# changelog

author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.84.1.el8_10]
changelog:
  - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775]
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718}
  - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005]


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.85.1.el8_10]
changelog:
  - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799]
  - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968}
  - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969}
  - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970}
  - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799]
  - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971}
  - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799]
  - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799]
  - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972}
  - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799]
  - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122]
  - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697}
  - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.86.1.el8_10]
changelog:
  - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825}
  - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237]
  - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724}
  - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513}
  - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921]
  - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921]
  - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921]
  - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921]
  - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921]
  - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921]
  - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.87.1.el8_10]
changelog:
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664]
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955}
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.88.1.el8_10]
changelog:
  - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199]
  - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539}
  - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.89.1.el8_10]
changelog:
  - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774]
  - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
  - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
  - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660]
  - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.91.1.el8_10]
changelog:
  - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355]
  - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240}
  - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)
  - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963]
  - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171]
  - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171]
  - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226]
  - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226]
  - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744]
  - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744]
  - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744]
  - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.92.1.el8_10]
changelog:
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285}
  - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993}
  - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396]
  - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396]
  - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396]
  - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396]


author: Release Engineering <releng@rockylinux.org> - 4.18.0-553.92.1
changelog:
  - Adding prod certs and changed cert date to 20210620 (Sherif Nagy)
  - Adding Rocky secure boot certs (Sherif Nagy)
  - Fixing vmlinuz removal (Sherif Nagy)
  - Fixing UEFI CA path (Sherif Nagy)
  - Porting to 8.10, debranding and Rocky branding (Louis Abel)
  - Fixing pesign_key_name values (Sherif Nagy)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.93.1.el8_10]
changelog:
  - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449]
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096}
  - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.94.1.el8_10]
changelog:
  - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301}
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933}
  - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051}


author: Tomas Matus <tmatus@redhat.com> - 310.6-1
changelog:
  - networking: Fix renaming of bridges and other groups (RHEL-131249)
  - networkmanager: use connection.type as a fallback (RHEL-131244)


author: Pavol Zacik <pzacik@redhat.com> - 1:2.2.6-60
changelog:
  - RHEL-40386 cups: Cupsd Listen arbitrary chmod 0140777
  - Delete the domain socket file after stopping the cups.socket service
  - Fix cupsd Listener checks


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-64
changelog:
  - RHEL-122045 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-65
changelog:
  - RHEL-129729 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129720 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Marian Csontos <mcsontos@redhat.com> - 2.03.14-14
changelog:
  - Fix multisegment RAID1 allocator using one disk for both legs.
  - Fix lvconvert -m 0 taking rimage_0 even if it is out of sync.
  - Add warning message when mirror images have (r)efresh bit set.
  - Document lv_attr volume type bit (g) for raid+integrity in lvs(8).


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-166
changelog:
  - Add patches for CVE-2024-34397, CVE-2024-52533, CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-67084
  - Resolves: RHEL-94286
  - Resolves: RHEL-94848


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.1
changelog:
  - Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue
    in mod_rewrite (CVE-2024-38474)
  - Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in
    mod_proxy (CVE-2024-38473)
  - Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output
    in mod_rewrite (CVE-2024-38475)
  - Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference
    in mod_proxy (CVE-2024-38477)
  - Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF
    in mod_rewrite (CVE-2024-39573)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.2
changelog:
  - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend
    applications whose response headers are malicious or exploitable (CVE-2024-38476)
  - Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.3
changelog:
  - Resolves: RHEL-56068 - Apache HTTPD no longer parse PHP files with
    unicode characters in the name


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.5
changelog:
  - Resolves: RHEL-99944 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade
  - Resolves: RHEL-99969 - CVE-2024-47252 httpd: insufficient escaping of
    user-supplied data in mod_ssl
  - Resolves: RHEL-99961 - CVE-2025-23048 httpd: access control bypass by trusted
    clients is possible using TLS 1.3 session resumption


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.6
changelog:
  - Resolves: RHEL-127073 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.7
changelog:
  - Resolves: RHEL-135054 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135039 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134471 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.34-9
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131452)
  - CVE-2025-65018: heap buffer overflow (RHEL-131465)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133226)


author: Remi Collet <remi@remirepo.net> - 1.0.18-9
changelog:
  - Security: `crypto_core_ed25519_is_valid_point()` now properly
    rejects small-order points that are not in the main subgroup
    CVE-2025-69277


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-7
changelog:
  - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict
    Resolves: RHEL-76376


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-8
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-85887
    Resolves: RHEL-85900
    Resolves: RHEL-85901
    Resolves: RHEL-87039
    Resolves: RHEL-87094
    Resolves: RHEL-87114
    Resolves: RHEL-88348
    Resolves: RHEL-88351


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-9
changelog:
  - Add patches to improve test reliability
  - Backport patches for various CVEs
    Resolves: RHEL-85879
    Resolves: RHEL-92280
    Resolves: RHEL-93031
    Resolves: RHEL-93032


author: Pavel Raiskup <praiskup@redhat.com> 41.5-1
changelog:
  - Fedora 39 EOL
  - fix openSUSE-tumbleweed update failure during the second build (duli4868@gmail.com)
  - use non development bootstrap image for CentOS Stream 10 (romain.geissler@amadeus.com)
  - remove ELN ResilientStorage repos (yselkowi@redhat.com)
  - update ELN bootstrap image (yselkowi@redhat.com)
  - Add epel and epel-testing repos to the EPEL 10 config (carlwgeorge@gmail.com)


author: Miroslav Suchý <msuchy@redhat.com> 42.2-1
changelog:
  - fix: expand Oracle Linux distro_id from ol to oraclelinux
    (avi.miller@oracle.com)
  - Navy Linux 8 configuration fixes (adil@linux.com)
  - EuroLinux end-of-life (praiskup@redhat.com)
  - bugfix: upgrade openeuler chroots to latest release and fix gpg check failed
    in 20.03 (pkwarcraft@gmail.com)
  - Add Azure Linux 3 configuration (negativo17@gmail.com)
  - Add Azure Linux 2 configuration (negativo17@gmail.com)
  - Add Kylin 10 configuration files (negativo17@gmail.com)
  - Add AlmaLinux Kitten 10 + EPEL 10 configs (ngompa@almalinux.org)
  - Add AlmaLinux Kitten 10 configs (ngompa@almalinux.org)
  - Add openSUSE Leap 15.6, move openSUSE Leap 15.5 to eol (negativo17@gmail.com)


author: Pavel Raiskup <praiskup@redhat.com> 42.3-1
changelog:
  - Fedora 40 EOL
  - Add RHEL 10 template and configs (carlwgeorge@gmail.com)
  - disable copying ca-trust dirs with Azure Linux 3 (reubeno@users.noreply.github.com)
  - Add epel-z-10 template (carlwgeorge@gmail.com)
  - Update Azure Linux configurations (scaronni@nvidia.com)
  - make opensuse-leap-15.5.tpl eol
  - fix the leap image reference to 15.6


author: Pavel Raiskup <praiskup@redhat.com> 42.4-1
changelog:
  - fix sysusers packaging practice once more
  - configuration file owned by `root:root`
  - Rocky Linux 10 configs added (label@rockylinux.org)
  - missing config for AlmaLinux Kitten x86_64_v2 added (jhernandez@cloudlinux.com)
  - config for AlmaLinux Kitten 10 x86_64_v2 added (jonathan@almalinux.org)
  - AlmaLinux 10 configs added (jonathan@almalinux.org)


author: Pavel Raiskup <praiskup@redhat.com> 43.2-1
changelog:
  - disable gpgcheck for EPEL [local] repos
  - make sure [local] repo is available in rhel+epel repos
  - Add Kylin OS 11 (negativo17@gmail.com)
  - Azure Linux (CBL Mariner) 2.0 is now EOL (negativo17@gmail.com)


author: Pavel Raiskup <praiskup@redhat.com> 43.3-1
changelog:
  - Add openSUSE Leap 16.0 configurations (negativo17@gmail.com)
  - Update Kylin OS images and comments (negativo17@gmail.com)


author: Jiri Kyjovsky <j1.kyjovsky@gmail.com> 43.4-1
changelog:
  - Disable bootstrap for riscv (j1.kyjovsky@gmail.com)
  - Add risc-v fedora chroots (j1.kyjovsky@gmail.com)
  - eol/epel-6: copy-paste ca-bundle from host (praiskup@redhat.com)
  - Fix aarch64 configuration for Azure Linux 3 (negativo17@gmail.com)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-30
changelog:
  - fix crash when configured as proxy - issue 82 (RHEL-14454)
  - log once truncating issue (RHEL-13597)
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-26650)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.0-1
changelog:
  - Rebase to open-vm-tools 12.2.0 [bz#2177068]
  - Resolves: bz#2177068
    ([ESXi][RHEL8]open-vm-tools version 12.2.0 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.2.0-3
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2215563]
  - Resolves: bz#2215563
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-1
changelog:
  - Rebase to open-vm-tools 12.2.5 [bz#2214861]
  - Resolves: bz#2214861
    ([ESXi][RHEL8]open-vm-tools version 12.2.5 has been released - please rebase)
  - Resolves: bz#2216415
    ([ESXi][RHEL8] URL in service unit files are started from http instead of https)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-3
changelog:
  - Rebuild CVE-2023-20900 for 8.10
  - Resolves: RHEL-4584
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8.10.0])


author: Jon Maloy <jmaloy@redhat.com> - 12.2.5-4
changelog:
  - ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [RHEL-7012]
  - Resolves: RHEL-7012
    ([RHEL8.10][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-1
changelog:
  - Rebase to 12.3.5 [RHEL-15059]
  - Fix CVE-2023-34058 [RHEL-14649]
  - Fix CVE-2023-34059 [RHEL-14683]
  - Resolves: RHEL-15059
    ([ESXi][RHEL8]open-vm-tools version 12.3.5 has been released - please rebase)
  - Resolves: RHEL-14649
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-8.10.0])
  - Resolves: RHEL-14683
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-8.10.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-2
changelog:
  - ovt-Restart-tools-on-failure.patch [RHEL-17683]
  - Resolves: RHEL-17683
    (Add Restart=on-failure to vmtoolsd.service [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-2.el8.1
changelog:
  - ovt-SDMP-Service-Discovery-Plugin.patch [RHEL-117388]
  - Resolves: RHEL-117388
    ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-8.10.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.3.5-2.el8_10.2
changelog:
  - ovt-Validate-user-names-and-file-paths.patch [RHEL-129361]
  - Resolves: RHEL-129361
    (Backport of CVE-2025-22247 to 8.10)


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
changelog:
  - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
    Resolves: RHEL-14245
  - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
    Resolves: RHEL-14239


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
changelog:
  - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
    excessively long X9.42 DH keys or parameters may be very slow
    Resolves: RHEL-16538


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
changelog:
  - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
    (a proper fix for CVE-2020-25659)
    Resolves: RHEL-17696


author: Nikita Sanjay Patwa <npatwa@redhat.com> - 1:1.1.1k-14
changelog:
  - Backport fix for Out-of-bounds read & write in RFC 3211 KEK Unwrap
    Fix CVE-2025-9230
    Resolves: RHEL-128613
  - Fix bug for ticket_lifetime_hint exceed issue
    Resolves: RHEL-119891


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Leo Sandoval <lsandova@redhat.com> - 1.74-10
changelog:
  - 90fallback: include possible kernel parameters from grub's default file
  - common.sh: do not resolve symbolic link on mapped device filesystems
  - Resolves: #RHEL-55234


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-17
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/1866072)
  - Resolves: RHEL-62549


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-18
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/70e4d02)
  - Resolves: RHEL-62522


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-19
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/bfdd4c2)
  - Resolves: RHEL-67601


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-20
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/0e11f82)
  - fixes "CVE-2025-22869 container-tools:rhel8/podman: Potential denial of service in golang.org/x/crypto [rhel-8.10.z]"
  - Resolves: RHEL-81299


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-21
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/97e91b5)
  - fixes "Terminate healthcheck command upon reaching timeout. [rhel-8.10.z]"
  - Resolves: RHEL-96914


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-22
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/6cc8283)
  - fixes "CVE-2025-6032 container-tools:rhel8/podman: podman missing TLS verification [rhel-8.10.z]"
  - Resolves: RHEL-96702


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-23
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/ff15af1)
  - fixes "CVE-2025-9566 container-tools:rhel8/podman: Podman kube play command may overwrite host files [rhel-8.10.z]"
  - Resolves: RHEL-113145


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-25
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/638f1d2)
  - fixes "[Minor Incident] CVE-2025-52881 container-tools:rhel8/podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-8.10.z]"
  - Resolves: RHEL-126904


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-26
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/837a65c)
  - fixes "do not pass volume options as bind mounts options to runtime"
  - Resolves: RHEL-132859


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-27
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/702415d)
  - fixes "CVE-2025-47913 container-tools:rhel8/podman: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [rhel-8.10.z]"
  - Resolves: RHEL-130976


author: Brian Read <brianr@koozali.org> 11.0.0-148.sme
changelog:
  - Adjust CSs for parameters lisr inc textarea and arrange textarea label to be top aligned [SME: 13388]


author: Brian Read <brianr@koozali.org> 11.0.0-151.sme
changelog:
  - Fix unit var in useraccounts.pm [SME: 12294]
  - sort out user_PASSWORD_Wiki lex string quotes  [SME: 13394]
  - sort out data dump in useraccounts layout template [SME: 13394]


author: Brian Read <brianr@koozali.org> 11.0.0-152.sme
changelog:
  - General Lexical file audit [SME: 12950]
  - Add menu entry lex to bugreport.lex [SME: 12950]
  - Add missing entries in webmail lex file and in layout [SME: 12950]
  - Add missing entries and translations in yum lex files [SME: 12950]
  - Fix lex files for Ibays and add prefix to calls in controller file [SME: 12950]
  - Add prefix to column headings in Remoteaccess layout file [SME: 12950]
  - Fix various issues with ibays, email, datetime [SME: 12950]


author: Brian Read <brianr@koozali.org> 11.0.0-157.sme
changelog:
  - Correct Calculate sizes for tape dump in backup [SME: 13100]
  - Do not change Perform button status on backup functions [SME: 13101]


author: Brian Read <brianr@koozali.org> 11.0.0-6.sme
changelog:
  - Fix a few errors in the lex files stopping it compiling [SME: 12900]
  - Add createlinks to provide smeserver-manager-locale-update action so that re-configure/reboot not required


author: Brian Read <brianr@koozali.org> 11.0.0-12.sme
changelog:
  - Add French translation for Theme button [SME: 13313]
  - Added French translation for _info strings [SME: 12725]


author: Brian Read <brianr@koozali.org> 11.0.0-17.sme
changelog:
  - Audit and translate where easy lex files in Useraccounts cnd Bugreport category [SME: 12950]
  - Take out all html <p> and <hs> and <br> tags except in multiline strings [SME: 12950]
  - Map meta vars in translations to [_1] etc [SME: 12950]
  - Add in missing lexical strings, review all panels and menu entries. [SME: 12950]


author: Jean-Philippe Pialasse <jpp@koozali.org> 1.0-8.sme
changelog:
  - fix catch-all behaviour [SME: 12382]
    myorigin now is hostname
    in case email sent outside by deamon generic rewrite occurs


author: Jean-Philippe Pialasse <jpp@koozali.org> 1.0-12.sme
changelog:
  - template /etc/aliases [SME: 13262]
  - implement postfix delayed delivery notifications [SME: 12854]


author: Jean-Philippe Pialasse <jpp@koozali.org> 1.0-15.sme
changelog:
  - make myorigine more unique [SME: 13284]
    to avoid a pseudonym matching it and triggering do not list domain 
    in BOTH mydestination and virtual_alias_domains
  - added support for qpsmtpd{Helohost} as myhostname
  - migrate SMTPSmartHost and smtp-auth-proxy to postfix [SME: 13286]


author: Jean-Philippe Pialasse <jpp@koozali.org> 1.0-18.sme
changelog:
  - fix smtp auth on port 465 requires extra settings [SME: 13406]
  - reject email to ibays [SME: 13407]
  - workaround recipient delimiter [SME: 13263 ]
  - remove users from /etc/aliases [SME: 13262]


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.5
changelog:
  - man: be even clearer that tmpfiles user/group/mode are applied on existing inodes (RHEL-77145)
  - Revert "man: fix description of --force in halt(8) (#7392)" (RHEL-81056)
  - man: explicitly document that "reboot -f" is different from "systemctl reboot -f" (RHEL-81056)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.6
changelog:
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-75081)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-75081)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-75081)
  - core: do not disconnect from bus when failed to install signal match (RHEL-75081)
  - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-75081)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-75081)
  - core/manager: drop duplicate bus track deserialization (RHEL-75081)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.7
changelog:
  - cgroup-util: add mask definitions for sets of controllers supported by cgroupsv1 vs. cgroupsv2 (RHEL-9322)
  - cgroup: dump delegation mask too (RHEL-9322)
  - cgroup: units that aren't loaded properly should not result in cgroup controllers being pulled in (RHEL-9322)
  - cgroup: be more careful with which controllers we can enable/disable on a cgroup (RHEL-9322)
  - cgroup: extend reasons when we realize the enable mask (RHEL-9322)
  - cgroup: drastically simplify caching of cgroups members mask (RHEL-9322)
  - cgroup: when we unload a unit, also update all its parent's members mask (RHEL-9322)
  - test: extend testcase to ensure controller membership doesn't regress (RHEL-9322)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.8
changelog:
  - test-execute: let's ignore the difference between CLD_KILLED and CLD_DUMPED (RHEL-108744)
  - test-execute: turn off coredump generation in test services (RHEL-108744)
  - test: introduce TEST-53-TIMER (RHEL-108744)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-108744)
  - test: check the next elapse timer timestamp after deserialization (RHEL-108744)
  - timer: don't run service immediately after restart of a timer (RHEL-108744)
  - Revert "test: extend testcase to ensure controller membership doesn't regress" (RHEL-9322)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.9
changelog:
  - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-38859)
  - cryptsetup-generator: continue parsing after error (RHEL-38859)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-82.10
changelog:
  - hwdb: add ACCEL_LOCATION property to parse_hwdb.py (RHEL-130979)
  - hwdb: update ACCEL_LOCATION property to use Or instead of QuotedString (RHEL-130979)
  - test: support general properties in hwdb files (RHEL-130979)
  - hwdb: Relax parsing script to allow 0 and 1 for all ID_* properties (RHEL-130979)
  - hwdb: allow spaces in usb: matches and similar patterns (RHEL-130979)
  - test: fix parsing of 60-seat.hwdb and 60-keyboard.hwdb (RHEL-130979)
  - parse_hwdb: fix compatibility with pyparsing 2.4.* (RHEL-130979)
  - login: use parse_uid() when unmounting user runtime directory (RHEL-132175)
  - pid1: do not use generated strings as format strings (#19098) (RHEL-132317)
  - core/transaction: make merge_unit_ids() always return NUL-terminated string (RHEL-132317)
  - core/transaction: make merge_unit_ids() return non-NULL on success (RHEL-132317)
  - core/transaction: do not log "(null)" (RHEL-132317)


