# changelog

author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.48.10-2
changelog:
  - cloud-setup: Allow bigger restart bursts (RHEL-56740)
  - cloud-setup: Fix Azure swap of primary and secondary IP addresses (RHEL-56387)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.51.7-1
changelog:
  - Update to 1.51.7 (dev)
  - Add support in initramfs generator for parsing NM eDNS configuration (RHEL-70420)
  - Add new dnsconfd DNS backend (RHEL-67917)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.51.7-2
changelog:
  - Remove the build argument -flto-partition to avoid compilation crashes due
    to high memory usage.


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.52.0-1
changelog:
  - Update to 1.52.0
  - Add support for creating VLANs for secondary VNICs in nm-cloud-setup (RHEL-36423)
  - Always reset retries when unblocking children or ports (RHEL-78122)
  - Prevent the activation of unavailable OVS interfaces (RHEL-79997)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.52.0-3
changelog:
  - Invalid memory access on Dnsconfd DBUS error (RHEL-84692)
  - Support IP configuration for secondary interfaces on Oracle VM from metadata (RHEL-84695)


author: Wen Liang <wenliang@redhat.com> - 1:1.52.0-4
changelog:
  - ovs: allow reapplying ovs-bridge and ovs-port properties (RHEL-87595)
  - core: ovs: fix NULL pointer dereference in ovsdb read timeout callback (RHEL-87347)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1.2.18-2
changelog:
  - Support point-to-point IPSec tunnel (RHEL-20690)
  - Fix crash in libreswan_nmstate_iface_dpd_rsa (RHEL-21221)
  - Support configuring IPSec mode with 'type' (RHEL-21554)


author: Radovan Sroka <rsroka@redhat.com> - 0.16-102
changelog:
  RHEL 9.5.0 ERRATUM
  - aide fails with "Not enough parameters in db:15384. Trying to continue." unexpectedly
  Resolves: RHEL-27606
  - AIDE fails when using root_prefix option
  Resolves: RHEL-28882


author: Radovan Sroka <rsroka@redhat.com> - 0.16-103
changelog:
  RHEL 9.6.0 ERRATUM
  - /boot/grub2/grubenv's timestamp is getting modified continuously due to "boot_success" implementation
  Resolves: RHEL-4331


author: Attila Lakatos <alakatos@redhat.com> - 0.16-103.2
changelog:
  RHEL 9.6.Z ERRATUM
  - CVE-2025-54389 aide: improper output neutralization enables bypassing
  Resolves: RHEL-109910


author: Michal Sekletar <msekleta@redhat.com> - 0.8-21
changelog:
  - fix file attributes on /run/avahi-daemon (RHEL-5633)
  - avahi-client: fix resource leak (RHEL-27722)
  - fix resource leak in avahi_time_event_queue_new (RHEL-27717)


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-22
changelog:
  - Resolve CVE-2024-1975
  - Resolve CVE-2024-1737
  - Resolve CVE-2024-4076
  - Add ability to change runtime limits for max types and records per name


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 138.0.7204.49-1.inferit
changelog:
  - Update to 138.0.7204.49
    * CVE-2025-6555: Use after free in Animation
    * CVE-2025-6556: Insufficient policy enforcement in Loader
    * CVE-2025-6557: Insufficient data validation in DevTools


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 138.0.7204.157-1.inferit
changelog:
  - Update to 138.0.7204.157
    * CVE-2025-7656: Integer overflow in V8
    * CVE-2025-7657: Use after free in WebRTC
    * CVE-2025-6558: Incorrect validation of untrusted input in ANGLE and GPU


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 138.0.7204.168-1.inferit
changelog:
  - Update to 138.0.7204.168
    * CVE-2025-8010: Type Confusion in V8
    * CVE-2025-8011: Type Confusion in V8


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 138.0.7204.183-1.inferit
changelog:
  - Update to 138.0.7204.183
    * CVE-2025-8292: Use after free in Media Stream
  - Update chromium.conf - rename vaapi flags


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 139.0.7258.66-1.inferit
changelog:
  - Updated to 139.0.7258.66
    * CVE-2025-8576: Use after free in Extensions
    * CVE-2025-8578: Use after free in Cast
    * CVE-2025-8579: Inappropriate implementation in Gemini Live in Chrome
    * CVE-2025-8580: Inappropriate implementation in Filesystems
    * CVE-2025-8581: Inappropriate implementation in Extensions
    * CVE-2025-8582: Insufficient validation of untrusted input in DOM
    * CVE-2025-8583: Inappropriate implementation in Permissions


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 139.0.7258.127-1.inferit
changelog:
  - Updated to 139.0.7258.127
    * CVE-2025-8879: Heap buffer overflow in libaom
    * CVE-2025-8880: Race in V8
    * CVE-2025-8901: Out of bounds write in ANGLE
    * CVE-2025-8881: Inappropriate implementation in File Picker
    * CVE-2025-8882: Use after free in Aura


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 139.0.7258.138-1.inferit
changelog:
  - Updated to 139.0.7258.138
    * CVE-2025-9132: Out of bounds write in V8
  - Drop unused yasm build dependency
    https://fedoraproject.org/wiki/Changes/DeprecateYASM


author: Packit <hello@packit.dev> - 330-1
changelog:
  - Web server: Increased sandboxing, setuid removal, bootc support
  - Development: New install mode using systemd-sysext
  - ws container: Move to Fedora 41


author: Packit <hello@packit.dev> - 331-1
changelog:
  - ws: Prevent search engine indexing with robots.txt
  - container/ws: Support using an external SSH agent


author: Packit <hello@packit.dev> - 332-1
changelog:
  - containers/ws: Include cockpit-files
  - login: Beibooting to all supported OSes
  - metrics: Show system boots in metrics


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.4.1
  - Resolves: RHEL-28855


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.1
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.0
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.1
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.2-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.6.2
  - Related: RHEL-60277


author: Jindrich Novy <jnovy@redhat.com> - 1:1.6.2-2
changelog:
  - rebuild to fix CVE-2025-22871 containernetworking-plugins: Request smuggling due to acceptance of invalid chunked data in net/http
  - Resolves: RHEL-90031


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-12
changelog:
  - resolves: RHEL-101766 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.21.3-7)


author: Pavol Zacik <pzacik@redhat.com> - 1:2.3.3op2-28
changelog:
  - RHEL-39940 cups: Cupsd Listen arbitrary chmod 0140777
  - Delete the domain socket file after stopping the cups.socket service
  - Fix cupsd Listener checks


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-33.1
changelog:
  - RHEL-113077 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-14
changelog:
  - RHEL-19201 redhat-lsb unnecessary pulls in cups and avahi dependencies
  - RHEL-16026 Cups Browsed does not correctly pull printer location and description information from print server


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.28.7-18
changelog:
  - CVE-2024-47175 cups-filters: remote command injection via attacker controlled data in PPD file
  - CVE-2024-47076 cups-filters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes
  - CVE-2024-47176 cups-filters: cups-browsed binds on UDP INADDR_ANY:631 trusting any packet from any source


author: Martin Osvald <mosvald@redhat.com> - 3.4.1-11
changelog:
  - Resolves: RHEL-20925 - Seen/Unseen Flag not working correctly
    for shared mailboxes
  - cyrus-imapd.spec: rename patches to correspond with others


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-14
changelog:
  - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55212)
  - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55224)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
changelog:
  - Disable xwidgets (RHEL-14551)
  - org-file-contents: Consider all remote files unsafe (CVE-2024-30205)
  - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203)
  - Add protection for LaTeX preview (CVE-2024-30204)
  - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)


author: Tomas Korbar <tkorbar@redhat.com> - 2.5.0-2
changelog:
  - Fix parsing of large tokens
  - Reject direct parameter entity recursion
  - Resolves: RHEL-29699
  - Resolves: RHEL-29696


author: Tomas Korbar <tkorbar@redhat.com> - 2.5.0-3
changelog:
  - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492
  - Resolves: RHEL-56761
  - Resolves: RHEL-57520
  - Resolves: RHEL-57511


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-80
changelog:
  - fence_mpath: add support for hex-key format (used in multipath.conf)
    Resolves: RHEL-56138
  - fence_scsi/fence_mpath: add support for SPC-4 disks
    Resolves: RHEL-7629


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-81
changelog:
  - fence_ibm_powervs: add private endpoint and token file support
    Resolves: RHEL-62206
  - ha-cloud-support: bundle libs for the powervs-subnet resource agent
    Resolves: RHEL-64023


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-85
changelog:
  - fence_azure_arm: use azure-identity instead of msrestazure, which has
    been deprecated
    Resolves: RHEL-76493


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-86.3
changelog:
  - fence_ibm_vpc: refresh bearer-token if token data is corrupt, and
    avoid edge-case of writing empty token file
    Resolves: RHEL-83488


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-86.4
changelog:
  - fence_sbd: improve error handling and get devices from SBD_DEVICE env
    variable if devices parameter isnt set
    Resolves: RHEL-92695


author: Kalev Lember <klember@redhat.com> - 1.12.9-2
changelog:
  - Backport upstream patches for CVE-2024-42472
  - Require bubblewrap version that has new --bind-fd option backported for
    addressing CVE-2024-42472


author: Michel Lind <salimma@centosproject.org> - 2.10.4-10
changelog:
  - Fix for CVE-2025-27363 out-of-bound write vulnerability
  - Patch initially by Marc Deslauriers of Canonical
  - https://www.openwall.com/lists/oss-security/2025/03/14/3
  - Adjusted for EL9 by Jonathan Wright of AlmaLinux
  - and a member of the Meta security team
  - Resolves: RHEL-83105


author: Michal Ruprich <mruprich@redhat.com> - 8.3.1-12
changelog:
  - Resolves: RHEL-3541 - Incorrect handling of a error in parsing of an invalid section of a BGP update can de-peer a router


author: Michal Ruprich <mruprich@redhat.com> - 8.5.3-2
changelog:
  - Resolves: RHEL-15915 - crash from specially crafted MP_UNREACH_NLRI-containing BGP UPDATE message
  - Resolves: RHEL-15918 - crash from malformed EOR-containing BGP UPDATE message


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-16
changelog:
  - RHEL-38839 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-17
changelog:
  - RHEL-44759 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
  - RHEL-44745 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction
  - RHEL-44731 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass)


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-18
changelog:
  - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable()
  - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space
  - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding
  - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript
  - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-11
changelog:
  - Really fix authentication failures when sd-bus clients connect to GDBus servers
  - Resolves: #2217771


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-16.2
changelog:
  - Add patches for CVE-2024-52533 and CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-94290
  - Resolves: RHEL-102845


author: Daiki Ueno <dueno@redhat.com> - 3.8.2-2
changelog:
  - Bump nettle dependency to 3.9.1
  - Skip KTLS test exercising ChaCha20-Poly1305 in TLS 1.2 (RHEL-18498)


author: Daiki Ueno <dueno@redhat.com> - 3.8.3-2
changelog:
  - Fix timing side-channel in deterministic ECDSA (RHEL-28959)
  - Fix potential crash during chain building/verification (RHEL-28954)


author: Nicolas Frayer <nfrayer@redhat.com> - 2.06-96
changelog:
  - Fixes for several CVEs
  - Resolves: CVE-2024-45779 CVE-2024-45778 CVE-2025-1118
  - Resolves: CVE-2025-0677 CVE-2024-45782 CVE-2025-0690
  - Resolves: CVE-2024-45783 CVE-2025-0624 CVE-2024-45776
  - Resolves: CVE-2025-0622 CVE-2024-45774 CVE-2024-45775
  - Resolves: CVE-2024-45781 CVE-2024-45780
  - Resolves: #RHEL-79700
  - Resolves: #RHEL-79341
  - Resolves: #RHEL-79875
  - Resolves: #RHEL-79849
  - Resolves: #RHEL-79707
  - Resolves: #RHEL-79857
  - Resolves: #RHEL-79709
  - Resolves: #RHEL-79846
  - Resolves: #RHEL-75737
  - Resolves: #RHEL-79713
  - Resolves: #RHEL-73785
  - Resolves: #RHEL-73787
  - Resolves: #RHEL-79704
  - Resolves: #RHEL-79702


author: Nicolas Frayer <nfrayer@redhat.com> 2.06-101
changelog:
  - Added the following 2 commits to optimize memory consumption
  - tpm: Disable the tpm verifier if the TPM device is not present
  - powerpc: increase MIN RMA size for CAS negotiation
  - Resolves: #RHEL-76558


author: Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
changelog:
  - Bump version
  - Apply patches for CVE-2024-47538, CVE-2024-47541, CVE-2024-47542,
    CVE-2024-47600, CVE-2024-47607, CVE-2024-47615, CVE-2024-47835
    Resolves: RHEL-70983, RHEL-71035, RHEL-70932, RHEL-71037
    Resolves: RHEL-71019, RHEL-70995, RHEL-71163


author: Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
changelog:
  - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540
    CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,
    CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599,
    CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606,
    CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776,
    CVE-2024-47777, CVE-2024-47778, CVE-2024-47834
  - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195
  - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200
  - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204
  - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039
  - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167
  - Resolves: RHEL-71189


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.22.8-2
changelog:
  - Enable asfdemux, dvdlpcmdec, dvdsub, and realmedia plugins
  - Disable AMR plugins in RHEL builds
  - Resolves: rhbz#2236889


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-3
changelog:
  - Resolves: RHEL-68660 - RewriteRule proxying to UDS (unix domain socket)
    configured in .htaccess doesn't work on httpd-2.4.62-1


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4
changelog:
  - Resolves: RHEL-66488 - Apache HTTPD no longer parse PHP files with unicode
    characters in the name


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-4.1
changelog:
  - Resolves: RHEL-99972 - CVE-2024-47252 httpd: insufficient escaping of
    user-supplied data in mod_ssl
  - Resolves: RHEL-99963 - CVE-2025-23048 httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption
  - Resolves: RHEL-102079 - stickysession field does not work when specifying it
    in the query parameter after upgrade to 9.5


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-6
changelog:
  - Resolves: RHEL-68448 ipa trust-add fails in FIPS mode with an internal error has occurred
  - Resolves: RHEL-69301 Support GSSAPI in Cockpit on IPA servers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-7
changelog:
  - Resolves: RHEL-70760 Fix typo in ipa-migrate log file i.e 'Privledges' to 'Privileges'
  - Resolves: RHEL-70481 ipa-server-upgrade fails after established trust with ad
  - Resolves: RHEL-69927 add support for python cryptography 44.0.0
  - Resolves: RHEL-69908 All user groups are not being included during HSM token validation
  - Resolves: RHEL-69900 Upgrade to ipa-server-4.12.2-1.el9 OTP-based bind to LDAP without enforceldapotp is broken


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-8
changelog:
  - Resolves: RHEL-73022 A slow HSM can cause IPA server installation to fail setting up certificate tracking [rhel-9]
  - Resolves: RHEL-71261 [RHEL-9.6] Include latest fixes in python3-ipatests package
  - Resolves: RHEL-67191 CVE-2024-11029 ipa: Administrative user data leaked through systemd journal [rhel-9.6]
  - Resolves: RHEL-59040 KRA installation failure caused by a certificate mismatch in NSS DB and configuration file.


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-9
changelog:
  - Resolves: RHEL-74465 kinit with external idp user is failing
  - Resolves: RHEL-75656 Include latest fixes in python3-ipatests package


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-10
changelog:
  - Resolves: RHEL-73022 A slow HSM can cause IPA server installation to fail setting up certificate tracking


author: Thomas Woerner <twoerner@redhat.com> - 4.12.2-11
changelog:
  - Resolves: RHEL-67913 Add DNS over TLS Support, Require bind9.18 32:9.18.29-2 and new bind-dyndb-ldap 11.11-1


author: Thomas Woerner <twoerner@redhat.com> - 4.12.2-14
changelog:
  - Resolves: RHEL-80345 Use new bind9.18-dyndb-ldap and bind9.18 only for DNS over TLS with the ipa-server-encrypted-dns package


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-14.1
changelog:
  - Resolves: RHEL-89908
    EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin in FreeIPA
  - Resolves: RHEL-89144
    kdb: ipadb_get_connection() succeeds but returns null LDAP context


author: Andrea Claudi <aclaudi@redhat.com> - 1.2.2-1.el9
changelog:
  - New version 1.2.2 (Andrea Claudi) [RHEL-77280]
  - Fix buffer overflow via ifaces.c (Andrea Claudi) [RHEL-71493]


author: Jan Macku <jamacku@redhat.com> - 20210202-10
changelog:
  - arping: Fix 1s delay on exit for unsolicited arpings (RHEL-34110)
  - arping: exit 0 if running in deadline mode and we see replies (RHEL-27718)
  - ping: Print reply with wrong source with warning & some follow-up fixes (RHEL-12789, RHEL-13480)
  - ping: Fix socket error reporting (RHEL-4608)


author: Jan Macku <jamacku@redhat.com> - 20210202-11.1
changelog:
  - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94335)


author: Julien Rische <jrische@redhat.com> - 1.20.1-9
changelog:
  - Do not disable PKINIT if some of the well-known DH groups are unavailable
    Resolves: rhbz#2187722
  - Make PKINIT CMS SHA-1 signature verification available in FIPS mode
    Resolves: rhbz#2155607
  - Allow to set PAC ticket signature as optional
    Resolves: rhbz#2178298


author: Julien Rische <jrische@redhat.com> - 1.21.1-1
changelog:
  - New upstream version (1.21.1)
  - Fix double-free in KDC TGS processing (CVE-2023-39975)
  - Add support for "pac_privsvr_enctype" KDB string attribute
    Resolves: rhbz#2060421


author: Julien Rische <jrische@redhat.com> - 1.21.1-2
changelog:
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-27251
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-27245
  - Fix memory leak in failing UTF-8 to UTF-16 re-encoding for PAC
    Resolves: RHEL-27253
  - Make TCP waiting time configurable
    Resolves: RHEL-17132


author: Julien Rische <jrische@redhat.com> - 1.21.1-3
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45402 RHEL-45392


author: Julien Rische <jrische@redhat.com> - 1.21.1-4
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55423
  - Fix various issues detected by static analysis
    Resolves: RHEL-58216
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-15323


author: Julien Rische <jrische@redhat.com> - 1.21.1-5
changelog:
  - Support PKCS11 EC client certs in PKINIT
    Resolves: RHEL-74374
  - kdb5_util: fix DB entry flags on modification
    Resolves: RHEL-56059
  - Add ECDH support for PKINIT (RFC5349)
    Resolves: RHEL-4902


author: Julien Rische <jrische@redhat.com> - 1.21.1-9
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: RHEL-88704
  - Don't issue RC4 session keys by default (CVE-2025-3576)
    Resolves: RHEL-88048
  - Add PKINIT paChecksum2 from MS-PKCA v20230920
    Resolves: RHEL-82647


author: José Expósito <jexposit@redhat.com> - 1.7.0-9
changelog:
  - Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
  - Fix CVE-2023-43786: stack exhaustion from infinite recursion in
    PutSubImage()
  - Fix CVE-2023-43787: integer overflow in XCreateImage() leading to
    a heap overflow


author: Tomas Bzatek <tbzatek@redhat.com> - 2.28-9
changelog:
  - nvme: HostID fixes for TP4126
    Resolves: RHEL-1375
  - nvme: Stack smashing fixes
    Resolves: RHEL-13127
    Resolves: RHEL-8037


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-1
changelog:
  - Resolves: RHEL-36586 - Rebase SSSD for RHEL 9.5
  - Resolves: RHEL-27716 - SSSD fails to process AD groups with 'Global Scope' correctly causing incomplete group-membership on RHEL if cache is empty
  - Resolves: RHEL-17659 - [RfE] SSSD Failover Enhancements
  - Resolves: RHEL-35781 - Passkey errors when handling multiple altSecurityIdentities values
  - Resolves: RHEL-30142 - sssd_pac is crashing
  - Resolves: RHEL-22206 - Errors in krb5_child.log every time a user authenticates - Pre-authentication failed: No pkinit_anchors supplied
  - Resolves: RHEL-32595 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest
  - Resolves: RHEL-28666 - sssctl config-check is reporting false positive error msg
  - Resolves: RHEL-29454 - NULL dereference in inotify handling
  - Resolves: RHEL-1654 - Improve documentation for allowing e-mail address as username


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-2
changelog:
  - Resolves: RHEL-40742 - passkey_child with wrong owner
  - Resolves: RHEL-41047 - sssd is skipping GPO evaluation with auto_private_groups
  - Resolves: RHEL-40570 - GPO access the wrong memory location


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4
changelog:
  - Resolves: RHEL-49711 - SYSDB: remove index on dataExpireTimestamp
  - Resolves: RHEL-49811 - 2FA is being enforced after upgrading 2.9.1->2.9.4


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4.1
changelog:
  - Resolves: RHEL-59876 - EL9/CentOS Stream 9 lost offline smart card authentication
  - Resolves: RHEL-50912 - possible regression of rhbz#2196521


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.6-1
changelog:
  - Resolves: RHEL-70189 - Rebase SSSD for RHEL 9.6
  - Resolves: RHEL-67670 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-9]
  - Resolves: RHEL-68369 - sssd backend process segfaults when krb5.conf is invalid
  - Resolves: RHEL-66266 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-9]


author: Richard W.M. Jones <rjones@redhat.com> - 1.20.2-2
changelog:
  - Rebase to libnbd 1.20.2
    resolves: RHEL-31883
  - Fix multiple flaws in TLS server certificate checking
    resolves: RHEL-49801
  - Print full NBD error from server
    resolves: RHEL-50665


author: Daiki Ueno <dueno@redhat.com> - 4.15-2
changelog:
  - Fix auto=ondemand connection initialization with TCP (RHEL-51879)
  - Make use of Netlink extack for additional error reporting (RHEL-51881)


author: Daiki Ueno <dueno@redhat.com> - 4.15-4
changelog:
  - pluto: fix refcounting of whack FD at CREATE_CHILD_SA request (RHEL-61461)
  - pluto: ignore CREATE_CHILD_SA request if crypto is in progress (RHEL-61461)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-9
changelog:
  - Add patches for CVE-2024-52530, CVE-2024-52531, and CVE-2024-52532
    Resolves: RHEL-67069
    Resolves: RHEL-67081


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-10.1
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-85906
    Resolves: RHEL-85912
    Resolves: RHEL-85919
    Resolves: RHEL-87061
    Resolves: RHEL-87069
    Resolves: RHEL-87102
    Resolves: RHEL-87120
    Resolves: RHEL-88364
    Resolves: RHEL-88367


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-10.2
changelog:
  - Backport patches for various CVEs
    Resolves: RHEL-85888
    Resolves: RHEL-87081
    Resolves: RHEL-88332
    Resolves: RHEL-92285


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-11
changelog:
  - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder
  - lvm2: Refactor udisks_daemon_util_lvm2_wipe_block()


author: Arkady L. Shane <tigro@msvsphere-os.ru> - 10.10.0-7.6.el9_6.inferit.2.fstec
changelog:
  - Fixed guestfs access type
  - Set more precise requirement to avoid install error
  - Added integrity support


author: David King <dking@redhat.com> - 2.9.13-10
changelog:
  - Fix CVE-2025-6021 (RHEL-96507)
  - Fix CVE-2025-49794 (RHEL-96405)
  - Fix CVE-2025-49796 (RHEL-96431)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.9.6-2.1
changelog:
  - Resolves: RHEL-100102 - CVE-2025-48866 mod_security: ModSecurity
    Denial of Service Vulnerability


author: José Expósito <jexposit@redhat.com> - 2.3.4-28
changelog:
  - Fix CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer()
  - Fix CVE-2023-43789: out of bounds read on XPM with corrupted colormap


author: Miroslav Lichvar <mlichvar@redhat.com> 6.2-9.20210508
changelog:
  - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
  - ignore TERMINFO and HOME environment variables if running as root (#2211666)


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-1
changelog:
  - Rebase to latest 0.23.0 release (#2100409)
  - Use separate OpenSSL context to work better from inside of OpenSSL providers


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-2
changelog:
  - Fix regression in handling OpenPGP cards
  - Fix CVE-2023-2977: buffer overrun in pkcs15init for cardos


author: Jakub Jelen <jjelen@redhat.com> - 0.23.0-3
changelog:
  - Fix file caching with different offsets (RHEL-4079)
  - Fix CVE-2023-40660: Potential PIN bypass
  - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
  - Fix CVE-2023-4535: Out-of-bounds read in MyEID driver handling encryption using symmetric keys
  - Fix CVE-2023-5992: Side-channel leaks while stripping encryption PKCS#1.5 padding


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-16
changelog:
  - libpam: use close_range() to close file descriptors. Resolves: RHEL-5099
  - fix formatting of audit messages. Resolves: RHEL-5100


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-18
changelog:
  - libpam: use getlogin() from libc and not utmp. Resolves: RHEL-16727
  - pam_access: handle hostnames in access.conf. Resolves: RHEL-22300


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-19
changelog:
  - pam_namespace: protect_dir(): use O_DIRECTORY to prevent local DoS
    situations. CVE-2024-22365. Resolves: RHEL-21244


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-22
changelog:
  - pam_unix: always run the helper to obtain shadow password file entries.
    CVE-2024-10041. Resolves: RHEL-62879
  - pam_access: always match local address and clarify LOCAL keyword behaviour.
    Resolves: RHEL-23631 and RHEL-39943


author: Adrian Reber <areber@redhat.com> - 3.14.0-14
changelog:
  - Applied patch for CVE-2022-1941 (#RHEL-40872)
  - Applied patch to make emacs dependency optional (#RHEL-40572)


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.2.6-5
changelog:
  - Confirm License is SPDX MIT
  - Reduce macro indirection, etc.
  - Drop unused manual runtime dependency on setuptools
  - Add a note about the circular dependency with ruamel.yaml
  - Stop numbering sources and patches
  - Update URL (close RHBZ#1840610)
  - Add an import-only “smoke test”
  - Properly handle libyaml bundling
  - Port to pyproject-rpm-macros (“new Python guidelines”)
  - Add a link to the upstream issue for the Cython workaround


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.21-1
changelog:
  - Update to 3.9.21
  - Security fix for CVE-2024-11168 and CVE-2024-9287
  Resolves: RHEL-64889
  Resolves: RHEL-69942


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.21-2.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98053, RHEL-98025, RHEL-98243, RHEL-98195, RHEL-98219


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-9
changelog:
  - kvm-qdev-Fix-set_pci_devfn-to-visit-option-only-once.patch [RHEL-39948]
  - kvm-tests-avocado-hotplug_blk-Fix-addr-in-device_add-com.patch [RHEL-39948]
  - kvm-qdev-monitor-avoid-QemuOpts-in-QMP-device_add.patch [RHEL-39948]
  - kvm-vl-use-qmp_device_add-in-qemu_create_cli_devices.patch [RHEL-39948]
  - Resolves: RHEL-39948
    (qom-get iothread-vq-mapping is empty on new hotplug disk [rhel-9.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-10
changelog:
  - kvm-target-i386-Make-sure-SynIC-state-is-really-updated-.patch [RHEL-53073]
  - kvm-hw-virtio-fix-crash-in-processing-balloon-stats.patch [RHEL-73688]
  - kvm-qemu-ga-Optimize-freeze-hook-script-logic-of-logging.patch [RHEL-52278]
  - kvm-qga-Add-log-to-guest-fsfreeze-thaw-command.patch [RHEL-56340]
  - Resolves: RHEL-53073
    (kvm-unti kvm-hyperv_synic test is stuck on AMD with COS9)
  - Resolves: RHEL-73688
    (VM crashes when requesting domstats)
  - Resolves: RHEL-52278
    (fsfreeze hooks doesn't log error on system logs when running hook fails)
  - Resolves: RHEL-56340
    (qemu-ga logs only "guest-fsfreeze called" (but not "guest-fsthaw called"))


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-11
changelog:
  - kvm-pci-ensure-valid-link-status-bits-for-downstream-por.patch [RHEL-65616]
  - Resolves: RHEL-65616
    (Failed to hot add PCIe device behind xio3130 downstream port)


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-12
changelog:
  - kvm-target-i386-cpu-set-correct-supported-XCR0-features-.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-do-not-rely-on-ExtSaveArea-for-accelerat.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-return-bool-from-x86_cpu_filter_features.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-add-AVX10-feature-and-AVX10-version-prop.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-add-CPUID.24-features-for-AVX10.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-Add-feature-dependencies-for-AVX10.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-Add-AVX512-state-when-AVX10-is-supported.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-Introduce-GraniteRapids-v2-model.patch [RHEL-30316 RHEL-45111]
  - kvm-target-i386-add-sha512-sm3-sm4-feature-bits.patch [RHEL-30316 RHEL-45111]
  - kvm-arm-disable-pauth-for-virt-rhel9.patch [RHEL-75782]
  - kvm-tests-qtest-disable-most-pauth-tests.patch [RHEL-75782]
  - Resolves: RHEL-30316
    ([Intel 9.6 FEAT] [GNR] Virt-QEMU: Add AVX10.1 instruction support)
  - Resolves: RHEL-45111
    ([Intel 9.6 FEAT] [CWF][DMR] Virt-QEMU: Advertise new instructions SHA2-512NI, SM3, and SM4)
  - Resolves: RHEL-75782
    ([Nvidia "Grace"] Lack of "PAuth" CPU feature results in live migration failure from RHEL 9.6 to 10)


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-13
changelog:
  - kvm-pc-bios-s390-ccw-Abort-IPL-on-invalid-loadparm.patch [RHEL-72716]
  - kvm-pc-bios-s390-ccw-virtio-Add-a-function-to-reset-a-vi.patch [RHEL-72716]
  - kvm-pc-bios-s390-ccw-Fix-boot-problem-with-virtio-net-de.patch [RHEL-72716]
  - kvm-pc-bios-s390-ccw-netmain-Fix-error-messages-with-reg.patch [RHEL-72716]
  - Resolves: RHEL-72716
    (Boot fall back to cdrom from network not always working)


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-14
changelog:
  - kvm-nbd-server-Silence-server-warnings-on-port-probes.patch [RHEL-67863]
  - kvm-vhost-Add-stubs-for-the-migration-state-transfer-int.patch [RHEL-78372]
  - kvm-virtio-net-vhost-user-Implement-internal-migration.patch [RHEL-78372]
  - Resolves: RHEL-67863
    (Ensure qemu as NBD server does not flood logs [rhel 9.6])
  - Resolves: RHEL-78372
    (Add vhost-user internal migration for passt [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-15
changelog:
  - kvm-net-Fix-announce_self.patch [RHEL-73891]
  - kvm-migration-Add-helper-to-get-target-runstate.patch [RHEL-54296 RHEL-78397]
  - kvm-qmp-cont-Only-activate-disks-if-migration-completed.patch [RHEL-54296 RHEL-78397]
  - kvm-migration-block-Make-late-block-active-the-default.patch [RHEL-54296 RHEL-78397]
  - kvm-migration-block-Apply-late-block-active-behavior-to-.patch [RHEL-54296 RHEL-78397]
  - kvm-migration-block-Fix-possible-race-with-block_inactiv.patch [RHEL-54296 RHEL-78397]
  - kvm-migration-block-Rewrite-disk-activation.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Add-active-field-to-BlockDeviceInfo.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Allow-inactivating-already-inactive-nodes.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Inactivate-external-snapshot-overlays-when-nec.patch [RHEL-54296 RHEL-78397]
  - kvm-migration-block-active-Remove-global-active-flag.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Don-t-attach-inactive-child-to-active-node.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Fix-crash-on-block_resize-on-inactive-node.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Add-option-to-create-inactive-nodes.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Add-blockdev-set-active-QMP-command.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Support-inactive-nodes-in-blk_insert_bs.patch [RHEL-54296 RHEL-78397]
  - kvm-block-export-Don-t-ignore-image-activation-error-in-.patch [RHEL-54296 RHEL-78397]
  - kvm-block-Drain-nodes-before-inactivating-them.patch [RHEL-54296 RHEL-78397]
  - kvm-block-export-Add-option-to-allow-export-of-inactive-.patch [RHEL-54296 RHEL-78397]
  - kvm-nbd-server-Support-inactive-nodes.patch [RHEL-54296 RHEL-78397]
  - kvm-iotests-Add-filter_qtest.patch [RHEL-54296 RHEL-78397]
  - kvm-iotests-Add-qsd-migrate-case.patch [RHEL-54296 RHEL-78397]
  - kvm-iotests-Add-NBD-based-tests-for-inactive-nodes.patch [RHEL-54296 RHEL-78397]
  - Resolves: RHEL-73891
    (No RARP packets on the destination after migration [rhel-9.6])
  - Resolves: RHEL-54296
    (Provide QMP command for block device reactivation after migration [rhel-9.5])
  - Resolves: RHEL-78397
    (backport fix for double migration of a paused VM (disk activation rewrite))


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-15.el9_6.2
changelog:
  - kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch [RHEL-80622]
  - Resolves: RHEL-80622
    (Allow libvirt to restart passt/vhost-user when the process is killed [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-15.el9_6.3
changelog:
  - kvm-qga-implement-a-guest-get-load-command.patch [RHEL-83000]
  - Resolves: RHEL-83000
    ([qemu-guest-agent][RFE] Report CPU load average [rhel-9.6.z])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-15.el9_6.4
changelog:
  - kvm-file-posix-probe-discard-alignment-on-Linux-block-de.patch [RHEL-87734]
  - kvm-block-io-skip-head-tail-requests-on-EINVAL.patch [RHEL-87734]
  - kvm-file-posix-Fix-crash-on-discard_granularity-0.patch [RHEL-87734]
  - Resolves: RHEL-87734
    (QEMU sends unaligned discards on 4K devices [rhel-9.6.z])


author: Michal Ruprich <mruprich@redhat.com> - 3.2.3-21
changelog:
  - Resolves: RHEL-70265 - Rebase rsync to 3.2.5
  - Resolves: RHEL-67142 - Wrong progress reported by rsync when using copy-devices
  - Resolves: RHEL-29340 - Slowness in rsync due to extra validation steps.
  - Resolves: RHEL-18216 - rysnc script /usr/share/doc/rsync/support/rrsync is unsecure


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-2
changelog:
  - Resolves: RHEL-70158 - Info Leak via Uninitialized Stack Contents
  - Resolves: RHEL-70208 - Path traversal vulnerability in rsync
  - Resolves: RHEL-70210 - --safe-links option bypass leads to path traversal
  - Resolves: RHEL-71657 - Race Condition in rsync Handling Symbolic Links


author: Jun Aruga <jaruga@redhat.com> - 3.0.4-160
changelog:
  - Bypass git submodule test failure on Git >= 2.38.1.
  - Fix tests with Europe/Amsterdam pre-1970 time on tzdata version 2022b.
  - Fix for tzdata-2022g.
  - Fix File.utime test.


author: Jun Aruga <jaruga@redhat.com> - 3.0.4-161
changelog:
  - Fix OpenSSL.fips_mode and OpenSSL::PKey.read in OpenSSL 3 FIPS.
    Resolves: RHEL-12724
  - ssl: use ffdhe2048 from RFC 7919 as the default DH group parameters
    Related: RHEL-12724


author: Jun Aruga <jaruga@redhat.com> - 3.0.7-162
changelog:
  - Upgrade to Ruby 3.0.7.
    Resolves: RHEL-35740
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-35741
  - Fix ReDoS vulnerability in URI.
    Resolves: RHEL-35742
  - Fix ReDoS vulnerability in Time.
    Resolves: RHEL-35743
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-35744
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-35746
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-35747


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-164
changelog:
  - Undefine GC compaction methods on ppc64le.
    Resolves: RHEL-83135
  - Fix printing warnings when using IRB from a script.
    Resolves: RHEL-83137


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-165
changelog:
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-87183
  - Fix ReDoS in CGI::Util#escapeElement. (CVE-2025-27220)
    Resolves: RHEL-87184


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-7
changelog:
  - useradd: check if subid range exists for user. Resolves: #2179987
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #2179988


author: Jindrich Novy <jnovy@redhat.com> - 2:1.18.1-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.18
    (https://github.com/containers/skopeo/commit/bfd0850)
  - fixes "CVE-2025-27144 skopeo: Go JOSE's Parsing Vulnerable to Denial of Service [rhel-9.6.z]"
  - Resolves: RHEL-82972


author: Jindrich Novy <jnovy@redhat.com> - 2:1.18.1-2
changelog:
  - rebuild to fix CVE-2025-22871 skopeo: Request smuggling due to acceptance of invalid chunked data in net/http
  - Resolves: RHEL-89329


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-10
changelog:
  RHEL 9.3.0.Z ERRATUM
  - CVE-2023-28487 sudo: Sudo does not escape control characters in sudoreplay output
  Resolves: RHEL-21834
  - CVE-2023-28486 sudo: Sudo does not escape control characters in log messages
  Resolves: RHEL-21828
  - CVE-2023-42465 sudo: Targeted Corruption of Register and Stack Variables
  Resolves: RHEL-21821


author: systemd maintenance team <systemd-maint@redhat.com> - 252-49
changelog:
  - logind: tighten for which classes of sessions we do stop-on-idle (RHEL-24340)
  - Fix configuration for Packit 1.0.0 (RHEL-70884)
  - udev/net_id: introduce naming scheme for RHEL-9.6 (RHEL-25515)
  - hwdb: Fix accelerometer mount matrix for ASUS T100TAS (RHEL-49810)
  - hwdb.d/60-keyboard.hwdb: add Clevo mic mute quirk for V5x dGPU (RHEL-49810)
  - hwdb: add entry for Dell AlpsPS/2 ALPS DualPoint TouchPad (RHEL-49810)
  - hwdb: Mark Apple Wireless keyboards as not having NumLock LED (RHEL-49810)
  - update keyboard hwdb to add acer Predator PHN16-72 (RHEL-49810)
  - hwdb: death to tabs! (RHEL-49810)
  -  hwdb.d/60-keyboard.hwdb: add Clevo mic mute quirk for V5x iGPU, NV41PZ (RHEL-49810)
  - Add ACCEL_MOUNT_MATRIX for Chuwi Hi10 Max. (RHEL-49810)
  - Add HUAWEI MateBook D 15 AMD ACCEL properties (RHEL-49810)
  - hwdb: add Kensington SlimBlade Pro trackball (Bluetooth mode) (RHEL-49810)
  - hwdb: Add accel orientation quirk for the IdeaPad Duet 3 10IGL5-LTE (RHEL-49810)
  - hwdb: add keymaps for Acer Nitro 5 AN515-47 (#34493) (RHEL-49810)
  - hwdb: make key map match comment for one laptop (RHEL-49810)
  - hwdb: there's KEY_BRIGHTNESS_AUTO these days, hence hook it up where a FIXME suggests that (RHEL-49810)
  - hwdb: use KEY_ROTATE_DISPLAY for various cases of display rotation keys (RHEL-49810)
  - hwbd: use newer KEY_PICKUP_PHONE, KEY_HANGUP_PHONE, KEY_SELECTIVE_SCREENSHOT, KEY_NOTIFICATION_CENTER keycodes where appropriate (RHEL-49810)
  - hwdb: add SCAI SKU prefix for Samsung keyboard mapping (#34648) (RHEL-49810)
  - tree-wide: drop doubled empty lines (RHEL-49810)
  - hwdb: move key 66/65 handling from specific to generic HP laptop coverage (RHEL-49810)
  - hwdb: fix key toggle touchpad and programmable buttom for Positivo V142N (#34725) (RHEL-49810)
  - hwdb: add Stream Deck Neo (#34903) (RHEL-49810)
  - hwdb: update autosuspend rules (RHEL-49810)
  - hwdb: import newest autosuspend rules from chromeos (RHEL-49810)
  - update hwdb (RHEL-49810)
  - Update hwdb (RHEL-49810)
  - hwdb: fix broken numpad paren keys on Lenovo Thinkbook 16 G6+ 2024 (RHEL-49810)
  - Update hwdb (RHEL-49810)
  - hwdb: add new Cube Mix Plus (i18D) rotation info (RHEL-49810)
  - hwdb: Add quirk for Logitech MX Keys for Mac (RHEL-49810)
  - hwdb: add support for PineTab2 to 60-sensor.hwdb (#35304) (RHEL-49810)
  - hwdb: add entry for Chuwi Hi10 X1 (#35331) (RHEL-49810)
  - hwdb: update (RHEL-49810)
  - hwdb: Make 3D mice work out-of-the-box (RHEL-49810)
  - hwdb: Add Chuwi MiniBook X trackpad fuzz (RHEL-49810)
  - Update hwdb (RHEL-49810)
  - hwdb: disable inclusion of the PCI domain in MANA network interface naming (RHEL-49810)
  - hwdb: move down touchpad toggle section from generic to product specific (RHEL-49810)
  - hwdb: add scancodes for HP Elitebook 2170p runnning coreboot (RHEL-49810)
  - hwdb: Make remote controllable lights work out-of-the-box (RHEL-49810)
  - hwdb: fix key toggle touchpad for VAIO VJFH52 (#35645) (RHEL-49810)
  - hwdb: comment out the entry for Logitech MX Keys for Mac (RHEL-49810)
  - 60-sensor.hwdb: Loosen model mask to include entire series (RHEL-49810)
  - Correct ACCEL_MOUNT_MATRIX for Chuwi Hi10 Max (RHEL-49810)
  - hwdb: Add macro keys for HP 430 Programmable Wireless Keypad (RHEL-49810)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-50
changelog:
  - journal: again create user journals for users with high uids (RHEL-70103)
  - install: don't translate unit instances to paths when reenabling them (RHEL-5956)
  - test-systemctl-enable: fix typo (RHEL-5956)
  - udev: Handle PTP device symlink properly on udev action 'change' (RHEL-59088)
  - systemctl: print warning about missing /proc only as debug message (RHEL-3906)
  - repart: avoid use of uninitialized TPM2B_PUBLIC data (RHEL-56793)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-51
changelog:
  - ci: use ubuntu 22:04 for deploy of man pages (RHEL-70884)
  - man/tmpfiles: fix off-by-one in example (RHEL-74015)
  - test: drop removed SCSI passthrough feature (RHEL-70884)
  - nspawn: call json_dispatch() with a correct pointer (RHEL-55266)
  - varlink,json: introduce new varlink_dispatch() helper (RHEL-55266)
  - json: add json_dispatch_const_user_group_name() (RHEL-55266)
  - sd-varlink: add new sd_varlink_error_is_invalid_parameter() helper (RHEL-55266)
  - userdb: return ESRCH if userdb service refuses a user/group name as invalid (RHEL-55266)
  - test: rename assert.sh to util.sh (RHEL-55301)
  - core: Don't GC unit if it is in cgroup_empty_queue (RHEL-55301)
  - core: Handle cgroup pruning in on_cgroup_empty_event (RHEL-55301)
  - Fix failing test (RHEL-55301)
  - unit: don't gc unit in oom queue (RHEL-55301)
  - core: do not GC units/jobs that are in the D-Bus queue (RHEL-55301)


author: Jan Grulich <jgrulich@redhat.com> - 1.14.1-2
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-62001


author: Jan Grulich <jgrulich@redhat.com> - 1.14.1-5
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-80015
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-80027
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79395
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-80035
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79378
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-80047
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-80041
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79358


author: Jan Grulich <jgrulich@redhat.com> - 1.14.1-7
changelog:
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97287
  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97305
  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97380
  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97415
  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97430


author: Jan Grulich <jgrulich@redhat.com> - 1.14.1-8
changelog:
  - Additional fix to CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97305


author: Jan Macku <jamacku@redhat.com> - 3:2.1.1-1
changelog:
  - rebase to 2.1.1 (RHEL-67117)
      Interpret ipv4-mapped ipv6 addresses (::ffff:A.B.C.D) as true ipv4.

  	   There are no ipv4-mapped addresses in the real network which we
  	   operate on, so use just ipv4 in such cases, but allow users
  	   to specify it this way for convenience.

  	  Return back more robast poll(2) loop handling.


author: José Expósito <jexposit@redhat.com> - 1.20.11-22
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18322
    Resolves: https://issues.redhat.com/browse/RHEL-18329


author: José Expósito <jexposit@redhat.com> - 1.20.11-23
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21203
    Resolves: https://issues.redhat.com/browse/RHEL-20531
    Resolves: https://issues.redhat.com/browse/RHEL-20380
    Resolves: https://issues.redhat.com/browse/RHEL-20386
    Resolves: https://issues.redhat.com/browse/RHEL-21193
    Resolves: https://issues.redhat.com/browse/RHEL-21200


author: José Expósito <jexposit@redhat.com> - 1.20.11-25
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-28
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79125), CVE-2025-26595 (RHEL-79129),
                 CVE-2025-26596 (RHEL-79133), CVE-2025-26597 (RHEL-79137),
                 CVE-2025-26598 (RHEL-79138), CVE-2025-26599 (RHEL-79143),
                 CVE-2025-26600 (RHEL-79153), CVE-2025-26601 (RHEL-79149)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-30
changelog:
  - xfree86: Fix potentially NULL reference to platform device's PCI device
    Resolves: https://issues.redhat.com/browse/RHEL-88187


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-31
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97289), CVE-2025-49176 (RHEL-97311),
                 CVE-2025-49178 (RHEL-97388), CVE-2025-49179 (RHEL-97410),
                 CVE-2025-49180 (RHEL-97255)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.9-5
changelog:
  Fix for CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408, CVE-2024-0409


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79126), CVE-2025-26595 (RHEL-79130),
                 CVE-2025-26596 (RHEL-79134), CVE-2025-26597 (RHEL-79140),
                 CVE-2025-26598 (RHEL-79141), CVE-2025-26599 (RHEL-79146),
                 CVE-2025-26600 (RHEL-79154), CVE-2025-26601 (RHEL-79150)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97341), CVE-2025-49176 (RHEL-97335),
                 CVE-2025-49177 (RHEL-97358), CVE-2025-49178 (RHEL-97395),
                 CVE-2025-49179 (RHEL-97405), CVE-2025-49180 (RHEL-97245)


