# changelog

author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.6.1.el9_5]
changelog:
  - scsi: smartpqi: Bump driver version to 2.1.26-030 (Don Brace) [RHEL-21268]
  - scsi: smartpqi: Fix logical volume rescan race condition (Don Brace) [RHEL-21268]
  - scsi: smartpqi: Add new controller PCI IDs (Don Brace) [RHEL-21268]
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51559] {CVE-2024-42079}
  - x86/mm: Fix pti_clone_pgtable() alignment assumption (Rafael Aquini) [RHEL-57170] {CVE-2024-44965}
  - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() (CKI Backport Bot) [RHEL-47822] {CVE-2024-40919}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.7.1.el9_5]
changelog:
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() (Jose Ignacio Tornos Martinez) [RHEL-55579] {CVE-2024-43879}
  - wifi: mac80211: fix NULL dereference at band check in starting tx ba session (Jose Ignacio Tornos Martinez) [RHEL-56191] {CVE-2024-43911}
  - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (Jose Ignacio Tornos Martinez) [RHEL-54805] {CVE-2024-43842}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.8.1.el9_5]
changelog:
  - ionic: fix kernel panic in XDP_TX action (CKI Backport Bot) [RHEL-47730] {CVE-2024-40907}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (Izabela Bakollari) [RHEL-44037] {CVE-2024-38586}
  - ata: libata-core: Fix double free on error (Tomas Henzl) [RHEL-53777]
  - ata: libata: Fix memory leak for error path in ata_host_alloc() (Tomas Henzl) [RHEL-53777]
  - ata: ahci: Clean up sysfs file on error (Tomas Henzl) [RHEL-53777]
  - ata: libata-core: Fix null pointer dereference on error (Tomas Henzl) [RHEL-53777]
  - ata: libata-core: Add ATA_HORKAGE_NOLPM for all Crucial BX SSD1 models (Tomas Henzl) [RHEL-53777]
  - ata: ahci: Do not enable LPM if no LPM states are supported by the HBA (Tomas Henzl) [RHEL-53777]
  - ata: libata-scsi: Set the RMB bit only for removable media devices (Tomas Henzl) [RHEL-53777]
  - ata: libata-core: Do not try to set sleeping devices to standby (Tomas Henzl) [RHEL-53777]
  - KVM: s390: fix validity interception issue when gisa is switched off (CKI Backport Bot) [RHEL-57197] {CVE-2024-45005}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.9.1.el9_5]
changelog:
  - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55074] {CVE-2024-42284}
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57119] {CVE-2024-44970}
  - net/mlx5e: Fix CT entry update leaks of modify header context (Michal Schmidt) [RHEL-55628] {CVE-2024-43864}
  - net/mlx5: Always drain health in shutdown callback (Michal Schmidt) [RHEL-55616] {CVE-2024-43866}
  - net/mlx5: SF, Stop waiting for FW as teardown was called (Michal Schmidt) [RHEL-55616]
  - net/mlx5: Fix missing lock on sync reset reload (Michal Schmidt) [RHEL-55121] {CVE-2024-42268}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.10.1.el9_5]
changelog:
  - intel_th: pci: Add Granite Rapids SOC support (Michael Petlan) [RHEL-15664]
  - dma: fix call order in dmam_free_coherent (Eder Zulian) [RHEL-54751] {CVE-2024-43856}
  - dmaengine: idxd: Avoid unnecessary destruction of file_ida (Jerry Snitselaar) [RHEL-44508] {CVE-2024-38629}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.11.1.el9_5]
changelog:
  - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56254] {CVE-2024-43892}
  - bnxt_en: Fix double DMA unmapping for XDP_REDIRECT (Michal Schmidt) [RHEL-57259] {CVE-2024-44984}


author: Julien Rische <jrische@redhat.com> - 1.21.1-2
changelog:
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-27251
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-27245
  - Fix memory leak in failing UTF-8 to UTF-16 re-encoding for PAC
    Resolves: RHEL-27253
  - Make TCP waiting time configurable
    Resolves: RHEL-17132


author: Julien Rische <jrische@redhat.com> - 1.21.1-3
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45402 RHEL-45392


author: Richard Hughes <richard@hughsie.com> 0.7.18-5
changelog:
  - Backport a patch from upstream to fix handling unknown tags in AppStream metadata
  - Resolves: #RHEL-28856


author: Filip Januš <fjanus@redhat.com> - 5.3.28-54
changelog:
  - Add db_converter into -utils subpackage
  - It allowes to convert BerkeleyDB database format to GDBM/LMDB format
  - Resolves: RHEL-35607


author: Karel Zak <kzak@redhat.com> 2.37.4-19
changelog:
  - fix RHEL-34165 - lsipc: fix semaphore USED counter
  - fix RHEL-25265 - libblkid: Check offset in LUKS2 header
  - fix RHEL-25559 - more: fix poll() use


author: Adrian Reber <areber@redhat.com> - 1.2-7
changelog:
  - Apply upstream patch to fix 3 findings from static application security testing
    Resolves: RHEL-27656


author: José Expósito <jexposit@redhat.com> - 0.16-7
changelog:
  - Fix findings from static application security testing (SAST)
    Resolves: https://issues.redhat.com/browse/RHEL-29753


author: Daiki Ueno <dueno@redhat.com> - 4.15-2
changelog:
  - Fix auto=ondemand connection initialization with TCP (RHEL-51879)
  - Make use of Netlink extack for additional error reporting (RHEL-51881)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.4-11
changelog:
  - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder
  - lvm2: Refactor udisks_daemon_util_lvm2_wipe_block()


author: Jiri Denemark <jdenemar@redhat.com> - 10.3.0-1
changelog:
  - Rebased to libvirt-10.3.0 (RHEL-29642)
  - The rebase also fixes the following bugs:
      RHEL-25993, RHEL-7101, RHEL-7461, RHEL-16333, RHEL-7343
      RHEL-28808, RHEL-32880, RHEL-35879, RHEL-34112, RHEL-30373
      RHEL-23416, RHEL-23608, RHEL-26276, RHEL-22728


author: Jiri Denemark <jdenemar@redhat.com> - 10.4.0-1
changelog:
  - Rebased to libvirt-10.4.0 (RHEL-7489)
  - The rebase also fixes the following bugs:
      RHEL-29642, RHEL-30373, RHEL-32182, RHEL-33044, RHEL-33082
      RHEL-34615, RHEL-35948, RHEL-36565, RHEL-36721, RHEL-39271
      RHEL-39400


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-1
changelog:
  - Rebased to libvirt-10.5.0 (RHEL-21381)
  - The rebase also fixes the following bugs:
      RHEL-23833, RHEL-29642, RHEL-37542, RHEL-39969, RHEL-40899
      RHEL-43309


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-2
changelog:
  - vmx: Do not require all ID data for VMWare Distributed Switch (RHEL-46099)
  - tests: vhostuser: add virtiofsd json descriptor (RHEL-7108, RHEL-40135)
  - tests: qemuxmlconf: adjust test case to new virtiofsd (RHEL-7108, RHEL-40135)
  - qemu: fill capabilities for virtiofsd (RHEL-7108, RHEL-40135)
  - qemu: do not use deprecated options for new virtiofsd (RHEL-7108)
  - qemu: migration: allow migration for virtiofs (RHEL-40135)
  - virt-host-validate: Drop extra "PASS" (RHEL-46868)
  - qemu: Don't leave beingDestroyed=true on inactive domain (RHEL-43309)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-5
changelog:
  - qemu: virtiofs: cache: use 'never' instead of 'none' (RHEL-50329)
  - qemu_domain: Strip <acpi/> from s390(x) definitions (RHEL-49516)
  - qemuxmlconftest: Add tests for the ACPI stripping hack on s390 (RHEL-49516)
  - vsh: Allow vshReadlineInit() to be called multiple times (RHEL-53560)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-6
changelog:
  - udevListInterfaces: Honour array length for zero-length NULL arrays (CVE-2024-8235) (CVE-2024-8235, RHEL-55373)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7
changelog:
  - qemu: Refactor default panic model (RHEL-56451)
  - qemu: Sometimes the default panic model doesn't exist (RHEL-56451)
  - qemu: Use pvpanic by default on aarch64 (RHEL-56451)


author: Brian C. Lane <bcl@redhat.com> 34.9.26-1
changelog:
  - monitor: Skip repo errors involving CDROM/file source (bcl) (bcl)
    Resolves: RHEL-4658
  - rsyslog.conf: Update to use current config syntax (bcl) (bcl)
    Resolves: RHEL-46857


author: José Expósito <jexposit@redhat.com> - 24.1.2-3
changelog:
  - Match mesa-libEGL version
    Cherry-picked from: https://src.fedoraproject.org/rpms/mesa/pull-request/24
    Resolves: https://issues.redhat.com/browse/RHEL-50229


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.3-1
changelog:
  - Rebase to 1.38.3 (along stable branch)
  - Send the last error to the NBD client
    resolves: RHEL-50664


author: Stepan Broz <sbroz@redhat.com> - 1:5.9.1-13.3
changelog:
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-32062)


author: Josef Ridky <jridky@redhat.com> - 1:5.9.1-14
changelog:
  - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
    CVE-2022-24809 and CVE-2022-24810 (RHEL-26649)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-17
changelog:
  - bump package epoch to resolve RHEL-33939
  - Resolves: RHEL-33939 - Update path for nginx broken for existing CS
    installations


author: Gris Ge <fge@redhat.com> - 2.2.27-1
changelog:
  - N/A

   - Support TCP congestion window(cwnd) in route. (59f99632)
   - Support query interface driver. (67817c23)
   - New API to generate changed state. (fe5327a2)

   - Include driver information for `persist-nic-names` subcommand. (1129e46b)
   - nm: Protect global DNS config in checkpoint. (881373ba)
   - route rule: Append rule instead of overriding when iface defined. (88d3d3ef)
  - Resolves RHEL-19409


author: Gris Ge <fge@redhat.com> - 2.2.33-1
changelog:
  - Upgrade to 2.2.33
  - Fix validation of controller overbook. RHEL-40683
  - Support DNS and route in kernel mode. RHEL-37665


author: Gris Ge <fge@redhat.com> - 2.2.35-1
changelog:
  - Upgrade to 2.2.35
  - Fix gen_diff on VLAN ID change. RHEL-38623
  - Fix Nmpolicy on mac-address identifier. RHEL-54292
  - Fix reapply. RHEL-50556


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-2
changelog:
  - Fix MD-5 decode issue in pkcs #12
  - turn off policy processing for pkcs12 and smime
  - restore the rhel9 pkcs12 defaults for pk12util


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-6
changelog:
  - fix param encoding in pkcs12 pbamac encoding
  - add support for certificate compression in selfserv and tstclient


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.4.0-1
changelog:
  - Rebase to 12.4.0 [RHEL-30341
  - Resolves: RHEL-30341
    ([ESXi][RHEL9]open-vm-tools version 12.4.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.4.0-2
changelog:
  - ovt-Require-dbus-tools.patch [RHEL-35543]
  - Resolves: RHEL-35543
    ([ESXi][open-vm-tools]The open-vm-tools should depend on dbus-tools)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-40
changelog:
  - Correctly audit hostname and IP address
    Resolves: RHEL-22316
  - Make default key sizes configurable in sshd-keygen
    Resolves: RHEL-26454


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-1
changelog:
  - Rebase to OpenSSL 3.2.2. Fixes CVE-2024-2511, CVE-2024-4603, CVE-2024-4741,
    and Minerva attack.
    Resolves: RHEL-32148
    Resolves: RHEL-36792
    Resolves: RHEL-38514
    Resolves: RHEL-39111


author: Nathan Scott <nathans@redhat.com> - 6.2.0-5
changelog:
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57805)
  - Guard against symlink attacks in pmpost program (RHEL-57810)
  - Fix libpcp_web webgroup slow request refcounting (RHEL-58306)
  - Updated pmdahacluster for newer crm_mon versions (RHEL-50693)


author: Nathan Scott <nathans@redhat.com> - 6.2.1-1
changelog:
  - Rebase to latest stable version of PCP (RHEL-30198)
  - Disable pmproxy(1) RESP proxying by default (RHEL-30720)
  - Add pmcheck(1) utility to check installation (RHEL-25497)


author: Nathan Scott <nathans@redhat.com> - 6.2.2-1
changelog:
  - Rebase to latest stable version of PCP (RHEL-30198)
  - Fix pcp2openmetrics on s390x reading from an archive (RHEL-32407)
  - Fix pcp2openmetrics -F output file option (RHEL-32674)
  - Fix pmlogdump version reporting (RHEL-32381)
  - Add timestamps for pcp2openmetrics archive option (RHEL-32369)
  - Add new metrics to monitor VMware balloon usage (RHEL-32198)


author: Lauren Chilton <lchilton@redhat.com> - 6.2.2-4
changelog:
  - Removed excess headers for pcp2openmetrics tool (RHEL-39159)
  - Fix pcp2openmetrics '-s' option (RHEL-39132)
  - Fix pcp2openmetrics timestamps in archive mode (RHEL-32983)
  - Fix pcp2openmetrics output to adhere to prometheus parser (RHEL-39293)


author: Nathan Scott <nathans@redhat.com> - 6.2.2-5
changelog:
  - Add rpm dependency on package providing ps(1) tool (RHEL-39491)
  - Update Java bytecode in pcp-testasuite package (RHEL-40718)


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/e3221b5)
  - Resolves: RHEL-56327 RHEL-50231


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-12
changelog:
  - rebuild to address CVE-2024-34155 CVE-2024-34156 CVE-2024-34158
  - Resolves: RHEL-57980 RHEL-57950 RHEL-58203


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-13
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/6cf9920)
  - Resolves: RHEL-60964


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-14
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/235a22c)
  - Resolves: RHEL-61154


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-15
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/1866072)
  - Resolves: RHEL-61868


author: Jindrich Novy <jnovy@redhat.com> - 4:4.9.4-16
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
    (https://github.com/containers/podman/commit/70e4d02)
  - Resolves: RHEL-65451


author: Jan Rybar <jrybar@redhat.com> - 0.117-13
changelog:
  - session-monitor: watch sessions only
  - PolkitPermission: react on really changed sessions
  - allow polkit-pkla-compat to be uninstalled if no .pkla rules
  - Resolves: RHEL-39063


author: Kate Hsuan <hpa@redhat.com> - 0.21-1
changelog:
  - Update to 0.21
  - Support multi-drivers mode and amdgpu
  - Support dynamically adjusts amd-pstate EPP values between battery and AC modes.
  - Resolves: RHEL-23395


author: Attila Lakatos <alakatos@redhat.com> - 3.1.5-1
changelog:
  - New upstream maintenance release, 3.1.4
  - Prevent scriplets from failing
  - When upgrading, restart the daemon if it's running
  - If uninstalling, stop the daemon
  - auditctl: use pidfd_send_signal for signaling auditd
    Resolves: RHEL-45865
  - Minor doc update
    Resolves: RHEL-5186
  - augenrules: do not exit with failure if in immutable mode
    Resolves: RHEL-40110
  - auditd.service: Disable ProtectControlGroups
    Resolves: RHEL-5197
  - auditctl: correct output when displaying rules with exe/path/dir
    Resolves: RHEL-40243


author: Vojtech Trefny <vtrefny@redhat.com> - 3.6.0-15
changelog:
  - Backport fixes for Stratis support needed for storage role
    Resolves: RHEL-35382
  - Add support for resizing PVs to the size of the underlying block device
    Resolves: RHEL-35386


author: Richard W.M. Jones <rjones@redhat.com> - 1.20.2-2
changelog:
  - Rebase to libnbd 1.20.2
    resolves: RHEL-31883
  - Fix multiple flaws in TLS server certificate checking
    resolves: RHEL-49801
  - Print full NBD error from server
    resolves: RHEL-50665


author: Petr Pisar <ppisar@redhat.com> - 0.7.24-3
changelog:
  - Some static analysis fixes for unitialized structs
    Resolves: RHEL-25498
  - Fix a memory leak in parse_package() of repo conda (RHEL-25496)


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.9-1
changelog:
  - Rebase to 3.11.9
  - Security fixes for CVE-2023-6597 and CVE-2024-0450
  - Fix expat tests for the latest expat security release
  Resolves: RHEL-33677, RHEL-33689


author: Lumír Balhar <lbalhar@redhat.com> - 3.12.2-3
changelog:
  - Move all test modules to the python3-test package, namely:
     - __phello__
     - _xxsubinterpreters
     - xxlimited
     - xxlimited_35
     - xxsubtype


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-1
changelog:
  - Rebase to QEMU 9.0.0 [RHEL-28073]
  - Resolves: RHEL-28073
    (Rebase qemu-kvm to QEMU 9.0.0 for RHEL 9.5)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-2
changelog:
  - kvm-hw-arm-virt-Fix-spurious-call-to-arm_virt_compat_set.patch [RHEL-34945]
  - kvm-Revert-x86-rhel-9.4.0-machine-type-compat-fix.patch [RHEL-30362]
  - Resolves: RHEL-34945
    ([aarch64, kvm-unit-tests] all tests tagged as FAIL [qemu-kvm: GLib: g_ptr_array_add: assertion 'rarray' failed] )
  - Resolves: RHEL-30362
    (Check/fix machine type compatibility for QEMU 9.0.0 [x86_64][rhel-9.5.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-3
changelog:
  - kvm-nbd-server-do-not-poll-within-a-coroutine-context.patch [RHEL-33440]
  - kvm-nbd-server-Mark-negotiation-functions-as-coroutine_f.patch [RHEL-33440]
  - Resolves: RHEL-33440
    (Qemu hang when quit dst vm after storage migration(nbd+tls))


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-4
changelog:
  - kvm-qio-Inherit-follow_coroutine_ctx-across-TLS.patch [RHEL-33440]
  - kvm-iotests-test-NBD-TLS-iothread.patch [RHEL-33440]
  - kvm-virtio-gpu-fix-v2-migration.patch [RHEL-34621]
  - kvm-rhel-9.4.0-machine-type-compat-for-virtio-gpu-migrat.patch [RHEL-34621]
  - Resolves: RHEL-33440
    (Qemu hang when quit dst vm after storage migration(nbd+tls))
  - Resolves: RHEL-34621
    ([RHEL9.5.0][stable_guest_abi]Failed to migrate VM with (qemu) qemu-kvm: Missing section footer for 0000:00:01.0/virtio-gpu qemu-kvm: load of migration failed: Invalid argument)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-5
changelog:
  - kvm-linux-aio-add-IO_CMD_FDSYNC-command-support.patch [RHEL-42411]
  - kvm-Revert-monitor-use-aio_co_reschedule_self.patch [RHEL-34618 RHEL-38697]
  - kvm-aio-warn-about-iohandler_ctx-special-casing.patch [RHEL-34618 RHEL-38697]
  - kvm-block-crypto-create-ciphers-on-demand.patch [RHEL-36159]
  - kvm-crypto-block-drop-qcrypto_block_open-n_threads-argum.patch [RHEL-36159]
  - Resolves: RHEL-42411
    (qemu-kvm: linux-aio: add support for IO_CMD_FDSYNC command)
  - Resolves: RHEL-34618
    (aio=io_uring: Assertion failure `luringcb->co->ctx == s->aio_context' with block_resize)
  - Resolves: RHEL-38697
    (aio=native: Assertion failure `laiocb->co->ctx == laiocb->ctx->aio_context' with block_resize)
  - Resolves: RHEL-36159
    (qemu crash on Assertion `block->n_free_ciphers > 0' failed in guest installation with luks and iothread-vq-mapping)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-6
changelog:
  - kvm-qcow2-Don-t-open-data_file-with-BDRV_O_NO_IO.patch [RHEL-35611]
  - kvm-iotests-244-Don-t-store-data-file-with-protocol-in-i.patch [RHEL-35611]
  - kvm-iotests-270-Don-t-store-data-file-with-json-prefix-i.patch [RHEL-35611]
  - kvm-block-Parse-filenames-only-when-explicitly-requested.patch [RHEL-35611]
  - Resolves: RHEL-35611
    (CVE-2024-4467 qemu-kvm: QEMU: 'qemu-img info' leads to host file read/write [rhel-9.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-7
changelog:
  - kvm-hw-virtio-Fix-the-de-initialization-of-vhost-user-de.patch [RHEL-40708]
  - kvm-hw-arm-virt-Avoid-unexpected-warning-from-Linux-gues.patch [RHEL-39936]
  - Resolves: RHEL-40708
    ([RHEL9.5.0][virtio_fs][s390x] after hot-unplug the vhost-user-fs-ccw device, the device is failed to hot-plug again )
  - Resolves: RHEL-39936
    (ARCH_DMA_MINALIGN smaller than CTR_EL0.CWG (128 < 256) on FUJITSU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-8
changelog:
  - kvm-introduce-pc_rhel_9_5_compat.patch [RHEL-39544]
  - kvm-target-i386-add-guest-phys-bits-cpu-property.patch [RHEL-39544]
  - kvm-kvm-add-support-for-guest-physical-bits.patch [RHEL-39544]
  - kvm-i386-kvm-Move-architectural-CPUID-leaf-generation-to.patch [RHEL-39544]
  - kvm-target-i386-Introduce-Icelake-Server-v7-to-enable-TS.patch [RHEL-39544]
  - kvm-target-i386-Add-new-CPU-model-SierraForest.patch [RHEL-39544]
  - kvm-target-i386-Export-RFDS-bit-to-guests.patch [RHEL-39544]
  - kvm-pci-host-q35-Move-PAM-initialization-above-SMRAM-ini.patch [RHEL-39544]
  - kvm-q35-Introduce-smm_ranges-property-for-q35-pci-host.patch [RHEL-39544]
  - kvm-hw-i386-acpi-Set-PCAT_COMPAT-bit-only-when-pic-is-no.patch [RHEL-39544]
  - kvm-confidential-guest-support-Add-kvm_init-and-kvm_rese.patch [RHEL-39544]
  - kvm-i386-sev-Switch-to-use-confidential_guest_kvm_init.patch [RHEL-39544]
  - kvm-ppc-pef-switch-to-use-confidential_guest_kvm_init-re.patch [RHEL-39544]
  - kvm-s390-Switch-to-use-confidential_guest_kvm_init.patch [RHEL-39544]
  - kvm-scripts-update-linux-headers-Add-setup_data.h-to-imp.patch [RHEL-39544]
  - kvm-scripts-update-linux-headers-Add-bits.h-to-file-impo.patch [RHEL-39544]
  - kvm-linux-headers-update-to-current-kvm-next.patch [RHEL-39544]
  - kvm-runstate-skip-initial-CPU-reset-if-reset-is-not-actu.patch [RHEL-39544]
  - kvm-KVM-track-whether-guest-state-is-encrypted.patch [RHEL-39544]
  - kvm-KVM-remove-kvm_arch_cpu_check_are_resettable.patch [RHEL-39544]
  - kvm-target-i386-introduce-x86-confidential-guest.patch [RHEL-39544]
  - kvm-target-i386-Implement-mc-kvm_type-to-get-VM-type.patch [RHEL-39544]
  - kvm-target-i386-SEV-use-KVM_SEV_INIT2-if-possible.patch [RHEL-39544]
  - kvm-i386-sev-Add-legacy-vm-type-parameter-for-SEV-guest-.patch [RHEL-39544]
  - kvm-hw-i386-sev-Use-legacy-SEV-VM-types-for-older-machin.patch [RHEL-39544]
  - kvm-trace-kvm-Split-address-space-and-slot-id-in-trace_k.patch [RHEL-39544]
  - kvm-kvm-Introduce-support-for-memory_attributes.patch [RHEL-39544]
  - kvm-RAMBlock-Add-support-of-KVM-private-guest-memfd.patch [RHEL-39544]
  - kvm-kvm-Enable-KVM_SET_USER_MEMORY_REGION2-for-memslot.patch [RHEL-39544]
  - kvm-kvm-memory-Make-memory-type-private-by-default-if-it.patch [RHEL-39544]
  - kvm-HostMem-Add-mechanism-to-opt-in-kvm-guest-memfd-via-.patch [RHEL-39544]
  - kvm-RAMBlock-make-guest_memfd-require-uncoordinated-disc.patch [RHEL-39544]
  - kvm-physmem-Introduce-ram_block_discard_guest_memfd_rang.patch [RHEL-39544]
  - kvm-kvm-handle-KVM_EXIT_MEMORY_FAULT.patch [RHEL-39544]
  - kvm-kvm-tdx-Don-t-complain-when-converting-vMMIO-region-.patch [RHEL-39544]
  - kvm-kvm-tdx-Ignore-memory-conversion-to-shared-of-unassi.patch [RHEL-39544]
  - kvm-hw-i386-x86-Eliminate-two-if-statements-in-x86_bios_.patch [RHEL-39544]
  - kvm-hw-i386-Have-x86_bios_rom_init-take-X86MachineState-.patch [RHEL-39544]
  - kvm-hw-i386-pc_sysfw-Remove-unused-parameter-from-pc_isa.patch [RHEL-39544]
  - kvm-hw-i386-x86-Don-t-leak-isa-bios-memory-regions.patch [RHEL-39544]
  - kvm-hw-i386-x86-Don-t-leak-pc.bios-memory-region.patch [RHEL-39544]
  - kvm-hw-i386-x86-Extract-x86_isa_bios_init-from-x86_bios_.patch [RHEL-39544]
  - kvm-hw-i386-pc_sysfw-Alias-rather-than-copy-isa-bios-reg.patch [RHEL-39544]
  - kvm-i386-correctly-select-code-in-hw-i386-that-depends-o.patch [RHEL-39544]
  - kvm-i386-pc-remove-unnecessary-MachineClass-overrides.patch [RHEL-39544]
  - kvm-hw-i386-split-x86.c-in-multiple-parts.patch [RHEL-39544]
  - kvm-scripts-update-linux-header.sh-be-more-src-tree-frie.patch [RHEL-39544]
  - kvm-scripts-update-linux-headers.sh-Remove-temporary-dir.patch [RHEL-39544]
  - kvm-scripts-update-linux-headers.sh-Fix-the-path-of-setu.patch [RHEL-39544]
  - kvm-update-linux-headers-fix-forwarding-to-asm-generic-h.patch [RHEL-39544]
  - kvm-update-linux-headers-move-pvpanic.h-to-correct-direc.patch [RHEL-39544]
  - kvm-linux-headers-Update-to-current-kvm-next.patch [RHEL-39544]
  - kvm-update-linux-headers-import-linux-kvm_para.h-header.patch [RHEL-39544]
  - kvm-machine-allow-early-use-of-machine_require_guest_mem.patch [RHEL-39544]
  - kvm-i386-sev-Replace-error_report-with-error_setg.patch [RHEL-39544]
  - kvm-i386-sev-Introduce-sev-common-type-to-encapsulate-co.patch [RHEL-39544]
  - kvm-i386-sev-Move-sev_launch_update-to-separate-class-me.patch [RHEL-39544]
  - kvm-i386-sev-Move-sev_launch_finish-to-separate-class-me.patch [RHEL-39544]
  - kvm-i386-sev-Introduce-sev-snp-guest-object.patch [RHEL-39544]
  - kvm-i386-sev-Add-a-sev_snp_enabled-helper.patch [RHEL-39544]
  - kvm-i386-sev-Add-sev_kvm_init-override-for-SEV-class.patch [RHEL-39544]
  - kvm-i386-sev-Add-snp_kvm_init-override-for-SNP-class.patch [RHEL-39544]
  - kvm-i386-cpu-Set-SEV-SNP-CPUID-bit-when-SNP-enabled.patch [RHEL-39544]
  - kvm-i386-sev-Don-t-return-launch-measurements-for-SEV-SN.patch [RHEL-39544]
  - kvm-i386-sev-Add-a-class-method-to-determine-KVM-VM-type.patch [RHEL-39544]
  - kvm-i386-sev-Update-query-sev-QAPI-format-to-handle-SEV-.patch [RHEL-39544]
  - kvm-i386-sev-Add-the-SNP-launch-start-context.patch [RHEL-39544]
  - kvm-i386-sev-Add-handling-to-encrypt-finalize-guest-laun.patch [RHEL-39544]
  - kvm-i386-sev-Set-CPU-state-to-protected-once-SNP-guest-p.patch [RHEL-39544]
  - kvm-hw-i386-sev-Add-function-to-get-SEV-metadata-from-OV.patch [RHEL-39544]
  - kvm-i386-sev-Add-support-for-populating-OVMF-metadata-pa.patch [RHEL-39544]
  - kvm-i386-sev-Add-support-for-SNP-CPUID-validation.patch [RHEL-39544]
  - kvm-hw-i386-sev-Add-support-to-encrypt-BIOS-when-SEV-SNP.patch [RHEL-39544]
  - kvm-i386-sev-Invoke-launch_updata_data-for-SEV-class.patch [RHEL-39544]
  - kvm-i386-sev-Invoke-launch_updata_data-for-SNP-class.patch [RHEL-39544]
  - kvm-i386-kvm-Add-KVM_EXIT_HYPERCALL-handling-for-KVM_HC_.patch [RHEL-39544]
  - kvm-i386-sev-Enable-KVM_HC_MAP_GPA_RANGE-hcall-for-SNP-g.patch [RHEL-39544]
  - kvm-i386-sev-Extract-build_kernel_loader_hashes.patch [RHEL-39544]
  - kvm-i386-sev-Reorder-struct-declarations.patch [RHEL-39544]
  - kvm-i386-sev-Allow-measured-direct-kernel-boot-on-SNP.patch [RHEL-39544]
  - kvm-memory-Introduce-memory_region_init_ram_guest_memfd.patch [RHEL-39544]
  - kvm-hw-i386-sev-Use-guest_memfd-for-legacy-ROMs.patch [RHEL-39544]
  - kvm-hw-i386-Add-support-for-loading-BIOS-using-guest_mem.patch [RHEL-39544]
  - kvm-i386-sev-fix-unreachable-code-coverity-issue.patch [RHEL-39544]
  - kvm-i386-sev-Move-SEV_COMMON-null-check-before-dereferen.patch [RHEL-39544]
  - kvm-i386-sev-Return-when-sev_common-is-null.patch [RHEL-39544]
  - kvm-target-i386-SEV-fix-formatting-of-CPUID-mismatch-mes.patch [RHEL-39544]
  - kvm-i386-sev-Fix-error-message-in-sev_get_capabilities.patch [RHEL-39544]
  - kvm-i386-sev-Fallback-to-the-default-SEV-device-if-none-.patch [RHEL-39544]
  - kvm-i386-sev-Don-t-allow-automatic-fallback-to-legacy-KV.patch [RHEL-39544]
  - kvm-target-i386-SEV-fix-mismatch-in-vcek-disabled-proper.patch [RHEL-39544]
  - kvm-virtio-rng-block-max-bytes-0.patch [RHEL-50336]
  - kvm-scsi-disk-Use-positive-return-value-for-status-in-dm.patch [RHEL-50000]
  - kvm-scsi-block-Don-t-skip-callback-for-sgio-error-status.patch [RHEL-50000]
  - kvm-scsi-disk-Add-warning-comments-that-host_status-erro.patch [RHEL-50000]
  - kvm-scsi-disk-Always-report-RESERVATION_CONFLICT-to-gues.patch [RHEL-50000]
  - kvm-nbd-server-Plumb-in-new-args-to-nbd_client_add.patch [RHEL-52617]
  - kvm-nbd-server-CVE-2024-7409-Cap-default-max-connections.patch [RHEL-52617]
  - kvm-nbd-server-CVE-2024-7409-Drop-non-negotiating-client.patch [RHEL-52617]
  - kvm-nbd-server-CVE-2024-7409-Close-stray-clients-at-serv.patch [RHEL-52617]
  - Resolves: RHEL-39544
    ([QEMU] Add support for AMD SEV-SNP to Qemu)
  - Resolves: RHEL-50336
    (Fail to boot up the guest including vtpm and virtio-rng (max-bytes=0) devices)
  - Resolves: RHEL-50000
    (scsi-block: Cannot setup Windows Failover Cluster, qemu crashes on assert)
  - Resolves: RHEL-52617
    (CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-9
changelog:
  - kvm-qemu-guest-agent-Update-the-logfile-path-of-qga-fsfr.patch [RHEL-52250]
  - Resolves: RHEL-52250
    (fsfreeze hooks break on the systems first restorecon)


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-10
changelog:
  - kvm-nbd-server-CVE-2024-7409-Avoid-use-after-free-when-c.patch [RHEL-52617]
  - Resolves: RHEL-52617
    (CVE-2024-7409 qemu-kvm: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure [rhel-9.5])


author: Pavel Reichl <preichl@redhat.com> - 1:4.09-1
changelog:
  - Update to new upstream version
  - Add tmpfs quota support
  - Remove rhel-only patches that were merged upstream


author: Pavel Cahyna <pcahyna@redhat.com> - 2.6-25
changelog:
  - Backport PR 3250 to fix useless warning that libsystemd-core requires
    additional libraries and ReaR recovery system needs additional libraries
  - Backport PR 3242 to fix IPv6 address in nfs:// and sshfs:// BACKUP/OUTPUT_URL
  - Backport PR 2576 to remove obsolete FAT16 options to avoid kernel warning


author: Michal Domonkos <mdomonko@redhat.com> - 208-1
changelog:
  - brp-mangle-shebangs: Strip env flags when mangling shebangs (RHEL-26961)
  - Fix automatic soname requires on non-versioned symlink targets (RHEL-28767)


author: Rich Megginson <rmeggins@redhat.com> - 1.87.1-0.1
changelog:
  - Resolves: RHEL-30888 : storage - Fingerprint storage RHEL System Role managed config files
  - s390x issue fix requires fix for architecture fact


author: Rich Megginson <rmeggins@redhat.com> - 1.87.2-0.1
changelog:
  - Resolves: RHEL-50825 : System Roles: No module documentation
  - Fix storage role tests_lvm_pool_pv_grow issue with pvcreate hang on el7
  - podman - skip quadlet tests on non-x86_64 arch
  - journald - fix the test pattern that looks for the max size
  - network - fix the bond tests issue with firewall
  - sshd - add new parameters for openssh 9.8


author: Rich Megginson <rmeggins@redhat.com> - 1.88.0-0.1
changelog:
  - Resolves: RHEL-55295 : ha_cluster - Fixes for new pcs and ansible
  - fix gather_facts issue with fapolicyd
  - fix gather_facts issue with ha_cluster
  - fix bond test firewall issue with network


author: Rich Megginson <rmeggins@redhat.com> - 1.88.2-0.1
changelog:
  - Resolves: RHEL-55295 : ha_cluster - Fixes for new pcs and ansible
  - several fixes for ostree issues


author: Rich Megginson <rmeggins@redhat.com> - 1.88.4-0.1
changelog:
  - Resolves: RHEL-53896 : kernel_settings - fix: Use tuned files instead of using it as a module
  - recent tuned in el9 changed the profile directory back to the old one
  - so had to change the role to detect directory


author: Rich Megginson <rmeggins@redhat.com> - 1.88.7-0.1
changelog:
  - Resolves: RHEL-56626 : podman - fails to configure and run containers with podman rootless using different username and groupname
  - fapolicyd - fix method used to read from journald to determine when daemon is listening
  - storage - fix tests to use blkid instead of lsblk to get partition table
  - storage - skip stratis tests on el8
  - logging - tests_combination.yml needs fact gathering


author: Rich Megginson <rmeggins@redhat.com> - 1.88.7-0.2
changelog:
  - Resolves: RHEL-56626 : podman - fails to configure and run containers with podman rootless using different username and groupname
  - fapolicyd - fix method used to read from journald to determine when daemon is listening
  - storage - fix tests to use blkid instead of lsblk to get partition table
  - storage - skip stratis tests on el8
  - logging - tests_combination.yml needs fact gathering
  - same as 1.88.7-0.1 but needed to bump N-V-R and rebuild for exception


author: Rich Megginson <rmeggins@redhat.com> - 1.88.8-0.1
changelog:
  - Resolves: RHEL-56626 : podman - fails to configure and run containers with podman rootless using different username and groupname
  - podman - previous fix broke ansible 2.9 + el8 with volume cleanup
  - logging - test issue with imuxsock and journald - restart dbus-broker


author: Rich Megginson <rmeggins@redhat.com> - 1.88.9-0.1
changelog:
  - Resolves: RHEL-56626 : podman - fails to configure and run containers with podman rootless using different username and groupname
  - logging - test issue with imuxsock and loginctl used by podman - restart systemd-logind to fix podman tests
  - updates collection README for new Automation Hub format


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2024.5-1
changelog:
  - Rebase to 2024.5
    Adds fix for https://github.com/coreos/rpm-ostree/security/advisories/GHSA-2m76-cwhg-7wv6
    Resolves: #RHEL-30415


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-30
changelog:
  - Don't segfault on missing priority tag (RHEL-35249)
  - Use unsigned integers for buildtime too for Y2K38 safety (RHEL-22602)
  - Rebuild against libimaevm.so.4 (RHEL-32505)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-31
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-22604)
  - Fix potential use of uninitialized pgp struct (RHEL-22605)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)
  - Add SourceLicense tag to spec syntax (RHEL-28798)
  - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-33
changelog:
  - Fix root relocation regression (RHEL-28967)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-3
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-57576
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57573
    Resolves: RHEL-57570
    Resolves: RHEL-57578
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-57567
  - Fix incorrect symlink for rubygem-irb's library.
    Resolves: RHEL-57597


author: Dan Horák <dhorak@redhat.com> - 2:2.33.1-1
changelog:
  - rebased to 2.33.1 (RHEL-23704)
  - dbginfo.sh: missing data of new ROCE cards (RHEL-24109)
  - SE-tooling: New IBM host-key subject locality (RHEL-30273)
  - Fix disk type detection when running under QEMU (RHEL-40358)
  - Resolves: RHEL-23704 RHEL-24109 RHEL-30273 RHEL-40358


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.0-102
changelog:
  - resolves: RHEL-2109  - Support Certificate Auto Enrollment in Samba
  - resolves: RHEL-22157 - Fix root cert import for samba-gpupdate


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.1-1
changelog:
  - related: RHEL-33645 - Update to version 4.20.1
  - resolves: RHEL-26337 - Fix site lookup for samba-gpupdate
  - resolves: RHEL-5846 - Fix warning messages while upgrading libwbclient


author: Pavel Filipenský <pfilipen@redhat.com> - 4.20.2-1
changelog:
  - related: RHEL-33645 - Update to version 4.20.2
  - resolves: RHEL-45841 - Fix KDC IP address lookup in case of trusted domain
  - resolves: RHEL-23814 - Fix smbclient to enumerate the printers


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-13
changelog:
  - Resolves: RHEL-30352 - squid v5 crashes with SIGABRT when ipv6 is disabled
    at kernel level but it is asked to connect to an ipv6 address by a client


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-14
changelog:
  - Resolves: RHEL-45057 - squid: Out-of-bounds write error may lead to Denial of 
    Service (CVE-2024-37894)
  - Resolves: RHEL-22594 - squid: vulnerable to a Denial of Service attack against
    Cache Manager error responses (CVE-2024-23638)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-1
changelog:
  - Resolves: RHEL-36586 - Rebase SSSD for RHEL 9.5
  - Resolves: RHEL-27716 - SSSD fails to process AD groups with 'Global Scope' correctly causing incomplete group-membership on RHEL if cache is empty
  - Resolves: RHEL-17659 - [RfE] SSSD Failover Enhancements
  - Resolves: RHEL-35781 - Passkey errors when handling multiple altSecurityIdentities values
  - Resolves: RHEL-30142 - sssd_pac is crashing
  - Resolves: RHEL-22206 - Errors in krb5_child.log every time a user authenticates - Pre-authentication failed: No pkinit_anchors supplied
  - Resolves: RHEL-32595 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest
  - Resolves: RHEL-28666 - sssctl config-check is reporting false positive error msg
  - Resolves: RHEL-29454 - NULL dereference in inotify handling
  - Resolves: RHEL-1654 - Improve documentation for allowing e-mail address as username


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-2
changelog:
  - Resolves: RHEL-40742 - passkey_child with wrong owner
  - Resolves: RHEL-41047 - sssd is skipping GPO evaluation with auto_private_groups
  - Resolves: RHEL-40570 - GPO access the wrong memory location


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4
changelog:
  - Resolves: RHEL-49711 - SYSDB: remove index on dataExpireTimestamp
  - Resolves: RHEL-49811 - 2FA is being enforced after upgrading 2.9.1->2.9.4


author: systemd maintenance team <systemd-maint@redhat.com> - 252-39
changelog:
  - enable FIDO2 support (RHEL-36276)
  - netif-naming-scheme: disable NAMING_BRIDGE_MULTIFUNCTION_SLOT (RHEL-44630)
  - netif-naming-scheme: make actually possible to use rhel-9.5 scheme (RHEL-44630)
  - generator: "uninline" generator_open_unit_file and generator_add_symlink (RHEL-33436)
  - ci: add support for rhel-only parameters (RHEL-30372)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-41
changelog:
  - timedatectl: setting set_local_rtc to 1 will throw Warning as well, use log_warning() (#33489) (RHEL-45020)
  - cryptsetup-tokens: fix pin asserts (RHEL-36276)
  - cryptenroll: Use CTAP2.1 credProtect extension (RHEL-36276)
  - kernel-install: check machine ID (RHEL-50672)
  - kernel-install: ignore errors when reading /etc/machine-id (RHEL-50672)
  - hwdb: Add Lenovo G580 (RHEL-5950)
  - Fix key toggle and programmable button for Positivo N14ZP (RHEL-5950)
  - hwdb: Add accel orientation quirk for the Acer Switch V 10 SW5-017 2-in-1 (RHEL-5950)
  - hwdb: fix Compaq N14KP6 key toggle touchpad (#25404) (RHEL-5950)
  - hwdb: remove fuzz and deadzone for Simucube wheel bases. (RHEL-5950)
  - hwdb: Add support for Elgato Stream Pedal (#25550) (RHEL-5950)
  - hwdb: add Clevo touchpad toggle key quirks (RHEL-5950)
  - hwdb: add Dell Inspiron N4010 touchpad corrections (RHEL-5950)
  - hwdb: add Positivo-vaio Pro PW key toggle touchpad (#25669) (RHEL-5950)
  - Add mount matrix for VisionBook 12Wr Tab (RHEL-5950)
  - Update 60-evdev.hwdb (#25704) (RHEL-5950)
  - hwdb: Add additional Dell models that require ACCEL_LOCATION=base (#25724) (RHEL-5950)
  - hwdb: drop trailing space (RHEL-5950)
  - hwdb: add comments about matching entries (RHEL-5950)
  - hwdb: also add a generic entry for DualPoint Stick (RHEL-5950)
  - hwdb: Add mount matrix for CSL Panther Tab HD (RHEL-5950)
  - hwdb: Fix mount matrix for CSL Panther Tab HD (#25752) (RHEL-5950)
  - hwdb: Fn+F5 fix for MSI Bravo 15-B5DX (#25788) (RHEL-5950)
  - hwdb: change definition of PROXIMITY_NEAR_LEVEL for sensors (RHEL-5950)
  - hwdb: Add mic-mute, control-center and screen-rotation mappings for MSI laptops (RHEL-5950)
  - Prevents airplane mode toggle for HP Spectre 16 (RHEL-5950)
  - Update 60-sensor.hwdb (RHEL-5950)
  - Added Tablet Teclast X98 Air 3G (C5J6) (RHEL-5950)
  - hwdb: remove spurious whitespace (RHEL-5950)
  - hwdb: Add Dell models that require ACCEL_LOCATION=base (RHEL-5950)
  - Fix Positivo MASTER-N1110 key toggle touchpad (RHEL-5950)
  - hwdb: Mark Dell platform accel sensor location to base (RHEL-5950)
  - hwdb: Add mount matrix for Linx 1020 (RHEL-5950)
  - hwdb: Add mic mute key mappings for Dell G16 Series (RHEL-5950)
  - hwdb: Add Chuwi Hi10X (N4120 version) iio matrix (RHEL-5950)
  - hwdb: Add touchpad toggle mapping for System76 Pangolin 12 (RHEL-5950)
  - hwdb: Prevent activation of airplane mode on HP ENVY x360 (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb: update (RHEL-5950)
  - hwdb: update autosuspend db (RHEL-5950)
  - hwdb: ieee1394-unit-function: add MOTU 896 mk3 Hybrid (RHEL-5950)
  - Add hwdb sensor entry for Lenovo IdeaPad Duet 3 10IGL5 (82AT). (RHEL-5950)
  - Fix Positivo-vaio VJPW12F11X key toggle touchpad (RHEL-5950)
  - hwdb: Add HP Envy x360 Convertible 15-cn0xxx to existing entry (RHEL-5950)
  - hwdb: add override for IdeaPad5 insert key (RHEL-5950)
  - hwdb: update database (RHEL-5950)
  - hwdb: Add HP ENVY x360 2-in-1 (RHEL-5950)
  - hwdb: update (RHEL-5950)
  - hwdb: fix swapped buttons for Logitech Lift left (RHEL-5950)
  - Revert "hwdb: fix swapped buttons for Logitech Lift left" (RHEL-5950)
  - hwdb: update 70-mouse.hwdb (#26782) (RHEL-5950)
  - hwdb: 60-keyboard.hwdb: Fix modalias for Thinkpad X200 Tablet (#26795) (RHEL-5950)
  - Add rebrands of Medion Akoya notebooks/tablets (RHEL-5950)
  - hwdb: fix Wifi toggling for Haier 7G-Series/JWU (#25293) (#26878) (RHEL-5950)
  - hwdb: drop boilerplate about match patterns in two more cases (RHEL-5950)
  - hwdb: Fix incorrect touchpad dimensions on Thinkpad L14 Gen1 (#26937) (RHEL-5950)
  - hwdb: drop redundant entry (RHEL-5950)
  - hwdb: Fixed thumb buttons reversed on CHERRY MW 2310 (#26992) (RHEL-5950)
  - hwdb: Move MSI touchpad-toggle mapping to generic MSI section (RHEL-5950)
  - update 60-sensor.hwdb with toshiba tablet (#27103) (RHEL-5950)
  - hwdb: Add support for "Passion Model P612F" (RHEL-5950)
  - hwdb: fix ambiguous glob pattern for Lenovo machines (RHEL-5950)
  - hwdb: add matrix for Asus BR1100F (#27197) (RHEL-5950)
  - hwdb: add accelerometer mount matrix for Lenovo Yoga Tablet 2 851F/L (RHEL-5950)
  - hwdb: Fix rotation for BMAX Y13 (RHEL-5950)
  - hwdb: disable entry for Logitech USB receiver used by G502 X (RHEL-5950)
  - hwdb: add hardware rfkill key for Dell Latitude E6* models (#27462) (RHEL-5950)
  - hwdb: do not include '#' in modalias (RHEL-5950)
  - hwdb: add landscape IdeaPad Miix 310 sensor orientation (#27555) (RHEL-5950)
  - Fix Positivo CF40CM-V2 key toggle touchpad (RHEL-5950)
  - hwdb: fix keyboard entry for IdeapadFlex5 (#27643) (RHEL-5950)
  - hwdb: fix Positivo CG15D key toggle touchpad and programmable keys (#27689) (RHEL-5950)
  - hwdb: add support for Elgato Stream Deck mini (gen 2) (RHEL-5950)
  - hwdb: fix arrow keys on HP Elite Dragonfly G3 (RHEL-5950)
  - hwdb: add support for Jun Tab2/Dere T11 to 60-sensor.hwdb (#28092) (RHEL-5950)
  - hwdb: fix volume control keys on Lenovo IdeaPad Flex 5 (14ARE05) (RHEL-5950)
  - hwdb: Add override for headset form-factors (RHEL-5950)
  - hwdb : add support for Archos 101 Cesium Educ to 60-sensor.hwdb (RHEL-5950)
  - hwdb: drop trailing white space (RHEL-5950)
  - hwdb: merge multiple keyboard entries with same setting (RHEL-5950)
  - hwdb: make matching modalias for Archos 101 Cesium Educ more strict (RHEL-5950)
  - hwdb update for v246-rc1 (RHEL-5950)
  - update hwdb autosuspend data for v254 (RHEL-5950)
  - hwdb: add support for Archos 101 Cesium to 60-sensor.hwdb (#28270) (RHEL-5950)
  - Hwdb: Add Sanwa Direct 400-MA128 external trackpad (#28272) (RHEL-5950)
  - hwdb: drop POINTINGSTICK_CONST_ACCEL (RHEL-5950)
  - Add alternate name for MX Ergo as found on some devices (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb: run update-hwdb (RHEL-5950)
  - hwdb: run update-hwdb (RHEL-5950)
  - hwdb: Mute SW rfkill keys on MSI Wind U100 (RHEL-5950)
  - Update 60-sensor.hwdb (#28804) (RHEL-5950)
  - hwdb: Added config for RCA W101SA23T1 (#29041) (RHEL-5950)
  - Update 60-input-id.hwdb: add TEX Shinobi (#29068) (RHEL-5950)
  - hwdb: keyboard: D330 FnLk toggle (RHEL-5950)
  - hwdb: Add Logitech G502 X (RHEL-5950)
  - hwdb: ieee1394-unit-function: remove superfluous Weiss Engineering DAC1 entry (RHEL-5950)
  - hwdb: ieee1394-unit-function: add Weiss Engineering DAC202 (Maya edition) (RHEL-5950)
  - hwdb: ieee1394-unit-function: add Weiss Engineering INT203 entry with older firmware (RHEL-5950)
  - hwdb: ieee1394-unit-function: add Weiss Engieering MAN301 (RHEL-5950)
  - hwdb: Add quirk for teclast x3 plus (G4K3) rotation (#29202) (RHEL-5950)
  - hwdb: add mic mute key mappings for Acer Predator Triton 300 SE (RHEL-5950)
  - hwdb: Bush tablet rotation support (#29268) (RHEL-5950)
  - hwdb: ieee1394-unit-function: add Miglia Technology Harmony Audio (HA02) (RHEL-5950)
  - add support for hp pavilion gaming 15 lid switch (#29304) (RHEL-5950)
  - Fix Positivo N14EP6 key toggle touchpad and programmable keys (#29448) (RHEL-5950)
  - add udev rule for micmute (f20) (RHEL-5950)
  - hwdb,rules: mark host-to-host network devices as only requiring link local addressing (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - Update hwdb autosuspend rules (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb: Add accelerometer data for Librem11 (#29974) (RHEL-5950)
  - hwdb: PNP/ACPI lists on uefi.org are now in CSV format (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb: rename .html=>.csv (RHEL-5950)
  - hwdb/acpi-update.py: streamline python code (RHEL-5950)
  - hwdb: Mark Dell platform accel sensor location to base (RHEL-5950)
  - hwdb: add Predator PHN16-71 (RHEL-5950)
  - Update 60-autosuspend.hwdb (#30131) (RHEL-5950)
  - hwdb: update (RHEL-5950)
  - hwdb: ieee1394-unit-function: add Sony DVMC-DA1 (RHEL-5950)
  - hwdb: ieee1394-unit-function: arrangement for Sony DVMC-DA1 (RHEL-5950)
  - hwdb: update (RHEL-5950)
  - hwdb: update (RHEL-5950)
  - Adding Trekstor Primebook C13 rotation to 60-sensor.hwdb (#30415) (RHEL-5950)
  - Add three Dell platforms to sensor accel location base (RHEL-5950)
  - Add Bosto BT-12HD series to hwdb (RHEL-5950)
  - hwdb: Add override for headset form-factor for the Corsair Void Elite (RHEL-5950)
  - hwdb: add Teclast X98 Pro sensor info (#30859) (RHEL-5950)
  - hwdb: Correct display rotation on Chuwi Ubook X N4100 (#24248) (RHEL-5950)
  - hwdb: ieee1394-unit-function: adjustment of entries with device attributes available in Linux v6.8 (RHEL-5950)
  - 60-evdev.hwdb: Add support for Huion Inspiroy 2 L (#31241) (RHEL-5950)
  - hwdb: add resolution setting for GAOMON S620 (RHEL-5950)
  - hwdb: Remove version check in CH Pro Pedals rule (RHEL-5950)
  - hwdb: Add support for MetawillBook01 to 60-sensor.hwdb Add accel orientation quirk for the METAPHYUNI MetawillBook01 2-in-1 laptop (RHEL-5950)
  - hwdb: Add headset form-factor override for Xbox Wireless Dongle (RHEL-5950)
  - hwdb: Add support for Elgato Stream Deck Plus (RHEL-5950)
  - Fix: Chuwi UBook X (CWI535) screen rotation matrix (RHEL-5950)
  - hwdb: Add touchpad toggle mapping for Kvadra LE14U/LE15U (RHEL-5950)
  - hwdb: Add touchpad configuration for ThinkPad E495 (RHEL-5950)
  - Fix Positivo N14NPE-N and N15NPE-N key toggle touchpad and search key (RHEL-5950)
  - Update USB ids of hwdb (RHEL-5950)
  - Added resolution for Huion Kamvas Pro 19 (RHEL-5950)
  - hwdb: Add mapping for ACPI quickstart keys on Toshiba Z830 (RHEL-5950)
  - hwdb: fix Asus T300FA rotation matrix (#31973) (RHEL-5950)
  - Fixed resolution for pen and touchpad (RHEL-5950)
  - hwdb: fix missing colon (#32108) (RHEL-5950)
  - hwdb: update for v256 (RHEL-5950)
  - autosuspend: update for v256 (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - Update autosuspend hwdb (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb: Add a common Logitech M185/M225 mouse variant (RHEL-5950)
  - hwdb: Add mapping for Samsung GalaxyBook - 550X (#32616) (RHEL-5950)
  - hwdb: Add mapping for Xiaomi Mipad 2 bottom bezel capacitive buttons (RHEL-5950)
  - hwdb: ieee1394-unit-function: add Tascam IF-FW/DM mkII (RHEL-5950)
  - hwdb: Add a Logitech MX Master 3S (connected via Bolt Receiver) (RHEL-5950)
  - Fix Positivo N14EPE and N15EPE key toggle touchpad and search key (RHEL-5950)
  - hwdb: update Dere N12 / Juno Tablet 3 accelerometer (#32765) (RHEL-5950)
  - hwdb: updated Librem 11 accelerometer (#32772) (RHEL-5950)
  - hwdb: ID_INPUT_XYZ allows an empty string (RHEL-5950)
  - hwdb: ASRock LED Controller classified incorrectly as joystick due to buttons and axis (#32775) (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb.d/60-keyboard.hwdb: enable Clevo quirk for model V5x0TU (RHEL-5950)
  - hwdb: Enable JP-IK LEAP W502's touchpad toggle key (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - Update autosuspend hwdb (RHEL-5950)
  - hwdb: Lenovo IdeaPad Z500 Touchpad Toggle (#33039) (RHEL-5950)
  - hwdb: add a vmbus id for HyperV Video device (RHEL-5950)
  - hwdb: Add Logitech MX Master 3S Bluetooth ID (RHEL-5950)
  - hwdb: Lenovo 16G6IRL volume keys and friends (#33107) (RHEL-5950)
  - hwdb: added hwdb rules for micmute and power button on Acer Nitro AN 515-58 (#32867) (RHEL-5950)
  - Fix key toggle touchpad and programmable buttom for Positivo N14AP7 (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb: add keyboard mappings for the Ayaneo Kun face buttons (RHEL-5950)
  - Update hwdb (RHEL-5950)
  - hwdb: add support for AIPTEK Media Tablet Ultimate (#33371) (RHEL-5950)
  - hwdb: add scancodes for AYANEO devices (#33378) (RHEL-5950)
  - Add OrangePi NEO Scancodes (RHEL-5950)
  - hwdb: Fix Logitech G915 TKL (Bluetooth) appearing as a mouse (RHEL-5950)
  - hwdb: fix keyboard of RedmiBook Pro 15 2022 (#33465) (RHEL-5950)
  - Added mised EVDEV_ABS_35 & EVDEV_ABS_36 for GAOMON s620 (RHEL-5950)
  - hwdb: Add some HP IR cameras (RHEL-5950)
  - hwdb: add more AV controllers (RHEL-5950)
  - Fix key toggle touchpad button for multilaser ul154 (#33630) (RHEL-5950)
  - hwdb: Added StarLabs StarLite position sensor mapping (RHEL-5950)
  - 70-mouse.hwdb: Added Glorious Model O DPI (RHEL-5950)
  - Update 60-sensor.hwdb (RHEL-5950)
  - Add MSI Claw AT Keyboard Scancodes. (RHEL-5950)
  - Add or fix mount matrix for multiple handhelds. (#33586) (RHEL-5950)
  - Revert "hwdb: Added StarLabs StarLite position sensor mapping" (RHEL-5950)
  - hwdb: fix accelerometer mount matrix for Aquarius Cmp NS483 (RHEL-5950)
  - hwdb: add backslash and touchpad toggle mapping for Aquarius Cmp NS483 (RHEL-5950)
  - hwdb: Add mic mute key mapping for Dell Pro Rugged series (RHEL-5950)
  - hwdb: fix MXC6655 accelerometer mount matrix for Aquarius Cmp NS483 (RHEL-5950)
  - add udev rules for trezor hw wallet devices (RHEL-5950)
  - hwdb: add axis range corrections for the Lenovo Thinkpad E16 (RHEL-5950)
  - hwdb: fix auto rotate on Asus Q551LB (#33921) (RHEL-5950)
  - udev: add hwdb execution for hidraw subsystem devices (RHEL-5950)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-43
changelog:
  - udev-builtin-net_id: skip non-directory entry earlier (RHEL-50103)
  - udev-builtin-net_id: return earlier when hotplug slot is not found (RHEL-50103)
  - udev-builtin-net_id: split-out pci_get_hotplug_slot() and pci_get_hotplug_slot_from_address() (RHEL-50103)
  - udev-builtin-net_id: use firmware_node/sun for ID_NET_NAME_SLOT (RHEL-50103)
  - Include <threads.h> if possible to get thread_local definition (RHEL-50651)
  - add APIs for detecting confidential virtualization (RHEL-50651)
  - detect-virt: add --cvm option (RHEL-50651)
  - detect-virt: add --list-cvm option (RHEL-50651)
  - unit: add "cvm" option for ConditionSecurity (RHEL-50651)
  - dbus: add 'ConfidentialVirtualization' property to manager object (RHEL-50651)
  - core: log detected confidential virtualization type (RHEL-50651)
  - core: set SYSTEMD_CONFIDENTIAL_VIRTUALIZATION env for generators (RHEL-50651)
  - udev: add 'conf-virt' constant for confidential virtualization tech (RHEL-50651)
  - confidential-virt: split caching of CVM detection into separate method (RHEL-50651)
  - confidential-virt: add detection for s390x target (RHEL-50651)
  - man/systemd-detect-virt: list known CVM technologies (RHEL-50651)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-44
changelog:
  - Revert "udev-builtin-net_id: use firmware_node/sun for ID_NET_NAME_SLOT" (RHEL-50103)
  - fundamental: share constants for confidential virt detection (RHEL-50651)
  - efi: add helper API for detecting confidential virtualization (RHEL-50651)
  - efi: don't pull kernel cmdline from SMBIOS in a confidential VM (RHEL-50651)
  - Fix detection of TDX confidential VM on Azure platform (RHEL-50651)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-46.2
changelog:
  - add %posttrans scriptlet to make sure our SELinux policy module is actually installed (RHEL-46339)


author: Martin Cermak <mcermak@redhat.com> - 5.1-4
changelog:
  - RHEL-50107.patch:  Make systemtap compatible with kernel
    commit 68cbd415dd4b .  Related: RHEL-56962 .


author: Jan Grulich <jgrulich@redhat.com> - 1.14.0-2
changelog:
  - 1.14.0
    Resolves: RHEL-45316
  - Move old log to log.old if present
    Resolves: RHEL-54294
  - Fix shared memory leak
    Resolves: RHEL-55768


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-39
changelog:
  - Resolves: RHEL-17605
    tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)


author: Sokratis Zappis <szappis@redhat.com> - 1:9.0.87-1
changelog:
  - Resolves: RHEL-35812 - Rebase tomcat to version 9.0.87
  - Resolves: RHEL-29257
    tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
  - Resolves: RHEL-29252
    tomcat: : Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)
  - Resolves: RHEL-53001 - Amend tomcat's changelog
    (CVE-2023-46589, CVE-2023-45648, CVE-2023-42795, CVE-2023-42794, CVE-2023-44487, CVE-2023-41080)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-2
changelog:
  - Resolves: RHEL-46163
    tomcat: Improper Handling of Exceptional Conditions (CVE-2024-34750)
  - Resolves: RHEL-18245 - OpenJDK 21 support for RHEL Tomcat


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-50568
    - spec: create /etc/tuned/profiles directory
    - hotplug: wait for device initialization
    - sap-netweaver: increased vm.max_map_count
      resolves: RHEL-31757
    - daemon: buffer sighup signal
      resolves: RHEL-31180
    - added an option to configure profile directories
      resolves: RHEL-26157
    - api: added commands to dynamically create/destroy instances
    - functions: added 'intel_recommended_pstate'
    - functions: added 'log' which helps with debugging
    - functions: added 'package2cpus' and 'packages2uncores' matchers
    - functions: added 'lscpu' to list CPU details
    - plugins: added plugin_irq
    - plugin_video: added support for amdgpu `panel_power_savings` attribute
    - plugin_cpu: check that writes are necessary if they may cause redundant IPIs
      resolves: RHEL-25613
    - plugin_uncore: allow to configure frequency limits using percent
    - amd-pstate: added support for controlling core performance boost
    - plugin_scheduler: adjusted error logging in _set_affinity
      resolves: RHEL-46560
    - plugin_audio: enabled controller reset to fix suspend with NVIDIA
    - plugin_irq: fixed expansion of variables
    - plugin_irqbalance: switched to IRQBALANCE_BANNED_CPULIST


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.2.rc1
changelog:
  - fixed functions packaging and added explicit conflict with power-profiles-daemon
    related: RHEL-50568


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-50568
    - clear plugin repository when stopping tuning
    - man: add description of the balanced-battery profile


author: Patsy Griffin <patsy@redhat.com> - 2024a-2
changelog:
  - Add java patch to fix incorrect calculations for
    Africa/Casablanca starting in 2027. (RHEL-26860)


author: Patsy Griffin <patsy@redhat.com> - 2024b-1
changelog:
  - Update to tzdata-2024b
    - Improve historical data for Mexico, Mongolia, and Portugal.
    - System V names are now obsolescent.
    - The main data form now uses %z.
    - The code now conforms to RFC 8536 for early timestamps.
    - Support POSIX.1-2024, which removes asctime_r and ctime_r.
    - Assume POSIX.2-1992 or later for shell scripts.
    - SUPPORT_C89 now defaults to 1.
    - Include two upstream patches for month names as in April vs Apr.


author: Mark Wielaard <mjw@redhat.com> - 3.23.0-4
changelog:
  Add upstream VALGRIND_3_23_BRANCH patches
    0001-Prepare-NEWS-for-branch-3.23-fixes.patch
    0002-486180-MIPS-VexGuestArchState-has-no-member-named-gu.patch
    0003-Bug-486293-memccpy-false-positives.patch
    0004-Bug-486569-linux-inotify_init-syscall-wrapper-missin.patch
    0005-aarch64-frinta-and-frinta-vector-instructions.patch
    0006-mips-skip-using-shared-syscall-numbers-for-mips32.patch
    0007-Fix-uninitialized-err-in-handle_extension.patch
    0008-Avoid-use-of-guest_IP_AT_SYSCALL-in-handle_extension.patch
    0009-s390x-Minor-fixes-in-extension-s390x.c.patch
    0010-Bug-453044-gbserver_tests-failures-in-aarch64.patch
    0011-Linux-regtest-reallocarray-needs-malloc.h.patch
    0012-Bug-487439-SIGILL-in-JDK11-JDK17.patch
    0013-Don-t-leave-fds-created-with-log-file-xml-file-or-lo.patch
    0014-Close-both-internal-pipe-fds-after-VG_-fork-in-paren.patch
    0015-Don-t-allow-programs-calling-fnctl-on-valgrind-s-own.patch
    0016-mips-skip-using-shared-syscall-numbers-for-mips64.patch
    0017-gdbserver_tests-filters-remove-python-rpm-module-loa.patch
    0018-Implement-VMOVQ-xmm1-xmm2-m64.patch
    0019-arm64-Fix-fcvtas-instruction.patch
    0020-gdbserver_tests-filters-remove-more-verbose-python-r.patch
    0021-Avoid-dev-inode-check-on-btrfs-with-sanity-level-3.patch


author: Tomas Korbar <tkorbar@redhat.com> - 6.6.2-5
changelog:
  - Add parameters h2_rst_allowance and h2_rst_allowance_period to mitigate CVE-2023-44487
  - Resolves: RHEL-12818


author: Luboš Uhliarik <luhliari@redhat.com> - 6.6.2-6
changelog:
  - Resolves: RHEL-30337 - varnish: HTTP/2 Broken Window Attack may result
    in denial of service (CVE-2024-30156)


author: José Expósito <jexposit@redhat.com> - 1.20.11-25
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: James Chapman <jachapma@redhat.com> - 2.5.1-1
changelog:
  - Bump version to 2.5.1-1
  - Resolves: RHEL-31777 - Rebase 389-ds-base.2.5.1 in RHEL 9.5
  - Resolves: RHEL-33348 - redhat-ds:11/389-ds-base: potential denial of service via specially crafted kerberos AS-REQ requ


author: James Chapman <jachapma@redhat.com> - 2.5.1-2
changelog:
  - Bump version to 2.5.1-2
  - Resolves: RHEL-44324 - unauthenticated user can trigger a DoS by sending a specific extended search request
  - Resolves: RHEL-40946 - Malformed userPassword hash may cause Denial of Service
  - Resolves: RHEL-33087 - dsconf schema does not show inChain matching rule
  - Resolves: RHEL-28177 - Malformed userPassword may cause crash at do_modify in slapd/modify.c
  - Resolves: RHEL-25070 - nsslapd-haproxy-trusted-ip is not in schema


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-1
changelog:
  - Bump version to 2.5.2-1
  - Resolves: RHEL-5108 - ns-slapd crash in referint_get_config
  - Resolves: RHEL-5113 - nsslapd-numlisteners limit is not enforced
  - Resolves: RHEL-5115 - `dscreate ds-root` accepts relative path
  - Resolves: RHEL-5131 - ldif2db can be very slow
  - Resolves: RHEL-5138 - Logconv.pl CSV file contains mismatched header and data columns
  - Resolves: RHEL-14760 - ns-slapd crash in vlvIndex_delete
  - Resolves: RHEL-17511 - nsslapd-idletimeout is ignored
  - Resolves: RHEL-49454 - perf search result investigation for many large static groups and members
  - Resolves: RHEL-49458 - subsuffix are not returned in one level scoped search


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-2
changelog:
  - Bump version to 2.5.2-2
  - Resolves: RHEL-55744 - ipahealthcheck.ds.backends.BackendsCheck.DSBLE0006: BDB is deprecated and should not be used as a backend


author: Radovan Sroka <rsroka@redhat.com> - 0.16-102
changelog:
  RHEL 9.5.0 ERRATUM
  - aide fails with "Not enough parameters in db:15384. Trying to continue." unexpectedly
  Resolves: RHEL-27606
  - AIDE fails when using root_prefix option
  Resolves: RHEL-28882


author: Thomas Woerner <twoerner@redhat.com> - 1.13.1-1
changelog:
  - Update to version 1.13.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.1
    Resolves: RHEL-35565
  - New inventory plugin
    Resolves: RHEL-35541
  - Enable batch command as backend
    Resolves: RHEL-38943
  - New collection sub package
    Resolves: RHEL-38931


author: Thomas Woerner <twoerner@redhat.com> - 1.13.2-1
changelog:
  - Update to version 1.13.2
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.13.2
    Resolves: RHEL-35565
  - Convert input certificates
    Resolves: RHEL-44614
  - Fix rolesdeployment with IPA 4.12
    Resolves: RHEL-40869


author: Jerome Marchand <jmarchan@redhat.com> - 0.30.0-3
changelog:
  - Really prevent the loading of compromised headers (RHEL-28769, CVE-2024-2314)
  - Add python3-pyelftools dependency (RHEL-36583)


author: Viktor Malik <vmalik@redhat.com> - 0.20.3-1
changelog:
  - Rebase on bpftrace 0.20.3 (RHEL-30779)
  - Fix CVE allowing unprivileged users loading of compromised linux headers
    (RHEL-28765, CVE-2024-2313)
  - Fix bpftrace creating BPF programs with truncated names (RHEL-8502)


author: Viktor Malik <vmalik@redhat.com> - 0.20.4-1
changelog:
  - Rebase on bpftrace 0.20.4
  - Fix CVE allowing unprivileged users loading of compromised linux headers
    (RHEL-28765, CVE-2024-2313)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.37.0-1
changelog:
  - update to https://github.com/containers/buildah/releases/tag/v1.37.0
  - Resolves: RHEL-47164 RHEL-40808


author: Packit <hello@packit.dev> - 89-1
changelog:
  - Use binary http channel for podman socket for non-UTF-8 robustness
  - Stop using obsolete cockpit.utf8_{de,en}coder() API
  - Fix tests for CentOS/RHEL 10


author: Jindrich Novy <jnovy@redhat.com> - 3:2.230.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.230.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.231.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.231.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 3:2.232.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.232.1
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.4.1
  - Resolves: RHEL-28855


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1:1.5.1-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.5.1
  - Related: RHEL-27608


author: Jeff Moyer <jmoyer@redhat.com> - 78-1
changelog:
  - Rebase to v78
  - Add support for legacy monitor.conf file location
  - Fix a test failure.
  - Resolves: RHEL-10382
  - Resolves: RHEL-8204
  - Resolves: RHEL-29151


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-14
changelog:
  - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55212)
  - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55224)


author: Pavel Valena <pvalena@redhat.com> - 057-67.git20240812
changelog:
  - feat(systemd): install systemd-executor
  - test: use -device instead of -watchdog to remove qemu
  - fix(fips): remove /dev/{random,urandom} pre-creation
  - fix(systemd): always include sg module
  - fix(fips): do not blindly remove /boot
  - fix(github): update format of labeler
  - fix(network-manager): add "After" dependency on dbus.service
  - fix(url-lib.sh): nfs_already_mounted() with trailing slash in
  - feat(systemd-pcrphase): introducing the systemd-pcrphase
  - fix(systemd-pcrphase): only include
  - fix(nfs): include also entries from /usr/lib/{passwd,group}


author: Pavel Valena <pvalena@redhat.com> - 057-70.git20240819
changelog:
  - fix(systemd): set right permissions for the machine-id file
  - feat(lsinitrd.sh): look for initrd in /usr/lib/modules/
  - feat(dracut-init.sh): give --force-add precedence over --omit


author: Viktor Malik <vmalik@redhat.com> - 1.27-1
changelog:
  - Resolves: RHEL-30780
  - New release: v1.26
  - When expanding types using 'pahole -E' do it for union and struct typedefs and for enums too.
  - Print number of holes, bit holes and bit paddings in class member types.
  - Introduce --contains_enumerator=ENUMERATOR_NAME:
  - Fix pretty printing using DWARF, waiting for a CU with both class (-C) and a specified "type_enum".
  - Add support for DW_TAG_constant in the DWARF loader, first seen in Go DWARF.
  - Fix loading DW_TAG_subroutine_type generated by the Go compiler.
  - Fix loading of 32-bit signed enums from BTF.
  - Add 'pahole --btf_features' to allow consumers to specify an opt-in set of features they want to use in BTF encoding.
  - Parallelize loading BTF and DWARF, speeding up a bit btfdiff.
  - Do type expansion to cover "private" types and enumerations in btfdiff.
  - New release: v1.27
  - Reproducible parallel builds: multiple runs with different number of loading/encoding threads produce the same result.
  - Inject kfunc decl tags into BTF from the BTF IDs ELF section in the Linux kernel vmlinux file.
  - Sanitize unsupported DWARF int type with greater-than-16 byte, as BTF doesn't support it.
  - Initial support for BTF_KIND_DECL_TAG in the BTF loader, adding support in pfunct output.
  - Fix hole discovery with inheritance in C++.


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240214-2
changelog:
  - edk2-OvmfPkg-PlatformPei-log-a-warning-when-memory-is-tig.patch [RHEL-22202]
  - edk2-OvmfPkg-PlatformPei-consider-AP-stacks-for-pei-memor.patch [RHEL-22202]
  - edk2-OvmfPkg-PlatformPei-rewrite-page-table-calculation.patch [RHEL-22202]
  - edk2-OvmfPkg-PlatformPei-log-pei-memory-cap-details.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p2.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p3.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p4.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-Add-support-for-multiple-HOBs-t.p5.patch [RHEL-22202]
  - edk2-UefiCpuPkg-MpInitLib-return-early-in-GetBspNumber.patch [RHEL-22202]
  - Resolves: RHEL-22202
    ([EDK2] Support booting with 4096 vcpus)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-1
changelog:
  - Rebase to edk2-stable202405
  - Bumo openssl to 8e5beb77088b
  - Resolves: RHEL-32486
    (rebase to edk2-stable202405 [rhel-9])
  - Resolves: RHEL-36446
    (edk2: enable MOR [rhel-9])
  - Resolves: RHEL-21653
    (CVE-2023-6237 edk2: openssl: Excessive time spent checking invalid RSA public keys [rhel-9])
  - Resolves: RHEL-21150
    (CVE-2023-6129 edk2: mysql: openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC)
  - Resolves: RHEL-22490
    (CVE-2024-0727 edk2: openssl: denial of service via null dereference [rhel-9])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-2
changelog:
  - edk2-MdeModulePkg-Warn-if-out-of-flash-space-when-writing.patch [RHEL-43442]
  - Resolves: RHEL-43442
    (edk2 disconnects abnormally before loading the kernel)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-3
changelog:
  - edk2-NetworkPkg-DxeNetLib-adjust-PseudoRandom-error-loggi.patch [RHEL-45899]
  - edk2-NetworkPkg-DxeNetLib-Reword-PseudoRandom-error-loggi.patch [RHEL-45899]
  - Resolves: RHEL-45899
    ([RHEL-9.5.0] edk2 hit Failed to generate random data)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-4
changelog:
  - edk2-AmdSevDxe-Fix-the-shim-fallback-reboot-workaround-fo.patch [RHEL-56081]
  - Resolves: RHEL-56081
    ([EDK2] Shim fallback reboot workaround might not work on SNP)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-5
changelog:
  - edk2-UefiCpuPkg-PiSmmCpuDxeSmm-skip-PatchInstructionX86-c.patch [RHEL-45847]
  - Resolves: RHEL-45847
    ([RHEL9.5] Hotplug vcpu to a guest cause guest kernel panic)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-6
changelog:
  - edk2-OvmfPkg-CpuHotplugSmm-delay-SMM-exit.patch [RHEL-56974]
  - edk2-Bumped-openssl-submodule-version-to-0205b5898872.patch [RHEL-55336]
  - Resolves: RHEL-56974
    (qemu-kvm: warning: Blocked re-entrant IO on MemoryRegion: acpi-cpu-hotplug at addr: 0x0 [rhel-9])
  - Resolves: RHEL-55336
    (CVE-2024-6119 edk2/openssl: Possible denial of service in X.509 name checks [rhel-9.5])


author: Eric Garver <egarver@redhat.com> - 1.3.4-6
changelog:
  - feat(IPv6_rpfilter): support loose rpfilter
  - feat(IPv6_rpfilter): support loose-forward rpfilter
  - feat(IPv6_rpfilter): support strict-forward rpfilter


author: Nick Clifton <nickc@redhat.com> - 12.67-1
changelog:
  - Annocheck: Stop spurious assembler warnings.  (RHEL-53213)
  - Annocheck: Stop warnings about known gaps.    (RHEL-53218)
  - Annocheck: Fix stack realign test.  (#2302427)


author: Nick Clifton <nickc@redhat.com> - 12.67-2
changelog:
  - Spec File: Use correct directory for plugin installation.  (RHEL-53209)
  - Spec File: Disable plugin when running on wrong major version of the compiler.


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53209)


author: Guinevere Larsen <blarsen@redhat.com>
changelog:
  - Remove gdb-6.5-BEA-testsuite.patch, as it was upstreamed and
    will make its way back with the next rebase.


author: Kevin Buettner <kevinb@redhat.com> - 14.1-8
changelog:
  - Backport upstream workaround for GCC 14 problem which is causing
    GDB internal errors (RHBZ 261580, Tom de Vries).


author: Keith Seitz <keiths@redhat.com>
changelog:
  - Backport "gdb: s390: Add arch14 record/replay support"
    (Andreas Arnez, RHEL-36225)
  - Backport "Add support for Power11 options"
    (Peter Bergner, RHEL-36518)
  - Backport "Sync x86 disassembler with (proposed) gdb-15.1 release."
    (many authors, RHEL-36527)


author: Guinevere Larsen <blarsen@redhat.com>
changelog:
  - Backport series Infcalls from B/P conditions in multi-threaded inferiors
    (Andrew Burgess, RHEL-13298)


author: Guinevere Larsen <blarsen@redhat.com> - 14.2-1.el9
changelog:
  - Rebase to gdb-14.2 and update all bug references
    (Resolves: RHEL-39554)
    (Resolves: RHEL-39553)
    (Resolves: RHEL-10550)
    (Resolves: RHEL-39555)
    (Resolves: RHEL-39585)
    (Resolves: RHEL-36211)


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-2
changelog:
  - Fixes patch 1002 for update to golang-fips
  - Remove unused code under apsl-1.1 and apsl-1.2 licenses
  - Resolves RHEL-33655


author: Richard W.M. Jones <rjones@redhat.com> - 1.51.6-4
changelog:
  - Add support for nbd+unix:// URIs
    resolves: RHEL-33956
  - customize: Implement --inject-blnsvr operation
    resolves: RHEL-36634


author: Jindrich Novy <jnovy@redhat.com> - 6:0.7.4-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.7.4
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 6:0.7.5-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.7.5
  - Related: RHEL-27608


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.43.20190303git
changelog:
  - hpvd-hv-hv_kvp_daemon-Support-for-keyfile-based-connectio.patch [RHEL-9902]
  - hpvd-hv-hv_kvp_daemon-Some-small-fixes-for-handling-NM-ke.patch [RHEL-9902]
  - hpvd-hv-hv_kvp_daemon-Handle-IPv4-and-Ipv6-combination-fo.patch [RHEL-9902]
  - hpvd-Changes-for-adding-keyfile-support-in-RHEL-specific-.patch [RHEL-9902]
  - Resolves: RHEL-9902
    ([Hyper-V][RHEL-9] hyperv-daemons write incompatible IPv6 prefix (IPV6NETMASK) in ifcfg)


author: Antonio Vieiro <avieirov@redhat.com> - 1:11.0.25.0.9-3
changelog:
  - Make java-11-openjdk NOT the default JDK in rhel-9.2.0.z, rhel-9.4.z, rhel-9.5.z
  - Resolves: RHEL-63042 
  - See-Also: RHEL-63043 RHEL-63044


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-3
changelog:
  - rework NMEA delay patch to fix PPS edge rejection (RHEL-39387)
  - fix ts2phc to correctly handle leap seconds (RHEL-40216)
  - fix ts2phc to reset NMEA parser after RMC message (RHEL-40947)
  - add options to configure multicast IP addresses (RHEL-31178)
  - add holdover support to ts2phc (RHEL-50216)


author: Tomas Halman <thalman@redhat.com> - 2.4.10-1
changelog:
  Rebase to 2.4.10 version improves `state cookies piling up` problem
    Resolves: RHEL-32450 Race condition in mod_auth_openidc filecache
    Resolves: RHEL-25422 mod_auth_openidc: DoS when using
              `OIDCSessionType client-cookie` and manipulating cookies
              (CVE-2024-24814)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:2.4.26-1
changelog:
  - Resolves: RHEL-25075 - new version 2.4.26
  - Resolves: RHEL-11838 - [RFE] add support of dns_01 challenge to mod_md
  - Resolves: RHEL-17462 - OCSP response rejected when nextUpdate field not set
  - Resolves: RHEL-17467 - mod_md should trigger the reissue of new pair
    key/certificate when OCSP reports a revoked status


author: Ray Strode <rstrode@redhat.com> - 40.9-18
changelog:
  - Don't allow applications on other workspaces to steal
    focus, unless their timestamps are pristine
    Resolves: RHEL-29537


author: Jonas Ådahl <jadahl@redhat.com>) - 40.9-20
changelog:
  - Fix positioning when using always-on-top windows
    Resolves: RHEL-45998
  - Improve handling of always-on-visible-workspace windows
    Resolves: RHEL-45366


author: Benedikt Bongartz <bongartz@redhat.com> - 0.95.0
changelog:
  - add observability user that is part of the systemd-journal group
  - add opentelemetry collector config folder (`/etc/opentelemetry-collector/configs`)
  - add opentelemetry collector default config
  - add microshift manifests


author: Felix Kolwa <fkolwa@redhat.com> - 0.102.1-4
changelog:
  - Fix SELinux policy resource names
  - Use sources for SELinux resources in spec file
  - Bump revision


author: Felix Kolwa <fkolwa@redhat.com> - 0.107.0-1
changelog:
  - Version bump to 0.107.0
  - Reset release to 1
  - Update addresses the following CVEs:
  - CVE-2024-34155
  - CVE-2024-34156
  - CVE-2024-42368


author: Paulo Alcantara <paalcant@redhat.com> - 7.0-4
changelog:
  - mount.cifs.rst: add missing reference for sssd
  - mount.cifs.rst: update section about xattr/acl support
  - Resolves: RHEL-22495


author: Nathan Scott <nathans@redhat.com> - 6.2.2-7
changelog:
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57809)
  - Guard against symlink attacks in pmpost program (RHEL-57814)
  - Fix libpcp_web webgroup slow request refcounting (RHEL-58307)
  - Updated pmdahacluster for newer crm_mon versions (RHEL-58303)


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.94-1
changelog:
  - Resolves: RHEL-40758
  - Update to 1.94
    - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and
      3.2, and LibreSSL 3.5-3.8
    - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to
      compile, it should now be much easier to identify the cause
    - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl()
      function are now exposed, enabling fine-grained control over the
      initialisation and configuration of both libraries
    - libssl functions implementing TLS 1.3 PSK authentication are now exposed,
      in particular SSL_CTX_set_psk_find_session_callback() (on the server side)
      and SSL_CTX_set_psk_use_session_callback() (on the client side)
    - libssl functions implementing server-side TLS 1.2 PSK authentication are
      now exposed, in particular SSL_CTX_set_psk_server_callback()
    - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a
      TLS server to set a callback function that is executed when the server
      processes a ClientHello message
    - Many more libcrypto/libssl constants and functions are now exposed; see the
      release notes for the 1.93 developer releases for a full list
  - Package tests


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.19-1
changelog:
  - Update to 3.9.19
  - Security fixes for CVE-2023-6597 and CVE-2024-0450
  - Fix tests for XMLPullParser with Expat with fixed CVE
  Resolves: RHEL-33679, RHEL-33691


author: Petr Pisar <ppisar@redhat.com> - 4.3.0-14
changelog:
  - needs-restarting prefers to obtain a boot time from systemd to deal with
    RTCs running in local time (RHEL-14900)


author: Petr Pisar <ppisar@redhat.com> - 4.3.0-16
changelog:
  - Revert needs-restarting prefers to obtain a boot time from systemd to deal
    with RTCs running in local time (RHEL-39775)


author: Vladis Dronov <vdronov@redhat.com> - 24.02.0-1
changelog:
  - Update to qatlib 24.02.0 (RHEL-20174)
  - Add zuc_sample to qatlib-tests package
  - Use proper SPDX license identifiers


author: Anubhav Shelat <ashelat@redhat.com> - 2.7-2
changelog:
  - Added a patch to fix -s option in hackbench.
  - Added a patch to prevent the user from erroneously passing negative numbers to hackbench.
  Resolves: RHEL-36746


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.38-1
changelog:
  - Add boolean qemu-ga to run unconfined script
  Resolves: RHEL-31211
  - Ensure dbus communication is allowed bidirectionally
  Resolves: RHEL-35782
  - Allow logwatch_mail_t read network sysctls
  Resolves: RHEL-34135
  - Allow sysadm execute dmidecode using sudo
  Resolves: RHEL-16104
  - Allow sudodomain list files in /var
  Resolves: RHEL-16104
  - Allow various services read and write z90crypt device
  Resolves: RHEL-33361
  - Allow system_cronjob_t dbus chat with avahi_t
  Resolves: RHEL-32290
  - Allow setroubleshootd get attributes of all sysctls
  Resolves: RHEL-34078
  - Remove permissive domain for bootupd_t
  Resolves: RHEL-22173


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.39-1
changelog:
  - Add interfaces for watching and reading ifconfig_var_run_t
  Resolves: RHEL-39408
  - Allow dhcpcd use unix_stream_socket
  Resolves: RHEL-39408
  - Allow dhcpc read /run/netns files
  Resolves: RHEL-39408
  - Allow all domains read and write z90crypt device
  Resolves: RHEL-38833
  - Allow bootupd search efivarfs dirs
  Resolves: RHEL-36289
  - Move unconfined_domain(sap_unconfined_t) to an optional block
  Resolves: RHEL-37663


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.40-1
changelog:
  - Allow systemd-coredump read nsfs files
  Resolves: RHEL-39937
  - Allow login_userdomain execute systemd-tmpfiles in the caller domain
  Resolves: RHEL-40374
  - Allow ptp4l_t request that the kernel load a kernel module
  Resolves: RHEL-38905
  - Allow collectd to trace processes in user namespace
  Resolves: RHEL-36293


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.41-1
changelog:
  - Differentiate between staff and sysadm when executing crontab with sudo
  Resolves: RHEL-31888
  - Label /usr/bin/samba-gpupdate with samba_gpupdate_exec_t
  Resolves: RHEL-25724
  - Allow unconfined_service_t transition to passwd_t
  Resolves: RHEL-17404
  - Allow sbd to trace processes in user namespace
  Resolves: RHEL-44680
  - Allow systemd-coredumpd sys_admin and sys_resource capabilities
  Resolves: RHEL-45245
  - Label /usr/lib/node_modules/npm/bin with bin_t
  Resolves: RHEL-36587
  - Support /var is empty
  Resolves: RHEL-29331
  - Allow timemaster write to sysfs files
  Resolves: RHEL-28777
  - Don't audit crontab_domain write attempts to user home
  Resolves: RHEL-31888
  - Transition from sudodomains to crontab_t when executing crontab_exec_t
  Resolves: RHEL-31888
  - Fix label of pseudoterminals created from sudodomain
  Resolves: RHEL-31888


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.42-1
changelog:
  - Label samba certificates with samba_cert_t
  Resolves: RHEL-25724
  - Allow systemd-coredumpd the sys_chroot capability
  Resolves: RHEL-45245
  - Allow svirt_tcg_t read vm sysctls
  Resolves: RHEL-27141
  - Label /usr/sbin/samba-gpupdate with samba_gpupdate_exec_t
  Resolves: RHEL-25724
  - Label /var/run/coreos-installer-reboot with coreos_installer_var_run_t
  Resolves: RHEL-38614
  - Allow coreos-installer add systemd unit file links
  Resolves: RHEL-38614


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.43-1
changelog:
  - Allow rhsmcertd read/write access to /dev/papr-sysparm
  Resolves: RHEL-49599
  - Label /dev/papr-sysparm and /dev/papr-vpd
  Resolves: RHEL-49599
  - Allow rhsmcertd read, write, and map ica tmpfs files
  Resolves: RHEL-50926
  - Update afterburn file transition policy
  Resolves: RHEL-49735
  - Label /run/metadata with afterburn_runtime_t
  Resolves: RHEL-49735
  - Allow afterburn list ssh home directory
  Resolves: RHEL-49735
  - Support SGX devices
  Resolves: RHEL-50922
  - Allow systemd-pstore send a message to syslogd over a unix domain
  Resolves: RHEL-45528
  - Allow postfix_domain map postfix_etc_t files
  Resolves: RHEL-46332
  - Allow microcode create /sys/devices/system/cpu/microcode/reload
  Resolves: RHEL-26821
  - Allow svirt_tcg_t map svirt_image_t files
  Resolves: RHEL-27141
  - Allow systemd-hostnamed shut down nscd
  Resolves: RHEL-45033
  - Allow postfix_domain connect to postgresql over a unix socket
  Resolves: RHEL-6776


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.44-1
changelog:
  - Allow coreos-installer-generator work with partitions
  Resolves: RHEL-38614
  - Label /etc/mdadm.conf.d with mdadm_conf_t
  Resolves: RHEL-38614
  - Change file context specification to /var/run/metadata
  Resolves: RHEL-49735
  - Allow initrc_t transition to passwd_t
  Resolves: RHEL-17404
  - systemd: allow systemd_notify_t to send data to kernel_t datagram sockets
  Resolves: RHEL-25514
  - systemd: allow sys_admin capability for systemd_notify_t
  Resolves: RHEL-25514
  - Change systemd-network-generator transition to include class file
  Resolves: RHEL-47033
  - Allow sshd_keygen_t connect to userdbd over a unix stream socket
  Resolves: RHEL-47033


author: Jindrich Novy <jnovy@redhat.com> - 2:1.16.0-1
changelog:
  - update to https://github.com/containers/skopeo/releases/tag/v1.16.0
  - Resolves: RHEL-47197 RHEL-44886 RHEL-40812


author: Jindrich Novy <jnovy@redhat.com> - 1.3.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.0
  - Related: RHEL-27608


author: Jindrich Novy <jnovy@redhat.com> - 1.3.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.1
  - Related: RHEL-27608


author: Martin Gieseking <martin.gieseking@uos.de> - 1.1.8-1
changelog:
  - Updated to new release.
  - Dropped version-related patch which has been applied upstream (BZ #1527850).


author: Chris White <chwhite@redhat.com> - 1.19.5-1
changelog:
  - Updated compile options for annocheck hardening
  - Ensure we resolve library symbols at load time (-z now) and are a Position Independent Executable (-pie). Refactored compile options to better deal with arch differences.
  - Added an 'annocheck' makefile target for local checking.
  - Makefile: change build to use FORTIFY_SOURCE=3
  - src/utils.c: fix off-by-one error in buffer allocation
  Resolves: RHEL-33662


author: Chris White <chwhite@redhat.com> - 1.19.6-1
changelog:
  - Makefile: add uninstall target
  - systemd: add BE environment variable to select backend
  Resolves: RHEL-33662


author: John Kacur <jkacur@redhat.com> - 0.17.08-1
changelog:
  - Rebase to upstream V0.17.08
  - ARM: Don't declare inlined yield helper if yield is not available
  Resolves: RHEL-33304


author: Vit Mojzis <vmojzis@redhat.com> - 0.2.8-2
changelog:
  - Add option to generate custom policy for a confined user (RHEL-28166)
  - Add tests covering confined user policy generation
  - confined: make "-l" non optional
  - confined: allow asynchronous I/O operations


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.4-2
changelog:
  - Package virt-v2v-in-place in libexec as unsupported tool
  - Add warning about virt-v2v-in-place not being supported
    resolves: RHEL-40903
  - Add more fields to virt-inspector output
    related: MTV-1079
  - Revert "docs: Remove paragraph about -ip passwords and ssh/scp"
    resolves: RHEL-45527


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.6-1
changelog:
  - Further fixes for QEMU Guest Agent
    resolves: RHEL-49761
  - Place Windows firstboot files under C:\Program Files\Guestfs\Firstboot
  - Improve debugging output


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.6-3
changelog:
  - Further fixes for QEMU Guest Agent install & VMware Tools removal
    resolves: RHEL-49761, RHEL-51169


author: Jiri Hnidek <jhnidek@redhat.com> 1.31.27-1
changelog:
  - ci: bump actions/checkout from 3 to 4
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Change /var/run -> /run (orion@nwra.com)
  - ci: add dependabot config for GitHub Actions (ptoscano@redhat.com)
  - Drop unused copy of python-daemon sources (ptoscano@redhat.com)
  - Migrate to SPDX license (jhnidek@redhat.com)
  - fix: disable complex tests for ESX (jhnidek@redhat.com)
  - fix: use ssl.SSLContext.wrap_socket for wrapping socket (jhnidek@redhat.com)
  - fix: stylish issue discovered by flake8 (jhnidek@redhat.com)
  - fix: Use ConfigParser and not SafeConfigParser (jhnidek@redhat.com)
  - spec: drop unused openssl dependency (ptoscano@redhat.com)
  - spec: hardcode/inline Python 3 variables (ptoscano@redhat.com)
  - spec: drop unused Group tag (ptoscano@redhat.com)
  - spec: do not Require setuptools (ptoscano@redhat.com)
  - spec: drop $RPM_BUILD_ROOT manual cleanup (ptoscano@redhat.com)
  - Updated README.md file to reflect current state (jhnidek@redhat.com)
  - Drop outdated/unused requirements (ptoscano@redhat.com)
  - Removed support for Jenkins (jhnidek@redhat.com)
  - Added support for GitHub actions (jhnidek@redhat.com)
  - Removed some unused parts of Makefile (jhnidek@redhat.com)
  - Removed support for docker (jhnidek@redhat.com)
  - spec: assume the python3-libvirt package name everywhere
    (ptoscano@redhat.com)
  - spec: drop redundant "release_number" variable (ptoscano@redhat.com)
  - spec: drop outdated variables and comments (ptoscano@redhat.com)
  - spec: drop six dependency (ptoscano@redhat.com)
  - Drop non-systemd support (ptoscano@redhat.com)
  - Feature: improve log message, when wrong value is provided
    (jhnidek@redhat.com)
  - Fix: default value for prism_central cannot be None (jhnidek@redhat.com)
  - spec: drop support for Python < 3 (ptoscano@redhat.com)
  - spec: drop support for Fedora < 36 (ptoscano@redhat.com)
  - spec: drop support for RHEL < 8 (ptoscano@redhat.com)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.11.1-1
changelog:
  - Update to upstream version 1.11.1 [RHEL-47989]
  - Resolves: RHEL-47989
    (Rebase virtiofsd to latest version for RHEL 9.5)


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-1
changelog:
  - Rebase to a more recent upstream release
  - Related: RHEL-28339
  - Following is a list of dropped backported patches which
  - are contained in the current rebase:
  - xfsprogs-6.4.0-set-bnobt-cntbt-numrecs-correctly-when-formattin.patch
  - xfsprogs-6.4.0-mkfs-fix-man-s-default-value-for-sparse-option.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-add-junked-entries-to-the-rebuilt-d.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-fixing-imap-due-to-spa.patch
  - xfsprogs-6.4.0-xfs_repair-don-t-spray-correcting-imap-all-by-itself.patch
  - xfsprogs-6.4.0-xfs_repair-fix-messaging-when-shortform_dir2_junk-is.patch
  - xfsprogs-6.4.0-xfs_db-move-obfuscate_name-assertion-to-callers.patch
  - xfsprogs-6.4.0-xfs_db-fix-metadump-name-obfuscation-for-ascii-ci-fi.patch
  - xfsprogs-6.4.0-xfs-stabilize-the-dirent-name-transformation-functio.patch
  -
  - Rename xfs_quota-fix-missing-mount-point-warning.patch to reflect upstream
  -	version it was merged in.


author: Bill O'Donnell <bodonnel@redhat.com> - 6.4.0-2
changelog:
  - Fix various CVE issues.
  - Related: RHEL-32996
  - Following is the patch list:
  - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-fix-leak-in-flist_find_ftyp.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-make-duration-take-time_t.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_scrub-don-t-call-phase_end-if-phase_rusage-was-n.patch
  - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-convert-fsrallfs-to-use-time_t-instead-of-in.patch
  - xfsprogs-6.5.0-xfs_fsr.xfs.8-xfs_fsr-replace-atoi-with-strtol.patch
  - xfsprogs-6.5.0-xfs_db.xfs.8-xfs_db-add-helper-for-flist_find_type-for-clearer-fi.patch
  - xfsprogs-6.5.0-xfs_repair.xfs.8-xfs_repair-catch-strtol-errors.patch
  - xfsprogs-rhelonly-xfs_db-fix-unitialized-variable-in-check_parents-function.patch


author: Bill O'Donnell <bodonnel@redhat.com> - 6.4.0-3
changelog:
  - Fix coverity issue
  - Related: RHEL-39449
  - Following is the patch list:
  - xfsprogs-6.5.0-xfs.8-xfs-fix-bounds-check-in-xfs_defer_agfl_block.patch


author: James Chapman <jachapma@redhat.com> - 2.5.2-3
changelog:
  - Bump version to 2.5.2-3
  - Resolves: RHEL-65775 - Wrong set of entries returned for some search filters [rhel-9.5.z]
  - Resolves: RHEL-66138 - deadlock during cleanAllRuv [rhel-9.5.z]
  - Resolves: RHEL-67163 - cleanallruv consums CPU and is slow [rhel-9.5.z]
  - Resolves: RHEL-70257 - Freelist ordering causes high wtime [rhel-9.5.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.5.2-5
changelog:
  - Resolves: RHEL-74350 - Some nsslapd-haproxy-trusted-ip values are discarded upon a restart. [rhel-9.5.z]


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.48.10-3
changelog:
  - Only validate the SR-IOV device capability when SR-IOV is enabled (RHEL-58397)
  - Fix bug when deactivating port connections (RHEL-50747)
  - Fix validation of ovs-dpdk interface name (RHEL-60022)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.48.10-4
changelog:
  - Remove routes added by NetworkManager when doing reapply, also those not in main table (RHEL-73013)


author: Wen Liang <wenliang@redhat.com> - 1:1.48.10-5
changelog:
  - vpn: Support routing rules in vpn conenctions (RHEL-73167)
  - vpn: Place gateway route to table defined in ipvx.route-table (RHEL-73166)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.37.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.37
    (https://github.com/containers/buildah/commit/fd39521)
  - Resolves: RHEL-67617


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.1
changelog:
  - ci-Fix-metric-setting-for-ifcfg-network-connections-for.patch [RHEL-65018]
  - ci-fix-python3.13-Fix-import-error-for-passlib-on-Pytho.patch [RHEL-65018]
  - Resolves: RHEL-65018
    (Configuring metric for default gateway is not working [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.2
changelog:
  - ci-fix-Render-bridges-correctly-for-v2-on-sysconfig-wit.patch [RHEL-65021]
  - ci-fix-Render-v2-bridges-correctly-on-network-manager-w.patch [RHEL-65021]
  - Resolves: RHEL-65021
    (NoCloud - network_config bridges incorrectly configured [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.3
changelog:
  - ci-Prevent-NM-from-handling-DNS-when-network-interfaces.patch [RHEL-65778]
  - Resolves: RHEL-65778
    ([RHEL-9] Prevent NM from handling DNS when network interfaces have DNS config [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 23.4-19.el9_5.4
changelog:
  - ci-refactor-Ensure-internal-DNS-state-same-for-v1-and-v.patch [RHEL-68409]
  - Resolves: RHEL-68409
    (cloud-init fails to configure DNS and search domain [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-6.el9_5.1
changelog:
  - edk2-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch [RHEL-60831]
  - Resolves: RHEL-60831
    (CVE-2024-38796 edk2: Integer overflows in PeCoffLoaderRelocateImage [rhel-9.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20240524-6.el9_5.2
changelog:
  - edk2-OvmfPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-65735]
  - edk2-OvmfPkg-ArmVirtPkg-Add-a-Fallback-RNG-RH-only.patch [RHEL-65735]
  - Resolves: RHEL-65735
    ([Regression] HTTP Boot not working on old vCPU without virtio-rng device present  [rhel-9.5.z])


author: Jon Maloy <jmaloy@redhat.com> - 20240524-6.el9_5.3
changelog:
  - edk2-OvmfPkg-Rerun-dispatcher-after-initializing-virtio-r.patch [RHEL-63094]
  - Resolves: RHEL-63094
    ([Regression] HTTP Boot fails to work with edk2-ovmf-20231122-6.el9_4.2 and greater [rhel-9.5])


author: Tomas Korbar <tkorbar@redhat.com> - 2.5.0-3
changelog:
  - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492
  - Resolves: RHEL-56761
  - Resolves: RHEL-57520
  - Resolves: RHEL-57511


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-76.1
changelog:
  - fence_scsi: preempt clears all devices on the mpath device, so only
    run it for the first device
    Resolves: RHEL-59882


author: Jan Grulich <jgrulich@redhat.com - 128.4.0-2
changelog:
  - Enable PipeWire camera support for RHEL 10
    + backport upstream fixes for PipeWire camera support
    Fixes: RHEL-64749


author: Sayan Paul <paul.sayan@gmail.com> - 0.15.7-1
changelog:
  - Update to 0.15.7
  - Reword warning message for disabled checks
  - Fixed the issue that boot_counter cannot be unset and some scripts do not have executable permissions
  - Packit: only use IoT relevant branches


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-3
changelog:
  - Fixes for CVE-2024-47538, CVE-2024-47607, CVE-2024-47615
    Resolves: RHEL-70979, RHEL-71015, RHEL-70991


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-3
changelog:
  - CVE-2024-47537, CVE-2024-47539, CVE-2024-47540, CVE-2024-47606,
    CVE-2024-47613
    Resolves: RHEL-70954, RHEL-70967, RHEL-70941, RHEL-71027,
    Resolves: RHEL-71003


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.4.22-3.1
changelog:
  - Always clear retry flags in read/write functions to avoid CPU
    usage spikes
  - Fix "unable to load certificate chain from file" issue
    Resolves: RHEL-72955, RHEL-72952


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-1.2
changelog:
  - Resolves: RHEL-73580 - RewriteRule proxying to UDS (unix domain socket)
    configured in .htaccess doesn't work on httpd-2.4.62-1


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-1.3
changelog:
  - Resolves: RHEL-69928 add support for python cryptography 44.0.0
  - Resolves: RHEL-70258 Upgrade to ipa-server-4.12.2-1.el9 OTP-based bind to LDAP without enforceldapotp is broken
  - Resolves: RHEL-70482 ipa-server-upgrade fails after established trust with ad
  - Resolves: RHEL-67192 CVE-2024-11029 ipa: Administrative user data leaked through systemd journal


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.432.b06-3
changelog:
  - Rebuild RPM for 9.5 0day release
  - Related: RHEL-58794
  - Related: RHEL-62280
  - Related: RHEL-61287


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.2.ea
changelog:
  - Update to 8u442-b05 (EA).
  - Update release notes for 8u442-b05.
  - Switch to EA mode for pre-release.
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-73998


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b05-0.3.ea
changelog:
  - Add zero_arches to the portable_build_arches now that the portable build bundles libffi
  - Temporarily workaround libffi.so not being in lib/%{archinstall} by copying it
  - Exclude libffi.so from the debugedit run
  - Add a simple -version check on both the JDK and JRE bin/java
  - Add libffi.so to the filelist, including expanding the lib/%{archinstall} contents as with jre/lib
  - Sync the copy of the portable specfile and new patches with the latest update
  - Resolves: RHEL-74305


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.442.b06-2
changelog:
  - Update to 8u442-b06 (GA)
  - Update release notes for 8u442-b06.
  - Switch to GA mode for final release
  - Revise JDK-8141590 backport to install libffi.so* in lib as well as jre/lib
  - Sync the copy of the portable specfile with the latest update
  - Remove libffi.so copying workaround now the portable build installs it in lib
  - Add bundled libffi.so to _privatelibs
  - Remove libffi.so copy if we are building on the same platform as the portable
  - Resolves: RHEL-73551
  - Related: RHEL-74305


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.13.0.11-4
changelog:
  - Set this to be the default/system JDK providing 'java', 'jre', 'java-devel', etc.
  - Set rpmrelease to 4
  - Resolves: RHEL-63034


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.14.0.1-0.2.ea
changelog:
  - Update to jdk-17.0.14+1 (EA)
  - Add to .gitignore openjdk-17.0.14+1-ea.tar.xz
  - Set updatever to 14
  - Set buildver to 1
  - Set rpmrelease to 2
  - Set is_ga to 0
  - Update sources to openjdk-17.0.14+1-ea.tar.xz
  - Double percent signs consistently throughout comments
  - Set bundled giflib provide version to 5.2.2
  - Set bundled libpng provide version to 1.6.43
  - Warn about bundled provide version bumps and backouts in openjdk_news.sh
  - Remove 0001-8332174-Remove-2-unpaired-RLO-Unicode-characters-in-.patch file
  - Revert: Use component in EPEL and Fedora bug URLs


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.14.0.7-2
changelog:
  - Update to jdk-17.0.14+7 (GA)
  - Add to .gitignore openjdk-17.0.14+7.tar.xz
  - Set buildver to 7
  - Set is_ga to 1
  - Update sources to openjdk-17.0.14+7.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Resolves: RHEL-73981
  - Resolves: RHEL-73559
  - ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-2
changelog:
  - Update to jdk-21.0.5+11 (GA)
  - Update release notes to 21.0.5+11
  - Remove local JDK-8327501 & JDK-8328366 backport as this is now upstream.
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-61344


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-3
changelog:
  - Transition to the devkit build by not defining pkgos
  - Exempt x86_64 from the static libs debuginfo test until portable uses an older DWARF version
  - Sync the copy of the portable specfile with the devkit version
  - Include the devkit specfile and patches
  - Document the devkit in README.md
  - Resolves: RHEL-74403


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
changelog:
  - Update to jdk-21.0.6+7 (GA)
  - Update release notes to 21.0.6+7
  - Sync the copy of the portable & devkit specfiles with the latest update
  - Include the latest devkit patches
  - Update README.md to list an easier way of disabling the devkit
  - ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **
  - Resolves: RHEL-73562


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.12.1.el9_5]
changelog:
  - net: nexthop: Initialize all fields in dumped nexthops (Antoine Tenart) [RHEL-55080] {CVE-2024-42283}
  - tracing/osnoise: Fix build when timerlat is not enabled (Tomas Glozar) [RHEL-61870 RHEL-39968]
  - tracing/timerlat: Add interface_lock around clearing of kthread in stop_kthread() (Tomas Glozar) [RHEL-61870 RHEL-39968]
  - tracing/timerlat: Only clear timer if a kthread exists (Tomas Glozar) [RHEL-61870 RHEL-39968]
  - tracing/osnoise: Use a cpumask to know what threads are kthreads (Tomas Glozar) [RHEL-61870 RHEL-39968]
  - iommufd: Require drivers to supply the cache_invalidate_user ops (CKI Backport Bot) [RHEL-60681 RHEL-60761] {CVE-2024-46824}
  - Revert "fw loader: Remove the now superfluous sentinel element from ctl_table array" (Eric Chanudet) [RHEL-62925 RHEL-50129]
  - smb: client: fix hang in wait_for_response() for negproto (Jay Shin) [RHEL-61607 RHEL-57983]


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.13.1.el9_5]
changelog:
  - efi: libstub: Move screen_info handling to common code (Maxim Levitsky) [RHEL-65344]
  - mpls: Reduce skb re-allocations due to skb_cow() (Guillaume Nault) [RHEL-61697]
  - mptcp: pm: Fix uaf in __timer_delete_sync (CKI Backport Bot) [RHEL-64678 RHEL-60737] {CVE-2024-46858}
  - ceph: fix cap ref leak via netfs init_request (Patrick Donnelly) [RHEL-62667 RHEL-61459]
  - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann)


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.14.1.el9_5]
changelog:
  - ext4: fix off by one issue in alloc_flex_gd() (Pavel Reichl) [RHEL-65318]
  - ping: fix address binding wrt vrf (Antoine Tenart) [RHEL-57564 RHEL-50920]
  - smb: client: stop flooding dmesg in smb2_calc_signature() (Paulo Alcantara) [RHEL-36346 RHEL-61193]
  - smb: client: print failed session logoffs with FYI (Paulo Alcantara) [RHEL-36346 RHEL-61193]
  - smb: client: propagate error from cifs_construct_tcon() (Paulo Alcantara) [RHEL-36346 RHEL-61193]
  - smb: client: fix DFS failover in multiuser mounts (Paulo Alcantara) [RHEL-36346 RHEL-61193]
  - smb: client: fix DFS interlink failover (Paulo Alcantara) [RHEL-36346 RHEL-61193]
  - smb: client: improve purging of cached referrals (Paulo Alcantara) [RHEL-36346 RHEL-61193]
  - smb: client: avoid unnecessary reconnects when refreshing referrals (Paulo Alcantara) [RHEL-36346 RHEL-61193]
  - smb: client: handle lack of FSCTL_GET_REPARSE_POINT support (Paulo Alcantara) [RHEL-36346 RHEL-57983]
  - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-36346 RHEL-57983]
  - cifs: Fix reacquisition of volume cookie on still-live connection (Paulo Alcantara) [RHEL-36346 RHEL-57983]


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.15.1.el9_5]
changelog:
  - USB: serial: mos7840: fix crash on resume (Desnes Nunes) [RHEL-65484 RHEL-59050] {CVE-2024-42244}
  - attr: block mode changes of symlinks (CKI Backport Bot) [RHEL-61231 RHEL-60822]
  - ice: Adjust PTP init for 2x50G E825C devices (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Add NAC Topology device capability parser (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Add support for E825-C TS PLL handling (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Change CGU regs struct to anonymous (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Introduce ETH56G PHY model for E825C products (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Introduce ice_get_base_incval() helper (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Move CGU block (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Add PHY OFFSET_READY register clearing (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Implement Tx interrupt enablement functions (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Introduce helper to get tmr_cmd_reg values (Petr Oros) [RHEL-64017 RHEL-29210]
  - ice: Introduce ice_ptp_hw struct (Petr Oros) [RHEL-64017 RHEL-29210]
  - wifi: rtw89: limit the PPDU length for VHT rate to 0x40000 (Narpat Mali) [RHEL-61753 RHEL-35542]
  - wifi: rtw89: 885xbx: apply common settings to 8851B, 8852B and 8852BT (Narpat Mali) [RHEL-61753 RHEL-35542]
  - wifi: rtw89: 8852b: fix definition of KIP register number (Narpat Mali) [RHEL-61753 RHEL-35542]
  - wifi: rtw89: 8852b: set AMSDU limit to 5000 (Narpat Mali) [RHEL-61753 RHEL-35542]
  - bpf: Fix overrunning reservations in ringbuf (CKI Backport Bot) [RHEL-62940] {CVE-2024-41009}
  - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-61424 RHEL-60572]
  - cxl/port: Fix use-after-free, permit out-of-order decoder shutdown (CKI Backport Bot) [RHEL-66837] {CVE-2024-50226}
  - ethtool: check device is present when getting link settings (Michal Schmidt) [RHEL-60581 RHEL-57750]
  - iommu/amd: Fix argument order in amd_iommu_dev_flush_pasid_all() (CKI Backport Bot) [RHEL-59982 RHEL-59981]


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.16.1.el9_5]
changelog:
  - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-64902 RHEL-55873]
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Steve Best) [RHEL-65436 RHEL-27748] {CVE-2024-26615}
  - gitlab-ci: use zstream builder container image (Michael Hofmann)
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (CKI Backport Bot) [RHEL-66856] {CVE-2024-50251}
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (CKI Backport Bot) [RHEL-65401] {CVE-2024-49949}
  - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-58761 RHEL-54768] {CVE-2024-43854}
  - proc: fix dentry/inode overinstantiating under /proc/${pid}/net (Joel Savitz) [RHEL-62824 RHEL-57703]
  - iommu: Restore lost return in iommu_report_device_fault() (CKI Backport Bot) [RHEL-67364] {CVE-2024-44994}
  - net: ena: Extend customer metrics reporting support (Kamal Heib) [RHEL-66933 RHEL-59968]
  - net: ena: Add ENA Express metrics support (Kamal Heib) [RHEL-66933 RHEL-59968]
  - xsk: fix batch alloc API on non-coherent systems (Felix Maurer) [RHEL-59884 RHEL-58954]
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66106] {CVE-2024-46695}
  - PCI/AER: Disable AER service on suspend (Lenny Szubowicz) [RHEL-67037 RHEL-22265]
  - ACPI: PM: s2idle: Evaluate all Low-Power S0 Idle _DSM functions (Mark Langsdorf) [RHEL-67037 RHEL-54149]
  - mptcp: fallback when MPTCP opts are dropped after 1st data (CKI Backport Bot) [RHEL-62216 RHEL-62218]
  - cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (David Arcari) [RHEL-61469 RHEL-45016]
  - cpufreq/amd-pstate: Add the missing cpufreq_cpu_put() (David Arcari) [RHEL-61469 RHEL-45016]
  - cpufreq/amd-pstate: Fix the scaling_max_freq setting on shared memory CPPC systems (David Arcari) [RHEL-61469 RHEL-45016]
  - cpufreq/amd-pstate-ut: Convert nominal_freq to khz during comparisons (David Arcari) [RHEL-61469 RHEL-45016]
  - cpufreq/amd-pstate: fix setting policy current frequency value (David Arcari) [RHEL-61469 RHEL-45016]
  - netfilter: flowtable: initialise extack before use (CKI Backport Bot) [RHEL-58545] {CVE-2024-45018}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.17.1.el9_5]
changelog:
  - arm64: probes: Remove broken LDR (literal) uprobe support (CKI Backport Bot) [RHEL-66046] {CVE-2024-50099}
  - qed: put cond_resched() in qed_dmae_operation_wait() (Michal Schmidt) [RHEL-61705 RHEL-6372]
  - qed: allow the callee of qed_mcp_nvm_read() to sleep (Michal Schmidt) [RHEL-61705 RHEL-6372]
  - qed: put cond_resched() in qed_grc_dump_ctx_data() (Michal Schmidt) [RHEL-61705 RHEL-6372]
  - qed: make 'ethtool -d' 10 times faster (Michal Schmidt) [RHEL-61705 RHEL-6372]
  - qed: allow sleep in qed_mcp_trace_dump() (Michal Schmidt) [RHEL-61705 RHEL-6372]
  - sched/numa: Fix the potential null pointer dereference in task_numa_work() (CKI Backport Bot) [RHEL-66810] {CVE-2024-50223}
  - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66969] {CVE-2024-50192}
  - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66969] {CVE-2024-50192}
  - perf/x86/intel/uncore: Support HBM and CXL PMON counters (Michael Petlan) [RHEL-65856]
  - perf/x86/uncore: Cleanup unused unit structure (Michael Petlan) [RHEL-65856]
  - perf/x86/uncore: Apply the unit control RB tree to PCI uncore units (Michael Petlan) [RHEL-65856]
  - perf/x86/uncore: Apply the unit control RB tree to MSR uncore units (Michael Petlan) [RHEL-65856]
  - perf/x86/uncore: Apply the unit control RB tree to MMIO uncore units (Michael Petlan) [RHEL-65856]
  - perf/x86/uncore: Retrieve the unit ID from the unit control RB tree (Michael Petlan) [RHEL-65856]
  - perf/x86/uncore: Support per PMU cpumask (Michael Petlan) [RHEL-65856]
  - perf/x86/uncore: Save the unit control address of all units (Michael Petlan) [RHEL-65856]


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.18.1.el9_5]
changelog:
  - bpf: Fix a kernel verifier crash in stacksafe() (CKI Backport Bot) [RHEL-66097 RHEL-66098] {CVE-2024-45020}
  - bpf: Fix a sdiv overflow issue (CKI Backport Bot) [RHEL-64598 RHEL-64597] {CVE-2024-49888}
  - bpf: Fix out-of-bounds write in trie_get_next_key() (CKI Backport Bot) [RHEL-66877] {CVE-2024-50262}
  - bpf: Fix use-after-free in bpf_uprobe_multi_link_attach() (CKI Backport Bot) [RHEL-63331] {CVE-2024-47675}
  - nfsd: ensure that nfsd4_fattr_args.context is zeroed out (Jay Shin) [RHEL-58884 RHEL-58883] {CVE-2024-46697}
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (Jon Maloy) [RHEL-65872] {CVE-2024-50115}
  - net: tighten bad gso csum offset check in virtio_net_hdr (Guillaume Nault) [RHEL-67683]
  - udp: fix receiving fraglist GSO packets (Guillaume Nault) [RHEL-67683]
  - Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs (CKI Backport Bot) [RHEL-66804] {CVE-2024-50255}
  - Bluetooth: ISO: Fix UAF on iso_sock_timeout (Bastien Nocera) [RHEL-66321] {CVE-2024-50124}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout (Bastien Nocera) [RHEL-65928] {CVE-2024-50125}
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (Bastien Nocera) [RHEL-65928] {CVE-2024-27398}
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (CKI Backport Bot) [RHEL-44173] {CVE-2024-38564}
  - Bluetooth: bnep: fix wild-memory-access in proto_unregister (CKI Backport Bot) [RHEL-66365] {CVE-2024-50148}
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (CKI Backport Bot) [RHEL-57716 RHEL-36374] {CVE-2024-27399}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.19.1.el9_5]
changelog:
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66462 RHEL-66461] {CVE-2024-50142}
  - xfrm: fix one more kernel-infoleak in algo dumping (CKI Backport Bot) [RHEL-65960] {CVE-2024-50110}
  - Revert "Merge: [qed] softlockup triggered by ethtool -d  [rhel-9.5.z]" (Lucas Zampieri) [RHEL-61705]
  - tracing/hwlat: Fix a race during cpuhp processing (Tomas Glozar) [RHEL-69468]
  - tracing/timerlat: Fix a race during cpuhp processing (Tomas Glozar) [RHEL-69468] {CVE-2024-49866}
  - tracing/timerlat: Drop interface_lock in stop_kthread() (Tomas Glozar) [RHEL-69468]
  - tracing/timerlat: Fix duplicated kthread creation due to CPU online/offline (Tomas Glozar) [RHEL-69468]
  - ceph: remove the incorrect Fw reference check when dirtying pages (Xiubo Li) [RHEL-61416 RHEL-60255]


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.20.1.el9_5]
changelog:
  - bnxt_en: Add support for user configured RSS key (Michal Schmidt) [RHEL-68699 RHEL-54645]
  - bnxt_en: Add function to calculate Toeplitz hash (Michal Schmidt) [RHEL-68699 RHEL-54645]
  - kvm: Note an RCU quiescent state on guest exit (Leonardo Bras) [RHEL-65734 RHEL-20288]
  - rcu: Add rcutree.nohz_full_patience_delay to reduce nohz_full OS jitter (Leonardo Bras) [RHEL-65734 RHEL-20288]
  - context_tracking: Fix KCSAN noinstr violation (Leonardo Bras) [RHEL-65734 RHEL-20288]
  - perf/aux: Fix AUX buffer serialization (Michael Petlan) [RHEL-67495] {CVE-2024-46713}
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages (Mohammad Heib) [RHEL-66669 RHEL-52759] {CVE-2024-50208}


author: Lucas Zampieri <lzampier@redhat.com> [5.14.0-503.21.1.el9_5]
changelog:
  - mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (CKI Backport Bot) [RHEL-66899] {CVE-2024-50252}
  - CVE-2024-53122 mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Patrick Talbert) [RHEL-70083 RHEL-69670] {CVE-2024-53122}
  - mm: make show_free_areas() static (Aristeu Rozanski) [RHEL-66998 RHEL-27743]
  - mm: remove arguments of show_mem() (Aristeu Rozanski) [RHEL-66998 RHEL-27743]
  - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-67922 RHEL-65229]
  - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-67922 RHEL-65229]
  - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-67922 RHEL-65229]
  - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-67922 RHEL-65229]
  - KVM: s390: remove useless include (Thomas Huth) [RHEL-67922 RHEL-65229]
  - s390/mm: Re-enable the shared zeropage for !PV and !skeys KVM guests (Thomas Huth) [RHEL-67922 RHEL-65229]
  - mm/userfaultfd: Do not place zeropages when zeropages are disallowed (Thomas Huth) [RHEL-67922 RHEL-65229]
  - s390: allow pte_offset_map_lock() to fail (Thomas Huth) [RHEL-67922 RHEL-54248]
  - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-67922 RHEL-65229]
  - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-67922 RHEL-65229]
  - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-68137 RHEL-68102]
  - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-68137 RHEL-68102]
  - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Call gfs2_queue_verify_delete from gfs2_evict_inode (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Minor delete_work_func cleanup (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Allow immediate GLF_VERIFY_DELETE work (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-62105 RHEL-60945]
  - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-62105 RHEL-60945]
  - smb: client: fix use-after-free of signing key (Jay Shin) [RHEL-69306 RHEL-66206]
  - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-60300 RHEL-53992]
  - KVM: arm64: Ensure vgic_ready() is ordered against MMIO registration (CKI Backport Bot) [RHEL-70294]


author: Chao YE <cye@redhat.com> [5.14.0-503.22.1.el9_5]
changelog:
  - [s390] zcore: WRITE is "data source", not destination... (CKI Backport Bot) [RHEL-63078]
  - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-72218] {CVE-2024-50275}
  - bpf: Use raw_spinlock_t in ringbuf (Luis Claudio R. Goncalves) [RHEL-68992 RHEL-20608]
  - rh_messages.h: un-unmaintain hfi1 (CKI Backport Bot) [RHEL-71322]
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-66055 RHEL-53595]
  - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-66055 RHEL-53595]
  - ASoC: SOF: ipc4-topology: Preserve the DMA Link ID for ChainDMA on unprepare (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Only handle dai_config with HW_PARAMS for ChainDMA (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Use single token list for the copiers (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Use correct queue_id for requesting input pin format (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Adjust the params based on DAI formats (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Improve readability of sof_ipc4_prepare_dai_copier() (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology/pcm: Rename sof_ipc4_copier_is_single_format() (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Print out the channel count in sof_ipc4_dbg_audio_format (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: support tdm slot number query (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc3-topology: support tdm slot number query (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: sof-audio: add sof_dai_get_tdm_slots function (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: sof-audio: rename dai clock setting query function (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Add support for NHLT with 16-bit only DMIC blob (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Correct DAI copier config and NHLT blob request (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: Allow selective update in sof_ipc4_update_hw_params (Jaroslav Kysela) [RHEL-62030]
  - ASoC: SOF: ipc4-topology: remove shadowed variable (Jaroslav Kysela) [RHEL-62030]
  - Revert "ixgbe: Manual AN-37 for troublesome link partners for X550 SFI" (Ivan Vecera) [RHEL-65624]
  - KVM: SVM: Propagate error from snp_guest_req_init() to userspace (Bandan Das) [RHEL-68361 RHEL-65840]
  - KVM: SEV: Provide support for SNP_EXTENDED_GUEST_REQUEST NAE event (Bandan Das) [RHEL-68361 RHEL-65840]
  - x86/sev: Move sev_guest.h into common SEV header (Bandan Das) [RHEL-68361 RHEL-65840]
  - KVM: SEV: Provide support for SNP_GUEST_REQUEST NAE event (Bandan Das) [RHEL-68361 RHEL-65840]
  - i40e: fix race condition by adding filter's intermediate sync state (CKI Backport Bot) [RHEL-69809] {CVE-2024-53088}
  - ice: fix truesize operations for PAGE_SIZE >= 8192 (CKI Backport Bot) [RHEL-70660 RHEL-37905]
  - ice: fix ICE_LAST_OFFSET formula (CKI Backport Bot) [RHEL-70660 RHEL-37905]
  - ice: fix page reuse when PAGE_SIZE is over 8k (CKI Backport Bot) [RHEL-70660 RHEL-37905]
  - nvme-fabrics: handle zero MAXCMD without closing the connection (Maurizio Lombardi) [RHEL-72970]
  - selftests: netfilter: add test case for recent mismatch bug (Florian Westphal) [RHEL-71357 RHEL-60554]
  - netfilter: nf_tables: unconditionally flush pending work before notifier (Florian Westphal) [RHEL-71357 RHEL-60554]
  - netfilter: nft_set_pipapo_avx2: disable softinterrupts (Florian Westphal) [RHEL-71357 RHEL-60554]
  - netfilter: nf_set_pipapo: fix initial map fill (Florian Westphal) [RHEL-71357 RHEL-60554]
  - netfilter: nf_tables: store new sets in dedicated list (Florian Westphal) [RHEL-71357 RHEL-60554]
  - netfilter: nft_socket: Fix a NULL vs IS_ERR() bug in nft_socket_cgroup_subtree_level() (Florian Westphal) [RHEL-71357 RHEL-60554]
  - netfilter: nft_socket: make cgroupsv2 matching work with namespaces (Florian Westphal) [RHEL-71357 RHEL-60554]
  - netfilter: nft_socket: fix sk refcount leaks (Florian Westphal) [RHEL-71357 RHEL-60554]
  - tcp: Fix use-after-free of nreq in reqsk_timer_handler(). (Guillaume Nault) [RHEL-70541 RHEL-70449]
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66329 RHEL-66328] {CVE-2024-50154}
  - rcu: Use system_unbound_wq to avoid disturbing isolated CPUs (Waiman Long) [RHEL-61329 RHEL-50220]
  - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71393 RHEL-9848]
  - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71393 RHEL-9848]


author: Julien Rische <jrische@redhat.com> - 1.21.1-4
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55423
  - Fix various issues detected by static analysis
    Resolves: RHEL-58216
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-15323


author: Tomas Popela <tpopela@redhat.com> - 2.72.0-8.el9_5.1
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Resolves: RHEL-67080


author: Tomas Popela <tpopela@redhat.com> - 2.72.0-8.el9_5.2
changelog:
  - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data
  - Resolves: RHEL-67068


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-8.3
changelog:
  - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict
    Resolves: RHEL-76381


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.1.el9_5
changelog:
  - qemu: migration: Pre-create QCOW2 images for non-shared storage with 0 allocation (RHEL-61177)
  - virTypedParamsFilter: Adjust return type and docs (RHEL-61177)
  - virTypedParamsGetStringList: Refactor and adjust docs (RHEL-61177)
  - virTypedParamsFilter: Introduce option to filter also by type (RHEL-61177)
  - virTypedParamsGetStringList: Ensure that returned array is NULL if there are no matching fields (RHEL-61177)
  - virTypedParamsGetStringList: Ensure that returned string list is NULL-terminated (RHEL-61177)
  - qemuMigrationSrcBeginPhaseBlockDirtyBitmaps: Use qemuMigrationAnyCopyDisk() (RHEL-61177)
  - qemu: migration: Don't log 'nmigrate_disks' (RHEL-61177)
  - qemu: migration: Avoid use of 'nmigration_disks' (RHEL-61177)
  - qemu: migration: Extract validation of disk target list (RHEL-61177)
  - qemu: migration: Remove 'nmigration_disks' variable from all places (RHEL-61177)
  - qemu: Introduce and wire in 'VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES' (RHEL-61177)
  - virsh: Add support for VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES migration parameter (RHEL-61177)
  - qemu: migration: Fix blockdev config with VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES (RHEL-61177)
  - docs: Add warning about using a cleared image with VIR_MIGRATE_PARAM_MIGRATE_DISKS_DETECT_ZEROES_ZEROES (RHEL-61177)
  - util: Look for newer name of cpu wait time statistic (RHEL-61511)
  - vmx: Allow '*' to appear in VMX file keys (RHEL-58677)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.2.el9_5
changelog:
  - qemu: Add support for postcopy-recover-setup migration state (RHEL-63877)
  - qemu: Avoid false failure when resuming post-copy migration (RHEL-63877)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-3.el9_5.1
changelog:
  - add option to ts2phc to specify minimum expected NMEA delay (RHEL-70168)
  - don't require -O option without -a and -w in phc2sys (RHEL-70678)


author: Jonas Ådahl <jadahl@redhat.com> - 40.9-22
changelog:
  - Fix crash when moving window while switching workspace
    Resolves: RHEL-62997
  - Improve app discovery for workspace logic
    Resolves: RHEL-63000


author: Gris Ge <fge@redhat.com> - 2.2.38-1
changelog:
  - Upgrade to 2.2.38
  - Fix gc mode on blackhole route. RHEL-58666
  - Only search desired interface for storing route rule. RHEL-60261


author: Wen Liang <wenliang@redhat.com> - 2.2.39-1
changelog:
  - Upgrade to 2.2.39
  - Fix VLAN interface being removed unnecessarily due to route mismatches triggering deactivations. RHEL-65031


author: Jan Staněk <jstanek@redhat.com> - 1:20.12.2-1
changelog:
  - Rebase to version 20.12.0
    Fixes CVE-2024-27983 CVE-2024-27982 CVE-2024-22025 (node)
    Fixes CVE-2024-25629 (c-ares)


author: Diaa Sami <disami@redhat.com> - 1.5.1-21
changelog:
  - pam_unix: always run the helper to obtain shadow password file entries.
    CVE-2024-10041. Resolves: RHEL-62880


author: Jindrich Novy <jnovy@redhat.com> - 2:5.2.2-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/8e693ce)
  - Resolves: RHEL-60963


author: Jindrich Novy <jnovy@redhat.com> - 4:5.2.2-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/c03b5f3)
  - Resolves: RHEL-61667


author: Jindrich Novy <jnovy@redhat.com> - 4:5.2.2-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/6df7dfb)
  - Resolves: RHEL-61847


author: Jindrich Novy <jnovy@redhat.com> - 4:5.2.2-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/39171ac)
  - Resolves: RHEL-62566


author: Jindrich Novy <jnovy@redhat.com> - 4:5.2.2-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/e40738b)
  - Resolves: RHEL-61962


author: Jindrich Novy <jnovy@redhat.com> - 4:5.2.2-12
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/76d1690)
  - Resolves: RHEL-73592


author: Jindrich Novy <jnovy@redhat.com> - 4:5.2.2-13
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/173b20b)
  - Resolves: RHEL-67606


author: Jindrich Novy <jnovy@redhat.com> - 2:5.2.2-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/5f2c188)
  - Resolves: RHEL-59703


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.21-1
changelog:
  - Update to 3.9.21
  - Security fix for CVE-2024-11168 and CVE-2024-9287
  Resolves: RHEL-64888
  Resolves: RHEL-67259


author: Tomas Korbar <tkorbar@redhat.com> - 1.16.2-6
changelog:
  - Fix KeyTrap - Extreme CPU consumption in DNSSEC validator CVE-2023-50387
  - Fix Preparing an NSEC3 closest encloser proof can exhaust CPU resources CVE-2023-50868
  - Resolves: RHEL-25671
  - Resolves: RHEL-25643


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-10.el9_5.1
changelog:
  - kvm-migration-multifd-Avoid-the-final-FLUSH-in-complete.patch [RHEL-63874]
  - kvm-migration-Rename-thread-debug-names.patch [RHEL-63874]
  - kvm-migration-Use-MigrationStatus-instead-of-int.patch [RHEL-63874]
  - kvm-migration-Cleanup-incoming-migration-setup-state-cha.patch [RHEL-63874]
  - kvm-migration-postcopy-Add-postcopy-recover-setup-phase.patch [RHEL-63874]
  - kvm-migration-docs-Update-postcopy-recover-session-for-S.patch [RHEL-63874]
  - kvm-tests-migration-tests-Drop-most-WIN32-ifdefs-for-pos.patch [RHEL-63874]
  - kvm-tests-migration-tests-Always-enable-migration-events.patch [RHEL-63874]
  - kvm-tests-migration-tests-migration_event_wait.patch [RHEL-63874]
  - kvm-tests-migration-tests-Verify-postcopy-recover-setup-.patch [RHEL-63874]
  - kvm-tests-migration-tests-Cover-postcopy-failure-on-reco.patch [RHEL-63874]
  - Resolves: RHEL-63874
    (Failure to resume paused post-copy migration is undetectable [rhel-9.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.0.0-10.el9_5.2
changelog:
  - kvm-vhost-fail-device-start-if-iotlb-update-fails.patch [RHEL-73006]
  - Resolves: RHEL-73006
    (qemu-kvm: vhost: reports error while updating IOTLB entries [rhel-9.5.z])


author: Jarek Prokop <jprokop@redhat.com> - 3.1.4-143
changelog:
  - Upgrade to Ruby 3.1.4.
    Resolves: RHEL-5586
  - Fix HTTP response splitting in CGI.
    Resolves: RHEL-5591
  - Fix ReDos vulnerability in URI.
    Resolves: RHEL-28919
    Resolves: RHEL-5612
  - Fix ReDos vulnerability in Time.
    Resolves: RHEL-28920
  - Make RDoc soft dependency in IRB.
    Resolves: RHEL-5613


author: Jun Aruga <jaruga@redhat.com> - 3.1.5-144
changelog:
  - Upgrade to Ruby 3.1.5.
    Resolves: RHEL-33978
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-34129
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-34121
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-33871


author: Matthew Burket <mburket@redhat.com> - 0.1.75-1
changelog:
  - Rebase to new release (RHEL-66154)
  - the rule sshd_use_priv_separation is no longer used (RHEL-66057)
  - add a rule checking for presence of chrony to CIS RHEL 9 profile (RHEL-60005)
  - remediation of Networkmanager DNS mode now remediates value "default" (RHEL-53426)
  - Adjust mount_option_nodev_nonroot_local_partitions to work in Image Builder environments. (RHEL-45018)
  - Adjusted rules related to sshd ensure constancy in checked values and ensure that drop in configuration files are checked. (RHEL-38206)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.16.3-2.el9_5.1
changelog:
  - seabios-pciinit-don-t-misalign-large-BARs.patch [RHEL-68955]
  - Resolves: RHEL-68955
    (amdgpu failed to initialize when multiple AMD MI210 GPUs assigned and firmware is seabios [rhel-9.5.z])


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-14.1
changelog:
  - Resolves: RHEL-62332 - (Regression) Transfer-encoding:chunked data is not sent
    to the client in its complementary


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-14.3
changelog:
  - Disable ESI support
  - Resolves: RHEL-65076 - CVE-2024-45802 squid: Denial of Service processing ESI
    response content


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4.1
changelog:
  - Resolves: RHEL-59876 - EL9/CentOS Stream 9 lost offline smart card authentication
  - Resolves: RHEL-50912 - possible regression of rhbz#2196521


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4.2
changelog:
  - Resolves: RHEL-66268 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-9.5.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.5-4.3
changelog:
  - Resolves: RHEL-67673 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-9.5.z]


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30756
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30768
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30762


author: Jan Grulich <jgrulich@redhat.com> - 1.14.1-1
changelog:
  - 1.14.1
    Resolves: RHEL-66600
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-62000


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-2
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66639
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66616


author: Petr Menšík <pemensik@redhat.com> - 32:9.18.29-1.1
changelog:
  - Limit additional section records CPU processing (CVE-2024-11187)
  - Read HTTPS requests in limited chunks and prevent overload (CVE-2024-12705)


author: Phil Sutter <psutter@redhat.com> [1.8.10-5.el9]
changelog:
  - xtables-monitor: Ignore ebtables policy rules unless tracing (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Fix for ebtables rule events (Phil Sutter) [RHEL-47264]
  - tests: shell: New xtables-monitor test (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Support arptables chain events (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Align builtin chain and table output (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Flush stdout after all lines of output (Phil Sutter) [RHEL-47264]
  - xtables-monitor: Proper re-init for rule's family (Phil Sutter) [RHEL-47264]
  - nft: Fix for zeroing existent builtin chains (Phil Sutter) [RHEL-49497]
  - nft: cache: Annotate faked base chains as such (Phil Sutter) [RHEL-49497]
  - nft: Fix for zeroing non-existent builtin chains (Phil Sutter) [RHEL-49497]


author: Scott Weaver <scweaver@redhat.com> [5.14.0-503.23.2.el9_5]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CKI Backport Bot) [RHEL-78075 RHEL-69574] {CVE-2024-53104}


author: Chao YE <cye@redhat.com> [5.14.0-503.24.1.el9_5]
changelog:
  - smb: client: fix potential race in cifs_put_tcon() (Jay Shin) [RHEL-73594 RHEL-70959]
  - smb: client: don't try following DFS links in cifs_tree_connect() (Jay Shin) [RHEL-73594 RHEL-70959]
  - smb: client: allow reconnect when sending ioctl (Jay Shin) [RHEL-73594 RHEL-70959]
  - smb: client: get rid of @nlsc param in cifs_tree_connect() (Jay Shin) [RHEL-73594 RHEL-70959]
  - smb: client: allow more DFS referrals to be cached (Jay Shin) [RHEL-73594 RHEL-70959]
  - smb3: fix broken reconnect when password changing on the server by allowing password rotation (Jay Shin) [RHEL-73594 RHEL-57983]
  - i40e: Fix handling changed priv flags (Kamal Heib) [RHEL-69857 RHEL-30524]
  - mm: migrate: fix getting incorrect page mapping during page migration (Rafael Aquini) [RHEL-70898 RHEL-27742 RHEL-28873] {CVE-2023-52490}
  - mm: migrate: record the mlocked page status to remove unnecessary lru drain (Rafael Aquini) [RHEL-70898 RHEL-27742]
  - mm: convert migrate_pages() to work on folios (Rafael Aquini) [RHEL-70898 RHEL-27742]
  - migrate_pages_batch: simplify retrying and failure counting of large folios (Rafael Aquini) [RHEL-70898 RHEL-27742]


author: Chao YE <cye@redhat.com> [5.14.0-503.26.1.el9_5]
changelog:
  - redhat: drop Y issues from changelog (Jan Stancek)
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CKI Backport Bot) [RHEL-78075] {CVE-2024-53104}


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.3.el9_5
changelog:
  - libvirt_private.syms: Export virDomainIOMMUDefNew() (RHEL-69725)
  - qemu: Turn EIM IOMMU on automagically (RHEL-69725)
  - qemu_domain: Automagically add IOMMU if needed (RHEL-69725)


author: Jiri Denemark <jdenemar@redhat.com> - 10.5.0-7.4.el9_5
changelog:
  - qemu: Enable I/O APIC if needed (RHEL-69725)
  - qemu: Enable I/O APIC even more frequently (RHEL-69725)


author: Jan Staněk <jstanek@redhat.com> - 1:22.13.1-1
changelog:
  - Update to version 22.13.1
    Fixes CVE-2025-23083 CVE-2025-23085 CVE-2025-22150
    Resolves: RHEL-76360


author: Andrei Radchenko <aradchen@redhat.com>
changelog:
  - Update to version 20.18.2
    Fixes: CVE-2025-23083 CVE-2025-23085 CVE-2025-22150
    Resolves: RHEL-76536 RHEL-76364


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-6.1
changelog:
  - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
    Resolves: RHEL-76755


author: Kseniia Nivnia <knivnia@redhat.com> - 0.107.0-2
changelog:
  - Bump revision
  - Update tarball name to match upstream
  - Upgrade the following tarball dependencies:
  - x/sys v0.23.0 to v0.29.0
  - x/crypto v0.26.0 to v0.32.0
  - x/net v0.28.0 to v0.33.0
  - x/sync v0.8.0 to v0.10.0
  - x/term v0.23.0 to v0.28.0
  - x/text v0.17.0 to v0.21.0
  - Update addresses the following CVEs:
  - CVE-2024-45338
  - CVE-2024-45337


author: Patsy Griffin <pats@redhat.com> - 2025a-1
changelog:
  Update to tzdata-2025a (RHEL-74308)
    - Paraguay is now permanently at -03. This impacts timestamps
      starting on 2025-03-22.
    - Includes improvements to pre-1991 data for the Philippines.
    - Etc/Unknown is now reserved.


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.6-8
changelog:
  - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper
    resolves: RHEL-78844
  - convert: Use yum/apt/... for package removals
    resolves: RHEL-78842


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11.el9_5.1
changelog:
  - Fix man.el shell injection vulnerability (RHEL-79021)
  - Eliminate use of obsolete patch syntax (RHEL-80450)


