# changelog

author: Boris Ranto <branto@redhat.com> - 2.0.19-12
changelog:
  - New release
  - Move OpenIPMI modprobe conf to /usr/lib/modprobe.d/ (#1195289)
  - Avoid warning on update/removal (#1256798)
  - Stop manually creating and shipping /var/run/OpenIPMI (#1296560)


author: Pavel Raiskup <praiskup@redhat.com> - 2.69-6
changelog:
  - fedora-review (minor) fixes and typos: trim lines, remove defattr(,,), do not
    run `rm -rf %{buildroot} at the beginning of install section, use curly
    brackets only around rpm macros/variables and not around shell variables,
    remove clean section


author: Pavel Raiskup <praiskup@redhat.com> - 2.69-8
changelog:
  - the 'INSTALL' file can be used as template file for packages which are using
    autoconf - mark it for installation again (#661623)


author: Miroslav Lichvar <mlichvar@redhat.com> - 5.18-1
changelog:
  - Update to 5.18
  - Fix multilib conflicts (#831379)
  - Make some dependencies arch-specific
  - Remove obsolete macros


author: Pablo Greco <pgreco@centosproject.org>
changelog:
  - Own yum vars
  - Generate yum vars at build time
  - Remove dist_suffix
  - Fix autorelabel preset
  - Fix tuned profile in system-release-cpe
  - Set aarch64 tuned profile to server
  - Update to 7.7


author: Pablo Greco <pgreco@centosproject.org>
changelog:
  - Add rootfs-expand to aarch64
  - Create generic kvariant in aarch64 if it doesn't exist (for new kernel repos)
  - Own kvariant var in armhfp and aarch64
  - Backport move of /etc/os-release to /usr/lib/os-release (ngompa)
  - Spec file cleanup (carlwgeorge)
  - Update to 7.8


author: Marek Polacek <polacek@redhat.com> 4.8.5-31
changelog:
  - backport s390 -mpic-data-is-text-relative feature (#1555397)
  - fix crash when write follows large read (#1463706)
  - fix emit_move_insn ICE (#1565536)
  - add missing rs6000-cpus.def (#1512202)


author: Marek Polacek <polacek@redhat.com> 4.8.5-34
changelog:
  - fix infinite looping in -fipa-cp-clone (#1546372)
  - don't look for vsld gcc.target/powerpc/pr72717.c


author: Marek Polacek <polacek@redhat.com> 4.8.5-38
changelog:
  - fix mode mismatch in prepare_cmp_insn (#1641329, PR target/63442)
  - allow libitm to use HTM (#1659698)
  - fix up memset handling in DSE (#1640805, PR rtl-optimization/69891)
  - fix bits/bytes confusion in set_noop_p (#1594975, PR rtl-optimization/68814)
  - enable initializing statics with COMPOUND_LITERAL_EXPR in C99
    (#1672652, PR c/63567)
  - fix PIC_OFFSET_TABLE_REGNUM (#1614326)
  - quash spurious -Wmissing-field-initializers warnings (#1633716, PR c/60784)
  - fix ICE with alias template (#1648161, PR c++/53658)


author: Zdenek Pavlas <zpavlas@redhat.com> - 0.9.9-21
changelog:
  - update to latest HEAD
  - don't BuildRequire bash-completion in rhel
  - Fail for bad compress-type options to modifyrepo, like createrepo. BZ 886589
  - Fix options documentation. BZ 892657.
  - modifyrepo: fix --compress option bug. BZ 950724
  - modifyrepo: add --checksum and --{unique,simple}-md-filenames options


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-24
changelog:
  - mergerepo: merge package versions from multiple repos.
  - Related: bug#1178763
  - Close lock file before unlink().
  - Related: bug#1256216


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-26
changelog:
  - Make sure filename doesn't already contain a checksum.
  - Resolves: bug#1270784
  - Catch IOErrors when loading pkglist.
  - Resolves: bug#1083182
  - Add missing options to the manpage.
  - Resolves: bug#1285761


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-27
changelog:
  - Fix temporary files cleanup.
  - Resolves: bug#1406418
  - Fix --update for pkgs with same nevra.
  - Resolves: bug#1404239


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> - 0.9.9-28
changelog:
  - createrepo: allow xz and bz2 for xml files.
  - Resolves: bug#1125437
  - modifyrepo: fix handling of already compressed input.
  - Resolves: bug#1227782
  - modifyrepo: handle empty file with LZMA.
  - Resolves: bug#1287685
  - modifyrepo: docs: remove compat compress type.
  - Resolves: bug#1287714


author: Ondrej Kozina <okozina@redhat.com> - 1.7.4-4
changelog:
  - patch: fix regression in blockwise functions
  - patch: avoid repeating error messages when device holders
    detected.
  - patch: add option to cryptsetup-reencrypt to print progress
    log sequentaly
  - patch: use --progress-frequency in reencryption dracut module
  - Resolves: #1480006 #1447632 #1479857


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-2
changelog:
  - patch: stop LUKS2 auto-recovery if device is no longer LUKS
    type
  - patch: update cryptsetup man page for --type option
  - patch: rephrase error message for invalid --type option in
    convert action
  - Resolves: #1599281 #1601477 #1601481


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-3
changelog:
  - Add expected permissions explicitly for locking directory.
  - Reinstate sed script removing library rpath from libtool
    script due to bug in upstream sources distribution.
  - Resolves: #1609847 #1610379


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-4
changelog:
  - patch: Fix broken LUKS2 api test.
  - patch: Allow cryptsetup to process all LUKS2 metadata variants
    according to LUKS2 specifiation.
  - Resolves: #1653388


author: Ondrej Kozina <okozina@redhat.com> - 2.0.3-5
changelog:
  - patch: calculate alignment offset correctly for LUKS2 devices.
  - patch: fix memory leak in LUKS2 validation.
  - Resolves: #1613953 #1693592


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-48
changelog:
  - fix RTSP bad headers buffer over-read (CVE-2018-1000301)
  - fix FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
  - fix LDAP NULL pointer dereference (CVE-2018-1000121)
  - fix RTSP RTP buffer over-read (CVE-2018-1000122)
  - http: prevent custom Authorization headers in redirects (CVE-2018-1000007)
  - doc: --tlsauthtype works only if built with TLS-SRP support (#1542256)
  - update certificates in the test-suite because they expire soon (#1572723)


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-50
changelog:
  - remove dead code, detected by Coverity Analysis
  - remove unused variable, detected by GCC and Clang


author: Kamil Dudka <kdudka@redhat.com> - 7.29.0-52
changelog:
  - prevent curl --rate-limit from hanging on file URLs (#1281969)
  - fix NTLM password overflow via integer overflow (CVE-2018-14618)
  - fix bad arithmetic when outputting warnings to stderr (CVE-2018-16842)
  - backport options to force TLS 1.3 in curl and libcurl (#1672639)
  - prevent curl --rate-limit from crashing on https URLs (#1683292)


author: Jonathan Dieter <jdieter@lesbg.com> - 3.6-0.13.20130520git
changelog:
  - Clearer error message when applydeltaiso fails (#825428) (Thanks, John!)
  - Add details to applydeltaiso and makedeltaiso man pages (#569499)
  - Add fragiso man page to deltaiso package (#569776)
  - Fix section for applydeltaiso (#548970)
  - Add arch-specific requires (#677060)


author: Jonathan Dieter <jdieter@lesbg.com> - 3.6-1
changelog:
  - Update to 3.6 which, among other things, fixes a bug when applying a deltarpm
    to create a gzip-compressed rpm using full compression


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.185-2
changelog:
  - Fix cluster conversions from linear to mirror.
  - Report no_discard_passdown for cache LVs with lvs -o+kernel_discards.
  - Prevent shared active mirror LVs with lvmlockd.
  - Parsing of cache status understand no_discard_passdown.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.186-1
changelog:
  - Improve removal of cached devices.
  - Synchronize with udev when dropping snapshot.
  - Add missing device synchronization point before removing pvmove node.
  - Correctly set read_ahead for LVs when pvmove is finished.
  - Fix metadata writes from corrupting with large physical block size.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.186-2
changelog:
  - Prevent creating VGs with PVs with different logical block sizes.
  - Pvmove runs in exlusively activating mode for exclusively active LVs.
  - Activate thin-pool layered volume as 'read-only' device.
  - Enhance validation for thin and cache pool conversion and swapping.


author: Marian Csontos <mcsontos@redhat.com> - 7:2.02.186-3
changelog:
  - Fix lvmetad shutdown and avoid lenghty timeouts when rebooting system.
  - Change allow_mixed_block_sizes default to 1.


author: Peter Rajnoha <prajnoha@redhat.com> - 0.7.0-0.1-rc6
changelog:
  - Don't open devices as writeable if --clear-needs-check-flag is not set.
  - Fix cache metadata format version 2 superblock packing.


author: Marian Csontos <mcsontos@redhat.com> - 0.7.2-1
changelog:
  - Update to latest upstream release including various bug fixes and new features.
  - Fix segfault when dump tools are given a tiny metadata file.
  - Fix -V exiting with 1.
  - Fix thin_check when running on XML dump instead of binary data.
  - Speed up free block searches.


author: Marian Csontos <mcsontos@redhat.com> - 0.7.3-1
changelog:
  - Update to latest bugfix and documentation update release.
  - *_restore tools wipe superblock as a last resort.
  - Add thin_check --override-mapping-root.


author: Lukas Nykryn <lnykryn@redhat.com> - 033-560
changelog:
  - fips: removed false-positive 'FATAL: Module xxx not found' error message when kernel provides a generic algo for module
  - fips: ensure fs module for /boot is installed
  - iscsi: always popd, even if there is no iscsi device
  - Harden dracut against BASH_ENV environment variable
  - fips: check fips integrity just before mounting local filesystems in /sysroot


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-8
changelog:
  - e4defrag: backwards-allocated files should be defragmented (#1176785)
  - tune2fs: allow removal of dirty journal with two "-f" options (#1212376)
  - mke2fs: prevent creation of filesystem with unsupported revision (#1212378)
  - libext2fs: prevent buffer overflows (#1293677)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-10
changelog:
  - libext2fs: don't ignore fsync errors (#1405049)
  - Fix nroff macro issue in chattr man page (#1429213)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-11
changelog:
  - libext2fs: skip start_blk adjustment when stride and flex_bg is set (#1503969)
  - tune2fs: edit dire warning about check intervals (#1433233)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-13
changelog:
  - e2fsck: warn if checkinterval and broken_system_clock both set (#1365594)
  - e2fsprogs: fail to open 1k block size ext4 with bigalloc,meta_bg,^resize_inode (#1448019)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-14
changelog:
  - Various fixes and improvements (#1682935)
  - Automatically enable meta_bg to avoid failure when creating huge fs with small bs (#1608635)
  - don't ignore fsync errors in filefrag (#1451185)


author: Mark Wielaard <mjw@redhat.com> - 0.171-1
changelog:
  - New upstream release.
    - DWARF5 and split dwarf, including GNU DebugFission, support.
    - readelf: Handle all new DWARF5 sections.
      --debug-dump=info+ will show split unit DIEs when found.
      --dwarf-skeleton can be used when inspecting a .dwo file.
      Recognizes GNU locviews with --debug-dump=loc.
    - libdw: New functions dwarf_die_addr_die, dwarf_get_units,
      dwarf_getabbrevattr_data and dwarf_cu_info.
      libdw will now try to resolve the alt file on first use
      when not set yet with dwarf_set_alt.
      dwarf_aggregate_size() now works with multi-dimensional arrays.
    - libdwfl: Use process_vm_readv when available instead of ptrace.
    - backends: Add a RISC-V backend.


author: Mark Wielaard <mjw@redhat.com> - 0.172-1
changelog:
  - New upstream release.
    - No functional changes compared to 0.171.
    - Various bug fixes in libdw and eu-readelf dealing with bad DWARF5
      data. Thanks to running the afl fuzzer on eu-readelf and various
      testcases.
    - eu-readelf -N is ~15% faster.


author: Mark Wielaard <mjw@redhat.com> - 0.176-1
changelog:
  - New upstream release (#1676504)
    CVE-2019-7146, CVE-2019-7148, CVE-2019-7149, CVE-2019-7150,
    CVE-2019-7664, CVE-2019-7665, CVE-2018-16062, CVE-2018-16402,
    CVE-2018-16403, CVE-2018-18310, CVE-2018-18521, CVE-2018-18520.


author: Mark Wielaard <mjw@redhat.com> - 0.170-1
changelog:
  - New upstream release. Remove upstreamed patches.
  - Sync provide_yama_scope with fedora.
  - Add elfutils-0.170-x86_64-backtrace-test-override.patch.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.49-10
changelog:
  - Use vsnprintf instead of vsprintf to avoid buffer overflow
    (it happens e.g. when running systemtap testsuite)
    Resolves: #1038931


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.45-13
changelog:
  - Fix segfaults if Tcl is built with stubs and Expect is used directly from C program
    (patch taken from Debian project, written by Sergei Golovan)
    Resolves: #1091060


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.45-14
changelog:
  - Use different and probably better approach of fixing segfaults if Tcl is
    built with stubs and Expect is used directly from C program
    Resolves: #1091060


author: Dmitry Butskoy <Dmitry@Butskoy.name> - 1.00.38-1
changelog:
  - Update to 1.00.38
  - split freetds-libs package (for multiarch support)
  - change default tds vesrion to auto
  - move odbc plugin from devel to libs package (#1449881)


author: Honza Horak <hhorak@redhat.com> - 1.9.1-1
changelog:
  - Updated to new upstream release 1.9.1
  - Dropped -filestruct, -ndbmlock and -fhs patches, they are not 
    needed anymore and GDBM_NOLOCK is used always
  - Run testsuite


author: Honza Horak <hhorak@redhat.com> - 1.10-1
changelog:
  - Updated to new upstream release 1.10
  - Dropped -shortread patch, which has been already applied by upstream
  - Disable large file support, that is enabled by default since 1.9, 
    but not compatible with db files created using gdbm-1.8.3 and lower
  - License change to GPLv3+
  - Add doc files THANKS AUTHORS NOTE-WARNING
  - Changed text in NOTE-WARNING to correspond with build settings


author: Patsy Griffin <pfrankli@redhat.com> - 2.17-299
changelog:
  - Update glibc headers for Linux 4.0, 4.1 definitions and 
    Linux 4.2 netinet/in.h values. (#1579451)


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 1:6.0.0-13
changelog:
  - Explicitly added '-g' option into CFLAGS & CXXFLAGS to correctly build .debug_info for i386 (bug #1413034)
  - Added a workaround to correctly add hardening flags during build process (bug #1406689)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-13
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.24-1
changelog:
  - Addressed issue with DSA public keys smaller than 2^1024 (#1238279)
  - Addressed two-byte buffer overflow in the DTLS-0.9 protocol (#1209365)
  - When writing certificates to smart cards write the CKA_ISSUER and
    CKA_SERIAL_NUMBER fields to allow NSS reading them (#1272179)
  - Use the shared system certificate store (#1110750)
  - Address MD5 transcript collision attacks in TLS key exchange (#1289888, 
    CVE-2015-7575)
  - Allow hashing data over 2^32 bytes (#1306953)
  - Ensure written PKCS#11 public keys are not marked as private (#1339453)
  - Ensure secure_getenv() is called on all uses of environment variables
    (#1344591).
  - Fix issues related to PKCS #11 private key listing on certain HSMs
    (#1351389)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-7
changelog:
  - Address interoperability issue with 3.5.x (#1388932)
  - Reject CAs which are both trusted and blacklisted in trust module (#1375303)
  - Added new functions to set issuer and subject ID in certificates (#1378373)
  - Reject connections with less than 1024-bit DH parameters (#1335931)
  - Fix issue that made GnuTLS parse only the first 32 extensions (#1383748)
  - Mention limitations of certtool in manpage (#1375463)
  - Read PKCS#8 files with HMAC-SHA256 -as generated by openssl 1.1 (#1380642)
  - Do not link directly to trousers but instead use dlopen (#1379739)
  - Fix incorrect OCSP validation (#1377569)
  - Added support for pin-value in PKCS#11 URIs (#1379283)
  - Added the --id option to p11tool (#1399232)
  - Improved sanity checks in RSA key generation (#1444780)
  - Addressed CVE-2017-5334, CVE-2017-5335, CVE-2017-5336, CVE-2017-5337,
    CVE-2017-7869


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.26-9
changelog:
  - Address crash in OCSP status request extension, by eliminating the
    unneeded parsing (CVE-2017-7507, #1455828)


author: Anderson Sasaki <ansasaki@redhat.com> 3.3.29-8
changelog:
  - Backported --sni-hostname option which allows overriding the hostname
    advertised to the peer (#1444792)
  - Improved counter-measures in TLS CBC record padding for lucky13 attack
    (CVE-2018-10844, #1589704, CVE-2018-10845, #1589707)
  - Added counter-measures for "Just in Time" PRIME + PROBE cache-based attack
    (CVE-2018-10846, #1589708)
  - Address p11tool issue in object deletion in batch mode (#1375307)
  - Backport PKCS#11 tests from master branch. Some tests were disabled due to
    unsupported features in 3.3.x (--load-pubkey and --test-sign options, ECC key
    generation without login, and certificates do not inherit ID from the private
    key)
  - p11tool explicitly marks certificates and public keys as NOT private objects
    and private keys as private objects
  - Enlarge buffer size to support resumption with large keys (#1542461)
  - Legacy HMAC-SHA384 cipher suites were disabled by default
  - Added DSA key generation to p11tool (#1464896)
  - Address session renegotiation issue using client certificate (#1434091)
  - Address issue when importing private keys into Atos HSM (#1460125)


author: Jiri Kucera <jkucera@redhat.com> - 1.20.7-6
changelog:
  - Remove old scriptlets
    Enable PIE and RELRO
    ./autogen.sh runs too early
    Resolves: #1092527, #1095444


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.40-1
changelog:
  - require 'redhat-release' instead of /etc/system-release & conflict with older versions
  - ifup-post: always update 'nameserver' & 'search' entries in /etc/resolv.conf
  - systemd/system: symlinks for initscripts' services removed
  - *.old extension added to list of ignored files
  - ifup-eth: wait for STP to complete setup on bridge if $DELAY is not set
  - init.d/functions: convert2sec() function added
  - init.d/functions: is_true() & is_false() extended by ON/OFF support
  - usleep(1) calls replaced with sleep(1) calls
  - network-scripts: DBus calls forwarded to /dev/null
  - network-scripts: firewall-cmd replaced with DBus calls
  - ARPUDATE option introduced


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.41-1
changelog:
  - ifdown-post: fix logical error in commit 5d61564
  - network-functions: use POSIX forwarding instead of bash-ism


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.42-1
changelog:
  - rhel-autorelabel: set UEFI boot order (BootNext) same as BootCurrent
  - network-functions: use tr to upper case strings rather than awk
  - sysconfig/readonly-root: Clarify the usage of readonly-root
  - network-functions: add error messages for bonding installation
  - sysctl.conf.s390: drop SHMALL and SHMMAX
  - network.service: 'reload' removed
  - rhel-readonly.service: target name for random seed fixed
  - init.d/functions: fix sourcing for ksh


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.49.45-1
changelog:
  - network: parsing of /proc/mounts returned (bug #1572659)
  - netconsole: LSB header added (bug #1508489)
  - ifdown-eth: no longer needed 'pidof -x dhclient' condition removed (bug #1559384)


author: Jan Macku <jamacku@redhat.com> - 9.49.48-1
changelog:
  - network: don't fail with IFDOWN_ON_SHUTDOWN (bug #1693977)
  - Configure autorelabel service to output to journal and to console if set (bug #1634661)
  - Fix changelog typo


author: Jan Macku <jamacku@redhat.com> - 9.49.49-1
changelog:
  - ifup-eth: Check that device name is set (bug #1741830)
  - Add option for IPv6 GRE tunnel (bug #1691552)


author: Boris Ranto <branto@redhat.com> - 0:1.8.15-7
changelog:
  - New release (0:1.8.15-7)
  - ID:437 - sel: Fix "sel time set <time>"
  - ID 408 - fix sel list last X listing


author: Josef Ridky <jridky@redhat.com> - 0:1.8.18-3
changelog:
  - Fix issues with warning: dereferencing type-punned pointer 
    will break strict-aliasing rules from RPMDiff


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.10.1.el7]
changelog:
  - [net] netfilter: masquerade: don't flush all conntracks if only one address deleted on device (Patrick Talbert) [1779564 1771396]
  - [net] netfilter: conntrack: resched in nf_ct_iterate_cleanup (Patrick Talbert) [1779564 1771396]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.11.1.el7]
changelog:
  - [tty] TTY: serial_core, add ->install (Kenneth Yin) [1780163 1443152]
  - [net] gro: fix use-after-free read in napi_gro_frags() (Paolo Abeni) [1780033 1750810]
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Stanislaw Gruszka) [1778631 1778632]
  - [fs] userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx (Alex Gladkov) [1777351 1749766]
  - [fs] gfs2: Use async glocks for rename (Robert S Peterson) [1777297 1677686]
  - [fs] gfs2: create function gfs2_glock_update_hold_time (Robert S Peterson) [1777297 1677686]
  - [fs] gfs2: separate holder for rgrps in gfs2_rename (Robert S Peterson) [1777297 1677686]
  - [wireless] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (Stanislaw Gruszka) [1776615 1776616]
  - [x86] cpuidle-haltpoll: vcpu hotplug support (Marcelo Tosatti) [1776289 1771849]
  - [cpuidle] cpuidle-haltpoll: return -ENODEV on modinit failure (Marcelo Tosatti) [1776289 1756843]
  - [wireless] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (Stanislaw Gruszka) [1776205 1776206]
  - [wireless] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (Stanislaw Gruszka) [1776156 1776157] {CVE-2019-14901}
  - [fs] vfs: Fix EOVERFLOW testing in put_compat_statfs64 (Eric Sandeen) [1775678 1758001]
  - [x86] x86/atomic: Fix smp_mb__{before,after}_atomic() (Prarit Bhargava) [1772812 1769569]
  - [mm] mm-vmstat-reduce-zone-lock-holding-time-by-proc-pagetypeinfo-fix (Waiman Long) [1770732 1757943]
  - [mm] mm, vmstat: reduce zone->lock holding time by /proc/pagetypeinfo (Waiman Long) [1770732 1757943]
  - [mm] mm, vmstat: hide /proc/pagetypeinfo from normal users (Waiman Long) [1770732 1757943]
  - [md] dm rq: fix handling underlying queue busy (Ming Lei) [1770113 1767482]
  - [pci] hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers (Mohammed Gamal) [1766097 1634251]
  - [pci] hv: Detect and fix Hyper-V PCI domain number collision (Mohammed Gamal) [1766097 1634251]
  - [pci] hv: Serialize the present and eject work items (Mohammed Gamal) [1766097 1634251]
  - [netdrv] hv_netvsc: fix network namespace issues with VF support (Mohammed Gamal) [1766093 1741334]
  - [netdrv] hv_netvsc: move VF to same namespace as netvsc device (Mohammed Gamal) [1766093 1741334]
  - [netdrv] hv_netvsc: set master device (Mohammed Gamal) [1766093 1741334]
  - [pci] PCI: hv: Avoid use of hv_pci_dev->pci_slot after freeing it (Mohammed Gamal) [1766089 1737567]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.12.1.el7]
changelog:
  - [powerpc] powerpc/pseries: Remove confusing warning message (Gustavo Duarte) [1780148 1748306]
  - [powerpc] powerpc/pseries: Call H_BLOCK_REMOVE when supported (Gustavo Duarte) [1780148 1748306]
  - [powerpc] powerpc/pseries: Read TLB Block Invalidate Characteristics (Gustavo Duarte) [1780148 1748306]
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1776290 1750577]
  - [scsi] scsi: bnx2fc: remove set but not used variable 'fh' (Nilesh Javali) [1776290 1750577]
  - [fs] SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write (Leif Sahlberg) [1767621 1764567]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.14.1.el7]
changelog:
  - [s390] jump_label: replace stop_machine with smp_call_function (Hendrik Brueckner) [1787559 1720387]
  - [s390] kernel: avoid cpu yield in SMT environment (Philipp Rudo) [1787558 1777876]
  - [x86] mm: serialize against gup_fast in pmdp_splitting_flush() (Vitaly Kuznetsov) [1783177 1674266]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.15.1.el7]
changelog:
  - [tools] perf top: Fix global-buffer-overflow issue (Michael Petlan) [1793581 1757325]
  - [tools] perf top: Always sample time to satisfy needs of use of ordered queuing (Michael Petlan) [1793581 1757325]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.16.1.el7]
changelog:
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1796798 1794812]
  - [kernel] sched: Fix schedule_tail() to disable preemption (Phil Auld) [1796261 1771094]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.17.1.el7]
changelog:
  - [kvm] kvm: x86: always expose VIRT_SSBD to guests (Eduardo Habkost) [1797511 1744281]
  - [kvm] kvm: x86: fix reporting of AMD speculation bug CPUID leaf (Eduardo Habkost) [1797511 1744281]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-1062.18.1.el7]
changelog:
  - [x86] x86/boot/64: Round memory hole size up to next PMD page (Frank Ramsay) [1798163 1773762]
  - [x86] x86/boot/64: Make level2_kernel_pgt pages invalid outside kernel area (Frank Ramsay) [1798163 1773762]
  - [fs] gfs2: Use d_materialise_unique instead of d_splice_alias (2) (Andreas Grunbacher) [1796431 1784550]
  - [fs] gfs2: gfs2_create_inode(): don't bother with d_splice_alias() (Andreas Grunbacher) [1796431 1784550]
  - [fs] gfs2: bugger off early if O_CREAT open finds a directory (Andreas Grunbacher) [1796431 1784550]
  - [scsi] scsi: hpsa: remove printing internal cdb on tag collision (Joseph Szczypek) [1793579 1741355]
  - [scsi] scsi: hpsa: correct scsi command status issue after reset (Joseph Szczypek) [1793579 1741355]
  - [infiniband] IB/mlx5: Fix MR registration flow to use UMR properly (Alaa Hleihel) [1792371 1741343]
  - [scsi] qedf: Initialize rport while creation of vport (Nilesh Javali) [1791825 1760746]
  - [scsi] scsi: hpsa: add missing hunks in reset-patch (Joseph Szczypek) [1791782 1761978]
  - [block] block: don't change REQ_NR_BITS (Ming Lei) [1791781 1779712]
  - [scsi] scsi: qla2xxx: Fix panic in qla_dfs_tgt_counters_show (Himanshu Madhani) [1791595 1729270]
  - [drm] drm/radeon: fix si_enable_smc_cac() failed issue (Dave Airlie) [1789744 1780026]
  - [scsi] scsi: bnx2fc: timeout calculation invalid for bnx2fc_eh_abort() (Nilesh Javali) [1784824 1772966]
  - [md] md/raid10: prevent access of uninitialized resync_pages offset (Nigel Croxon) [1781584 1767935]
  - [fs] fix inode leaks on d_splice_alias() failure exits (Miklos Szeredi) [1781159 1749390]
  - [fs] cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active (David Howells) [1780149 1765975]
  - [mm] mm: swap: clean up swap readahead (Rafael Aquini) [1780035 1725396]
  - [mm] mm: do_swap_page: clean up parameter list passing a pointer to struct vm_fault (Rafael Aquini) [1780035 1725396]
  - [mm] mm: __handle_mm_fault: introduce explicit barrier after orig_pte dereference (Rafael Aquini) [1780035 1725396]
  - [x86] kvm: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it (Paolo Bonzini) [1779766 1779768]
  - [x86] kvm: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: Mark expected switch fall-throughs (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: implement MSR_IA32_TSX_CTRL effect on CPUID (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: do not modify masked bits of shared MSRs (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm: x86: fix presentation of TSX feature in ARCH_CAPABILITIES (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [x86] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Paolo Bonzini) [1779766 1779768] {CVE-2019-19338}
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1778691 1765123]
  - [net] ipv6: Rewind hlist offset on interrupted /proc/net/if_inet6 read (Stefano Brivio) [1778084 1753480]
  - [net] revert "[net] ipv6: Display all addresses in output of /proc/net/if_inet6" (Stefano Brivio) [1778084 1753480]
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Josef Oskera) [1775235 1775236] {CVE-2019-17666}
  - [md] md: improve handling of bio with REQ_PREFLUSH in md_flush_request() (Xiao Ni) [1773482 1752061]
  - [fs] fscache: Don't use a constructor function on the slab allocator (David Howells) [1793086 1739996]
  - [mm] mm: fix insert_pfn regression (Jeff Moyer) [1793088 1739889]
  - [mm] mm/page_idle.c: fix oops because end_pfn is larger than max_pfn (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mlock.c: mlockall error for flag MCL_ONFAULT (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlb: use same fault hash key for shared and private mappings (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: on restore reserve error path retain subpool reservation (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory.c: fix modifying of page protection by insert_pfn() (Rafael Aquini) [1768386 1730471]
  - [mm] mm, swap: bounds check swap_info array accesses to avoid NULL derefs (Rafael Aquini) [1768386 1730471]
  - [mm] mm/slub.c: remove an unused addr argument (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: fix races and page leaks during migration (Rafael Aquini) [1768386 1730471]
  - [mm] mm, oom: fix use-after-free in oom_kill_process (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: convert spin_lock_irq to spin_lock_irqsave (Rafael Aquini) [1768386 1730471]
  - [mm] mm/swapfile.c: use kvzalloc for swap_info_struct allocation (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: fix kernel BUG at fs/hugetlbfs/inode.c:444! (Rafael Aquini) [1768386 1730471]
  - [mm] mm: Fix warning in insert_pfn() (Rafael Aquini) [1768386 1730471]
  - [mm] hugetlbfs: dirty pages as they are added to pagecache (Rafael Aquini) [1768386 1730471]
  - [mm] mm/swapfile.c: fix swap_count comment about nonexistent SWAP_HAS_CONT (Rafael Aquini) [1768386 1730471]
  - [mm] slab: __GFP_ZERO is incompatible with a constructor (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix the NULL mapping case in __isolate_lru_page() (Rafael Aquini) [1768386 1730471]
  - [mm] mm/filemap.c: fix NULL pointer in page_cache_tree_insert() (Rafael Aquini) [1768386 1730471]
  - [fs] block_invalidatepage(): only release page if the full page was invalidated (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mempolicy.c: avoid use uninitialized preferred_node (Rafael Aquini) [1768386 1730471]
  - [mm] mm: pin address_space before dereferencing it while isolating an LRU page (Rafael Aquini) [1768386 1730471]
  - [fs] fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: do not rely on preempt_count in print_vma_addr (Rafael Aquini) [1768386 1730471]
  - [mm] mm, swap: fix race between swap count continuation operations (Rafael Aquini) [1768386 1730471]
  - [mm] mm: meminit: mark init_reserved_page as __meminit (Rafael Aquini) [1768386 1730471]
  - [mm] mm/vmstat.c: fix wrong comment (Rafael Aquini) [1768386 1730471]
  - [mm] mm, hugetlb: do not allocate non-migrateable gigantic pages from movable zones (Rafael Aquini) [1768386 1730471]
  - [mm] mm: always flush VMA ranges affected by zap_page_range (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mremap: fail map duplication attempts for private mappings (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack (Rafael Aquini) [1768386 1730471]
  - [mm] mm: numa: avoid waiting on freed migrated pages (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory-failure.c: use compound_head() flags for huge pages (Rafael Aquini) [1768386 1730471]
  - [fs] fs/block_dev: always invalidate cleancache in invalidate_bdev() (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: remove unused chunk_alloc parameter from pcpu_get_pages() (Rafael Aquini) [1768386 1730471]
  - [mm] percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages (Rafael Aquini) [1768386 1730471]
  - [mm] mm: do not access page->mapping directly on page_endio (Rafael Aquini) [1768386 1730471]
  - [mm] mm/page_alloc: fix nodes for reclaim in fast path (Rafael Aquini) [1768386 1730471]
  - [mm] mm: alloc_contig_range: allow to specify GFP mask (Rafael Aquini) [1768386 1730471]
  - [mm] mm: vmscan: scan dirty pages even in laptop mode (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mempolicy.c: do not put mempolicy before using its nodemask (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix set pageblock migratetype in deferred struct page init (Rafael Aquini) [1768386 1730471]
  - [mm] mm: delete unnecessary and unsafe init_tlb_ubc() (Rafael Aquini) [1768386 1730471]
  - [kernel] mm, mempolicy: task->mempolicy must be NULL before dropping final reference (Rafael Aquini) [1768386 1730471]
  - [mm] mm: use phys_addr_t for reserve_bootmem_region() arguments (Rafael Aquini) [1768386 1730471]
  - [mm] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check (Rafael Aquini) [1768386 1730471]
  - [mm] mm: soft-offline: check return value in second __get_any_page() call (Rafael Aquini) [1768386 1730471]
  - [include] include/linux/memblock.h: fix ordering of 'flags' argument in comments (Rafael Aquini) [1768386 1730471]
  - [mm] rmap: fix theoretical race between do_wp_page and shrink_active_list (Rafael Aquini) [1768386 1730471]
  - [mm] mm/mremap.c: clean up goto just return ERR_PTR (Rafael Aquini) [1768386 1730471]
  - [mm] mremap should return -ENOMEM when __vm_enough_memory fail (Rafael Aquini) [1768386 1730471]
  - [mm] writeback: fix possible underflow in write bandwidth calculation (Rafael Aquini) [1768386 1730471]
  - [mm] writeback: add missing INITIAL_JIFFIES init in global_update_bandwidth() (Rafael Aquini) [1768386 1730471]
  - [mm] mm/memory.c: actually remap enough memory (Rafael Aquini) [1768386 1730471]
  - [mm] mm/compaction: fix wrong order check in compact_finished() (Rafael Aquini) [1768386 1730471]
  - [mm] mm, vmscan: prevent kswapd livelock due to pfmemalloc-throttled process being killed (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix anon_vma_clone() error treatment (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: fix collapsing of hugepages on madvise (Rafael Aquini) [1768386 1730471]
  - [mm] cgroup/kmemleak: add kmemleak_free() for cgroup deallocations (Rafael Aquini) [1768386 1730471]
  - [mm] OOM, PM: OOM killed task shouldn't escape PM suspend (Rafael Aquini) [1768386 1730471]
  - [mm] mm, compaction: pass gfp mask to compact_control (Rafael Aquini) [1768386 1730471]
  - [mm] mm: page_alloc: abort fair zone allocation policy when remotes nodes are encountered (Rafael Aquini) [1768386 1730471]
  - [mm] mm: vmscan: only update per-cpu thresholds for online CPU (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: replace smp_mb after atomic_add by smp_mb__after_atomic (Rafael Aquini) [1768386 1730471]
  - [mm] mm, thp: move invariant bug check out of loop in __split_huge_page_map (Rafael Aquini) [1768386 1730471]
  - [mm] thp: consolidate assert checks in __split_huge_page() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: fix sleeping function warning from __put_anon_vma (Rafael Aquini) [1768386 1730471]
  - [mm] mm: cleanup add_to_page_cache_locked() (Rafael Aquini) [1768386 1730471]
  - [mm] mm: mempolicy: turn vma_set_policy() into vma_dup_policy() (Rafael Aquini) [1768386 1730471]
  - [powerpc] powerpc/pseries: correctly track irq state in default idle (Steve Best) [1767620 1751970]
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705004 1705005] {CVE-2019-11487}
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705004 1705005] {CVE-2019-11487}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.5.1.el7]
changelog:
  - [netdrv] hv/netvsc: Fix NULL dereference at single queue mode fallback (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv/netvsc: fix handling of fallback to single queue mode (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Fix unwanted rx_table reset (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Fix tx_table init in rndis_set_subchannel() (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: fix typos in code comments (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Fix a deadlock by getting rtnl lock earlier in netvsc_probe() (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Fix hash key value reset after other ops (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Refactor assignments of struct netvsc_device_info (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: split sub-channel setup into async and sync (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Fix send_table offset in case of a host bug (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Add NetVSP v6 and v6.1 into version negotiation (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: Fix offset usage in netvsc_send_table() (Mohammed Gamal) [1817935 1806488]
  - [netdrv] hv_netvsc: simplify receive side calling arguments (Mohammed Gamal) [1817935 1806488]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.6.1.el7]
changelog:
  - [x86] x86/debug: Extend the lower bound of crash kernel low reservations (Pingfan Liu) [1817502 1811511]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.7.1.el7]
changelog:
  - [net] sched: flower: insert new filter to idr after setting its mask (Davide Caratti) [1824548 1785141]
  - [netdrv] r8169: fix network stalls due to missing bit TXCFG_AUTO_FIFO (Corinna Vinschen) [1822548 1787263]
  - [net] net_sched: remove a bogus warning in hfsc (Davide Caratti) [1821262 1781323]
  - [net] tcp: make tcp_space() aware of socket backlog (Guillaume Nault) [1817499 1790840]
  - [scsi] iscsi: Avoid potential deadlock in iscsi_if_rx func (Oleksandr Natalenko) [1817497 1715986]
  - [scsi] scsi: avoid repetitive logging of device offline messages (Nilesh Javali) [1815596 1798042]
  - [scsi] qla2xxx: Fix I/Os being passed down when FC device is being deleted (Nilesh Javali) [1815596 1798042]
  - [scsi] scsi: qla2xxx: Fix unbound sleep in fcport delete path (Nilesh Javali) [1815596 1798042]
  - [scsi] scsi: qla2xxx: Fix hang in fcport delete path (Nilesh Javali) [1815596 1798042]
  - [scsi] scsi: qla2xxx: Fix stuck session in GNL (Nilesh Javali) [1815596 1798042]
  - [scsi] scsi: qla2xxx: Correct fcport flags handling (Nilesh Javali) [1815596 1798042]
  - [scsi] scsi: qla2xxx: Remove defer flag to indicate immeadiate port loss (Nilesh Javali) [1815596 1798042]
  - [scsi] scsi: megaraid_sas: fixup MSIx interrupt setup during resume (Tomas Henzl) [1813249 1807077]
  - [md] dm mpath: call clear_request_fn_mpio() in multipath_release_clone() (Mike Snitzer) [1812937 1806400]
  - [scsi] scsi: implement .cleanup_rq callback (Mike Snitzer) [1812937 1806400]
  - [md] blk-mq: add callback of .cleanup_rq (Mike Snitzer) [1812937 1806400]
  - [md] dm rq: fix checking of dm_dispatch_clone_request's return value (Ming Lei) [1814537 1805401]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.9.1.el7]
changelog:
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827239 1827240] {CVE-2020-10711}
  - [scsi] scsi: qla2xxx: Fix a NULL pointer dereference in an error path (Nilesh Javali) [1832221 1808129]
  - [scsi] scsi: qla2xxx: Use common routine to free fcport struct (Nilesh Javali) [1832221 1808129]
  - [block] blk-mq: fix hang caused by freeze/unfreeze sequence (Ming Lei) [1824546 1821718]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.10.1.el7]
changelog:
  - [fs] revert "[fs] xfs: catch bad stripe alignment configurations" (Carlos Maiolino) [1839697 1836292]
  - [netdrv] hv_netvsc: Fix error handling in netvsc_set_features() (Mohammed Gamal) [1838600 1821814]
  - [netdrv] hv_netvsc: Sync offloading features to VF NIC (Mohammed Gamal) [1838600 1821814]
  - [netdrv] hv_netvsc: Fix IP header checksum for coalesced packets (Mohammed Gamal) [1838600 1821814]
  - [netdrv] hv_netvsc: Fix rndis_per_packet_info internal field initialization (Mohammed Gamal) [1838600 1821814]
  - [netdrv] hv_netvsc: Add handler for LRO setting change (Mohammed Gamal) [1838600 1821814]
  - [netdrv] hv_netvsc: Add support for LRO/RSC in the vSwitch (Mohammed Gamal) [1838600 1821814]
  - [netdrv] hv_netvsc: Add handlers for ethtool get/set msg level (Mohammed Gamal) [1838600 1821814]
  - [netdrv] hv_netvsc: Fix the variable sizes in ipsecv2 and rsc offload (Mohammed Gamal) [1838600 1821814]
  - [lib] kobject: don't use WARN for registration failures (Ewan Milne) [1836890 1756495]
  - [lib] lib/kobject: Join string literals back (Ewan Milne) [1836890 1756495]
  - [scsi] Fix abort timeouts in CQ Full conditions (Dick Kennedy) [1835675 1802654]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.11.1.el7]
changelog:
  - [fs] cachefiles: Fix race between read_waiter and read_copier involving op->to_do (Dave Wysochanski) [1839757 1829662]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.12.1.el7]
changelog:
  - [x86] x86/speculation: Prevent deadlock on ssb_state::lock (Waiman Long) [1841121 1836322]
  - [vfio] vfio-pci: Invalidate mmaps and block MMIO access on disabled memory (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio-pci: Fault mmaps to enable vma tracking (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Support faulting PFNMAP vmas (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio/pci: call irq_bypass_unregister_producer() before freeing irq (Alex Williamson) [1837297 1820632] {CVE-2020-12888}
  - [vfio] vfio_pci: Enable memory accesses before calling pci_map_rom (Alex Williamson) [1837297 1820632] {CVE-2020-12888}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.13.1.el7]
changelog:
  - [x86] x86/speculation: Support old struct x86_cpu_id & x86_match_cpu() kABI (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [cpufreq] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827187 1827188] {CVE-2020-0543}
  - [x86] x86/cpufeature: Fix various quality problems in the <asm/cpu_device_hd.h> header (Waiman Long) [1827187 1827188] {CVE-2020-0543}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.1.1.el7]
changelog:
  - [net] openvswitch: support asymmetric conntrack (Aaron Conole) [1806447 1757759]
  - [kernel] audit: CONFIG_CHANGE don't log internal bookkeeping as an event (Richard Guy Briggs) [1806430 1777239]
  - [kernel] tracing: Fix possible double free on failure of allocating trace buffer (Jerome Marchand) [1803010 1803011] {CVE-2017-18595}
  - [kernel] tracing: Fix crash when it fails to alloc ring buffer (Jerome Marchand) [1803010 1803011] {CVE-2017-18595}
  - [base] of: to support binding numa node to specified device in devicetree (Jeff Moyer) [1801699 1791883]
  - [ptp] ptp: free ptp device pin descriptors properly (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: fix the race between the release of ptp_clock and cdev (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: Fix pass zero to ERR_PTR() in ptp_clock_register (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: create "pins" together with the rest of attributes (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: use is_visible method to hide unused attributes (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: use kcalloc when allocating arrays (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: do not explicitly set drvdata in ptp_clock_register() (Vladis Dronov) [1798396 1774657]
  - [ptp] drivers/ptp: Fix kernel memory disclosure (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: Fix resource leak in case of error (Vladis Dronov) [1798396 1774657]
  - [netdrv] ptp: drivers: set the number of programmable pins (Vladis Dronov) [1798396 1774657]
  - [ptp] ptp: expose the programmable pins via sysfs (Vladis Dronov) [1798396 1774657]
  - [documentation] ptp: add the pin GET/SETFUNC ioctls to the testptp program (Vladis Dronov) [1798396 1774657]
  - [documentation] ptp: Allow selecting trigger/event index in testptp (Vladis Dronov) [1798396 1774657]
  - [documentation] ptp: add the PTP_SYS_OFFSET ioctl to the testptp program (Vladis Dronov) [1798396 1774657]
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1796799 1794812]
  - [kernel] sched: Fix schedule_tail() to disable preemption (Phil Auld) [1796262 1771094]


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.3.1.el7]
changelog:
  - [md] md/raid6: Set R5_ReadError when there is read failure on parity disk (Xiao Ni) [1810062 1804569]
  - [kernel] blktrace: fix dereference after null check (Ming Lei) [1806367 1798318] {CVE-2019-19768}
  - [kernel] blktrace: Protect q->blk_trace with RCU (Ming Lei) [1806367 1798318] {CVE-2019-19768}
  - [kernel] blktrace: fix trace mutex deadlock (Ming Lei) [1806367 1798318] {CVE-2019-19768}
  - [kernel] blktrace: fix unlocked registration of tracepoints (Ming Lei) [1806367 1798318] {CVE-2019-19768}
  - [kernel] blktrace: fix unlocked access to init/start-stop/teardown (Ming Lei) [1806367 1798318] {CVE-2019-19768}


author: Augusto Caringi <acaringi@redhat.com> [3.10.0-1127.4.1.el7]
changelog:
  - [x86] kvm: x86: do not reset microcode version on INIT or RESET (Paolo Bonzini) [1814003 1801852]
  - [x86] kvm: x86: list MSR_IA32_UCODE_REV as an emulated MSR (Paolo Bonzini) [1814003 1801852]
  - [x86] kvm: x86: Allow userspace to define the microcode version (Paolo Bonzini) [1814003 1801852]


author: David Howells <dhowells@redhat.com>
changelog:
  - Adjust the manual page for 'keyctl unlink' to show keyring is optional.
  - Add --version support for the keyutils version and build date.


author: David Howells <dhowells@redhat.com> - 1.5.4-1
changelog:
  - Fix the keyctl padd command and similar to handle binary input.
  - Make keyctl show able to take a keyring to dump.
  - Make keyctl show able to take a flag to request hex key IDs.
  - Make keyctl show print the real ID of the root keyring.


author: David Howells <dhowells@redhat.com> - 1.5.6-1
changelog:
  - Fix the request-key.conf.5 manpage.
  - Fix the max depth of key tree dump (keyctl show) [BZ 1002761].
  - The input buffer size for keyctl padd and pinstantiate should be larger [BZ 1002761].
  - Add keyctl_invalidate.3 manpage [BZ 1002761].


author: David Howells <dhowells@redhat.com> - 1.5.7-1
changelog:
  - Provide a utility function to find a key by type and name.
  - Allow keyctl commands to take a type+name arg instead of a key-id arg.
  - Add per-UID get_persistent keyring function [BZ 1014739].


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-20
changelog:
  - weak-modules: use function to generate weak_updates_dir
  - weak-modules: implement dry-run on the tempdir
    Resolves: rhbz#1510058


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-23
changelog:
  - weak-modules: fix initial state creation for dry-run
  - weak-modules: check compatibility in a temporary directory
    Resolves: rhbz#1619889.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-26
changelog:
  - weak-modules: handle independent modules in one run
  - weak-modules: use asterisk for kernel version in sandbox
    Resolves: rhbz#1695547


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 20-28
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1774925


author: Robbie Harwood <rharwood@redhat.com> - 1.15.1-32
changelog:
  - Include preauth name in trace output if possible
  - Update cert generation scripts to work on modern openssl
  - Fix per-request preauth scoping
  - Add test case for PKINIT DH renegotiation
  - Echo KDC cookies in preauth tryagain
  - Fall back to other preauth mechanisms after failures
  - Resolves: #1540130


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.109-8
changelog:
  - Change the source location to the new upstream on fedorahosted
  - import a new tarball from the new source


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.109-10
changelog:
  - Un-revert the RHEL-specific changes. (Jeff Moyer)
  - Make devel sub-package depend on specific ver-rel (Jeff Moyer)
  - Resolves: bz#905462


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.109-12.2
changelog:
  - Get rid of sparc support (we don't build it) (Jeff Moyer)
  - Implement proper support for aarch64 (Jeff Moyer)
  - Resolves: bz#1026429


author: Matej Mužila <mmuzila@redhat.com> - 5.3.21-23
changelog:
  - Mention in man page that care should be taken when running db_hotbackup
    with -c option. Resolves: rhbz#1460077


author: Steve Dickson <steved@redhat.com> 2.0.14-1
changelog:
  - Updated to latest stable upstream version: 2.0.14-stable (bz 727129)
  - Removed the installion of the outdate man pages and the latex raw docs.
  - Corrected where the other doc are installed.


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
  - Updated to latest stable upstream version: 2.0.18-stable
  - Moved documentation into its own rpm (bz 810138)


author: Lukas Nykryn <lnykryn@redhat.com> - 219-72
changelog:
  - service: introduce protocol error type (#1733998)
  - service: fix main processes exit behavior for type notify services (#1733998)
  - service: go through stop_post on failure (#4770) (#1733998)
  - Call getgroups() to know size of supplementary groups array to allocate (#1743230256 KB)
  - udev: introduce CONST key name (#1748051)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.2
changelog:
  - core: when restarting services, don't close fds (#1803802)
  - unit: rework a bit how we keep the service fdstore from being destroyed during service restart (#1803802)
  - tests: add basic journal test (#1803802)
  - tests: add regression test for `systemctl restart systemd-journald` (#1803802)
  - tests: add test that journald keeps fds over termination by signal (#1803802)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.4
changelog:
  - mount: don't propagate errors from mount_setup_unit() further up (#1809159)
  - mount: when allocating a Mount object based on /proc/self/mountinfo mark it so (#1809159)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.5
changelog:
  - core: enforce a ratelimiter when stopping units due to StopWhenUnneeded=1 (#1810576)
  - core: rework StopWhenUnneeded= logic (#1810576)
  - fix the fix for #1691511 (#1809159)


author: systemd maintenance team <systemd-maint@redhat.com> - 219-73.6
changelog:
  - sd-bus: when attached to an sd-event loop, disconnect on processing errors (#1817504)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1820073)
  - sd-journal: remove the dead code and actually fix #14695 (#1820073)
  - swap: adjust swap.c in a similar way to what we just did to mount.c (#1821261)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1821261)


author: Rex Dieter <rdieter@fedoraproject.org> - 1.0-2
changelog:
  - %files: track lib soname (so bumps aren't a surprise)
  - tighten subpkg deps (%_isa)
  - %build: --disable-static


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-10
changelog:
  - Add missing av_permission values (#1025931)
  - Set an appropriate errno in booleans.c (#1402140)
  - Change matchpathcon usage to match with matchpathcon manpage (#1412797)


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-8
changelog:
  - Save linked policy, skip re-link when possible
  - Replace access(,F_OK) checks to make setuid programs work (#1186431)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-9
changelog:
  - Update semanage to allow runtime labeling of Infiniband Pkeys (#1466274)
  - Update semanage to allow runtime labeling of ibendports (#1466274)
  - Keep copy of file_contexts.homedirs in policy store (#1409813)
  - Add support for listing fcontext.homedirs file (#1409813)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-12
changelog:
  - Do not change file mode of seusers and users_extra (#1512639)
  - Improve warning for installing disabled module (#1337199)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-14
changelog:
  - Include user name in ROLE_REMOVE audit events (#1622045)
  - Improve "reset umask before creating directories"


author: Petr Lautrbach <plautrba@redhat.com> - 2.5-3
changelog:
  - Correctly detect unknown classes in sepol_string_to_security_class
  - Sort object files for deterministic linking order
  - Fix neverallowxperm checking on attributes
  - Remove libsepol.map when cleaning
  - Add high-level language line marking support to CIL
  - Change logic of bounds checking to match change in kernel
  - Fix multiple spelling errors
  - Only apply bounds checking to source types in rules
  - Fix CIL and not add an attribute as a type in the attr_type_map
  - Build policy on systems not supporting DCCP protocol
  - Fix extended permissions neverallow checking
  - Fix CIL neverallow and bounds checking
  - Android.mk: Add -D_GNU_SOURCE to common_cflags


author: Petr Lautrbach <plautrba@redhat.com> 2.5-5
changelog:
  - Warn instead of fail if permission is not resolved
  - Ignore object_r when adding userrole mappings to policydb


author: Petr Lautrbach <plautrba@redhat.com> 2.5-6
changelog:
  - Fix memory leak in expand.c
  - Fix invalid read when policy file is corrupt
  - Fix possible use of uninitialized variables


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-7
changelog:
  - Define cgroup_seclabel policy capability (rhbz#1493517)
  - Fix unitialized jmp and invalid dereference


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-8.1
changelog:
  - Define nnp_nosuid_transition policy capability (rhbz#1480519)
  - use IN6ADDR_ANY_INIT to initialize IPv6 addresses
  - Allow runtime labeling of ibendports (rhbz#1464489)
  - Allow runtime labeling of Infiniband Pkeys (rhbz#1464489)
  - Add IB end port handling to CIL (rhbz#1464489)
  - Add ibendport ocontext handling (rhbz#1464489)
  - Add support for ibendportcon labels (rhbz#1464489)
  - Add Infiniband Pkey handling to CIL (rhbz#1464489)
  - Add ibpkey ocontext handling (rhbz#1464489)
  - Add support for ibpkeycon labels (rhbz#1464489)
  - Remove unused attribute on a used argument from avrule_read() (rhbz#1464489)
  - Add binary module support for xperms
  - Add support for converting extended permissions to CIL


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-9
changelog:
  - curl consumes too much memory during scp download (#1080459)
  - prevent a not-connected agent from closing STDIN (#1147717)


author: Kamil Dudka <kdudka@redhat.com> 1.4.3-12
changelog:
  - session: avoid printing misleading debug messages (#1503294)
  - scp: send valid commands for remote execution (#1489733)


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-2
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix out-of-bounds memory comparison with specially crafted message channel request (CVE-2019-3862)
  - fix out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)
  - fix zero-byte allocation in SFTP packet processing resulting in out-of-bounds read (CVE-2019-3858)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.2-14
changelog:
  - allow root to copy files into NFS in libtoolize (#740079)
  - pre-filter sed's input by dd (#636045)


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6
changelog:
  - Fix missing entities after CVE-2014-3660 fix
  - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195650)
  - Fix regressions introduced by CVE-2014-0191 patch


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-6.2
changelog:
  - Fix a series of CVEs (rhbz#1286496)
  - CVE-2015-7941 Stop parsing on entities boundaries errors
  - CVE-2015-7941 Cleanup conditional section error handling
  - CVE-2015-8317 Fail parsing early on if encoding conversion failed
  - CVE-2015-7942 Another variation of overflow in Conditional sections
  - CVE-2015-7942 Fix an error in previous Conditional section patch
  - Fix parsing short unclosed comment uninitialized access
  - CVE-2015-7498 Avoid processing entities after encoding conversion failures
  - CVE-2015-7497 Avoid an heap buffer overflow in xmlDictComputeFastQKey
  - CVE-2015-5312 Another entity expansion issue
  - CVE-2015-7499 Add xmlHaltParser() to stop the parser
  - CVE-2015-7499 Detect incoherency on GROW
  - CVE-2015-7500 Fix memory access error due to incorrect entities boundaries
  - CVE-2015-8242 Buffer overead with HTML parser in push mode
  - CVE-2015-1819 Enforce the reader to run in constant memory


author: Daniel Veillard <veillard@redhat.com> - libxml2-2.9.1-6.3
changelog:
  - Heap-based buffer overread in xmlNextChar (CVE-2016-1762)
  - Bug 763071: Heap-buffer-overflow in xmlStrncat <https://bugzilla.gnome.org/show_bug.cgi?id=763071> (CVE-2016-1834)
  - Bug 757711: Heap-buffer-overflow in xmlFAParsePosCharGroup <https://bugzilla.gnome.org/show_bug.cgi?id=757711> (CVE-2016-1840)
  - Bug 758588: Heap-based buffer overread in xmlParserPrintFileContextInternal <https://bugzilla.gnome.org/show_bug.cgi?id=758588> (CVE-2016-1838)
  - Bug 758605: Heap-based buffer overread in xmlDictAddString <https://bugzilla.gnome.org/show_bug.cgi?id=758605> (CVE-2016-1839)
  - Bug 759398: Heap use-after-free in xmlDictComputeFastKey <https://bugzilla.gnome.org/show_bug.cgi?id=759398> (CVE-2016-1836)
  - Fix inappropriate fetch of entities content (CVE-2016-4449)
  - Heap use-after-free in htmlParsePubidLiteral and htmlParseSystemiteral (CVE-2016-1837)
  - Heap use-after-free in xmlSAX2AttributeNs (CVE-2016-1835)
  - Heap-based buffer-underreads due to xmlParseName (CVE-2016-4447)
  - Heap-based buffer overread in htmlCurrentChar (CVE-2016-1833)
  - Add missing increments of recursion depth counter to XML parser. (CVE-2016-3705)
  - Avoid building recursive entities (CVE-2016-3627)
  - Fix some format string warnings with possible format string vulnerability (CVE-2016-4448)
  - More format string warnings with possible format string vulnerability (CVE-2016-4448)


author: David King <dking@redhat.com> - 2.9.1-6.4
changelog:
  - Fix CVE-2015-8035 (#1595697)
  - Fix CVE-2018-14404 (#1602817)
  - Fix CVE-2017-15412 (#1729857)
  - Fix CVE-2016-5131 (#1714050)
  - Fix CVE-2017-18258 (#1579211)
  - Fix CVE-2018-1456 (#1622715)


author: Martin Sehnoutka <msehnout@redhat.com> - 3.4.0-0.20160601gitf9185e5.1
changelog:
  - New upstream release
  - Drop patches that are already present in upstream
  - Apply upstream fix for systemd paths
  - Resolves: #1297795


author: Ondřej Lysoněk <olysonek@redhat.com> - 3.4.0-6.20160601gitf9185e5
changelog:
  - Fix License field capitalization
  - Resolves: rhbz#1577175
  - Add detection of AMD Ryzen w/ Vega graphics
  - Resolves: rhbz#1569542
  - Fix issues found by Coverity Scan
  - Resolves: rhbz#1578007


author: pjp <pjp@fedoraproject.org> - r128-1
changelog:
  - lz4cli sparse file support
  - Restored lz4hc compression ratio
  - lz4 cli supports long commands
  - Introduced lz4-static sub package BZ#1208203


author: pjp <pjp@fedoraproject.org> - r129-1
changelog:
  - New LZ4_compress_fast() API.
  - New LZ4 CLI improved performance with multiple files.
  - Other bug fix and documentation updates.


author: pjp <pjp@fedoraproject.org> - r130-1
changelog:
  - Fixed: incompatibility sparse mode vs console.
  - Fixed: LZ4IO exits too early when frame crc not present.
  - Fixed: incompatibility sparse mode vs append mode.
  - Performance fix: big compression speed boost for clang(+30%).


author: pjp <pjp@fedoraproject.org> - r131-1
changelog:
  - New: Dos/DJGPP target #114.
  - Added: Example using lz4frame library #118.
  - Changed: liblz4.a no longer compiled with -fPIC by default.


author: Michal Schorm <mschorm@redhat.com> - 5.5.52-2
changelog:
  - Extension of mariadb-prepare-db-dir script
  - Resolves: #1356897

  - Rebase to 5.5.52, that also include fix for CVE-2016-6662
    Resolves: #1377974


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-1
changelog:
  - Rebase to 5.5.56
    That release also fixes the following security issues:
    CVE-2016-5617/CVE-2016-6664 CVE-2017-3312 CVE-2017-3238 CVE-2017-3243
    CVE-2017-3244 CVE-2017-3258 CVE-2017-3313 CVE-2017-3317 CVE-2017-3318
    CVE-2017-3291 CVE-2017-3302 CVE-2016-5483/CVE-2017-3600 CVE-2017-3308
    CVE-2017-3309 CVE-2017-3453 CVE-2017-3456 CVE-2017-3464
    Resolves: #1458933
    New deps required by upstream: checkpolicy and policycoreutils-python
    License text removed by upstream: COPYING.LESSER
    Do not ignore test-suite failure
    Downstream script mariadb-prepare-db-dir fixed for CVE-2017-3265
    Resolves: #1458940


author: Honza Horak <hhorak@redhat.com> - 1:5.5.56-2
changelog:
  - Do not fix context and change owner if run by root in mariadb-prepare-db-dir
    Related: #1458940
  - Check properly that datadir includes only expected files
    Related: #1356897


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.60-1
changelog:
  - Rebase to 5.5.60
  - CVE's fixed: #1558256, #1558260, #1559060
    CVE-2017-3636 CVE-2017-3641 CVE-2017-3653 CVE-2017-10379
    CVE-2017-10384 CVE-2017-10378 CVE-2017-10268 CVE-2018-2562
    CVE-2018-2622 CVE-2018-2640 CVE-2018-2665 CVE-2018-2668
    CVE-2018-2755 CVE-2018-2819 CVE-2018-2817 CVE-2018-2761
    CVE-2018-2781 CVE-2018-2771 CVE-2018-2813
  - Resolves: #1535217, #1491833, #1511982, #1145455, #1461692


author: Michal Schorm <mschorm@redhat.com> - 1:5.5.64-1
changelog:
  - Rebase to 5.5.64
  - Resolves: #1490398
  - CVE's fixed: #1610986
    CVE-2018-3058 CVE-2018-3063 CVE-2018-3066 CVE-2018-3081
  - CVE's fixed: #1664043
    CVE-2018-3282 CVE-2019-2503
  - CVE's fixed: #1701686
    CVE-2019-2529


author: Honza Horak <hhorak@redhat.com> - 1:5.5.65-1
changelog:
  - Rebase to 5.5.65
    Also fixes:
    CVE-2019-2737 CVE-2019-2739 CVE-2019-2740 CVE-2019-2805
    Resolves: #1741357
  - Revert upstream changes that make the mysql_install_db relocatable
    because it broke mysql_install_db when run without --rpm arg
    Resolves: #1731062
  - Add openssl BR that was missing for the tests


author: Honza Horak <hhorak@redhat.com> - 5.2.5-1
changelog:
  - Update to 5.2.5
  - Enlarge buffer size for query string when getting info about tables
    Related: #948619


author: Marcin Juszkiewicz <mjuszkiewicz redhat com> - 5.2.5-4
changelog:
  - Build failed because whether to use lib64 or not is done by checking
    list of known 64-bit architectures. So added AArch64 to that list.
    Resolves: #1041348


author: Miroslav Lichvar <mlichvar@redhat.com> 5.9-8.20130126
changelog:
  - update to 20130126
  - clear scrollback buffer in clear (#815790)
  - make -base and -term subpackages noarch
  - make some dependencies arch-specific


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-39
changelog:
  - adjust logging of statfs (#1314610)
  - link libnetsnmptrapd against MYSQL LIBS (#1468084)
  - expand SNMPCONFPATH (#1514501)
  - remove date in mailheader (#1585940)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-44
changelog:
  - add support for glusterfs (#1316386)
  - change services to start after network-online.target (#1388118)
  - fix interface fadeout configuration (#1547355)
  - fix scanf pattern for ICMP stats (#1693547)
  - change buffer size in pass_common.c file (#1695363 and #1731357)
  - remove initial whitespace reading from scanf pattern of /sys/dev/block/../stat file (#1700494)
  - fix for CVE-2018-18066 (#1638911)
  - add Counter64 support for UCD-SNMP-MIB (#1703752)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.18.20131004git
changelog:
  - Resolves: #1063913 - netstat doesn't list sctp servers in -A mode
  - Resolves: #1257549 - netstat tool does not throw correct exit code on wrong parameter
  - Resolves: #1392910 - ifconfig inaccurately rounds exabytes


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.25.20131004git
changelog:
  - Resolves: #1632905 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-5
changelog:
  - Fixed SHA-3 implementation to conform to final standard (#1252936)
  - Fixed CVE-2015-8803 CVE-2015-8804 CVE-2015-8805 which caused issues
    in secp256r1 and secp384r1 calculations (#1314374)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> - 2.7.1-8
changelog:
  - Use a cache-silent version of mpz_powm to prevent cache-timing
    attacks against RSA and DSA in shared VMs. (#1364897,CVE-2016-6489)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
  - Restore s390x related patch as it hasn't been applied upstream yet
  - Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.43.0-7
changelog:
  - Don't override date in man-pages
  - Revert the change to use XDG basedirs (mozilla#818686)
  - Enable SSL2 compatible ClientHello by default
  - Disable SSL3 and RC4 by default


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-1
changelog:
  - Rebase to NSS 3.44
  - Restore fix-min-library-version-in-SSLVersionRange.patch to keep
    SSL3 supported in the code level while it is disabled by policy
  - Skip TLS 1.3 tests under FIPS mode


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-2
changelog:
  - Skip sysinit gtests properly
  - Fix shell syntax error in tests/ssl/ssl.sh
  - Regenerate manual pages


author: Daiki Ueno <dueno@redhat.com> - 3.44.0-3
changelog:
  - Disable TLS 1.3 under FIPS mode
  - Disable RSASSA-PKCS1-v1_5 in TLS 1.3
  - Fix post-handshake auth transcript calculation if
    SSL_ENABLE_SESSION_TICKETS is set


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-6
changelog:
  - back out out-of-bounds patch (patch for nss-softokn).
  - Fix segfault on empty or malformed ecdh keys (#1777712)


author: Bob Relyea <rrelyea@redhat.com> - 3.44.0-7
changelog:
  - Increase timeout on ssl_gtest so that slow platforms can complete when
     running on a busy system.


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-20
changelog:
  - validate lengths of values in extension fields (CVE-2014-9297)
  - drop packets with spoofed source address ::1 (CVE-2014-9298)
  - reject packets without MAC when authentication is enabled (CVE-2015-1798)
  - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
  - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)
  - add option to set Differentiated Services Code Point (DSCP) (#1202828)
  - add nanosecond support to SHM refclock (#1117702)
  - allow creating all SHM segments with owner-only access (#1122012)
  - allow different thresholds for forward and backward step (#1193154)
  - allow symmetric keys up to 32 bytes again (#1191111)
  - don't step clock for leap second with -x option (#1191122)
  - don't drop packets with source port below 123 (#1171640)
  - retry joining multicast groups (#1207014)
  - increase memlock limit again (#1053569)
  - warn when monitor can't be disabled due to limited restrict (#1191108)
  - use larger RSA exponent in ntp-keygen (#1191116)
  - fix crash in ntpq mreadvar command (#1180721)
  - move sntp kod database to allow SELinux labeling (#1082934)
  - fix typos in ntpd man page (#1195211)
  - improve documentation of restrict command (#1213953)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-22
changelog:
  - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
  - allow only one step larger than panic threshold with -g (CVE-2015-5300)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-24
changelog:
  - fix crash with invalid logconfig command (CVE-2015-5194)
  - fix crash when referencing disabled statistic type (CVE-2015-5195)
  - don't hang in sntp with crafted reply (CVE-2015-5219)
  - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
    CVE-2015-7702)
  - fix memory leak with autokey (CVE-2015-7701)
  - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
  - don't crash in ntpq with crafted packet (CVE-2015-7852)
  - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
  - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
  - don't allow spoofed packets to demobilize associations (CVE-2015-7979,
    CVE-2016-1547)
  - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
  - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)
  - fix resetting of leap status (#1242553)
  - extend rawstats log (#1242877)
  - report clock state changes related to leap seconds (#1242935)
  - allow -4/-6 on restrict lines with mask (#1304492)
  - explain synchronised state in ntpstat man page (#1309594)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-25
changelog:
  - don't allow spoofed packet to enable symmetric interleaved mode
    (CVE-2016-1548)
  - check mode of new source in config command (CVE-2016-2518)
  - make MAC check resilient against timing attack (CVE-2016-1550)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-26
changelog:
  - don't limit rate of packets from sources (CVE-2016-7426)
  - don't change interface from received packets (CVE-2016-7429)
  - fix calculation of root distance again (CVE-2016-7433)
  - require authentication for trap commands (CVE-2016-9310)
  - fix crash when reporting peer event to trappers (CVE-2016-9311)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-28
changelog:
  - fix buffer overflow in datum refclock driver (CVE-2017-6462)
  - fix crash with invalid unpeer command (CVE-2017-6463)
  - fix potential crash with invalid server command (CVE-2017-6464)
  - add Spectracom TSYNC driver (#1491797)
  - fix initialization of system clock status (#1493452)
  - fix typos in ntpd man page (#1420453)
  - use SHA1 request key by default (#1442083)
  - use network-online target in ntpdate and sntp services (#1466947)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-29
changelog:
  - fix CVE-2016-7429 patch to restore default ttl configuration (#1550637)
  - fix buffer overflow in parsing of address in ntpq and ntpdc (CVE-2018-12327)
  - fix crash in parsing of received address in ntpq (#1616250)
  - avoid reading freed memory after disabling netlink socket (#1555401)
  - don't disable netlink socket on ENOBUFS error (#1555413)
  - replace ntpstat with shell script using ntpq and supporting chrony (#1592871)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-12
changelog:
  - fix CVE-2017-3737 - incorrect handling of fatal error state
  - fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-13
changelog:
  - add S390x assembler updates
  - make CA name list comparison function case sensitive (#1548401)
  - fix CVE-2017-3735 - possible one byte overread with X.509 IPAdressFamily
  - fix CVE-2018-0732 - large prime DH DoS of TLS client
  - fix CVE-2018-0737 - RSA key generation cache timing vulnerability
  - fix CVE-2018-0739 - stack overflow parsing recursive ASN.1 structure


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-16
changelog:
  - fix CVE-2018-0495 - ROHNP - Key Extraction Side Channel on DSA, ECDSA
  - fix incorrect error message on FIPS DSA parameter generation (#1603597)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-17
changelog:
  - use SHA-256 in FIPS RSA pairwise key check
  - fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
    timing side-channel key extraction


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2k-18
changelog:
  - fix CVE-2018-0734 - DSA signature local timing side channel
  - fix CVE-2019-1559 - 0-byte record padding oracle
  - close the RSA decryption One & done EM side channel (#1619558)


author: Stef Walter <stefw@redhat.com> - 0.20.7-1
changelog:
  - Update to upstream stable 0.20.7 release
  - Expose pkcs11x.h header and defines for attached extensions rhbz#1142305


author: Daiki Ueno <dueno@redhat.com> - 0.23.5-3
changelog:
  - Avoid reference to thread-unsafe strerror rhbz#1378947
  - Fix PKCS#11 OAEP interface rhbz#1191209
  - Update documentation to follow RFC7512 rhbz#1165977


author: Petr Pisar <ppisar@redhat.com> - 8.32-13
changelog:
  - Disable unsupported JIT mode on little-endian 64-bit PowerPC platform
    (bug #1125642)
  - Raise optimization level to 3 on little-endian 64-bit PowerPC (bug #1123498)


author: Petr Pisar <ppisar@redhat.com> - 8.32-15
changelog:
  - Fix compiling expression where start-anchored character with more than one
    other case follows circumflex in multiline UTF mode (bug #1110621)
  - Fix character class with a literal quotation (bug #1111091)
  - Fix empty-matching possessive zero-repeat groups in interpreted mode
    (bug #1119320)
  - Fix compiler crash for zero-repeated groups with a recursive back reference
    (bug #1119356)
  - Reset non-matched groups within capturing group up to forced match
    (bug #1161597)
  - Fix static linking (bug #1217111)
  - Package pcredemo.c as a documentation for pcre-devel (bug #1217118)


author: Petr Pisar <ppisar@redhat.com> - 8.32-16
changelog:
  - Fix CVE-2015-2328 (infinite recursion compiling pattern with recursive
    reference in a group with indefinite repeat) (bug #1330509)
  - Fix CVE-2015-8385 (buffer overflow caused by named forward reference to
    duplicate group number) (bug #1330509)
  - Fix CVE-2015-8386 (buffer overflow caused by lookbehind assertion)
    (bug #1330509)
  - Fix CVE-2015-3217 (stack overflow caused by mishandled group empty match)
    (bug #1330509)
  - Fix CVE-2015-5073 and CVE-2015-8388 (buffer overflow for forward reference
    within backward assertion with excess closing parenthesis) (bug #1330509)
  - Fix CVE-2015-8391 (inefficient posix character class syntax check)
    (bug #1330509)
  - Fix CVE-2016-3191 (workspace overflow for (*ACCEPT) with deeply nested
    parentheses) (bug #1330509)


author: Petr Pisar <ppisar@redhat.com> - 8.32-17
changelog:
  - Let [:graph:], [:print:], and [:punct:] POSIX classes to handle Unicode
    characters in UCP mode to match Perl behavior (bug #1400267)
  - Fix matching Unicode ranges in JIT mode (bug #1402288)


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-286
changelog:
  - Remove CPU-speed-sensitive test in Benchmark test (bug #1238567)
  - Rebuild with corrected binutils to fix systemtap support (bug #1238472)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-288
changelog:
  - Fix CRLF conversion in ASCII FTP upload (bug #1263734)
  - Don't leak the temp utf8 copy of namepv (bug #1063330)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.16.3-291
changelog:
  - Backported and sub-packaged libraries historically supplied with Perl 4
    into perl-Perl4-CoreLibs


author: Petr Pisar <ppisar@redhat.com> - 4:5.16.3-293
changelog:
  - Add SSL support to Net::SMTP (bug #1557574)
  - Do not overload ".." in Math::BigInt (bug #1497734)
  - Provide perl(:VERSION) and perl-interpreter RPM symbols (bug #1410347)


author: Marcela Mašláňová <mmaslano@redhat.com> - 2.135.07-240
changelog:
  - update the version to override the module from perl.srpm
  - bump release to override sub-package from perl.spec


author: Petr Pisar <ppisar@redhat.com> - 2.51-6
changelog:
  - Rebuild against "file" package fixed by Jan Kaluza to correct run-time
    dependencies (bug #1048910)


author: Petr Pisar <ppisar@redhat.com> - 0.033-2
changelog:
  - Croak on failed write into a file (bug #1031096)
  - Do not use already existing temporary files (bug #1031096)


author: Marcela Mašláňová <mmaslano@redhat.com> - 1:0.225-4
changelog:
  - Install to vendor directories rather than perl core directories so as to
    avoid conflicts between our debuginfo and the main perl-debuginfo package


author: Paul Howarth <paul@city-fan.org> - 1:0.225-6
changelog:
  - Reinstate compatibility with old distributions like EL-5
    - Add back buildroot definition and cleaning
  - Use DESTDIR rather than PERL_INSTALL_ROOT
  - Make %files list more explicit
  - Drop redundant %{?perl_default_filter}
  - Don't use macros for commands
  - Use tabs


author: Paul Howarth <paul@city-fan.org> - 1:0.225-242
changelog:
  - Don't need to remove empty directories from the buildroot
  - Drop %defattr, redundant since rpm 4.4


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.42-2
changelog:
  - Add BR perl(File::Spec)
  - Replace PERL_INSTALL_ROOT with DESTDIR
  - Remove deleting empty directories
  - Remove defattr


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-30
changelog:
  - semanage/seobject: Fix listing boolean values (#1391605)
  - sepolicy: Make policy files sorting more robust
  - semanage: Fix setting alternative policy store (#1558033)
  - semanage: Load a store policy and set the store SELinux policy root
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: import sepolicy only when it's needed
  - semanage: move valid_types initialisations to class constructors
  - semanage/seobject: Fix indentation issues
  - scripts/fixfiles: Do not fail on file_contexts.local (#1647714)


author: Vit Mojzis <vmojzis@redhat.com> - 2.5-31
changelog:
  - semanage: Start exporting "ibendport" and "ibpkey" entries (#1657196)
  - semanage: Do not show "None" levels when using a non-MLS policy (#1400482)
  - semanage: Include MCS/MLS range when exporting local customizations (#1400482)


author: Panu Matilainen <pmatilai@redhat.com> - 1.13-12
changelog:
  - Hack poptBadOption() to return something semi-meaningful on exec alias
    failures (#697435, #710267)
  - Run internal test-suite on build, minimal as it might be


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-34
changelog:
  - Adjust --noghost documentation (#1395818)
  - Provide audit events on update verification (#1555326)


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-36
changelog:
  - Add popt-based options --setcaps and --restore (#1550745)
  - Improve hardlink handling in disk space calculation (#1491786)
  - Remove perl dependencies that are provided in the same file (#1570181)


author: Panu Matilainen <pmatilai@redhat.com> - 4.11.3-31
changelog:
  - Backport missing infra for --noconfig option (#1406611)
  - As a side-effect, this also makes --noghost work as intended


author: Pavlina Moravcova Varekova <pmoravco@redhat.com> - 4.11.3-33
changelog:
  - Repair of --noghost option implementation (#1395818)
  - Backport fix rpmSign() return value in case of failure (#1419590)
  - Backport passing _find_debuginfo_opts -g to eu-strip for executables
    (#1540653)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-258
changelog:
  - Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
  Resolves: rhbz#1688729
  - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label
  Resolves: rhbz#1658319


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-259
changelog:
  - Allow ganesha_t domain to read system network state and connect to cyphesis_port_t
  Resolves: rhbz#1653857
  - Label /var/log/collectd.log as collectd_log_t
  - Update gnome_role_template() interface to make working sysadm_u SELinux able to login to X sessions
  Resolves: rhbz#1688729
  - Update collectd policy to allow daemon create /var/log/collectd with collectd_log_t label
  Resolves: rhbz#1658319
  - Update sbd policy to allow manage cgroups
  Resolves: rhbz#1715136
  - Allow sudo userdomain to run rpm related commands
  - Update rpm_run() interface to avoid duplicate role transition in sudo_role_template
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-261
changelog:
  - Update sudo_role_template() to allow caller domain to read syslog pid files
  Resolves: rhbz#1651253


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-264
changelog:
  - Allow tmpwatch process labeled as tmpreaper_t domain to execute fuser command
  Resolves: rhbz#1765063


author: Frank Ch. Eigler <fche@redhat.com> - 3.3-2
changelog:
  - Enable BPF build (rhbz1544689, rhbz1311586) (x86-64 only)
  - Fix vfs.add_to_page_cache probe (rhbz1547238)
  - Fix foreach_limit.exp compilability (rhbz1591267)


author: Serhei Makarov <smakarov@redhat.com> - 3.3-3
changelog:
  - Add BPF left-operand fix (rhbz1560044) (x86-64 only)
  - Add stap.1 note on missing stapbpf.8 (rhbz1560044)
  - Fix RHEL-ALT build (rhbz1544689)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.5.13-5
changelog:
  - Fixed fork, enabled threading (by notifier-thread-fork-fix patch)
    Resolves: rhbz#869315
  - Rebuild to fix systemtap on aarch64
    Resolves: rhbz#1238479


author: Martin Sehnoutka <msehnout@redhat.com> - 1:0.17-60
changelog:
  - Introduce new -i switch
  - ip addresses will be logged into utmp instead of hostname
  - Resolves: #1323094


author: Michal Ruprich <mruprich@redhat.com> - 1:0.17-63
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - additional info added to manpage


author: Michal Ruprich - 1:0.17-64
changelog:
  - Related: #1367415 - No option to specify IPv6 or IPv4 explicitly must be used
                      - more clear formulation of man page note - previous note was a bit ambiguous


author: Petr Menšík <pemensik@redhat.com> - 1.6.6-1
changelog:
  - Rebase to 1.6.6
  - Enable RFC 8145 Trust Anchor Signaling to help the root zone get keytag statistics
  - Enable ipsecmod support


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196134 #1196122 #1196126 #1196130


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-16
changelog:
  - Added patch for build option "-Werror=format-security"
  - Added support of non-unicode non-latin charset
  - Fix print of non-ascii filenames
  - Fix troubles with symlinks for archives with many files
    Resolves: rhbz#1276746, rhbz#1286165, rhbz#1276744


author: Jakub Martisko <jamartis@redhat.com> - 6.0-19
changelog:
  - rename patch unzip-6.0-nostrip.patch to unzip-6.0-configure.patch
  - make linking flags configurable from the specc file
  - set linking flags to use relro hardening
    Related: #1531116


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-2
changelog:
  - 1383902 - CPU spikes to 100% and timeouts observed in strace when opening yaml extensions using vim


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.160-3
changelog:
  - 1267826 - Include c++11 syntax highlighting in vim
  - 1319760 - [RFE] Vim should support blowfish2, plus ensure that RHEL6 encrypted files can be opened in RHEL7


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-1
changelog:
  - 1563419 - Vim in RHEL 7 is older than VIM in RHEL 6 (Rebase)
  - 1377316 - [RFE] make _remote_ vim doing the right decisions about 'set background'


author: Tomas Hozza <thozza@redhat.com> - 1.14-12
changelog:
  - Fix wget to include Host header on CONNECT as required by HTTP 1.1 (#1203384)
  - Run internal test suite during build (#1295846)
  - Fix -nv being documented as synonym for two options (#1147572)


author: Tomas Hozza <thozza@redhat.com> - 1.14-15
changelog:
  - Added TLSv1_1 and TLSv1_2 as secure-protocol values to help (#1439811)
  - Fixed synchronization in randomly failing unit test Test-proxied-https-auth (#1448440)


author: Pavel Raiskup <praiskup@redhat.com> - 5.1.2-5alpha
changelog:
  - fix manual page inconsistencies with help output (private #948533)
  - enable/fix the 'xzgrep -h' (private #850898)


