# changelog

author: Nick Clifton <nickc@redhat.com> - 2.30-113.1
changelog:
  - Backport: Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (RHEL-12881)


author: Nick Clifton <nickc@redhat.com> - 2.30-113.2
changelog:
  - Backport: Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (RHEL-12955)


author: Marek Polacek <polacek@redhat.com> 8.5.0-2
changelog:
  - revert upstream PR85873 gcc-8 fix, apply the fix from gcc-9 (#1960701)
  - fix 'this' adjustment for devirtualized call (PR c++/100797, #1965951)


author: Mark Wielaard <mjw@redhat.com> - 0.178-4
changelog:
  - Add elfutils-debuginfod-client Provides and Requires with depsuffix
    to get multilib dependencies correct. Add %{version}-%{release} to
    keep subpackages in sync.


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Mark Wielaard <mjw@redhat.com> - 0.186-1
changelog:
  - Upgrade to upstream 0.186
    - debuginfod-client: Default $DEBUGINFOD_URLS is computed from
      drop-in files /etc/debuginfod/*.urls rather than
      hardcoded into the /etc/profile.d/debuginfod*
      scripts.
      Add $DEBUGINFOD_MAXSIZE and $DEBUGINFOD_MAXTIME settings
      for skipping large/slow transfers.
      Add $DEBUGINFOD_RETRY for retrying aborted lookups.
    - debuginfod: Supply extra HTTP response headers, describing
      archive/file names that satisfy the requested buildid content.
      Support -d :memory: option for in-memory databases.
      Protect against loops in federated server configurations.
      Add -r option to use -I/-X regexes for grooming stale files.
      Protect against wasted CPU from duplicate concurrent requests.
      Limit the duration of groom ops roughly to rescan (-t) times.
      Add --passive mode for serving from read-only database.
      Several other performance improvements & prometheus metrics.
    - libdw: Support for the NVIDIA Cuda line map extensions.
      DW_LNE_NVIDIA_inlined_call and DW_LNE_NVIDIA_set_function_name
      are defined in dwarf.h. New functions dwarf_linecontext and
      dwarf_linefunctionname.
    - translations: Update Japanese translation.


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-188
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045063).


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.93.1.el8_6]
changelog:
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19952 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command (Wander Lairson Costa) [RHEL-19952 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix deadlock in gsmtty_open() (Wander Lairson Costa) [RHEL-19952 RHEL-19955] {CVE-2023-6546}
  - libceph: fix potential use-after-free on linger ping and resends (Jay Shin) [RHEL-21397 RHEL-20390]
  - media: em28xx: initialize refcount before kref_get (Dean Nelson) [RHEL-18731 2128003] {CVE-2022-3239}
  - drm/amdgpu: Fix potential fence use-after-free v2 (Michel Dänzer) [RHEL-24477 RHEL-22504] {CVE-2023-51042}
  - net/packet: fix packet_sock xmit return value checking (Xin Long) [RHEL-18559 2080486] {CVE-2022-20368}
  - net/packet: fix slab-out-of-bounds access in packet_recvmsg() (Xin Long) [RHEL-18559 2080486] {CVE-2022-20368}
  - af_packet: fix data-race in packet_setsockopt / packet_setsockopt (Xin Long) [RHEL-18559 2080486] {CVE-2022-20368}
  - rbd: don't move requests to the running list on errors (Ilya Dryomov) [RHEL-24202 RHEL-21941]
  - drm/vmwgfx: Remove rcu locks from user resources (Jocelyn Falempe) [RHEL-18802 RHEL-18804 2133493 2133499] {CVE-2022-38457 CVE-2022-40133}
  - tracing/timerlat: Add user-space interface (Chris White) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Skip running osnoise if all instances are off (Chris White) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Switch from PF_NO_SETAFFINITY to migrate_disable (Chris White) [RHEL-20360 RHEL-15142]
  - tracing/timerlat: Always wakeup the timerlat thread (Chris White) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Fix notify new tracing_max_latency (Chris White) [RHEL-20360 RHEL-15142]
  - tracing/timerlat: Notify new max thread latency (Chris White) [RHEL-20360 RHEL-15142]
  - trace/osnoise: make use of the helper function kthread_run_on_cpu() (Chris White) [RHEL-20360 RHEL-15142]
  - kthread: add the helper function kthread_run_on_cpu() (Chris White) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: set several trace_osnoise.c variables storage-class-specifier to static (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: No need for schedule_hrtimeout range (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Use built-in RCU list checking (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Add preempt and/or irq disabled options (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Add PANIC_ON_STOP option (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Make osnoise_options static (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Add OSNOISE_WORKLOAD option (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Add osnoise/options file (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Fix duration type (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/timerlat: Do not wakeup the thread if the trace stops at the IRQ (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/timerlat: Print stacktrace in the IRQ handler if needed (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/timerlat: Notify IRQ new max latency only if stop tracing is set (John Kacur) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Force quiescent states while tracing (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Do not unregister events twice (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Make osnoise_main to sleep for microseconds (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Properly unhook events if start_per_cpu_kthreads() fails (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Make osnoise_instances static (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Remove PREEMPT_RT ifdefs from inside functions (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Remove STACKTRACE ifdefs from inside functions (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Allow multiple instances of the same tracer (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Remove TIMERLAT ifdefs from inside functions (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Support a list of trace_array *tr (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Use start/stop_per_cpu_kthreads() on osnoise_cpus_write() (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Split workload start from the tracer start (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Improve comments about barrier need for NMI callbacks (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - tracing/osnoise: Do not follow tracing_cpumask (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - trace/timerlat: Add migrate-disabled field to the timerlat header (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - trace/osnoise: Add migrate-disabled field to the osnoise header (Jerome Marchand) [RHEL-20360 RHEL-15142]
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-24008 RHEL-23506] {CVE-2024-1086}
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Dean Nelson) [RHEL-18852 2213139] {CVE-2023-31084}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.94.1.el8_6]
changelog:
  - netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() (Florian Westphal) [RHEL-20297 2189517] {CVE-2023-7192}
  - net: sched: fix use-after-free in tc_new_tfilter() (Ivan Vecera) [RHEL-20363 2071704] {CVE-2022-1055}
  - x86/kasan: Populate shadow for shared chunk of the CPU entry area (Rafael Aquini) [RHEL-18817 2232451]
  - x86/kasan: Add helpers to align shadow addresses up and down (Rafael Aquini) [RHEL-18817 2165931] {CVE-2023-0597}
  - x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names (Rafael Aquini) [RHEL-18817 2232451]
  - x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area (Rafael Aquini) [RHEL-18817 2232451]
  - x86/mm: Recompute physical address for every page of per-CPU CEA mapping (Rafael Aquini) [RHEL-18817 2232451]
  - x86/mm: Do not shuffle CPU entry areas without KASLR (Rafael Aquini) [RHEL-18817 2165931] {CVE-2023-0597}
  - x86/mm: Randomize per-cpu entry area (Rafael Aquini) [RHEL-18817 2165931] {CVE-2023-0597}
  - x86/kasan: Map shadow for percpu pages on demand (Rafael Aquini) [RHEL-18817 2165931] {CVE-2023-0597}
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise (Rafael Aquini) [RHEL-18817 2165931] {CVE-2023-0597}
  - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-22075 RHEL-21685] {CVE-2024-0565}
  - smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-21660 RHEL-18990] {CVE-2023-6606}
  - wifi: cfg80211: fix u8 overflow in cfg80211_update_notlisted_nontrans() (Jose Ignacio Tornos Martinez) [RHEL-18732 2134385] {CVE-2022-41674}
  - wifi: cfg80211: fix BSS refcounting bugs (Jose Ignacio Tornos Martinez) [RHEL-18733 2134460] {CVE-2022-42720}
  - KVM: x86/mmu: Fix race condition in direct_page_fault (Jon Maloy) [RHEL-18829 2179929] {CVE-2022-45869}
  - wifi: cfg80211: avoid nontransmitted BSS list corruption (Jose Ignacio Tornos Martinez) [RHEL-18734 2134511] {CVE-2022-42721}
  - wifi: mac80211: fix crash in beacon protection for P2P-device (Jose Ignacio Tornos Martinez) [RHEL-18735 2134582] {CVE-2022-42722}
  - drm/atomic: Fix potential use-after-free in nonblocking commits (Jocelyn Falempe) [RHEL-23475 RHEL-22511] {CVE-2023-51043}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.95.1.el8_6]
changelog:
  - scsi: smartpqi: Fix disable_managed_interrupts (Tomas Henzl) [RHEL-26137 RHEL-25747]
  - scsi: smartpqi: Add module param to disable managed ints (Don Brace) [RHEL-21592 2101548]
  - KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} (Bandan Das) [RHEL-23061 RHEL-7558]
  - x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer (Bandan Das) [RHEL-23061 RHEL-7558]
  - KVM: x86: remove PMU FIXED_CTR3 from msrs_to_save_all (Bandan Das) [RHEL-23061 2074835]
  - s390/qeth: Fix vipa deletion (Tobias Huschle) [RHEL-25809 RHEL-11194]
  - psi: Fix uaf issue when psi trigger is destroyed while being polled (Waiman Long) [RHEL-21919 2046396] {CVE-2022-2938}
  - atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait (Íñigo Huguet) [RHEL-18798 2184353] {CVE-2021-43975}
  - HID: elo: Revert USB reference counting (Benjamin Tissoires) [RHEL-18557 2073833] {CVE-2022-27950}
  - HID: elo: fix memory leak in elo_probe (Benjamin Tissoires) [RHEL-18557 2073833] {CVE-2022-27950}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.96.1.el8_6]
changelog:
  - ibmveth: Remove condition to recompute TCP header checksum. (Mamatha Inamdar) [RHEL-20820 RHEL-12553]
  - ceph: don't let check_caps skip sending responses for revoke msgs (Xiubo Li) [RHEL-20907 RHEL-16412]
  - ceph: issue a cap release immediately if no cap exists (Xiubo Li) [RHEL-20907 RHEL-16412]
  - ceph: trigger to flush the buffer when making snapshot (Xiubo Li) [RHEL-20907 RHEL-16412]
  - ceph: force updating the msg pointer in non-split case (Xiubo Li) [RHEL-20907 RHEL-16412]
  - ceph: flush cap releases when the session is flushed (Xiubo Li) [RHEL-20907 RHEL-16412]
  - ceph: reorder fields in 'struct ceph_snapid_map' (Xiubo Li) [RHEL-20907 RHEL-16412]
  - ceph: voluntarily drop Xx caps for requests those touch parent mtime (Xiubo Li) [RHEL-20907 RHEL-16412]
  - migrate: grab the compound head in migration_entry_wait_on_locked (Nico Pache) [RHEL-26706 2188249]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.97.1.el8_6]
changelog:
  - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-27494 RHEL-21760]
  - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-27494 RHEL-21760]
  - ceph: try to queue a writeback if revoking fails (Xiubo Li) [RHEL-27494 2120940]
  - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-27494 RHEL-21760]
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Carlos Maiolino) [RHEL-26329 RHEL-23386] {CVE-2021-33631}
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (Ricardo Robaina) [RHEL-18821 2174409] {CVE-2023-1118}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.98.1.el8_6]
changelog:
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-26387 RHEL-23430] {CVE-2024-26602}
  - ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (Petr Oros) [RHEL-28838 2153356]
  - RDMA/irdma: Report the correct link speed (Petr Oros) [RHEL-28838 RHEL-23967]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.99.1.el8_6]
changelog:
  - ext4: fix check for block being out of directory size (Carlos Maiolino) [RHEL-18556 RHEL-15010]
  - ext4: make sure ext4_append() always allocates new block (Lukas Czerner) [RHEL-18556 2070216] {CVE-2022-1184}
  - ext4: check if directory block is within i_size (Lukas Czerner) [RHEL-18556 2070216] {CVE-2022-1184}
  - KVM: x86: avoid calling x86 emulator without a decoded instruction (Vitaly Kuznetsov) [RHEL-20890 2115240] {CVE-2022-1852}
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (David Marlin) [RHEL-18807 2148408] {CVE-2022-42895}
  - x86,config: Enable straight-line-speculation fix (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - x86/alternative: Relax text_poke_bp() constraint (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - perf/x86: Add support for perf text poke event for text_poke_bp_batch() callers (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - objtool: Add straight-line-speculation validation (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - objtool: Support conditional retpolines (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - objtool: Refactor sibling call detection logic (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - objtool: Change dead_end_function() to return boolean (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - x86/lib/atomic64_386_32: Rename things (Wander Lairson Costa) [RHEL-18719 2062175] {CVE-2021-26341}
  - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-28550 RHEL-13214]
  - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-28550 RHEL-13214]
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Ricardo Robaina) [RHEL-18805 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix build errors in some archs (Ricardo Robaina) [RHEL-18805 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression (Ricardo Robaina) [RHEL-18805 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Ricardo Robaina) [RHEL-18805 2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Ricardo Robaina) [RHEL-18805 2139617] {CVE-2022-3640}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.100.1.el8_6]
changelog:
  - veth: ensure skb entering GRO are not cloned. (Xin Long) [RHEL-29918 2080486] {CVE-2021-47099}
  - dm-crypt, dm-verity: disable tasklets (Benjamin Marzinski) [RHEL-26099 RHEL-22232]
  - dm crypt: avoid accessing uninitialized tasklet (Benjamin Marzinski) [RHEL-26099 2192702]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.101.1.el8_6]
changelog:
  - cgroup/rstat: Optimize cgroup_rstat_updated_list() (Waiman Long) [RHEL-30191 RHEL-18154]
  - cgroup/rstat: Reduce cpu_lock hold time in cgroup_rstat_flush_locked() (Waiman Long) [RHEL-30191 RHEL-18154]
  - cgroup: use irqsave in cgroup_rstat_flush_locked(). (Waiman Long) [RHEL-30191 RHEL-18154]
  - cgroup: fix spelling mistakes (Waiman Long) [RHEL-30191 RHEL-18154]
  - cgroup/rstat: check updated_next only for root (Waiman Long) [RHEL-30191 2193485]
  - cgroup: rstat: explicitly put loop variant in while (Waiman Long) [RHEL-30191 2193485]
  - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-29182 RHEL-26462] {CVE-2024-26586}


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.102.1.el8_6]
changelog:
  - ipv4: avoid using shared IP generator for connected sockets (Paolo Abeni) [RHEL-18554 2062427] {CVE-2020-36516}


author: David Howells <dhowells@redhat.com> - 1.5.10-1
changelog:
  - Include sys/types.h in keyutils.h.
  - The dns resolver needs limits.h.
  - Overhaul of all manual pages.
  - Some manual pages moved to Linux man-pages project.
  - Add Diffie-Helman keyctl function.


author: Lukas Czerner <lczerner@redhat.com> 1.45.4-1
changelog:
  - Rebase to the release 1.45.4 (#1783777)
  - provide rhel6/7 compatible fs_type in mke2fs.conf (#1780279)
  - fix crafted ext4 partition leads to out-of-bounds write (#1768709)
  - include note about supported rhel8 features and options (#1788573)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Björn Esser <besser82@fedoraproject.org> - 4.0.1-5
changelog:
  - Add patch to update to recent development branch
  - Re-enable SUNMD5 support as it is BSD licensed now
  - Build compatibility symbols for glibc only
  - Skip failing testsuite once


author: Bruno Meneguele <bmeneg@redhat.com> - 20211119-105.gitf5d51956
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update to latest AMD GPU firmware (rhbz 1986660)


author: Augusto Caringi <acaringi@redhat.com> - 20220209-106.git6342082c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include AMD GPU firmware fix (rhbz 2031172)
  - Support QCA WCN6856 v2.1 Module: Bluetooth firmware (rhbz 2007904)


author: Augusto Caringi <acaringi@redhat.com> - 20220210-110.git6342082c
changelog:
  - Update AMD fam17h cpu microcode (microcode_amd_fam17h.bin)
  - Update AMD fam19h cpu microcode (microcode_amd_fam19h.bin)
  - Fixes rhbz 2227151 (CVE-2023-20593)


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-7
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes. (#1589769)
  - Fix testing failure due to Perl changes related to expanding paths.


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067145


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-11
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures
  - fixed firefox crash due to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11.19
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


