# changelog

author: Charalampos Stratakis <cstratak@redhat.com> - 3.5.2-6
changelog:
- Use proper patch numbering and base upstream branch for
porting ssl and hashlib modules to OpenSSL 1.1.0
- Drop hashlib patch for now
- Add riscv64 arch to 64bit and no-valgrind arches


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-7
changelog:
- Fix error check, so that Random.seed actually uses OS randomness (rhbz#1412275)
- Skip test_aead_aes_gcm during rpmbuild


author: Tomas Orsava <torsava@redhat.com> - 3.6.0-8
changelog:
- Modify the runtime dependency of python3-libs on system-python-libs to use
  just the version and release number, but not the dist tag due to Modularity


author: Tomas Orsava <torsava@redhat.com> - 3.6.0-9
changelog:
- Modify the runtime dependency of python3-libs on system-python-libs again,
  because previous attempt didn't work properly with dnf resolving mechanism


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-12
changelog:
- BuildRequire the new dependencies of setuptools when rewheel mode is enabled
in order for the virtualenvs to work properly


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.0-18
changelog:
- Set values of prefix and exec_prefix to /usr/local for
  /usr/bin/python* executables
- Use new %_module_build macro


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.0-19
changelog:
- Revert "Set values of prefix and exec_prefix to /usr/local for
  /usr/bin/python* executables..." to prevent build failures
  of packages using alternate build tools


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.0-21
changelog:
- Use proper command line parsing in _testembed
- Backport of PEP 538: Coercing the legacy C locale to a UTF-8 based locale
  https://fedoraproject.org/wiki/Changes/python3_c.utf-8_locale


author: Iryna Shcherbina <ishcherb@redaht.com> - 3.6.1-0.1.rc1
changelog:
- Update to Python 3.6.1 release candidate 1
- Add patch 264 to skip a known test failure on aarch64


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.1-6
changelog:
- Enable profile guided optimizations for x86_64 and i686 architectures
- Update to a newer implementation of PEP 538
- Update description to reflect that Python 3 is now the default Python


author: Tomas Orsava <torsava@redhat.com> - 3.6.1-7
changelog:
- Added a dependency to the devel subpackage on python3-rpm-generators which
  have been excised out of rpm-build
- Updated notes on bootstrapping Python on top of this specfile accordingly
- Involves: rhbz#1410631, rhbz#1444925


author: Florian Weimer <fweimer@redhat.com> - 3.6.2-4
changelog:
- Do not generate debuginfo subpackages (#1476593)
- Rebuild with binutils fix for ppc64le (#1475636)


author: Tomas Orsava <torsava@redhat.com> - 3.6.2-5
changelog:
- Dropped BuildRequires on db4-devel which was useful for Python 2 (module
  bsddb), however, no longer needod for Python 3
- Tested building Python 3 with and without the dependency, all tests pass and
  filelists of resulting RPMs are identical


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.2-7
changelog:
- Revert "Add --executable option to install.py command"
  This enhancement is currently not needed and it can possibly
  collide with `pip --editable`option


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-8
changelog:
- Have /usr/bin/2to3 (rhbz#1111275)
- Provide 2to3 and idle3, list them in summary and description (rhbz#1076401)


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-11
changelog:
- Add bcond for --without optimizations
- Reword package descriptions
- Remove Group declarations
- Skip failing test_float_with_comma


author: Michal Cyprian <mcyprian@redhat.com> - 3.6.2-12
changelog:
- Use python3 style of calling super() without arguments in rpath
  patch to prevent recursion in UnixCCompiler subclasses
Resolves: rhbz#1458122


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-13
changelog:
- Rename patch files to be consistent
- Run autotools to generate the configure script before building
- Merge lib64 patches (104 into 102)
- Skip test_bdist_rpm using test config rather than a patch (removes patch 137)
- Remove patches 157 and 186, which had test changes left over after upstreaming
- Remove patch 188, a temporary workaround for hashlib tests
- Merge patches 180, 206, 243, 5001 (architecture naming) into new patch 274
- Move python2-tools conflicts to tools subpackage (it was wrongly in tkinter)


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-14
changelog:
- Expat >= 2.1.0 is everywhere, remove explicit requires
- Conditionalize systemtap-devel BuildRequires
- For consistency, require /usr/sbin/ifconfig instead of net-tools


author: Petr Viktorin <pviktori@redhat.com> - 3.6.2-16
changelog:
- Specfile cleanup
- Make the main description also applicable to the SRPM
- Add audiotest.au to the test package


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.2-19
changelog:
- Move pathfix.py to bindir, https://github.com/fedora-python/python-rpm-porting/issues/24
- Make the -devel package require redhat-rpm-config
Resolves: rhbz#1496757


author: Björn Esser <besser82@fedoraproject.org> - 3.6.4-8
changelog:
- Add patch to explicitly link _ctypes module with -ldl (#1537489)
- Refactored patch for libxcrypt
- Re-enable strict symbol checks in the link editor


author: Tomas Orsava <torsava@redhat.com> - 3.6.4-10
changelog:
- Disable test_gdb for all arches and test_buffer for ppc64le in anticipation
  of the F28 mass rebuild
- Re-enable these tests after the mass rebuild when they can be properly
  addressed


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.6.4-14
changelog:
- Remove the python3-tools package (#rhbz 1312030)
- Move /usr/bin/2to3 to python3-devel
- Move /usr/bin/idle and idlelib to python3-idle
- Provide python3-tools from python3-idle


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.4-15
changelog:
- Filter out automatic /usr/bin/python3.X requirement,
  recommend the main package from libs instead
Resolves: rhbz#1547131


author: Miro Hrončok <mhroncok@redhat.com> - 3.6.4-18
changelog:
- Fix the py_byte_compile macro to work on Python 2
- Remove the pybytecompile macro file from the flat package
Resolves: rhbz#1484993


author: Tomas Orsava <torsava@redhat.com> - 3.6.5-2
changelog:
- Fix %py_byte_compile macro: when invoked with a Python 2 binary it also
  mistakenly ran py3_byte_compile


author: Lumir Balhar & Tomas Orsava <lbalhar@redhat.com> - 3.6.8-2
changelog:
- Converting F28 python3 specfile to RHEL7
- Updated the bootstrapping sequence
- Disabled LTO because of buggy support for it in gcc on RHEL7
- Removed deprecated system-python and platform-python tags and files
- Removed a tag from `python3-libs` that recommended the `python3` package,
  because the Recommends tag doesn't work in RHEL7
- Remove unnecessary unversioned requires on glibc and gdbm
- Changes from RHEL8:
  - Move macros.pybytecompile to python-rpm-macros
  - Enable test_gdb, test_faulthandler
- Changes from Fedora:
  - Security fix for CVE-2019-5010 (#1666519, #1666522)
  - Make sure we don't ship any exe files (not needed an prebuilt)
Resolves: rhbz#1597718


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-4
changelog:
- Add explicit conflicts with python34 < 3.4.9-3, which was the main python3
  package in EPEL before that version and contained conflicting files,
  e.g. /usr/bin/python3
Resolves: rhbz#1597718


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-8
changelog:
- Disallow control chars in http URLs
- Fixes CVE-2019-9740 and CVE-2019-9947
Resolves: rhbz#1703535 and rhbz#1704364


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-18
changelog:
- Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
Resolves: rhbz#1856481
- Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-19
changelog:
- Security fix for CVE-2023-24329
- Fix the test suite support for Expat >= 2.4.5
Resolves: rhbz#2173917


author: Dmitriy Popov <dpopov@cloudlinux.com> - 3.6.8-19.tuxcare.els1
changelog:
- CVE-2021-3177: Replace snprintf to prevent buffer overflow
- CVE-2022-48565: Reject XML entity declarations in plist files


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 3.6.8-19.tuxcare.els2
changelog:
- CVE-2021-3737: Fix http client infinite line reading (DoS) after a
  HTTP 100 Continue
- CVE-2021-28861: Fix an open redirection vulnerability in http.server
- CVE-2022-0391: Make urllib.parse sanitize urls containing ASCII newline and
  tabs
- CVE-2022-45061: Fix quadratic time idna decoding


author: EL Errata <el-errata_ww@oracle.com> - 3.6.8-21.0.1
changelog:
- Remove the "getfile" feature of pydoc for oracle7 builds only
  [Orabug: 33182027][CVE-2021-3426]
- Add Oracle Linux distribution in platform.py [Orabug: 20812544]


author: Dmitriy Popov <dpopov@cloudlinux.com> - 3.6.8-21.tuxcare.els1
changelog:
- Moved tuxcare patches from 3.6.8-19
- CVE-2021-3177: Replace snprintf to prevent buffer overflow
- CVE-2022-48565: Reject XML entity declarations in plist files
- CVE-2021-3737: Fix http client infinite line reading (DoS) after a
  HTTP 100 Continue
- CVE-2021-28861: Fix an open redirection vulnerability in http.server
- CVE-2022-0391: Make urllib.parse sanitize urls containing ASCII newline and
  tabs
- CVE-2022-45061: Fix quadratic time idna decoding
- CVE-2022-48560: fix posible crash in heapq with custom comparison operators
- CVE-2020-26116: prevent header injection in http methods


author: Dmitriy Popov <dpopov@cloudlinux.com> - 3.6.8-21.tuxcare.els4
changelog:
- CVE-2024-6232: remove backtracking when parsing tarfile headers
- CVE-2024-7592: fix quadratic complexity in parsing "-quoted cookie values
  with backslashes


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 3.6.8-21.0.1.tuxcare.els2
changelog:
- CVE-2024-9287: fix path names quoting to prevent command injection in virtual
  environment activation scripts


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 3.6.8-21.0.1.tuxcare.els3
changelog:
- CVE-2007-4559: implement PEP 706 - a filter in the tarfile module to
  prevent directory traversal vulnerability


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 3.6.8-21.0.5.tuxcare.els1
changelog:
- Bump package Release to 21.0.5
- CVE-2025-8194: tarfile: validate archives to ensure member offsets are
  non-negative


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 3.6.8-21.0.5.tuxcare.els2
changelog:
- CVE-2024-12718, CVE-2025-4138, CVE-2025-4330, CVE-2025-4435, CVE-2025-4517:
  fix multiple tarfile extraction filter bypasses (filter="tar"/filter="data")


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-2
changelog:
- Allow to import pip10's main from pip9's /usr/bin/pip
- Do not show the "new version of pip" warning outside of venv
Resolves: rhbz#1569488
Resolves: rhbz#1571650
Resolves: rhbz#1573755


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-3
changelog:
- Converting pip specfile from F28 to RHEL7
- Disabled building of the Python 2 subpackage
- Disabled building of docs, because we don't ship its build dependencies in
  RHEL7
- Updated to a newer version of tests to match the package version
- Backported Patch3 and Patch4 from Fedora
Resolves: rhbz#1660573


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-6
changelog:
- Add four new patches for CVEs in bundled urllib3 and requests
CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
Resolves: rhbz#1649153
Resolves: rhbz#1700824
Resolves: rhbz#1702473
Resolves: rhbz#1643829


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-7
changelog:
- Converting specfile from F28 to RHEL7
- Tests disabled because the minimal RHEL7 Python 3 stack does not contain test
  dependencies
- Disabled building of the Python 2 subpackage
Resolves: rhbz#1660563


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-8
changelog:
- SRPM renamed from python-setuptools to python3-setuptools
- Package prepared to contain only Python 3 version
Resolves: rhbz#1660563


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 39.2.0-10.0.5.tuxcare.els1
changelog:
- CVE-2022-40897: fix Regular Expression Denial of Service (ReDoS) in package_index.py
- CVE-2024-6345: fix remote code execution in package_index module


author: Michal Ruprich <mruprich@redhat.com> - 3.1.2-10
changelog:
- Resolves: #1672779 - Rsync bug resets modification time of every destination file that has not changed


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 3.1.2-12.tuxcare.els1
changelog:
- CVE-2018-25032: fix a bug that can crash deflate on some input when using
  Z_FIXED
- CVE-2022-37434: fix zlib bug with a large gzip header extra field


author: Jai S <jsathyapalan@cloudlinux.com> - 3.1.2-12.tuxcare.els3
changelog:
- CVE-2024-12087: fix path traversal vulnerability in rsync enabled by the '--inc-recursive' option
- CVE-2024-12088: make --safe-links stricter


author: John A. Martin <jam@jamux.com>
changelog:
- Built 1.6.3-2 after finding no rsync-1.6.3-1.src.rpm although there
  was an ftp://ftp.redhat.com/pub/contrib/alpha/rsync-1.6.3-1.alpha.rpm
  showing no packager nor signature but giving 
  "Source RPM: rsync-1.6.3-1.src.rpm".
- Changes from 1.6.2-1 packaging: added '$RPM_OPT_FLAGS' to make, strip
  to '%build', removed '%prefix'.


author: Bill Nottingham <notting@redhat.com>
changelog:
- fix some signed/unsigned issues (<krahmer@suse.de>)
- tweak ipv6 patch (#55337, <john.l.villalovos@intel.com>)
- make xinetd file %config(noreplace)


author: Bill Nottingham <notting@redhat.com> 2.5.4-2
changelog:
- upstream patches: fix accidental use of --whole-file, fix
  minor memory leak, and bad worst-case child kill behavior
- make passing -e to rsync:// URLs not cause an error exit (#62489)


author: Hardy Merrill <hmerrill@redhat.com> 2.5.6-6
changelog:
- removed patch rsync-2.5.4-maxdel.patch
- removed patch rsync-2.4.6-segv.patch
   - current 2.5.6 properly handles (no segfault) the situation
     (rsync '[a]') that caused a need for this patch.
- added patch rsync-2.5.6-sign.patch, which is a working
  subset of patches (that still apply) included in the original
  rsync-2.5.4-moresignage.patch


author: Hardy Merrill <hmerrill@redhat.com> 2.5.6-15
changelog:
- add rsync-2.5.6-signal.patch to fix kernel warnings that
  appear because socket.c sets SIGCHLD to SIG_IGN and then
  calls wait.  This is in response to bug#98740.  This patch
  *has* been committed to CVS upstream and will be in
  upstream rsync-2.5.7.


author: Jay Fenlason <fenlason@redhat.com> 2.6.1-1
changelog:
- Rsync 2.6.1 final.
- Add a patch from Wayne Davison <wayned@samba.org> that fixes a
  use of uninitilized memory in the map_uid and map_gid functions.
- Add another patch from Wayne Davidson that fixes the -R option.
- Add a patch (extracted from a patch by Sami Farin
  <safari-rsync@safari.iki.fi>) to not ignore the return value
  of close().


author: Jay Fenlason <fenlason@redhat.com> 2.6.2-0
changelog:
- New upstream version to correct the problems with 2.6.1.
  This obsoletes all the patches to 2.6.1


author: Jay Fenlason <fenlason@redhat.com> 2.6.3-0.pre1
changelog:
- New upstream version with security fix for CAN-2004-0792
- This obsoletes the -lastdir-corruption patch.


author: Jay Fenlason <fenlason@redhat.com> 2.6.4-3
changelog:
- Include the -address patch from upstream, to close
  bz#154752 Unable to use --address in client mode


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-2
changelog:
- New upstream release
- Use the upstream xattr patch instead of mine.  This closes
  bz#190208 CVE-2006-2083 rsync buffer overflow issue


author: Jay Fenlason <fenlason@redhat.com> 2.6.8-3
changelog:
- Add my xattrs_bug patch to fix a bug where xattrs don't get sent correctly.
- Add BuildRequires to make sure libattr-devel and libacl-devel are avaliable
- replace --with... with --enable... so they actually work
- Add make, autoconf and gcc to BuildRequires


author: Simo Sorce <ssorce@redhat.com> 3.0.0-0.pre8.fc9
changelog:
- Eight prerelease
- Add second source, now patches are in a separate file
- Add temporary fix to the xattrs.diff patch line as, in this version
  the patch contains one extra humk already contained in acls.diff


author: Michal Luscon <mluscon@redhat.com> 3.0.9-4
changelog:
- Fixed: #823088 - rsync loses track of files with different directory prefixes
- Fixed: #495310 - rsync contains forked copy of zlib


author: Pavel Šimerda <psimerda@redhat.com> - 3.0.9-14
changelog:
- Resolves: #1052814 - rsync command is terminated with SIGSEGV
- Resolves: #1052814 - add missing patch file


author: Luboš Uhliarik <luhliari@redhat.com> - 3.0.9-17
changelog:
- Resolves: #1082496 - socket activation for rsync doesn't work (added missing
  rsyncd@.service file)


author: Michal Ruprich - 3.1.2-4
changelog:
- Related: #1432899 - removing dependencies on perl
- using the bundled zlib.h(#1491582)
- turning on upstream tests


author: Dmitrii Zudin <dzudin@cloudlinux.com> - 2.0.0.648-39.tuxcare.els1
changelog:
- test/net/imap/test_imap.rb: fix test failures due to expired certs
- test/ruby/test_time_tz.rb: fix timezone test


author: Dmitrii Zudin <dzudin@cloudlinux.com> - 2.0.0.648-39.tuxcare.els4
changelog:
- CVE-2021-41817: add length limit option for methods that parses date strings
  The default limit is 128. You can configure the limit by giving `limit` keyword
  arguments like `Date.parse(str, limit: 1000)`. If you pass `limit: nil`,
  the limit is disabled.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.0.0.648-39.tuxcare.els6
changelog:
- CVE-2024-49761: fix ReDoS vulnerability in parsing XML with hex numeric
  character reference in REXML gem


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.0.0.648-39.tuxcare.els7
changelog:
- CVE-2025-27219: fix a potential Denial of Service (DoS) vulnerability in
  cookie parsing
- CVE-2025-27220: fix ReDoS vulnerability exists in the escapeElement
  method
- CVE-2025-27221: fix he URI handling methods (URI.join, URI#merge, URI#+)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2.0.0.648-39.tuxcare.els8
changelog:
- CVE-2017-9226: fix a heap out-of-bounds write or read occurs in
  next_state_val() during regular expression compilation.


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 2.0.0.648-39.tuxcare.els11
changelog:
- CVE-2016-2337: Fix type confusion in _cancel_eval Ruby's TclTkIp class method
  to prevent arbitrary code execution
- CVE-2017-9224: Fix stack out-of-bounds read in match_at() during regular
  expression searching
- CVE-2017-9227: Fix stack out-of-bounds read in mbc_enc_len() and invalid
  pointer dereference in  forward_search_range()
- CVE-2017-9228: Fix heap out-of-bounds write in bitset_set_range() and
  parse_char_class() by initializing critical local variable


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-32
changelog:
- Add Psych.safe_load
  * ruby-2.1.0-there-should-be-only-one-exception.patch
  * ruby-2.1.0-Adding-Psych.safe_load.patch
  Related: CVE-2017-0903
- Disable Tokyo TZ tests broken by recen tzdata update.
  * ruby-2.5.0-Disable-Tokyo-TZ-tests.patch
  Related: CVE-2017-0903


author: Jun Aruga <jaruga@redhat.com> - 2.0.0.648-35
changelog:
- Kill bundled certificates.
- Add macros to edit files lists in .gemspec
- Fix buffer under-read in String#unpack
  Resolves: CVE-2018-8778
- Fix HTTP response splitting in WEBrick
  Resolves: CVE-2017-17742
- Fix DoS by large request in WEBrick
  Resolves: CVE-2018-8777
- Fix directory traversal by poisoned NULL byte in Dir.
  Resolves: CVE-2018-8780
- Fix file and directory creation with directory traversal.
  Resolves: CVE-2018-6914
- Fix socket creation by poisoned NULL byte.
  Resolves: CVE-2018-8779
- Fix: return default path with nonexistent home dir
- Fix flags not propagated in Array#pack and String#unpack.
  Resolves: CVE-2018-16396
- Fix strictly interpret octal fields in tar headers.
  Resolves: CVE-2018-1000075
- Fix a security error for duplicate files in a package.
  Resolves: CVE-2018-1000076
- Enforce URL validation on spec homepage attribute.
  Resolves: CVE-2018-1000077
- Mitigate XSS vulnerability in homepage attribute.
  Resolves: CVE-2018-1000078
- Prevent Path Traversal issue during gem installation.
  Resolves: CVE-2018-1000079
- Fix unsafe Object Deserialization Vulnerability in gem owner.
  Resolves: CVE-2018-1000074
- Refresh expired certificates.
- Fix path traversal when writing to a symlinked basedir outside of the root
  Resolves: CVE-2018-1000073


author: Vít Ondruch <vondruch@redhat.com> - 2.0.0.648-36
changelog:
- Introduce `Gem::UserInteraction#verbose` method as precondition to fix
  CVE-2019-8321.
  * rubygems-2.3.0-refactor-checking-really_verbose.patch
- Fix escape sequence injection vulnerability in verbose.
- Fix escape sequence injection vulnerability in gem owner.
  Resolves: CVE-2019-8322
- Fix escape sequence injection vulnerability in API response handling.
  Resolves: CVE-2019-8323
- Prohibit arbitrary code execution when installing a malicious gem.
  Resolves: CVE-2019-8324
- Fix escape sequence injection vulnerability in errors.
  Resolves: CVE-2019-8325
  * ruby-2.4.6-Applied-security-patches-for-RubyGems.patch


author: Lubos Uhliarik <luhliari@redhat.com> - 7:3.5.20-17.6
changelog:
- Resolves: #1944256 - CVE-2020-25097 squid: improper input validation may allow
  a trusted client to perform HTTP Request Smuggling


author: Stepan Broz <sbroz@redhat.com> - 7:3.5.20-17.10
changelog:
- Resolves: RHEL-16779 - squid: NULL pointer dereference in the gopher protocol
  code -- Remove support for Gopher protocol (CVE-2023-46728)
- Resolves: RHEL-18176 - squid: Buffer over-read in the HTTP Message processing
  feature (CVE-2023-49285)
- Resolves: RHEL-18171 - squid: Incorrect Check of Function Return Value In
  Helper Process management (CVE-2023-49286)
- Resolves: RHEL-16758 - squid: Denial of Service in SSL Certificate validation
  (CVE-2023-46724)
- Resolves: RHEL-19557 - squid: denial of service in HTTP request parsing
  (CVE-2023-50269)
- Resolves: RHEL-26082 - squid: denial of service in HTTP header parser
  (CVE-2024-25617)


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 7:3.5.20-17.0.3.10.tuxcare.els1
changelog:
- CVE-2021-28651: fix memory leak in RFC 2169 response parsing
- CVE-2021-28652: fix broken cache manager URL parsing
- CVE-2021-31806: fix memory management bug
- CVE-2021-31807: fix integer overflow problem
- CVE-2021-31808: fix input validation bug
- CVE-2021-33620: handle more partial responses


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 7:3.5.20-17.0.5.99.tuxcare.els2
changelog:
- CVE-2025-62168: fix failure to redact HTTP authentication credentials in error
  handling to prevent information disclosure
- email_err_data directive now defaults to 'off' for security (previously 'on')


author: Nalin Dahyabhai <nalin@redhat.com> 1.6.6-2
changelog:
- remove absolute path names from the PAM configuration, ensuring that the
  right modules get used for whichever arch we're built for
- don't try to install the FAQ, which isn't there any more


author: Colin Walters <walters@redhat.com> 1.6.7p5-24
changelog:
- Enhance sesh.c to fork/exec children itself, to avoid
  having sudo reap all domains.
- Only reinstall default signal handlers immediately before
  exec of child with SELinux patch


author: Karel Zak <kzak@redhat.com> 1.6.8p9-1
changelog:
- new version 1.6.8p9 (resolve #161116 - CAN-2005-1993 sudo trusted user arbitrary command execution)


author: Dan Walsh <dwalsh@redhat.com> 1.6.8p12-3
changelog:
- Remove selinux patch.  It has been decided that the SELinux patch for sudo is
- no longer necessary.  In tageted policy it had no effect.  In strict/MLS policy
- We require the person using sudo to execute newrole before using sudo.


author: Karel Zak <kzak@redhat.com> 1.6.8p12-7
changelog:
- fix #198755 - make login processes (sudo -i) initialise session keyring
  (thanks for PAM config files to David Howells)
- add IPv6 support (patch by Milan Zazrivec)


author: Peter Vrabec <pvrabec@redhat.com> 1.6.9p17-2
changelog:
- adjust audit patch, do not scream when kernel is
  compiled without audit netlink support (#401201)


author: Daniel Kopecek <dkopecek@redhat.com> 1.6.9p17-6
changelog:
- fixed building with new libtool
- fix for incorrect handling of groups in Runas_User
- added /usr/local/sbin to secure-path


author: Daniel Kopecek <dkopecek@redhat.com> 1.7.1-4
changelog:
- moved the closefrom() call before audit_help_open() (sudo-1.7.1-auditfix.patch)
- epoch number sync


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-1
changelog:
- new upstream version 1.7.2p2-1
- commented out unused aliases in sudoers to make visudo happy (#550239)


author: Ville Skyttä <ville.skytta@iki.fi> - 1.7.2p2-2
changelog:
- Add /etc/sudoers.d dir and use it in default config (#551470).
- Drop *.pod man page duplicates from docs.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p2-4
changelog:
- audit related Makefile.in and configure.in corrections
- added --with-audit configure option
- removed call to libtoolize


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.2p6-1
changelog:
- update to new upstream version
- merged .audit and .libaudit patch
- added sudoers.ldap.5* to files


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-1
changelog:
- update to new upstream version
- new command available: sudoreplay
- use native audit support
- corrected license field value: BSD -> ISC


author: Daniel Kopecek <dkopecek@redhat.com> - 1.7.4p4-5
changelog:
- anybody in the wheel group has now root access (using password) (rhbz#656873)
- sync configuration paths with the nss_ldap package (rhbz#652687)


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.1p2-1
changelog:
- rebase to 1.8.1p2
- removed .sudoi patch
- fixed typo: RELPRO -> RELRO
- added -devel subpackage for the sudo_plugin.h header file
- use default ldap configuration files again


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.5-4
changelog:
- added patches that fix & improve SSSD support (thanks to pbrezina@redhat.com)
- re-enabled SSSD support
- removed libsss_sudo dependency


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p3-2
changelog:
- added upstream patch for a regression
- don't include arch specific files in the -devel subpackage
- ship only one sample plugin in the -devel subpackage


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-1
changelog:
- update to 1.8.6p7
- fixes CVE-2013-1775 and CVE-2013-1776
- fixed several packaging issues (thanks to ville.skytta@iki.fi)
  - build with system zlib.
  - let rpmbuild strip libexecdir/*.so.
  - own the %{_docdir}/sudo-* dir.
  - fix some rpmlint warnings (spaces vs tabs, unescaped macros).
  - fix bogus %changelog dates.


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-3
changelog:
- synced sudoers, configure options & configuration files with
  expected RHEL configuration
  Resolves: rhbz#969373
  Resolves: rhbz#971009
  Resolves: rhbz#965124
  Resolves: rhbz#971013
  Resolves: rhbz#839705


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-5
changelog:
- added standalone manpage for sudo.conf and sudo-ldap.conf
- spec file cleanup
  Resolves: rhbz#881258


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-6
changelog:
- fixed alias cycle detection code
- added debug messages for tracing of netgroup matching
- fixed aborting on realloc when displaying allowed commands
- sssd: filter netgroups in the sudoUser attribute
- parse uids/gids more strictly
- added debug messages to trace netgroup matching
  Resolves: rhbz#1026904
  Resolves: rhbz#1026890
  Resolves: rhbz#1007014
  Resolves: rhbz#1026894
  Resolves: rhbz#1000389
  Resolves: rhbz#994566


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-11
changelog:
- Fixed incorrect login shell path construction in sesh
  (thanks fkrska@redhat.com for the patch)
  Resolves: rhbz#1065418


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-12
changelog:
- RHEL 7.1 erratum
  - don't retry authentication when ctrl-c pressed
  - fix double-quote processing in Defaults options
  - handle the "(none)" hostname correctly
  - SSSD: fix sudoUser netgroup specification filtering
  - SSSD: list correct user when -U <user> -l specified
  - SSSD: show rule names on long listing (-ll)
  - fix infinite loop when duplicate entries are specified on the
    sudoers nsswitch.conf line
  Resolves: rhbz#1084488
  Resolves: rhbz#1088464
  Resolves: rhbz#1088825
  Resolves: rhbz#1092499
  Resolves: rhbz#1093099
  Resolves: rhbz#1096813
  Resolves: rhbz#1147497
  Resolves: rhbz#1147557


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-14
changelog:
- RHEL 7.2 erratum
  - backported command digest specification
  - fixed CVE-2014-9680 sudo: unsafe handling of TZ environment variable
  - fixed typos in sudoers.ldap man page
  - fixed handling of double-quoted sudoOption values in ldap, sssd sources
  - fixed numeric uid specification support in ldap source
  - fixed authentication flag logic in ldap source
  - added the systemctl command to the SERVICES alias in the default sudoers file
  Resolves: rhbz#1144446
  Resolves: rhbz#1235570
  Resolves: rhbz#1138259
  Resolves: rhbz#1183818
  Resolves: rhbz#1233607
  Resolves: rhbz#1144419
  Resolves: rhbz#1135539
  Resolves: rhbz#1215400


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-15
changelog:
- RHEL 7.2 erratum
  - fixed compilation of testing binaries during make check
  - added legacy group processing patch
  - replaced buggy base64 decoder with a public domain implementation
  Resolves: rhbz#1254621
  Resolves: rhbz#1183818
  Resolves: rhbz#1247591


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-18
changelog:
- RHEL 7.3 erratum
  - removed requiretty flag from the default sudoers policy
  - backported pam_service and pam_login_service defaults options
  - implemented netgroup_tuple defaults option for changing netgroup
    processing semantics
  - fixed user matching logic in the LDAP nss backend
  - don't allow visudo to accept an invalid sudoers file
  - fixed a bug causing that non-root users can list privileges of
    other users
  - modified digest check documentation to mention the raciness of
    the checking mechanism
  Resolves: rhbz#1196451
  Resolves: rhbz#1247230
  Resolves: rhbz#1334331
  Resolves: rhbz#1334360
  Resolves: rhbz#1261998
  Resolves: rhbz#1313364
  Resolves: rhbz#1312486
  Resolves: rhbz#1268958
  Resolves: rhbz#1335039
  Resolves: rhbz#1335042
  Resolves: rhbz#1335045
  Resolves: rhbz#1273243
  Resolves: rhbz#1299883


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.6p7-19
changelog:
- RHEL 7.3 erratum
  - removed INPUTRC from env_keep to prevent a potential info leak
  Resolves: rhbz#1340700


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-1
changelog:
- RHEL 7.4 erratum
  - Resolves: rhbz#1360687 - rebase to 1.8.19p2
  - Resolves: rhbz#1123526 - performance improvement
  - Resolves: rhbz#1308789 - add MAIL and NOMAIL tags
  - Resolves: rhbz#1348504 - sudo now parses sudoers with sudoers locale
  - Resolves: rhbz#1374417 - "sudo -l command" indicated that the command
    was runnable even if denied by sudoers when using LDAP or SSSD backend.
  - Resolves: rhbz#1387303 - add ignore_iolog_errors option
  - Resolves: rhbz#1389360 - wrong log file group ownership
  - Resolves: rhbz#1389735 - add iolog_group, iolog_mode, iolog_user options
  - Resolves: rhbz#1397169 - maxseq and ignore_iolog_errors options
  - Resolves: rhbz#1403051 - add support for querying netgroups directly via LDAP
  - Resolves: rhbz#1410086 - race condition while creating /var/log/sudo-io dir
  - Resolves: rhbz#1413160 - add ignore_unknown_defaults flag
  - Resolves: rhbz#1254772 - ability to export sudoers in json format
  - Resolves: rhbz#1417187 - wrong reference to config file in systax error message
  - Resolves: rhbz#1424575 - visudo was not printing severity of error/warning message


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-2
changelog:
- RHEL 7.4 erratum
- Fixes coverity scan issues created by our patches:
  - fixed resource leaks and a compiler warning in digest backport patch
  - removed needless code from cmnd_no_wait patch causing clang warning
  - format of the last changelog message causes problems to rhpkg push,
    so don't use that as a commit message
  Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-3
changelog:
- RHEL 7.4 eratum
- Fixes semicolon typo in digest backport patch from the previous build
  Resolves: rhbz#1360687


author: Tomas Sykora <tosykora@redhat.com> - 1.8.19p2-4
changelog:
- RHEL 7.4 erratum
- fixed cmnd_no_wait patch
- backported iolog_flush sudoers default
  Resolves: rhbz#1369856
  Resolves: rhbz#1425853


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
- RHEL 7.4 erratum
- added doc patch about sudo lookup issue
  Resolves: rhbz#1293306
- added test suite patch
  Resolves: rhbz#1360687
- fixed use after free fqdn problem
  Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
- RHEL 7.4 erratum
- added patch to fix output truncation (in some cases) when log_output
  option is enabled
  Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
- RHEL 7.4 erratum
- Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
  Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
- RHEL 7.4 erratum
- removed patch for output truncation (1454571) which introduced regression
  Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
- RHEL 7.5 erratum
- Fixed exit codes for `sudo -l -U <user>`
- Fixed truncated output when log_output is enabled
- Updated use_pty and IO logging manpage

  Resolves: rhbz#1458696
  Resolves: rhbz#1454571
  Resolves: rhbz#1490358

- Fixed second pass LDAP filter expression in the sudoers ldap backend
  - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
- RHEL 7.5 erratum
- Fixed sudo -l checking results whether user should be authenticated
- Enabled LDAP filter patch
- Fixed double free in sssd

  Resolves: rhbz#1505409
  Resolves: rhbz#1511850
  Resolves: rhbz#1518104


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-1
changelog:
- RHEL-7.6 erratum
  Resolves: rhbz#1547974 - Rebase sudo to latest stable upstream version (1.8.23)
  Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets
  Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
  Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
  Resolves: rhbz#1548380 - RFE: Create flag to filter to sudo -l output
  Resolves: rhbz#1510002 - Ensure that the command input (stdin) eating behaviour of Default log_input is documented
  Resolves: rhbz#1596032 - Why does sudo package depend on vim-minimal?


author: Daniel Kopecek <dkopecek@redhat.com> 1.8.23-2
changelog:
- RHEL-7.6 erratum
  Resolves: rhbz#1533964 - sudo skips PAM account module in case NOPASSWD is used in sudoers
  Resolves: rhbz#1506025 - Latest update broke sudo for ldap users.
  Resolves: rhbz#1502630 - inclusion of system-auth for session hooks missing in sudo PAM snippets


author: Radovan Sroka <rsroka@redhat.com> 1.8.23-4
changelog:
- RHEL-7.7 erratum
  Resolves: rhbz#1672876 - Backporting sudo bug with expired passwords
  Resolves: rhbz#1665285 - Problem with sudo-1.8.23 and 'who am i'


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-5
changelog:
- RHEL-7.8 erratum
  Resolves: rhbz#1711997 sudo is super slow when /etc/security/limits.conf contains many entries


author: Marek Tamaskovic <mtamasko@redhat.com> 1.8.23-6
changelog:
- RHEL-7.8 erratum
  Resolves: rhbz#1647678 sudo access denied with pam_access and pts terminal configurations


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.2
changelog:
- RHEL 7.9.Z ERRATUM
- defaults use_pty plus SELinux ROLE in user specification breaks terminal
  Resolves: rhbz#1972820


author: Radovan Sroka <rsroka@redhat.com> - 1.8.23-10.3
changelog:
- RHEL 7.9.Z ERRATUM
- CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161222


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.8.23-10.3.tuxcare.els3
changelog:
- CVE-2025-32462: fix privilege escalation vulnerability by restricting
  unauthorized users from gaining elevated system privileges via the Sudo host
  option


author: Preston Brown <pbrown@redhat.com>
changelog:
- packaged for Winston
- change va patch to indicate kernel is not patched for iostat accounting.
  re-enable if our stock kernel gets this patch.
- upgrade to 3.2.
- install crontab entry.


author: Preston Brown <pbrown@redhat.com>
changelog:
- make sure disk accounting is enabled to fix iostat -l, -p (#16268)
- crontab entries were missing the user (root) to run as (#18212)


author: Preston Brown <pbrown@redhat.com>
changelog:
- Summarize previous day's activity with sa2, not current day (which is only 4 hours of data when it gets run) (#24820)
- upgrade to 3.3.4 for full 2.4 compatibility and improved iostat


author: Trond Eivind Glomsrød <teg@redhat.com> 4.0.2-1
changelog:
- 4.0.2
- the kernel patch for extended statistics is in, don't say it needs
  applying in the man page


author: Trond Eivind Glomsrød <teg@redhat.com> 4.0.3-2
changelog:
- Do the daily sa2 run just before midnight, not at 4AM... you'd 
  only get 4 hours worth of data that way (#63132)


author: Nils Philippsen <nphilipp@redhat.com> 5.0.0-0.4
changelog:
- fix insecure tmp files in scripts (#78212)
- require tools needed in scripts
- use IFNAMSIZ from {_includedir}/linux/if.h for maximum interface length


author: Nils Philippsen <nphilipp@redhat.com> 5.0.0-0.6
changelog:
- let user configure how long to keep logs through /etc/sysconfig/sysstat
  (#81294)
- reset stats at system boot (#102445)


author: Alan Cox <alan@redhat.com>
changelog:
- Fix spew of crap to console at startup
- Fix order of startup (#124035)
- Fix array overrun (#117182)
- Fix interrupt buffer sizing (caused bogus irq info)


author: Nils Philippsen <nphilipp@redhat.com>
changelog:
- version 5.0.5
- remove some obsolete patches
- update statreset, overrun, lib64init patches
- renumber patches


author: Charles Bennett <ccb@redhat.com> 5.0.5-5.fc
changelog:
- bring in filename and append-msg patch
- append-msg adds verbose text for when saNN data file cpu count
-  does not match cpu count on the currently running system


author: Ivana Varekova <varekova@redhat.com> - 8.0.1-1
changelog:
- update to 8.0.1
- remove useless patches
- spec file cleanup
- remove smp build flag (ar problem)
- add libdir flags


author: Ivana Varekova <varekova@redhat.com> - 8.0.2-2
changelog:
- change license tag
- remove sysstat.crond source (add -d)
- remove obsolete sysconfig file
- spec file cleanup


author: Ivana Varekova <varekova@redhat.com> - 9.0.4-3
changelog:
- fix init script - add INIT INFO flags (#522740)
  and add condrestart, try-restart and force-reload (#522743)


author: Ivana Hutarova Varekova <varekova@redhat.com> - 9.0.6.1-7
changelog:
- remove needless DOCDIR setting
- remove needless INIT_DIR setting
- fix the problem with --disable-man-group option


author: Ivana Hutarova Varekova <varekova@redhat.com> - 10.0.0-4
changelog:
- close the file descriptor in a special situation in read_uoptime function
- fix the number on open files in cifsiostat output


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.1-1
changelog:
- resolves: #844387
  update to 10.1.1
- keep log files for 28 days instead of 7
- collect all aditional statistics


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-1
changelog:
- resolves: #863791
  updated to 10.1.2
- resolves: #850333
  migrated to the new systemd-rpm macros
- cleaned .spec file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.2-2
changelog:
- added new -y option to iostat command to skip first since boot report if
  displaying multiple reports


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-5
changelog:
- resolves: #1100365
  fixed issue when sa data files weren't correctly overwritten in some cases
- resolves: #1097294
  count with xz compressed files as well in sa2 script
- resolves: #1097292
  fix file mode of sysstat cron file
- resolves: #1128569
  added workaround for dyn-tick kernel feature which makes /proc/stat file
  unreliable under certain circumstances
- resolves: #1110852
  added better explanation of HISTORY setting to sysstat(5) man page
- resolves: #1102610
  added possibility to set compress method in /etc/sysconfig/sysstat file


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-6
changelog:
- resolves: #1146081
  fixed issue when cifsiostat and nfsiostat were reporting incorrect statistics
  on a single CPU machines


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-8
changelog:
- resolves: #846699
  renamed nfsiostat to nfsiostat-sysstat, as nfsiostat is also provided
  by the nfs-utils package
- resolves: #1224882
  fixed bug when pidstat could run out of pre-allocated space for PIDs
- resolves: #1258990
  added support for more CPUs
- resolves: #1267972
  fixed bug when iostat didn't display the full device name if it's too long
- resolves: #1328490
  fixed bug, when sadc could forward SIGINIT to init process and couse reboot


author: Peter Schiffer <pschiffe@redhat.com> - 10.1.5-9
changelog:
- related: #846699
  do the renaming of nfsiostat properly, with patch
- resolves: #1332662
  added tapestat utility for monitoring tape drives


author: Michal Sekletár <msekleta@redhat.com> - 10.1.5-18
changelog:
- add -f flag to force fdatasync() after sa file update (#1662094)
- don't call filesystem count functions when we are not collecting fs statistics (#1670060)
- skip autofs when gathering filesystem statistics (#1670060)
- fix use of incorrect preposition in sar man page (#1624410)
- fix CPU usage reporting (#1618688)


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 10.1.5-20.tuxcare.els1
changelog:
- CVE-2022-39377: check an overflow and exit if it be
- CVE-2023-33204: fix possible buffer overflow in an incomplete fix for
  CVE-2022-39377


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-9
changelog:
- Resolves: rhbz#1641873 CVE-2018-11784 tomcat: Open redirect in default servlet
- Resolves: rhbz#1552375 CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
- Resolves: rhbz#1552374 CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
- Resolves: rhbz#1590182 CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
- Resolves: rhbz#1608609 CVE-2018-8034 tomcat: host name verification missing in WebSocket client
- Resolves: rhbz#1588703 Backport of Negative maxCookieCount value causes exception for Tomcat
- Resolves: rhbz#1472950 shutdown_wait option is not working for Tomcat
- Resolves: rhbz#1455483 Add support for characters "<" and ">" to the possible whitelist values


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-12
changelog:
- Resolves: rhbz#1367492 harden package permissions
- Resolves: rhbz#1523112 tomcat systemd does not cope with - in service names
- Resolves: rhbz#1629162 tomcat-dbcp.jar is missing from tomcat package
- Resolves: rhbz#1822453 Tomcat parses a request having an absolute URI path incorrectly and returns 404 Not Found
- Resolves: rhbz#1795645 connection leak with StatementCache, SlowQueryReport or StatementDecoratorInterceptor
- Resolves: CVE-2019-17563 tomcat: session fixation when using FORM authentication


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-14
changelog:
- Revert rhbz#1814315 because it caused other issues with ipa-server, see rhbz#1831127
- Resolves: CVE-2020-9484 tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Coty Sutherland <csutherl@redhat.com> 0:7.0.76-15
changelog:
- Resolves: CVE-2020-13935 tomcat: multiple requests with invalid payload length in a WebSocket frame could lead to DoS


author: Hui Wang <huwang@redhat.com> 0:7.0.76-16
changelog:
- Resolves: rhbz#1814315 CVE-2020-1935 tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 0:7.0.76-16.tuxcare.els3
changelog:
- CVE-2025-24813: fix path equivalence vulnerability leading to remote code
  execution and information disclosure


author: Patsy Griffin <patsy@redhat.com> - 2022d-1
changelog:
- Rebase to tzdata-2022d
  - Palestine's DST transition will be on October 29, 2022,
    not October 28, 2022.
  - Europe/Uzhgorod and Europe/Zaporozhye are moved to 'backzone'.


author: Patsy Griffin <patsy@redhat.com> - 2022e-1
changelog:
- Rebase to tzdata-2022e
  - Jordan and Syria cancelled the DST transition planned
    for 2022-10-28, remaining at +03 permanently.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
- Rebase to tzdata-2022f
  - Mexico will stop observing DST except near the US border.
  - Chihuahua moved to -06 year round starting on 2022-10-30.
  - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
- Rebase to tzdata-2022g
  - The northern edge of the Mexican state of Chihuahua will
    change time zone to agree with nearby US locations on
    2022-11-30.
  - Added a new Zone America/Ciudad_Juarez that splits from
    America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
- Rebase to tzdata-2023a
  - Egypt reintroduced DST, from April through October.
  - Morocco springs forward April 23, not April 30.
  - Palestine delayed the start of DST this year.


author: Patsy Griffin <patsy@redhat.com> - 2023d-1
changelog:
- Rebase to tzdata-2023d
  - Include time zone changes for Ittoqqortoormiit, Greenland
    and Vostok, Antarctica.
  - Update the expiration date for the leap-seconds.list file.
    No new leap seconds were added.


author: Patsy Griffin <patsy@redhat.com> - 2024a-1
changelog:
- Rebase to tzdata-2024a
  - Kazakhstan will transition from UTC+6 to UTC+5 on 2024-03-01.
  - Palestine will spring forward a week later than previously
    predicted.


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 2025b-1.tuxcare.els1
changelog:
- Upgrade to tzdata-2025b
  - New zone for Aysén Region in Chile which moves from -04/-03 to -03.
  - Paraguay adopted permanent -03 starting spring 2024.
  - Improve pre-1991 data for the Philippines.
  - Etc/Unknown is now reserved.
  - Improve historical data for Mexico, Mongolia, and Portugal.
  - System V names are now obsolescent.
  - The main data form now uses %z.
  - The code now conforms to RFC 8536 for early timestamps.
  - Support POSIX.1-2024, which removes asctime_r and ctime_r.
  - Assume POSIX.2-1992 or later for shell scripts.
  - SUPPORT_C89 now defaults to 1.
- Include leap-seconds.list in tzdata install.


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
- Rebase to 1.6.6
- Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
- Enable ipsecmod support


author: Martin Osvald <mosvald@redhat.com> - 1.6.6-2
changelog:
- Do not search for DNSSEC info when domain-insecure is set
  for stub zone (#1678550)
- Remove KSK-2010 from configuration files - it has been revoked (#1665503)


author: Anna Khaitovich <akhaitov@redhat.com> - 1.6.6-4
changelog:
- Fix amplifying an incoming query into a large number of queries directed to a target
- Resolves: rhbz#1839172 (CVE-2020-12662), rhbz#1840258 (CVE-2020-12663)


author: Nikita Maliutin <nmaliutin@cloudlinux.com> - 1.6.6-5.tuxcare.els1
changelog:
- CVE-2023-50387: enhanced DNS resolver performance and stability by optimizing
  the handling of DNSSEC responses, reducing the potential for resource exhaustion


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1.6.6-5.tuxcare.els3
changelog:
- CVE-2023-50868: avoid availabiluty of the remote attackers to cause a
  denial of service using DNSSEC


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
- Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
  Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
- Added patch for build option "-Werror=format-security"
- Added support of non-unicode non-latin charset
- Fix print of non-ascii filenames
- Fix troubles with symlinks for archives with many files
  Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
- rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
- make linking flags configurable from the specc file
- set linking flags to use relro hardening
  Related: #1531116


author: Jakub Martisko <jamartis@redhat.com> - 6.0-23
changelog:
- Disable the zipbomb detection patches
- There were too many false positives for now, will reenable this later with an option to opt-out
- Resolves: rhbz#2020318


author: Jakub Martisko <jamartis@redhat.com> - 6.0-24
changelog:
- Reenable the zipbomb detection patches
- Add environment variable that disables the zipbomb detection
- Resolves: rhbz#2020318


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
- 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
- 1267826 - Include c++11 syntax highlighting in vim
- 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
- 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
- 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> 2:7.4.629-8.tuxcare.els1
changelog:
- CVE-2023-0054: check the return value of vim_regsub()
- CVE-2023-0049: avoid going over the NUL at the end
- CVE-2023-0288: prevent the cursor from moving to line zero
- CVE-2023-0433: check for not going over the end of the line
- CVE-2023-2610: limit the text length to MAXCOL
- CVE-2023-4750: check buffer is valid before accessing it
- CVE-2023-4733: verify oldwin pointer after reset_VIsual()
- CVE-2023-4751: stop Visual mode when using :ball
- CVE-2023-5344: add NULL at end of buffer
- CVE-2024-22667: pass size of errbuf down the call stack, use snprintf()


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
- Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
- Run internal test suite during build (#1295846)
- Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
- Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
- Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.4-20
changelog:
- CVE fix for: CVE-2022-4283 (#2151800), CVE-2022-46340 (#2151775),
  CVE-2022-46341 (#2151780), CVE-2022-46342 (#2151787),
  CVE-2022-46343 (#2151790), CVE-2022-46344 (#2151797)


author: José Expósito <jexposit@redhat.com> - 1.20.4-25
changelog:
- CVE fix for: CVE-2023-6377, CVE-2023-6478
  Resolves: https://issues.redhat.com/browse/RHEL-18416
  Resolves: https://issues.redhat.com/browse/RHEL-18428


author: José Expósito <jexposit@redhat.com> - 1.20.4-26
changelog:
- CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
  CVE-2024-0408 and CVE-2024-0409
  Resolves: https://issues.redhat.com/browse/RHEL-21205
  Resolves: https://issues.redhat.com/browse/RHEL-20578
  Resolves: https://issues.redhat.com/browse/RHEL-20426
  Resolves: https://issues.redhat.com/browse/RHEL-20437
  Resolves: https://issues.redhat.com/browse/RHEL-21192
  Resolves: https://issues.redhat.com/browse/RHEL-21201


author: José Expósito <jexposit@redhat.com> - 1.20.4-28
changelog:
- CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
  CVE-2024-31083
  Resolves: https://issues.redhat.com/browse/RHEL-31003
  Resolves: https://issues.redhat.com/browse/RHEL-30989
  Resolves: https://issues.redhat.com/browse/RHEL-30973
- Add util-linux as a dependency of Xvfb
- Fix compilation error on i686


author: Dmitrii Samoilov <dsamoilov@cloudlinux.com> - 1.20.4-99.tuxcare.els1
changelog:
- CVE-2025-26594: refuse to free the root cursor and keep its ref
- CVE-2025-26595: fix buffer overflow in XkbVModMaskText()
- CVE-2025-26596: xkb: fix computation of XkbSizeKeySyms
- CVE-2025-26597: xkb: fix buffer overflow in XkbChangeTypesOfKey()
- CVE-2025-26598: Xi: Fix barrier device search
- CVE-2025-26599: always initialize the border clip in compAllocPixmap()
- CVE-2025-26600: dix: Dequeue pending events on frozen device on removal
- CVE-2025-26601: postpone actual changes in SyncChangeAlarmAttributes()


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 1.20.4-99.tuxcare.els2
changelog:
- CVE-2025-49176: fix integer overflow in BigRequest size check that could
  bypass the maximum request size limit


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 1.20.4-99.tuxcare.els3
changelog:
- CVE-2025-49179: fix integer overflow in the RecordSanityCheckRegisterClients
  function of the X Record extension


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 1.20.4-99.tuxcare.els4
changelog:
- CVE-2025-49180: fix integer overflow in the RandR extension affecting the
  RRChangeProviderProperty function


