.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20231122-6.el9_4.3
changelog:
  - edk2-OvmfPkg-Add-Hash2DxeCrypto-to-OvmfPkg.patch [RHEL-46976]
  - edk2-NetworkPkg-DxeNetLib-adjust-PseudoRandom-error-loggi.patch [RHEL-54188]
  - edk2-NetworkPkg-DxeNetLib-Reword-PseudoRandom-error-loggi.patch [RHEL-54188]
  - Resolves: RHEL-46976
    (No http boot support on edk2-ovmf-20231122-6.el9_4.2)
  - Resolves: RHEL-54188
    ([RHEL-9.4.z] edk2 hit Failed to generate random data)


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-6
changelog:
  - Add fix for mzbz#1819244
  - Fix tools subpackage dependency
  - Bump the release to "6" to accommodate the 9.1.0.z release bumps


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-7
changelog:
  - Bump the release to "7" to accommodate the 9.1.0.z release bumps as
    libwebp-1.2.0-6.el9 < libwebp-1.2.0-6.el9_1


author: Robert-André Mauchin <zebob.m@gmail.com> - 4.0.2-16
changelog:
  - Rebuilt for CVE-2022-1996, CVE-2022-24675, CVE-2022-28327, CVE-2022-27191,
    CVE-2022-29526, CVE-2022-30629


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-3
changelog:
  - remote_driver: Restore special behavior of remoteDomainGetBlockIoTune() (RHEL-22800)
  - conf: Introduce dynamicMemslots attribute for virtio-mem (RHEL-15316)
  - qemu_capabilities: Add QEMU_CAPS_DEVICE_VIRTIO_MEM_PCI_DYNAMIC_MEMSLOTS capability (RHEL-15316)
  - qemu_validate: Check capability for virtio-mem dynamicMemslots (RHEL-15316)
  - qemu_command: Generate cmd line for virtio-mem dynamicMemslots (RHEL-15316)
  - qemu_snapshot: fix detection if non-leaf snapshot isn't in active chain (RHEL-23212)
  - qemu_snapshot: create: refactor external snapshot detection (RHEL-22797)
  - qemu_snapshot: create: don't require disk-only flag for offline external snapshot (RHEL-22797)
  - remoteDispatchAuthPolkit: Fix lock ordering deadlock if client closes connection during auth (RHEL-20337)
  - util: virtportallocator: Add VIR_DEBUG statements for port allocations and release (RHEL-21543)
  - qemu: migration: Properly handle reservation of manually specified NBD port (RHEL-21543)
  - qemuMigrationDstStartNBDServer: Refactor cleanup (RHEL-21543)
  - virPCIVPDResourceIsValidTextValue: Adjust comment to reflect actual code (RHEL-22314)
  - util: pcivpd: Refactor virPCIVPDResourceIsValidTextValue (RHEL-22314)
  - virNodeDeviceCapVPDFormatCustom*: Escape unsanitized strings (RHEL-22314)
  - virNodeDeviceCapVPDFormat: Properly escape system-originated strings (RHEL-22314)
  - schema: nodedev: Adjust allowed characters in 'vpdFieldValueFormat' (RHEL-22314)
  - tests: Test the previously mishandled PCI VPD characters (RHEL-22314)
  - Don't overwrite error message from 'virXPathNodeSet' (RHEL-22314)
  - tests: virpcivpdtest: Remove 'testVirPCIVPDReadVPDBytes' case (RHEL-22314)
  - util: virpcivpd: Unexport 'virPCIVPDReadVPDBytes' (RHEL-22314)
  - util: pcivpd: Unexport virPCIVPDParseVPDLargeResourceFields (RHEL-22314)
  - tests: virpcivpd: Remove 'testVirPCIVPDParseVPDStringResource' case (RHEL-22314)
  - util: virpcivpd: Unexport 'virPCIVPDParseVPDLargeResourceString' (RHEL-22314)
  - virPCIVPDResourceGetKeywordPrefix: Fix logging (RHEL-22314)
  - util: virpcivpd: Remove return value from virPCIVPDResourceCustomUpsertValue (RHEL-22314)
  - conf: virNodeDeviceCapVPDParse*: Remove pointless NULL checks (RHEL-22314)
  - virpcivpdtest: testPCIVPDResourceBasic: Remove tests for uninitialized 'ro'/'rw' section (RHEL-22314)
  - util: virPCIVPDResourceUpdateKeyword: Remove impossible checks (RHEL-22314)
  - conf: node_device: Refactor 'virNodeDeviceCapVPDParseCustomFields' to fix error reporting (RHEL-22314)
  - virNodeDeviceCapVPDParseXML: Fix error reporting (RHEL-22314)
  - util: virpcivpd: Remove return value from virPCIVPDResourceUpdateKeyword (RHEL-22314)
  - virPCIDeviceHasVPD: Refactor "debug" messages (RHEL-22314)
  - virPCIDeviceGetVPD: Fix multiple error handling bugs (RHEL-22314)
  - virPCIDeviceGetVPD: Handle errors in callers (RHEL-22314)
  - virPCIVPDReadVPDBytes: Refactor error handling (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceString: Properly report errors (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Merge logic conditions (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Remove impossible 'default' switch case (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Refactor processing of read data (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Refactor return logic (RHEL-22314)
  - virPCIVPDParseVPDLargeResourceFields: Report proper errors (RHEL-22314)
  - virPCIVPDParse: Do reasonable error reporting (RHEL-22314)
  - virt-admin: Add warning when connection to default daemon fails (RHEL-23170)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-4
changelog:
  - Set stubDriverName from hostdev driver model attribute during pci device setup (RHEL-25858)
  - qemuMigrationDstPrepareStorage: Use 'switch' statement to include all storage types (RHEL-24825)
  - qemuMigrationDstPrepareStorage: Properly consider path for 'vdpa' devices (RHEL-24825)
  - domain_validate: Account for NVDIMM label size properly when checking for memory conflicts (RHEL-4452)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-5
changelog:
  - cpu: x86: Add support for adding features to existing CPU models (RHEL-25995)
  - qemu: domain: Check arch in qemuDomainMakeCPUMigratable (RHEL-25995)
  - conf: cpu: Introduce virCPUDefListFeatures (RHEL-25995)
  - qemu: domain: Drop added features from migratable CPU (RHEL-25995)
  - Add vmx-* features to Broadwell* (RHEL-25995)
  - Add vmx-* features to Cascadelake* (RHEL-25995)
  - Add vmx-* features to Conroe (RHEL-25995)
  - Add vmx-* features to Cooperlake (RHEL-25995)
  - Add vmx-* features to core{,2}duo (RHEL-25995)
  - Add vmx-* features to Haswell* (RHEL-25995)
  - Add vmx-* features to Icelake* (RHEL-25995)
  - Add vmx-* features to IvyBridge* (RHEL-25995)
  - Add vmx-* features to kvm* (RHEL-25995)
  - Add vmx-* features to Nehalem* (RHEL-25995)
  - Add vmx-* features to Penryn (RHEL-25995)
  - Add vmx-* features to SandyBridge* (RHEL-25995)
  - Add vmx-* features to SapphireRapids (RHEL-25995)
  - Add vmx-* features to Skylake* (RHEL-25995)
  - Add vmx-* features to Snowridge (RHEL-25995)
  - Add vmx-* features to Westmere* (RHEL-25995)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-6
changelog:
  - qemu: virtiofs: do not crash if cgroups are missing (RHEL-7386)
  - qemu: virtiofs: set correct label when creating the socket (RHEL-7386)
  - qemu: virtiofs: error out if getting the group or user name fails (RHEL-7386)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-6.1.el9_4
changelog:
  - Fix off-by-one error in udevListInterfacesByStatus (CVE-2024-1441, RHEL-25081)
  - remote: check for negative array lengths before allocation (CVE-2024-2494)


author: Jiri Denemark <jdenemar@redhat.com> - 10.0.0-6.6.el9_4
changelog:
  - vmx: Do not require DVS Port ID (RHEL-45520)
  - vmx: Do not require all ID data for VMWare Distributed Switch (RHEL-46595)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.3+1 (EA)
  - Update release notes to 21.0.3+1
  - Switch to EA mode
  - Require tzdata 2023d due to upstream inclusion of JDK-8322725
  - Bump FreeType version to 2.13.2 following JDK-8316028
  - Related: RHEL-30946


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
changelog:
  - Install alt-java man page from the misc tarball as it is no longer in the JDK image
  - generate_source_tarball.sh: Update examples in header for clarity
  - generate_source_tarball.sh: Cleanup message issued when checkout already exists
  - generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
  - generate_source_tarball.sh: Only add --depth=1 on non-local repositories
  - Move maintenance scripts to a scripts subdirectory
  - discover_trees.sh: Set compile-command and indentation instructions for Emacs
  - discover_trees.sh: shellcheck: Do not use -o (SC2166)
  - discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: Add authorship
  - icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
  - icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
  - icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: Set compile-command and indentation instructions for Emacs
  - openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
  - openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
  - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
  - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
  - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
  - Related: RHEL-30946


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
changelog:
  - Invoke xz in multi-threaded mode
  - generate_source_tarball.sh: Add WITH_TEMP environment variable
  - generate_source_tarball.sh: Multithread xz on all available cores
  - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
  - generate_source_tarball.sh: Update comment about tarball naming
  - generate_source_tarball.sh: Reformat comment header
  - generate_source_tarball.sh: Reformat and update help output
  - generate_source_tarball.sh: Do a shallow clone, for speed
  - generate_source_tarball.sh: Append -ea designator when required
  - generate_source_tarball.sh: Eliminate some removal prompting
  - generate_source_tarball.sh: Make tarball reproducible
  - generate_source_tarball.sh: Prefix temporary directory with temp-
  - generate_source_tarball.sh: Remove temporary directory exit conditions
  - generate_source_tarball.sh: Fix -ea logic to add dash
  - generate_source_tarball.sh: Set compile-command in Emacs
  - generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
  - generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
  - generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
  - generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
  - generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
  - generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
  - Use backward-compatible patch syntax
  - generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
  - generate_source_tarball.sh: Fix whitespace
  - generate_source_tarball.sh: Remove trailing period in echo
  - generate_source_tarball.sh: Use long-style argument to grep
  - generate_source_tarball.sh: Add license
  - generate_source_tarball.sh: Add indentation instructions for Emacs
  - Related: RHEL-30946


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
changelog:
  - Update to jdk-21.0.3+7 (EA)
  - Update release notes to 21.0.3+7
  - Require tzdata 2024a due to upstream inclusion of JDK-8322725
  - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
  - Drop JDK-8009550 which is now available upstream
  - Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
  - Resolves: RHEL-30946


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
changelog:
  - Update to jdk-21.0.3+9 (GA)
  - Update release notes to 21.0.3+9
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
  - Resolves: RHEL-32424


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.4+1 (EA)
  - Update release notes to 21.0.4+1
  - Switch to EA mode
  - Bump LCMS 2 version to 2.16.0 following JDK-8321489
  - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
  - Restore NEWS file so portable can be rebuilt
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-45356
  - Resolves: RHEL-46028


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
changelog:
  - Update to jdk-21.0.4+5 (EA)
  - Update release notes to 21.0.4+5
  - Limit Java only tests to one architecture using jdk_test_arch
  - Actually require tzdata 2024a now it is available in the buildroot
  - Resolves: RHEL-45356
  - Resolves: RHEL-47399


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
changelog:
  - Update to jdk-21.0.4+7 (GA)
  - Update release notes to 21.0.4+7
  - Switch to GA mode.
  - Sync the copy of the portable specfile with the latest update
  - Add missing section headers in NEWS
  - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
  - Resolves: RHEL-47022


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 0.29.35-2
changelog:
  - Initial package
  - Fedora contributions by:
        Alex Cobb <alex.cobb@smart.mit.edu>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <i.gnatenko.brain@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Kevin Fenzi <kevin@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Neal D. Becker <ndbecker2@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Scott Talbert <swt@techie.net>
        serge-sans-paille <sguelton@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio くらとみ <toshio@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.9.6-1
changelog:
  - Initial package
  - Fedora contributions by:
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Devrim Gündüz <devrim@gunduz.org>
        Filip Januš <fjanus@redhat.com>
        Honza Horak <hhorak@redhat.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Jason Tibbitts <tibbs@math.uh.edu>
        Jesse Keating <jkeating@fedoraproject.org>
        Jozef Mlich <jmlich@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Ondřej Sloup <ondrej.sloup@protonmail.com>
        Patrik Novotný <panovotn@redhat.com>
        Pavel Raiskup <praiskup@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Kubat <pkubat@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Todd Zullinger <tmz@fedoraproject.org>
        Tomas Hrnciar <thrnciar@redhat.com>
        Tom Lane <tgl@fedoraproject.org>


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.27.1.el9_4]
changelog:
  - drm/ast: Fix soft lockup (CKI Backport Bot) [RHEL-45716]
  - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41838 RHEL-33217] {CVE-2024-26880}
  - KVM: arm64: Do not re-initialize the KVM lock (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: Fix host-programmed guest events in nVHE (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - KVM: arm64: Fix double-free following kvm_pgtable_stage2_free_unlinked() (Sebastian Ott) [RHEL-37528 RHEL-36279]
  - octeontx2-af: Use separate handlers for interrupts (Kamal Heib) [RHEL-42846 RHEL-35170] {CVE-2024-27030}
  - Squashfs: check the inode number is not the invalid value of zero (Abhi Das) [RHEL-42811 RHEL-35098] {CVE-2024-26982}
  - net: fix sk_memory_allocated_{add|sub} vs softirqs (Paolo Abeni) [RHEL-36773 RHEL-34070]
  - tcp: sk_forced_mem_schedule() optimization (Paolo Abeni) [RHEL-36773 RHEL-34070]
  - net: make SK_MEMORY_PCPU_RESERV tunable (Paolo Abeni) [RHEL-36773 RHEL-34070]
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-42655 RHEL-31690] {CVE-2024-26773}
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-42528 RHEL-38200] {CVE-2023-52809}
  - KVM: x86/mmu: Retry fault before acquiring mmu_lock if mapping is changing (Maxim Levitsky) [RHEL-43388]
  - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-40398 RHEL-36047]
  - RAS: enable CONFIG_RAS_FMPM (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS: Avoid build errors when CONFIG_DEBUG_FS=n (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Safely handle saved records of various sizes (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Avoid NULL ptr deref in get_saved_records() (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - Merge tag 'edac_updates_for_v6.9' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Fix off by one when unwinding on error (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Add debugfs interface to print record entries (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/FMPM: Save SPA values (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS: Export helper to get ras_debugfs_dir (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Fix bit overflow in denorm_addr_df4_np2() (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS: Introduce a FRU memory poison manager (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - x86/cpu/amd: Provide a separate accessor for Node ID (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Add MI300 row retirement support (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - Documentation: Move RAS section to admin-guide (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Add MI300 DRAM to normalized address translation support (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Fix array overflow in get_logical_coh_st_fabric_id_mi300() (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - RAS/AMD/ATL: Add MI300 support (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - Documentation: RAS: Add index and address translation section (Aristeu Rozanski) [RHEL-36212 RHEL-17008]
  - cpu/SMT: Make SMT control more robust against enumeration failures (Aristeu Rozanski) [RHEL-36212 RHEL-17008]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.28.1.el9_4]
changelog:
  - mlxbf_gige: call request_irq() after NAPI initialized (Kamal Heib) [RHEL-43012 RHEL-37179] {CVE-2024-35907}
  - mlxbf_gige: stop PHY during open() error paths (Kamal Heib) [RHEL-43012 RHEL-37179] {CVE-2024-35907}
  - mlxbf_gige: stop interface during shutdown (Kamal Heib) [RHEL-41708 RHEL-37244] {CVE-2024-35885}
  - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43796 RHEL-43794] {CVE-2022-48743}
  - nfp: flower: handle acti_netdevs allocation failure (Ken Cox) [RHEL-42852 RHEL-35158] {CVE-2024-27046}
  - block: add check that partition length needs to be aligned with block size (Ming Lei) [RHEL-45501 RHEL-26616] {CVE-2023-52458}
  - nfsd: hold a lighter-weight client reference over CB_RECALL_ANY (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - NFSD: CREATE_SESSION must never cache NFS4ERR_DELAY replies (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - NFSD: Document the phases of CREATE_SESSION (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - NFSD: Fix the NFSv4.1 CREATE_SESSION operation (Benjamin Coddington) [RHEL-45517 RHEL-31513]
  - icmp: prevent possible NULL dereferences from icmp_build_probe() (Antoine Tenart) [RHEL-42974 RHEL-37002] {CVE-2024-35857}
  - NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking (Scott Mayhew) [RHEL-45360 RHEL-24133]
  - RAS/AMD/ATL: Use system settings for MI300 DRAM to normalized address translation (Aristeu Rozanski) [RHEL-46335 RHEL-38634]
  - RAS/AMD/ATL: Fix MI300 bank hash (Aristeu Rozanski) [RHEL-46335 RHEL-38634]
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-42689 RHEL-33271] {CVE-2024-26852}
  - epoll: be better about file lifetimes (Pavel Reichl) [RHEL-44091 RHEL-44083] {CVE-2024-38580}
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Dick Kennedy) [RHEL-40659 RHEL-40665 RHEL-24508 RHEL-39793] {CVE-2024-36924}
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Dick Kennedy) [RHEL-40659 RHEL-40669 RHEL-24508 RHEL-39887] {CVE-2024-36952}
  - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel (Viktor Malik) [RHEL-42640 RHEL-31726] {CVE-2024-26737}
  - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv (Ken Cox) [RHEL-41489 RHEL-38415] {CVE-2021-47459}
  - wifi: ath11k: restore country code during resume (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: refactor setting country code logic (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - bus: mhi: host: Add mhi_power_down_keep_dev() API to support system suspend/hibernation (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - net: qrtr: support suspend/hibernation (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: support hibernation (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: thermal: don't try to register multiple times (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: fix warning on DMA ring capabilities event (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: do not dump SRNG statistics during resume (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: remove MHI LOOPBACK channels (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]
  - wifi: ath11k: rearrange IRQ enable/disable in reset path (Jose Ignacio Tornos Martinez) [RHEL-46230 RHEL-12349]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.29.1.el9_4]
changelog:
  - net: Avoid address overwrite in kernel_connect (Davide Caratti) [RHEL-45728 RHEL-30875]
  - net: replace calls to sock->ops->connect() with kernel_connect() (Davide Caratti) [RHEL-45728 RHEL-33410]
  - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-41638 RHEL-39704] {CVE-2024-36020}
  - cifs: translate network errors on send to -ECONNABORTED (Jay Shin) [RHEL-47047 RHEL-31245]
  - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44132] {CVE-2024-38575}
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-43208 RHEL-39803] {CVE-2024-36921}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-42906 RHEL-36809] {CVE-2024-35789}
  - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-42886 RHEL-36900] {CVE-2024-27434}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-42860 RHEL-35142] {CVE-2024-27052}
  - wifi: mt76: mt7925e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-42856 RHEL-35148] {CVE-2024-27049}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-42743 RHEL-34187] {CVE-2024-26897}
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (Jose Ignacio Tornos Martinez) [RHEL-42383 RHEL-35199] {CVE-2023-52651}
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-41402 RHEL-39781] {CVE-2024-36929}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.30.1.el9_4]
changelog:
  - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35840] {CVE-2024-21823}
  - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35840] {CVE-2024-21823}
  - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35840] {CVE-2024-21823}
  - tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (Mark Salter) [RHEL-49538 RHEL-39308]
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails (Jon Maloy) [RHEL-44467] {CVE-2024-37353}
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-36271 RHEL-26682] {CVE-2024-26600}
  - eeprom: at24: fix memory corruption race condition (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: Probe for DDR3 thermal sensor in the SPD case (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: Use dev_err_probe for nvmem register failure (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: Add support for 24c1025 EEPROM (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - eeprom: at24: remove struct at24_client (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - at24: Support probing while in non-zero ACPI D state (CKI Backport Bot) [RHEL-42970] {CVE-2024-35848}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44439] {CVE-2024-37356}
  - cxl/region: Fix cxlr_pmem leaks (cki-backport-bot) [RHEL-44486] {CVE-2024-38391}
  - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44480] {CVE-2024-36489}
  - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-42714 RHEL-33266] {CVE-2024-26853}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44404 RHEL-44402] {CVE-2024-33621}
  - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-44404 RHEL-32205]
  - ipvlan: properly track tx_errors (Davide Caratti) [RHEL-44404 RHEL-32205]
  - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-41698 RHEL-39754] {CVE-2024-36941}
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-41658 RHEL-37028] {CVE-2024-35845}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-41556 RHEL-37018] {CVE-2024-35852}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44215] {CVE-2024-38558}
  - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-41520 RHEL-39799] {CVE-2024-36922}
  - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-38754 RHEL-37345] {CVE-2024-35937}
  - ice: fix memory corruption bug with suspend and rebuild (Petr Oros) [RHEL-49858 RHEL-17486] {CVE-2024-35911}
  - ipv6: prevent possible NULL deref in fib6_nh_init() (Hangbin Liu) [RHEL-48182 RHEL-45826] {CVE-2024-40961}
  - netns: Make get_net_ns() handle zero refcount net (Paolo Abeni) [RHEL-48117 RHEL-46610] {CVE-2024-40958}
  - net: do not leave a dangling sk pointer, when socket creation fails (Paolo Abeni) [RHEL-48072 RHEL-46610] {CVE-2024-40954}
  - net: ethtool: fix the error condition in ethtool_get_phy_stats_ethtool() (CKI Backport Bot) [RHEL-47902] {CVE-2024-40928}
  - net: netlink: af_netlink: Prevent empty skb by adding a check on len. (Ivan Vecera) [RHEL-43619 RHEL-30344] {CVE-2021-47606}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46921] {CVE-2024-39487}
  - nfs: fix panic when nfs4_ff_layout_prepare_ds() fails (Benjamin Coddington) [RHEL-42732 RHEL-34875] {CVE-2024-26868}
  - efi: fix panic in kdump kernel (Steve Best) [RHEL-42920 RHEL-36998] {CVE-2024-35800}
  - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() (Hangbin Liu) [RHEL-41735 RHEL-31050] {CVE-2024-27417}
  - netfilter: nf_tables: do not compare internal table flags on updates (Florian Westphal) [RHEL-41682 RHEL-33985] {CVE-2024-27065}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-41466 RHEL-39786] {CVE-2024-36903}
  - netfilter: nf_tables: honor table dormant flag from netdev release event path (Florian Westphal) [RHEL-40056 RHEL-33985] {CVE-2024-36005}
  - cifs: fix underflow in parse_server_interfaces() (Paulo Alcantara) [RHEL-34636 RHEL-31245] {CVE-2024-26828}
  - drm/i915/audio: Fix audio time stamp programming for DP (CKI Backport Bot) [RHEL-45843]
  - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-42548 RHEL-38260] {CVE-2023-52864}
  - platform/x86: wmi: remove unnecessary initializations (David Arcari) [RHEL-42548 RHEL-38260] {CVE-2023-52864}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (CKI Backport Bot) [RHEL-43170] {CVE-2024-36017}
  - netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain (Florian Westphal) [RHEL-40062 RHEL-33985] {CVE-2024-26808}
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-39017 RHEL-32372] {CVE-2024-35969}
  - netfilter: nf_tables: flush pending destroy work before exit_net release (Florian Westphal) [RHEL-38765 RHEL-33985] {CVE-2024-35899}
  - vt: fix unicode buffer corruption when deleting characters (Andrew Halaney) [RHEL-42947 RHEL-24205] {CVE-2024-35823}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.31.1.el9_4]
changelog:
  - net: fix __dst_negative_advice() race (CKI Backport Bot) [RHEL-46798] {CVE-2024-36971}
  - net: annotate data-races around sk->sk_dst_pending_confirm (CKI Backport Bot) [RHEL-46798] {CVE-2024-36971}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.32.1.el9_4]
changelog:
  - REDHAT: Makefile, dont reset dist-git-tmp if set (Lucas Zampieri)
  - net/mlx5e: Fix netif state handling (Benjamin Poirier) [RHEL-43872 RHEL-43870] {CVE-2024-38608}
  - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Benjamin Poirier) [RHEL-43872 RHEL-43870] {CVE-2024-38608}
  - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50202 RHEL-50203] {CVE-2024-41091}
  - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50264 RHEL-50265] {CVE-2024-41090}
  - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-43421 RHEL-30023] {CVE-2024-26810}
  - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44299] {CVE-2024-38538}
  - KVM: arm64: Ensure target address is granule-aligned for range TLBI (Sebastian Ott) [RHEL-52248 RHEL-31215]
  - RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (cki-backport-bot) [RHEL-44250] {CVE-2024-38544}
  - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-52082] {CVE-2024-41076}
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46421 RHEL-35393] {CVE-2024-39476}
  - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50074]
  - cxl/port: Fix delete_endpoint() vs parent unregistration race (John W. Linville) [RHEL-39290 RHEL-23582] {CVE-2023-52771}
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (Petr Oros) [RHEL-49862 RHEL-17486] {CVE-2024-26855}
  - ice: fix LAG and VF lock dependency in ice_reset_vf() (Petr Oros) [RHEL-49820 RHEL-17486] {CVE-2024-36003}
  - net: wwan: iosm: Fix tainted pointer delete is case of region creation fail (Jose Ignacio Tornos Martinez) [RHEL-47992 RHEL-9429] {CVE-2024-40939}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47770] {CVE-2024-40911}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47788] {CVE-2024-40912}
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47920] {CVE-2024-40929}
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48028] {CVE-2024-40941}
  - seg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors (Hangbin Liu) [RHEL-48098 RHEL-45826] {CVE-2024-40957}
  - ipv6: fix possible race in __fib6_drop_pcpu_from() (Hangbin Liu) [RHEL-47572 RHEL-45826] {CVE-2024-40905}
  - redhat/configs: Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-39581 RHEL-28760]
  - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-39581 RHEL-28760]
  - drm/mgag200: Fix caching setup for remapped video memory (Scott Weaver) [RHEL-39581 RHEL-24102]
  - Revert "drm/mgag200: Flush the cache to improve latency" (Scott Weaver) [RHEL-39581 RHEL-28760]
  - net: psample: fix flag being set in wrong skb (Adrian Moreno) [RHEL-47275]
  - net: openvswitch: store sampling probability in cb. (Adrian Moreno) [RHEL-47275]
  - net: openvswitch: add psample action (Adrian Moreno) [RHEL-47275]
  - net: psample: allow using rate as probability (Adrian Moreno) [RHEL-47275]
  - net: psample: skip packet copy if no listeners (Adrian Moreno) [RHEL-47275]
  - net: psample: add user cookie (Adrian Moreno) [RHEL-47275]
  - i40e: fix: remove needless retries of NVM update (CKI Backport Bot) [RHEL-48169 RHEL-36692]
  - ice: Reject pin requests with unsupported flags (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: Don't process extts if PTP is disabled (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: Fix improper extts handling (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: stop destroying and reinitalizing Tx tracker during reset (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: factor out ice_ptp_rebuild_owner() (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: rename ice_ptp_tx_cfg_intr (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: don't check has_ready_bitmap in E810 functions (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: rename verify_cached to has_ready_bitmap (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: pass reset type to PTP reset functions (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: introduce PTP state machine (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: make RX HW timestamp reading code more reusable (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: Rename E822 to E82X (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: periodically kick Tx timestamp interrupt (Petr Oros) [RHEL-50388 RHEL-17486]
  - ice: Re-enable timestamping correctly after reset (Petr Oros) [RHEL-50388 RHEL-17486]
  - ptp: introduce helpers to adjust by scaled parts per million (Petr Oros) [RHEL-50388 RHEL-17486]
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc (Andrew Halaney) [RHEL-42566 RHEL-24205] {CVE-2023-52880}
  - netfilter: complete validation of user input (Phil Sutter) [RHEL-47384 RHEL-37212] {CVE-2024-35962}
  - netfilter: validate user input for expected length (Phil Sutter) [RHEL-41668 RHEL-37212] {CVE-2024-35896}
  - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-40051 RHEL-39719] {CVE-2024-36025}
  - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-37615 RHEL-33260] {CVE-2024-26908}
  - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Prarit Bhargava) [RHEL-37615 RHEL-25415]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.33.1.el9_4]
changelog:
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44287] {CVE-2024-38540}
  - netfilter: flowtable: validate pppoe header (Florian Westphal) [RHEL-44430 RHEL-33469] {CVE-2024-27016}
  - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44116] {CVE-2024-38579}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51035 RHEL-51033] {CVE-2024-41041}
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Florian Westphal) [RHEL-42832 RHEL-33985] {CVE-2024-27019}
  - netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV (Florian Westphal) [RHEL-42832 RHEL-33985]
  - netfilter: nf_tables: NULL pointer dereference in nf_tables_updobj() (Florian Westphal) [RHEL-42832 RHEL-33985]
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Florian Westphal) [RHEL-41802 RHEL-33985] {CVE-2024-26925}
  - netfilter: nf_tables: discard table flag update with pending basechain deletion (Florian Westphal) [RHEL-40231 RHEL-33985] {CVE-2024-35897}
  - netfilter: nf_tables: reject table flag and netdev basechain updates (Florian Westphal) [RHEL-40231 RHEL-33985]
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-42966 RHEL-37040] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-42966 RHEL-37040] {CVE-2024-35839}
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-42966 RHEL-37040] {CVE-2024-35839}
  - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-42966 RHEL-37040] {CVE-2024-35839}
  - netfilter: nft_limit: reject configurations that cause integer overflow (Florian Westphal) [RHEL-40065 RHEL-33985] {CVE-2024-26668}
  - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48339] {CVE-2024-40978}
  - mm/huge_memory: don't unpoison huge_zero_folio (Aristeu Rozanski) [RHEL-47804] {CVE-2024-40914}
  - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48375 RHEL-6118] {CVE-2024-40983}
  - netfilter: nft_set_rbtree: skip end interval element from gc (Florian Westphal) [RHEL-41265] {CVE-2024-26581}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment (CKI Backport Bot) [RHEL-52021 RHEL-52019 RHEL-52020] {CVE-2024-42152}
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() (CKI Backport Bot) [RHEL-51756] {CVE-2024-42110}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Florian Westphal) [RHEL-40265 RHEL-33985] {CVE-2024-35898}
  - netfilter: br_netfilter: remove WARN traps (CKI Backport Bot) [RHEL-42882] {CVE-2024-27415}
  - netfilter: br_netfilter: skip conntrack input hook for promisc packets (CKI Backport Bot) [RHEL-42882] {CVE-2024-27415}
  - netfilter: bridge: confirm multicast packets before passing them up the stack (CKI Backport Bot) [RHEL-42882] {CVE-2024-27415}
  - netfilter: nf_conntrack_bridge: initialize err to 0 (CKI Backport Bot) [RHEL-42882] {CVE-2024-27415}
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Florian Westphal) [RHEL-42842 RHEL-33985] {CVE-2024-27020}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.34.1.el9_4]
changelog:
  - mm: prevent derefencing NULL ptr in pfn_section_valid() (Jarod Wilson) [RHEL-51140 RHEL-51138] {CVE-2024-41055}
  - mm, kmsan: fix infinite recursion due to RCU critical section (Jarod Wilson) [RHEL-51140 RHEL-51138] {CVE-2024-41055}
  - ppp: reject claimed-as-LCP but actually malformed packets (CKI Backport Bot) [RHEL-51061 RHEL-51059] {CVE-2024-41044}
  - x86: stop playing stack games in profile_pc() (CKI Backport Bot) [RHEL-51651] {CVE-2024-42096}
  - PCI/MSI: Fix UAF in msi_capability_init (CKI Backport Bot) [RHEL-51438] {CVE-2024-41096}
  - iommufd: Fix missing update of domains_itree after splitting iopt_area (Jerry Snitselaar) [RHEL-42518 RHEL-28780] {CVE-2023-52801}
  - mm: cachestat: fix folio read-after-free in cache walk (Nico Pache) [RHEL-41739 RHEL-5619] {CVE-2024-26630}
  - regmap: maple: Fix cache corruption in regcache_maple_drop() (Jaroslav Kysela) [RHEL-43179 RHEL-39706] {CVE-2024-36019}
  - mm: cachestat: fix two shmem bugs (Nico Pache) [RHEL-36912] {CVE-2024-35797}
  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address (Steve Best) [RHEL-42778 RHEL-34985] {CVE-2024-26946}
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-43132 RHEL-37467] {CVE-2024-36000}
  - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52675 RHEL-50366]
  - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52675 RHEL-50366]
  - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52675 RHEL-50366]
  - gpio: tegra186: Fix tegra186_gpio_is_accessible() check (Charles Mirabile) [RHEL-49347 RHEL-32452]
  - net/sched: Fix UAF when resolving a clash (CKI Backport Bot) [RHEL-51022 RHEL-51020] {CVE-2024-41040}
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (Maxim Levitsky) [RHEL-41462 RHEL-32430] {CVE-2024-35791}
  - cxl/region: Fix memregion leaks in devm_cxl_add_region() (John W. Linville) [RHEL-47965 RHEL-23582] {CVE-2024-40936}
  - x86/coco: Require seeding RNG with RDRAND on CoCo systems (Lenny Szubowicz) [RHEL-42986 RHEL-37269] {CVE-2024-35875}
  - scsi: qedf: Ensure the copied buf is NUL terminated (cki-backport-bot) [RHEL-44203] {CVE-2024-38559}


author: Scott Weaver <scweaver@redhat.com> [5.14.0-427.35.1.el9_4]
changelog:
  - usb-storage: alauda: Check whether the media is initialized (CKI Backport Bot) [RHEL-43716] {CVE-2024-38619}
  - ceph: force sending a cap update msg back to MDS for revoke op (Xiubo Li) [RHEL-55437]
  - ceph: periodically flush the cap releases (Xiubo Li) [RHEL-55437]
  - mm: avoid overflows in dirty throttling logic (Jay Shin) [RHEL-51848 RHEL-50004] {CVE-2024-42131}
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Jay Shin) [RHEL-51701 RHEL-50004] {CVE-2024-42102}
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Jay Shin) [RHEL-42628 RHEL-5619] {CVE-2024-26720}
  - net: fix out-of-bounds access in ops_init (Paolo Abeni) [RHEL-43188 RHEL-46610] {CVE-2024-36883}
  - nvme: avoid double free special payload (CKI Backport Bot) [RHEL-51311] {CVE-2024-41073}
  - kernfs: change kernfs_rename_lock into a read-write lock (Jay Shin) [RHEL-55253 RHEL-52956]
  - kernfs: Separate kernfs_pr_cont_buf and rename_lock (Jay Shin) [RHEL-55253 RHEL-52956]
  - kernfs: fix missing kernfs_iattr_rwsem locking (Jay Shin) [RHEL-55253 RHEL-52956]
  - kernfs: Use a per-fs rwsem to protect per-fs list of kernfs_super_info (Jay Shin) [RHEL-55253 RHEL-52956]
  - kernfs: Introduce separate rwsem to protect inode attributes (Jay Shin) [RHEL-55253 RHEL-52956]
  - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47894 RHEL-47892] {CVE-2024-40927}
  - Bluetooth: af_bluetooth: Fix deadlock (Bastien Nocera) [RHEL-34161] {CVE-2024-26886}
  - xdp: Remove WARN() from __xdp_reg_mem_model() (CKI Backport Bot) [RHEL-51586] {CVE-2024-42082}
  - nfsd: don't take fi_lock in nfsd_break_deleg_cb() (Benjamin Coddington) [RHEL-42578 RHEL-34875]
  - nfsd: fix RELEASE_LOCKOWNER (Benjamin Coddington) [RHEL-42578 RHEL-34875] {CVE-2024-26629}
  - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (CKI Backport Bot) [RHEL-43729 RHEL-43727]
  - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (CKI Backport Bot) [RHEL-43729 RHEL-43727]
  - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43729] {CVE-2024-36979}
  - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-42343 RHEL-26588] {CVE-2023-52463}
  - ACPI: arm64: export acpi_arch_thermal_cpufreq_pctg() (Charles Mirabile) [RHEL-34234 RHEL-1697]
  - ACPI: processor: reduce CPUFREQ thermal reduction pctg for Tegra241 (Charles Mirabile) [RHEL-34234 RHEL-1697]
  - ACPI: thermal: Add Thermal fast Sampling Period (_TFP) support (Scott Weaver) [RHEL-34234 RHEL-1697]


