# changelog

author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-6
changelog:
  - release 1.3.3.1-6
  - Resolves: bug 1151287 - dynamically added macro aci is not evaluated on the fly (DS 47922)
  - Resolves: bug 1080186 - Need to move slapi_pblock_set(pb, SLAPI_MODRDN_EXISTING_ENTRY, original_entry->ep_entry) prior to original_entry overwritten (DS 47897)
  - Resolves: bug 1150694 - Encoding of SearchResultEntry is missing tag (DS 47920)
  - Resolves: bug 1150695 - ldbm_back_modify SLAPI_PLUGIN_BE_PRE_MODIFY_FN does not return even if one of the preop plugins fails. (DS 47919)
  - Resolves: bug 1139882 - Fix remaining compiler warnings (DS 47892)
  - Resolves: bug 1150206 - result of dna_dn_is_shared_config is incorrectly used (DS 47918)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-8
changelog:
  - release 1.3.3.1-8
  - Resolves: bug 1156607 - Crash in entry_add_present_values_wsi_multi_valued (DS 47937)
  - Resolves: bug 1153737 - Disable SSL v3, by default (DS 47928, DS 47945, DS 47948)
  - Resolves: bug 1158804 - Malformed cookie for LDAP Sync makes DS crash (DS 47939)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-9
changelog:
  - release 1.3.3.1-9
  - Resolves: bug 1153737 - Disable SSL v3, by default. (DS 47928)
  - Resolves: bug 1163461 - Should not check aci syntax when deleting an aci (DS 47953)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-10
changelog:
  - release 1.3.3.1-10
  - Resolves: bug 1172731 - CVE-2014-8112 password hashing bypassed when "nsslapd-unhashed-pw-switch" is set to off 
  - Resolves: bug 1166265 - DS hangs during online total update (DS 47942)
  - Resolves: bug 1168151 - CVE-2014-8105 information disclosure through 'cn=changelog' subtree
  - Resolves: bug 1044170 - Allow memberOf suffixes to be configurable (DS 47526)
  - Resolves: bug 1171356 - Bind DN tracking unable to write to internalModifiersName without special permissions (DS 47950)
  - Resolves: bug 1153737 - logconv.pl -- support parsing/showing/reporting different protocol versions (DS 47949)
  - Resolves: bug 1171355 - start dirsrv after chrony on RHEL7 and Fedora (DS 47947)
  - Resolves: bug 1170707 - cos_cache_build_definition_list does not stop during server shutdown (DS 47967)
  - Resolves: bug 1170708 - COS memory leak when rebuilding the cache (DS - Ticket 47969)
  - Resolves: bug 1170709 - Account lockout attributes incorrectly updated after failed SASL Bind (DS 47970)
  - Resolves: bug 1166260 - cookie_change_info returns random negative number if there was no change in a tree (DS 47960)
  - Resolves: bug 1012991 - Error log levels not displayed correctly (DS 47636)
  - Resolves: bug 1108881 - rsearch filter error on any search filter (DS 47722)
  - Resolves: bug 994690  - Allow dynamically adding/enabling/disabling/removing plugins without requiring a server restart (DS 47451)
  - Resolves: bug 1162997 - Running a plugin task can crash the server (DS 47451)
  - Resolves: bug 1166252 - RHEL7.1 ns-slapd segfault when ipa-replica-install restarts (DS 47451)
  - Resolves: bug 1172597 - Crash if setting invalid plugin config area for MemberOf Plugin (DS 47525)
  - Resolves: bug 1139882 - coverity defects found in 1.3.3.x (DS 47965)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-11
changelog:
  - release 1.3.3.1-11
  - Resolves: bug 1080186 - During delete operation do not refresh cache entry if it is a tombstone (DS 47750)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-12
changelog:
  - release 1.3.3.1-12
  - Resolves: bug 1182477 - Windows Sync accidentally cleared raw_entry (DS 47989)
  - Resolves: bug 1180325 - upgrade script fails if /etc and /var are on different file systems (DS 47991 )
  - Resolves: bug 1183655 - Schema learning mechanism, in replication, unable to extend an existing definition (DS 47988)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-14
changelog:
  - release 1.3.3.1-14
  - Resolves: bug 1189154 - DNS errors after IPA upgrade due to broken ReplSync (DS 48030)
              Fixes spec file to make sure all the server instances are stopped before upgrade
  - Resolves: bug 1186548 - ns-slapd crash in shutdown phase (DS 48005)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-16
changelog:
  - release 1.3.3.1-16
  - Resolves: bug 1212894 - CVE-2015-1854 389ds-base: access control bypass with modrdn


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-17
changelog:
  - release 1.3.3.1-17
  - Resolves: bug 1230038 - idm/ipa 389-ds-base entry cache converges to 500 KB in dblayer_is_cachesize_sane (DS 48190)
  - Resolves: bug 1230037 - async simple paged results issue (DS 48146, DS 48192)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-18
changelog:
  - release 1.3.3.1-18
  - Resolves: bug 1232100 - CVE-2015-3230 389-ds-base: nsSSL3Ciphers preference not enforced server side (DS 48194)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.3.3.1-20
changelog:
  - release 1.3.3.1-20
  - Resolves: bug 1243718 - Winsync fails when AD users have multiple spaces (two)inside the value of the rdn attribute (DS 48223)


author: Thomas Haller <thaller@redhat.com> - 1:1.0.0-7.git20150107.1ea95cd3
changelog:
  - platform: fix handling of routes with special metric (rh #1172780)
  - ifcfg-rh: add reading and writing of route-metric property


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-9.git20150121.b4ea599c
changelog:
  - build: fix NetworkManager-libnm and old NetworkManager-glib conflict (rh #1066690)
  - core: accept numeric bond options (rh #1171009) (rh #1133544)
  - core/libnm: better validate setting properties (rh #1182567)
  - core: add dispatcher script to support policy based routing (rh #1160013)


author: Dan Williams <dcbw@redhat.com> - 1:1.0.0-13.git20150121.b4ea599c
changelog:
  - core: remove IPv6LL address when deactivating managed devices (rh #1184997)
  - core: recognize external IP config earlier on startup
  - core: fix bridge default metric


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-15
changelog:
  - Use /dev/urandom when generating rndc.key file (#1107568)
  - Allow authentication using TSIG in allow-notify configuration statement (#1067424)
  - Fix race condition when destroying a resolver fetch object (#1072379)
  - Increase defaults for lwresd workers and make workers and client objects number configurable (#1098959)
  - Configure BIND with --with-dlopen=yes to support dynamically loadable DLZ drivers (#1096688)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-17
changelog:
  - Fix error in dyndb API that can cause named to freeze on shutdown (#1142150)
  - Fix error in triggerun scriptlet (#1143033)
  - Remove /var/named/chroot/var/run on bind-chroot update if it is a directory (#1091341)


author: Tomas Hozza <thozza@redhat.com> - 32:9.9.4-18.4
changelog:
  - DNS resolution failure in high load environment with SERVFAIL and "out of memory/success" in the log (#1221180)
  - Increase ISC_SOCKET_MAXEVENTS to 2048 (#1250561)


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-21.9
changelog:
  - This fixes a problem seen on powerpc64le ELFv2 when creating a
    function symbol alias with ld --defsym.  st_other needs to be copied
    from the source symbol to the alias in order to set up the local entry
    offset for the alias.


author: Patsy Franklin <pfrankli@redhat.com> - 2.23.52.0.1-22.9
changelog:
  - Reduce the size of aarch64 .debug_line; fix cfi encoding of fp registers;
    add register names to dumping of aarch64 cfi data. Patch provided by rth.
    Resolves: #1132641


author: Jeff Law <law@redhat.com> - 2.23.52.0.1-25.9
changelog:
  Revert this change (handled elsewhere): 
  - Additional patch from Alan to fix problems with ld --defsym.
    (#1132732)


author: Kai Engert <kaie@redhat.com> - 2014.1.98-71
changelog:
  - Update to CKBI 1.98 from NSS 3.16.1
  - building on RHEL 7 no longer requires java-openjdk
  - added more detailed instructions for release numbers on RHEL branches,
    to avoid problems when rebasing on both z- and y-stream branches.


author: Stef Walter <stefw@redhat.com> - 2014.1.98-72
changelog:
  - The BasicConstraints fix for Entrust Root is no longer necessary.
    In addition it was invalid for p11-kit 0.20.x. rhbz#1130485


author: Kai Engert <kaie@redhat.com> - 2015.2.3-70.0
changelog:
  - Update to CKBI 2.3 from NSS 3.18 with legacy modifications.
  - Add a patch to the source RPM that documents the changes from the
    upstream version.
  - Introduce the ca-legacy utility, a manual page, and the ca-legacy.conf
    configuration file.
  - The new scriptlets require the coreutils package.
  - Remove the obsolete blacklist.txt file.
  - Add an alternative version of the "Thawte Premium Server CA" root,
    which carries a SHA1-RSA signature, to allow OpenJDK to verify applets
    which contain that version of the root certificate.
    This change doesn't add trust for another key, because both versions
    of the certificate use the same public key (rhbz#1170982).


author: Ray Strode <rstrode@redhat.com> 69.1.6-1
changelog:
  - Update syslinux background to black
    Resolves: #1003873
  - Prune unused images from anaconda/ after talking to #anaconda


author: Jim Perrin <jperrin@centos.org> - 70.0.5-1
changelog:
  - Properly import all backgrounds images
  - update poweredby.png
  - Add CREDITS for artwork attribution as possible. 
  - Update anaconda rnotes images from Tuomas, inspired by Alain


author: Karanbir Singh <kbsingh@centos.org> 7.0.el7.0.140617.3
changelog:
  - rebuild for 2014-06-17 pub qa release
  - ensure we get the right cpe info
  - ensure centos-release is trackable


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Trial run for CentOS DateStamp release
  - Add stubs for the yum repos
  - fix os-release to only have one ID_LIKE ( Avij #7171)
  - make the yum repo definitions be config noreplace ( Trevor )


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Roll in the final name change conversation results
  - Stage for release content
  - Add yum repos
  - Add distro keys ( incomplete )


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - add a yum var to route mirrorlist accurately
  - add CentOS-fastrack repo
  - Trim the CentOS-Debug-7 key
  - rename the Debug repo to base-debug so yum-utils can consume easier


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Bump Release for 1503 
  - add ABRT specific content to os-release
  - split redhat-release from centos-release


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-12
changelog:
  - Return jobs in rank order when handling IPP-Get-Jobs (bug #1046841).
  - dbus notifier: call _exit when handling SIGTERM (STR #4314, bug #1030666).
  - Use '-f' when using rm in %setup section (bug #1046374).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-16
changelog:
  - Apply upstream patch to fix CVE-2014-5029 (bug #1122600),
    CVE-2014-5030 (bug #1128764), CVE-2014-5031 (bug #1128767). Also:
    - Fix conf/log file reading for authenticated users (STR #4461).
    - Fix icon display in web interface during server restart (STR #4475).
  - Apply upstream patch to fix privilege escalation due to insufficient
    checking (CVE-2014-3537, bug #1115576).
  - Describe ErrorPolicy in the cupsd.conf man page (bug #1120591).
  - Reduce package dependencies (bug #1115057):
    - New client subpackage containing command line client tools.
    - Removed 'Requires: /sbin/chkconfig'.
    - Moved 'Provides: lpd' to lpd subpackage.
  - Avoid race condition in cupsdReadClient() (bug #1113045).
  - Apply upstream patch to avoid 10 second timeouts in cupsd caused by
    reading when no data ready (bug #1110259).
  - Use colord interface correctly (bug #1087323).
  - Fix for cupsEnumDest() 'removed' callbacks (bug #1072954, STR #4380).


author: Tim Waugh <twaugh@redhat.com> - 1:1.6.3-17
changelog:
  - Support for failover without load-balancing (bug #1115219).
  - Fix cupsGetPPD3() so it doesn't give the caller an unreadable file
    (part of fix for CVE-2014-5031, STR #4500).
  - Can no longer reproduce bug #1010580 so removing final-content-type
    patch as it causes issues for some backends (bug #1149245).
  - Start cups.service after network.target (bug #1144780).


author: Jeroen van Meeuwen <vanmeeuwen@kolabsys.com> - 2.4.17-1
changelog:
  - New upstream version, fixes upstream bugs:
  - reconstruct doesn't retain internaldate correctly (#3733)
  - Race condition in maibox rename (#3696)
  - DBERROR db4: Transaction not specified for a transactional database (#3715)
  - performance degradation on huge indexes in 2.4 branch (#3717)
  - typo fix in imapd.conf man page (#3729)
  - quota does not find all quotaroots if quotalegacy, fulldirhash and prefix are used and virtdomains is off (#3735)
  - Mail delivered during XFER was lost (#3737)
  - replication does not work on RENAME (#3742)
  - Failed asserting during APPEND (#3754)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-69
changelog:
  - Add 0096-RHBZ-979474-new-wildcards.patch
    * Add N, n, R, and r path wildcards to print World Wide ids
  - Add 0097-RH-fix-coverity-errors.patch
    * Fix a number of unterminated strings and memory leaks on failure
      paths.
  - Resolves: bz #979474


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-70
changelog:
  - Modify 0096-RHBZ-979474-new-wildcards.patch
    * Fix a faulty check
  - Add 0098-UPBZ-1067171-mutipath-i.patch
    * Add -i option to ignore wwids file when checking for valid paths
  - Add 0099-RH-add-all-devs.patch
    * Add new devices config option all_devs. This makes the configuration
      overwrite the specified values in all builtin configs
  - Related: bz #979474
  - Resolves: bz #1067171


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-71
changelog:
  - Re-add 0050-RH-listing-speedup.patch
  - Modify 0098-UPBZ-1067171-mutipath-i.patch
    * add dry_run cleanup code from upstream
  - Refresh 0099-RH-add-all-devs.patch
  - Add 0100-RHBZ-1067171-multipath-i-update.patch
    * make -i work correctly with find_multipaths
  - Resolves: bz #1067171


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-72
changelog:
  - Add 0101-RH-cleanup-partmaps-code.patch
    * code refactoring to prepare for next patch
  - Add 0102-RHBZ-631009-deferred-remove.patch
    * add deferred_remove option to /etc/multipath.conf
  - Resolves: bz #631009


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-75
changelog:
  - Add 0103-RHBZ-1148979-fix-partition-mapping-creation-race-with-kpartx.patch
    * Only run kpartx on device activation
  - Resolves: bz #1148979


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-76
changelog:
  - Modify 0102-RHBZ-631009-deferred-remove.patch
    * Fixed compiler warning message for builds with old device-mapper versions
  - Add 0104-RHBZ-1159337-fix-double-free.patch
    * made ev_remove_path exit immediately after failing setup_multipath, since
      it handles cleaning up the device
  - Resolves: bz #1159337
  - Related: bz #631009


author: Benjamin Marzinski <bmarzins@redhat.com> 0.4.9-77
changelog:
  - Add 0105-RHBZ-1180032-find-multipaths-man.patch
    * add find_multipaths to man page
  - Modify multipath.conf (bz #1069360)
    * add uid_attribute example
  - Resolves: bz #1180032


author: Tomas Hozza <thozza@redhat.com> - 2.66-4
changelog:
  - include several fixes from upstream repo:
    - Send TCP DNS messages in one packet
    - Fix crash on SERVFAIL when using --conntrack option
    - Fix regression in dhcp_lease_time utility
    - Man page typos fixes
    - Note that dhcp_lease_time and dhcp_release work only for IPv4
    - Fix for --dhcp-match option to work also with BOOTP protocol


author: Tomas Hozza <thozza@redhat.com> - 2.66-5
changelog:
  - dnsmasq unit file cleanup
    - drop forking Type and PIDfile and rather start dnsmasq with "-k" option
    - drop After syslog.target as this is by default


author: Tomas Hozza <thozza@redhat.com> - 2.66-6
changelog:
  - include several fixies from upstream repo:
    - Tighten hostname checks in legal hostname() function
    - Replace inet_addr() with inet_pton() in src/option.c
    - Use dnsmasq as default DNS server for RA only if it's doing DNS
    - Handle IPv4 interface address labels (aliases) in Linux (#962246)
    - Fix failure to start with ENOTSOCK (#962874)


author: Tomas Hozza <thozza@redhat.com> - 2.66-7
changelog:
  - use _hardened_build macro instead of hardcoded flags
  - include several fixies from upstream repo:
    - Allow constructed ranges from interface address at end of range
    - Dont BINDTODEVICE DHCP socket if more interfaces may come
    - Fix option parsing for dhcp host
    - Log forwarding table overflows
    - Remove limit in prefix length in auth zone


author: Harald Hoyer <harald@redhat.com> 033-224
changelog:
  - don't enforce iSCSI target name policy
  Resolves: rhbz#1078867
  - replaced "ip=auto" with "ip=dhcp" in the documentation
  Resolves: rhbz#1086931
  - bind bonding and bridge interfaces to SUBCHANNELS on s390(x)
  Resolves: rhbz#1090524
  - turn on ipv6, if configured
  Resolves: rhbz#1091410
  - parse DASD="none" as empty
  Resolves: rhbz#1096979
  - add virtio-console for qemu
  Resolves: rhbz#1097999
  - fail on missing dracut modules
  Resolves: rhbz#1121362
  - replace the default route
  Resolves: rhbz#1137022


author: Harald Hoyer <harald@redhat.com> 033-233
changelog:
  - fips: corrected previous fix
  Resolves: rhbz#1165603
  - fixed iscsi_target parsing
  Resolves: rhbz#1176534
  - skip GlobalKnownHostsFile for ssh_config
  Resolves: rhbz#1086778
  - cms-write-ifcfg.sh: turn SUBCHANNELS into lowercase
  Resolves: rhbz#1169384
  - fixed static routes execution
  Resolves: rhbz#1101412
  - add 90-vconsole.rules
  Resolves: rhbz#1162177


author: Harald Hoyer <harald@redhat.com> 033-237
changelog:
  - add support for multiple autoconf options ip=eth0:auto6,dhcp
  Resolves: rhbz#1069270
  - fixed team implementation
  Resolves: rhbz#1147521


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.49-10
changelog:
  - Use vsnprintf instead of vsprintf to avoid buffer overflow
    (it happens e.g. when running systemtap testsuite)
    Resolves: #1038931


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.45-13
changelog:
  - Fix segfaults if Tcl is built with stubs and Expect is used directly from C program
    (patch taken from Debian project, written by Sergei Golovan)
    Resolves: #1091060


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 5.45-14
changelog:
  - Use different and probably better approach of fixing segfaults if Tcl is
    built with stubs and Expect is used directly from C program
    Resolves: #1091060


author: Marek Grac <mgrac@redhat.com> - 4.0.11-5
changelog:
  - fence_wti: Fix problem with EOL introduced by rebase
    Resolves: rhbz#1148762
  - fence_rsb: Fix issue with new firmware 
    Resolves: rhbz#1111597


author: Marek Grac <mgrac@redhat.com> - 4.0.11-6
changelog:
  - fence_cisco_ucs and fence_vmware_soap should logout even in case of failure
    Resolves: rhbz#1111599
  - fence_vmware_soap: Fix issue with import of fail_usage
    Resolves: rhbz#1153059


author: Marek Grac <mgrac@redhat.com> - 4.0.11-9
changelog:
  - fence_ilo_ssh: Fix EOL issue, syslog problem and add fence_ilo_[34]_ssh symlink
    Resolves: rhbz#1121122


author: Marek Grac <mgrac@redhat.com> - 4.0.11-11
changelog:
  - fence_ipmilan: Unset default cipher
    Resolves: rhbz#1206294
  - fence_ilo2: Add --tls1.0
    Resolves: rhbz#1206293
  - update scripts so 'make check' is working again


author: Miroslav Lichvar <mlichvar@redhat.com> 1.2.1-11.20121204gita43f56
changelog:
  - update to 20121204gita43f56
  - create libs subpackage
  - split documentation to base and devel subpackages
  - drop defattr macros
  - add GFDL to License tag


author: Miroslav Lichvar <mlichvar@redhat.com> 1.3.0-5
changelog:
  - fix buffer overflow when processing ID3v2 metadata (CVE-2014-8962)
  - fix buffer overflow with invalid blocksize (CVE-2014-9028)


author: Soren Sandmann <ssp@redhat.com> - 1.0.2-3
changelog:
  - Man page fixes
    - Document that multiple connections don't work (988294)
    - Document the list of plugins (988307, 988308)


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-3
changelog:
  - Fix emboldening:
      - split out MSB function
      - fix integer overflows
      - fix broken emboldening at small sizes
  - Resolves: #891457


author: Marek Kasik <mkasik@redhat.com> - 2.4.11-10.el7_1.1
changelog:
  - Fixes CVE-2014-9657
     - Check minimum size of `record_size'.
  - Fixes CVE-2014-9658
     - Use correct value for minimum table length test.
  - Fixes CVE-2014-9675
     - New macro that checks one character more than `strncmp'.
  - Fixes CVE-2014-9660
     - Check `_BDF_GLYPH_BITS'.
  - Fixes CVE-2014-9661
     - Initialize `face->ttf_size'.
     - Always set `face->ttf_size' directly.
     - Exclusively use the `truetype' font driver for loading
       the font contained in the `sfnts' array.
  - Fixes CVE-2014-9663
     - Fix order of validity tests.
  - Fixes CVE-2014-9664
     - Add another boundary testing.
     - Fix boundary testing.
  - Fixes CVE-2014-9667
     - Protect against addition overflow.
  - Fixes CVE-2014-9669
     - Protect against overflow in additions and multiplications.
  - Fixes CVE-2014-9670
     - Add sanity checks for row and column values.
  - Fixes CVE-2014-9671
     - Check `size' and `offset' values.
  - Fixes CVE-2014-9673
     - Fix integer overflow by a broken POST table in resource-fork.
  - Fixes CVE-2014-9674
     - Fix integer overflow by a broken POST table in resource-fork.
     - Additional overflow check in the summation of POST fragment lengths.
  - Work around behaviour of X11's `pcfWriteFont' and `pcfReadFont' functions
  - Resolves: #1197739


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-4
changelog:
  - reverted change to use the p11-kit certificate storage (#1110750)
  - added functions to test DH/ECDH in FIPS-140-2 mode and fixed
    RSA key generation (#1110696)
  - added manual dependencies on libtasn1 3.8 as well as p11-kit 0.20.7
  - fixed SHA224 in SSSE3 optimized code
  - fixed issue with handshake buffer resets (#1153106)
  - fixed issue in RSA key generation with specific seeds in FIPS140-2 mode


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-9
changelog:
  - Amended fix for FIPS enforcement issue (#1163848)
  - Fixed issue with applications that close all file descriptors (#1165047)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-11
changelog:
  - Applied fix for urandom FD in FIPS140 mode (#1165047)
  - Applied fix for FIPS140-2 related regression (#1110696)


author: Nikos Mavrogiannopoulos <nmav@redhat.com> 3.3.8-12.1
changelog:
  - Corrected reseed and respect of max_number_of_bits_per_request in 
    FIPS140-2 mode. Also enhanced the initial tests. (#1228199)


author: Lokesh Mandvekar <lsm5@redhat.com> - 1.4.2-2
changelog:
  - update to 1.4.2 (iterative build)
  - emacs and vim subpackages obsoleted as they're no longer provided


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-30
changelog:
  - core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
  - mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-31
changelog:
  - mod_proxy_fcgi: determine if FCGI_CONN_CLOSE should be enabled
    instead of hardcoding it (#1168050)
  - mod_proxy: support Unix Domain Sockets (#1168081)


author: Jan Kaluza <jkaluza@redhat.com> - 2.4.6-31.1
changelog:
  - core: fix chunk header parsing defect (CVE-2015-3183)
  - core: replace of ap_some_auth_required with ap_some_authn_required
    and ap_force_authn hook (CVE-2015-3185)


author: CentOS Sources <bugs@centos.org> - 2.4.6-31.el7.centos.1
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: Michal Minar <miminar@redhat.com> 0.252-7.1
changelog:
  - Bumped release to reflect rhel version.
  - Fixed bogus dates in changelog.
  - Generate and install hwdb.d/* files.


author: Jan Synáček <jsynacek@redhat.com> - 20121207-1
changelog:
  - Update to iputils-s20121207 (#884983) - fixes a ping segfault introduced
    by the previous update
  - Update ninfod-minor patch
  - Renumber patches
  - Fix -F switch (flowlabel patch)


author: Michal Srb <msrb@redhat.com> - 0:1.1.2-13
changelog:
  - Prevent XXE and RCE in JSTL XML tags
  - Apply correction for previous CVE-2015-0254 patch (prevent XXE in <x:transform>)
  - Resolves: CVE-2015-0254


author: WANG Chao <chaowang@redhat.com> - 2.0.7-14
changelog:
  - fix core_collector issue for ssh/raw dump
  - remove sysctl.conf for kdump kernel
  - exclude aarch64 build
  - fix path directive issue
  - remove panic_on_warn kernel parameter


author: WANG Chao <chaowang@redhat.com> - 2.0.7-15
changelog:
  - mount fail if its mount poing doesn't exist in /sysroot
  - rebuild initrd dependency during kdump restart
  - fix a dump path issue


author: Baoquan He <bhe@redhat.com> - 2.0.7-19.2
changelog:
  - dracut-module-setup: Enhance kdump to support the bind mounted feature in Atomic
  - Fix the warning if the target path is bind mount in Atomic
  - Get the mount point correctly, if the device has several mount point
  - kdump-lib: Add new function to judge the system is Atomic or not
  - kdump-lib: Add the new function to enhance bind mounted judgement
  - Remove duplicate slash in save path
  - dracut-module-setup.sh: change the insecure use of /tmp/*$$* filenames


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-15
changelog:
  - fix argv rewrite (#1047507)
  - fix memory leak (#1048995)
  - standard error output could get misdirected (#1048272)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-19
changelog:
  - reading a file via command substitution did not work when any of stdin,
    stdout or stderr were closed (#1070328)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-20
changelog:
  - fix segfault in job list code (#1084406)
  - do not resend signal on termination (#1085385)
  - fix brace expansion on/off (#1099935)
  - fix incorrect rounding of numsers 0.5 < |x| <1.0 in printf (#1070871)
  - fix parser errors related to the end of the here-document marker (#1111120)
  - ksh hangs when command substitution fills out the pipe buffer (#1077090)
  - using typeset -l with a restricted variabled caused segmentation fault (#1121960)
  - monitor mode was documented incorrectly (#1100215)
  - do not crash when unsetting running function from another one (#1100215)
  - should report an error when trying to cd into directory without execution bit (#1109893)
  - job locking mechanism did not survive compiler optimization (#1116506)


author: Michal Hlavinka <mhlavink@redhat.com> - 20120801-21
changelog:
  - include symlink for restricted shell (#1146161)
  - ksh hangs when command substitution containing pipe fills out the pipe buffer (#1138751)
  - current directory could differ from PWD (#1135573)
  - cd builtin could break IO redirection (#1133585)
  - return code from a function could be wrong (#1116507)


author: Benjamin Tissoires <btissoir@redhat.com> 1.4.7-2
changelog:
  - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163604, bug 1163603)
  - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163604, bug 1163603)
  - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163604, bug 1163603)


author: Benjamin Tissoires <benjamin.tissoires@redhat.com> 1.4.7-3
changelog:
  - CVE-2015-1802: missing range check in bdfReadProperties (bug 1258894)
  - CVE-2015-1803: crash on invalid read in bdfReadCharacters (bug 1258894)
  - CVE-2015-1804: out-of-bounds memory access in bdfReadCharacters (bug 1258894)


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-5
changelog:
  - add FIPS DRBG implementation
  - run the FIPS POST tests in shared library constructor
  - make it possible to run the test suite in the FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.5.3-12.1
changelog:
  - touch only urandom in the selftest and when /dev/random is
    unavailable for example by SELinux confinement
  - fix the RSA selftest key (p q swap)


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-4
changelog:
  - disable TPACKET_V3 memory mapped packet capture on AF_PACKET socket, use TPACKET_V2 instead (#1085096)


author: Michal Sekletar <msekleta@redhat.com> - 14:1.5.3-4.2
changelog:
  - make sure that userland bpf filter interpreter is given snaplen such that size of
    cooked header is accounted for (#1207666)


author: David Vossel <dvossel@redhat.com> - 0.16.0-4
changelog:
  - Require log filtering to match function and file exactly.
    No substring matching.

  - Fixes complile time issue with 'make check' unit tests.

    Resolves: rhbz#1018091


author: David Vossel <dvossel@redhat.com> - 0.17.1-1
changelog:
  Fix: ipcs: Correctly allocate receive buffer size
    Fix: ipc_socket: Signalhandler must be resetted to Default, use only cleanup_sigpipe to return from qb_ipc_dgram_sock_setup.
    Fix: trie: allow modifying the trie map during the notify callback
    Fix: fix invalid option when run 'ipcclient -h'
    Fix: epoll: don't miss poll events under high load
    Fix: ipc_shm: fix error handling in qb_ipcs_shm_connect()
    Fix: ringbuffer: fix size in qb_rb_create_from_file()
    Fix: ringbuffer: fix qb_rb_open_2() debug format string
    Fix: trie: fixes regression caused by ref count refactoring
    Fix: ipcc: Properly timeout during recv when timeout value is provided

    Resolves: rhbz#1110043
    Resolves: rhbz#975903


author: David Vossel <dvossel@redhat.com> - 0.17.1-1.1
changelog:
  Fix bug that prevents ipc server from working in pid with realtime priority.

    Resolves: rhbz#1198718


author: Jakub Filak <jfilak@redhat.com> - 2.1.11-22
changelog:
  - switch the default dump dir mode to 0750
  - harden against directory traversal, crafted symbolic links
  - avoid race-conditions in dump dir opening
  - Resolves: #1212096, #1217499, #1218610, #1217484


author: Matej Habrnal <mhabrnal@redhat.com> - 2.1.11-23.el7.centos.0.1
changelog:
  - add reporter mantisbt plugin
  - add problem format api
  - set url to public faf server
  - add event for reporting AVCs
  - Resolves bugs.centos#8422


author: Miloslav Trmač <mitr@redhat.com> - 0.58-2
changelog:
  - Always use secure_getenv() or __secure_getenv(), fail build if neither is
    available.  Patch by Viktor Hercinger <vhercing@redhat.com>.


author: Daniel Veillard <veillard@redhat.com> - 2.9.0-2
changelog:
  - remaining cleanups from merge bug rhbz#226079
  - do not put the docs in the main package, only in -devel rhbz#864731


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-1
changelog:
  - upstream release of 2.9.1
  - a couple more API entry point
  - compatibility with python3
  - a lot of bug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.9.1-5.2
changelog:
  - Fix missing entities after CVE-2014-3660 fix
  - CVE-2014-0191 Do not fetch external parameter entities (rhbz#1195649)
  - Fix regressions introduced by CVE-2014-0191 patch


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.112-1
changelog:
  - Update to latest upstream release with various fixes and
    enhancements documented in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.113-1
changelog:
  - Fix missing rounding to 64KB when estimating optimal thin pool chunk size.
  - Fix size in pvresize "Resizing to ..." verbose msg to show proper result size.
  - Add --cachepolicy and --cachesettings options to lvchange.
  - Validate that converted volume and specified pool volume differ in lvconvert.
  - Fix regression in vgscan --mknodes usage (2.02.112).
  - Respect --prefix when setting CLMVD_PATH configure (2.02.89).
  - Default to configure --enable-udev-systemd-background-jobs for systemd>=205.
  - Fix ignore_vg() to properly react on various vg_read errors (2.02.112).
  - Failed recovery returns FAILED_RECOVERY status flag for vg_read().
  - Exit with non-zero status code when pvck encounters a problem.
  - Fix clean_tree after activation/resume for cache target (2.02.112).
  - Fix memory corruption with sorting empty string lists (1.02.86).
  - Fix man dmsetup.8 syntax warning of Groff
  - Accept unquoted strings and / in place of {} when parsing configs.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-2
changelog:
  - Release socket in daemon_close and protocol string in daemon_open error path.
  - Add --cachepolicy and --cachesettings to lvcreate.
  - Fix regression when parsing /dev/mapper dir (2.02.112).
  - Fix typo in clvmd initscript causing CLVMD_STOP_TIMEOUT var to be ignored.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-3
changelog:
  - Add cache_policy and cache_settings reporting fields.
  - Add missing recognition for --binary option with {pv,vg,lv}display -C.
  - Fix vgimportclone to notify lvmetad about changes done if lvmetad is used.
  - Fix vgimportclone to properly override config if it is missing in lvm.conf.
  - Fix automatic use of configure --enable-udev-systemd-background-jobs.
  - Correctly rename active split LV with -splitmirrors for raid1.
  - Still restrict mirror region size to power of 2 when VG extent size is not.
  - Fix segfault while using selection with regex and unbuffered reporting.
  - Remove unimplemented dm_report_set_output_selection from libdevmapper.h.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-4
changelog:
  - Fix incorrect rimage names when converting from mirror to raid1 LV (2.02.112).
  - Avoid excessive re-reading of metadata and related error messages in pvremove.
  - Check for cmirror availability during cluster mirror creation and activation.
  - Fix possible segfault when using cache_policy and cache_settings fields.
  - Fix reserved values recognition for cache_policy and cache_settings fields.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.114-5
changelog:
  - Report lv_health_status and health attribute also for thin pool.
  - Add lv_error_when_full reporting field.
  - Add support for lvcreate --errorwhenfull y|n for thin pools.
  - Report more info from thin pool status (out of data, metadata-ro, fail).
  - Support error_if_no_space for thin pool target.
  - Do not filter out snapshot origin LVs as unusable devices for an LVM stack.
  - Fix process_each_pv to match item by device not by its PV device name only.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-1
changelog:
  - Report segment types without monitoring support as undefined.
  - Support lvchange --errorwhenfull for thin pools.
  - Improve the processing and reporting of duplicate PVs.
  - Add support for lvcreate --errorwhenfull y|n for thin pools
  - Fix lvconvert --repair to honour resilience requirement for segmented RAID LV.
  - Also call lvscan --cache in dmeventd for mirror device update in lvmetad.
  - Filter out partitioned device-mapper devices as unsuitable for use as PVs.
  - Also notify lvmetad about filtered device if using pvscan --cache DevicePath.
  - Add report/compact_output to lvm.conf to enable/disable compact report output.
  - Rename lv_error_when_full reporting field to lv_when_full.
  - Reduce severity of ioctl error message when dmeventd waitevent is interrupted.
  - Report 'unknown version' when incompatible version numbers were not obtained.
  - Add dm_report_compact_fields to remove empty fields from report output.
  - Add BuildRequires: device-mapper-persistent-data for proper thin_check configuration.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-2
changelog:
  - Remove rules from 10-dm.rules which handle multipath, rules for handling
    multipath devices are directly part of device-mapper-multipath package.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-3
changelog:
  - Preserve chunk size with repair and metadata swap of a thin pool.
  - Fix raid --splitmirror 1 functionality (2.02.112).
  - Fix tree preload to handle splitting raid images.


author: Peter Rajnoha <prajnoha@redhat.com> - 7:2.02.115-3.el7_1.1
changelog:
  - Fix lvm2app lvm_lv_get_property return value for fields with info/status ioctl.
  - Fix lvm2app regression in lvm_lv_get_attr causing unknown values (2.02.115).


author: Jan Kaluza <jkaluza@redhat.com> - 3:2.1.15-18
changelog:
  - fix #1107652 - add support for DMARC
  - fix #1180981 - install tmpfiles.d into /usr/lib instead of /etc
  - fix #1188043 - set 2775 permission for /etc/mailman


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-28
changelog:
  - Fix problem with policy with path=* not working if there is no
    /dev/disk/by-path/ directory, as is the case with (S)ATA only systems
  - Resovles bz1045510


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-29
changelog:
  - Fix problem with mdadm crashing, if trying to create an IMSM array, with
    missing devices.
  - Resolves bz1056466


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-30
changelog:
  - Fix problem where Resync and recovery of RAID10 stopped at more than
    50% does not continue after reassemblation
  - Resolves bz1068154


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-31
changelog:
  - Fix problem of IMSM platform capabilities not being detected in UEFI
    mode when only the second SATA controller is enabled.
  - Resolves bz1074161


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-32
changelog:
  - Fix issue with mdmon not being launched correctly after reboot
    during container reshape second of a second RAID5 array, resulting in
    it being read-only and cannot be mounted.
  - Resolves bz1074970


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.2.6-33
changelog:
  - Fix problem with spare disk not being added correctly to IMSM array
    because mdmon is unable to write metadata to it.
  - Resolves bz1072979


author: Jes Sorensen <Jes.Sorensen@redhat.com> - 3.3.2-2.1
changelog:
  - Z-Stream fix
  - Fix issue where migration record was not always cleared after successful
    reshape.
  - Resolves rhbz#1205325


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-14
changelog:
  - move tmpfiles.d config file to /usr/lib (#881218)
  - fixed dashes in net-snmp-config.h (#1038642)
  - fixed snmpd crashing on monitor trigger evaluation (#1050971)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-17
changelog:
  - fixed various error codes in Python module (#1064338)
  - fixed net-snmp-config.h header file (#1064437)


author: Jan Safranek <jsafrane@redhat.com> - 1:5.7.2-19
changelog:
  - Fixed not-increasing OIDs in IP-FORWARD-MIB::ipCidrRouteTable (#1172013)
  - Fixed HOST-RESOURCES-MIB::hrProcessorTable on machines with >100 CPUs
    (#1070076)
  - skip 'mvfs' (ClearCase) when skipNFSInHostResources is enabled (#1086606)
  - Added clear error message when port specified in 'clientaddrr' config
    option cannot be bound (#1086925)
  - fixed proxying of out-of-tree GETNEXT requests (#1087801)
  - use python/README to net-snmp-python subpackage (#1158391)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-1
changelog:
  - Update to NSPR_4_10_2_RTM
  - Avoid unsigned integer wrapping in PL_ArenaAllocate
  - Resolves: rhbz#1031465 - CVE-2013-5607


author: Elio Maldonado <emaldona@redhat.com> - 4.10.2-2
changelog:
  - Restore previously used s390x patch as it isn't upstream yet
  - Related: rhbz#1031465 - CVE-2013-5607


author: Elio Maldonado <emaldona@redhat.com> 4.10.6-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126243 - Ensure nspr is built for 64 bit on ppc64le


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
  - Restore s390x related patch as it hasn't been applied upstream yet
  - Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Add the nss-util portion of a fix for a bug in nss and nss-util
  - Resolves: Bug 752980 - Support ECDSA via pluggable ECC in the nss package


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - Update to nss-3.15.4
  - Modified the nss-split-util script to use the nss upstream pristine sources
  - Resolves: Bug 1054457 - CVE-2013-1740 nss: false start PR_Recv information disclosure security issue [rhel-7.0]


author: Peter Robinson <pbrobinson@redhat.com> 3.16.2-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126244 - Ensure nss-util is built for 64 bit on ppc64le
  - Fix contributed by Peter Robinson <pbrobinson@redhat.com>


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Bump the release number to be higher than the one for rhel-7.0
  - Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-12
changelog:
  - workaround failing autogen
  - move files from /lib
  - don't own ntp-units.d directory
  - drop old systemd scriptlets
  - fix dates in changelog


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-13
changelog:
  - ignore duplicate servers from dhclient
  - don't use -Wstrict-overflow with -fno-strict-overflow
  - buildrequire systemd-units
  - remove pie test


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-16
changelog:
  - refresh peers on routing updates (#1048132)
  - fix calculation of root dispersion (#1045377)
  - remove unnecessary IPv6 restrict line from default ntp.conf (#1048255)
  - remove kod from default restrict in ntp.conf (#1048255)
  - update logconfig documentation for patched default (#1048252)


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2.6p5-19
changelog:
  - don't generate weak control key for resolver (CVE-2014-9293)
  - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294)
  - fix buffer overflows via specially-crafted packets (CVE-2014-9295)
  - don't mobilize passive association when authentication fails (CVE-2014-9296)


author: Ade Lee <alee@redhat.com> - 1.0.1-10
changelog:
  - Resolves: rhbz#1117072 -  ppc64le is missing from ExcludeArch
  - reverted the previous change.  ppc64le now removed from ExcludeArch


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-4
changelog:
  - support TLS 1.1 and later (#1160468)
  - fix: /etc/openldap/certs directory is empty after installation (#1064251)
  - fix: Typo in script to generate /usr/libexec/openldap/generate-server-cert.sh (#1087490)
  - fix: remove correct tmp file when generating server cert (#1103101)
  - fix: slapd.ldif olcFrontend missing important/required objectclass (#1132094)


author: Jan Synáček <jsynacek@redhat.com> - 2.4.39-5
changelog:
  - add documentation reference to service file (#1087288)
  - fix: tls_reqcert try has bad behavior (#1027613)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-4 + 0.9.3-9
changelog:
  - revert the default of KerberosUseKuserok back to yes
  - fix kuserok patch which checked for the existence of .k5login unconditionally
    and hence prevented other mechanisms to be used properly


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-8 + 0.9.3-9
changelog:
  - increase size of AUDIT_LOG_SIZE to 256 (#1171163)
  - record pfs= field in CRYPTO_SESSION audit event (#1171248)


author: Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-9
changelog:
  - add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278
    (#1169843)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-37
changelog:
  - add support for RFC 5649 (#1119738)
  - do not pass the FIPS integrity check if the .hmac files are empty (#1128849)
  - add ECC TLS extensions to DTLS (#1119803)
  - do not send ECC ciphersuites in SSLv2 client hello (#1090955)
  - properly propagate encryption failure in BIO_f_cipher (#1072439)
  - fix CVE-2014-0224 fix that broke EAP-FAST session resumption support
  - improve documentation of ciphersuites - patch by Hubert Kario (#1108026)
  - use case insensitive comparison for servername in s_server (#1081163)
  - add support for automatic ECDH curve selection on server (#1080128)
  - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    variable is set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - use FIPS approved method for computation of d in RSA
  - copy digest algorithm when handling SNI context switch


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42
changelog:
  - test in the non-FIPS RSA keygen for minimal distance of p and q
    similarly to the FIPS RSA keygen


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.3
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.3
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.5
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.6
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.7
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-42.8
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-7
changelog:
  - rename the 90-nproc.conf to 20-nproc.conf (#1071618)
  - canonicalize user name in pam_selinux (#1071010)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-9
changelog:
  - fix CVE-2014-2583: potential path traversal issue in pam_timestamp
  - pam_pwhistory: call the helper if SELinux enabled


author: Tomáš Mráz <tmraz@redhat.com> 1.1.8-11
changelog:
  - be tolerant to corrupted opasswd file
  - audit the module names that granted access
  - pam_userdb: correct the example in man page (#1078784)
  - pam_limits: check whether the utmp login entry is valid (#1080023)
  - pam_console_apply: do not print error if console.perms.d is empty
  - pam_limits: nofile refers to open file descriptors (#1111220)
  - apply PIE and full RELRO to all binaries built


author: Chris Feist <cfeist@redhat.com> - 0.9.137-6
changelog:
  - Allowed configuration of resource-discovery option on location constraint
    rules
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-7
changelog:
  - When a role is removed in the GUI the user is now automatically deleted
    if they aren't members of another role
  - Resolves: rhbz#1054491


author: Chris Feist <cfeist@redhat.cmo> 0.9.137-8
changelog:
  - Configuration of resource-discovery is now available on advanced location
    constraint rules
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-9
changelog:
  - Added acl enable and disable commands
  - Display whether acls are enabled in the 'pcs acl' output
  - Resolves: rhbz#1054491


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-11
changelog:
  - Stop cluster nodes in parallel and keep cluster quorate during pacemaker
    shutdown
  - Resolves: rhbz#1180506


author: Tomas Jelinek <tojeline@redhat.com> - 0.9.137-13.el7_1.4
changelog:
  - Fixed session and cookies processing
  - Fixed command injection vulnerability
  - Resolves: rhbz#1253289 rhbz#1253293


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.21-1
changelog:
  - Use _netdev mount option as needed. (dlehman)
    Resolves: rhbz#1166509
  - Don't crash when a free region is too small for an aligned partition.
    (dlehman)
    Resolves: rhbz#1167292
  - Avoid exception when aligned start and end are crossed over (exclusion)
    Resolves: rhbz#1167233
  - Multiple loops shouldn't be fatal (bcl)
    Resolves: rhbz#980510
  - If allowing degraded array, attempt to start it (amulhern)
    Resolves: rhbz#1090009
  - Add a method that looks at DEVNAME (amulhern)
    Related: rhbz#1090009
  - Add mdrun method to just start, not assemble, an array. (amulhern)
    Related: rhbz#1090009
  - Change allow_degraded_mdraid flag to allow_imperfect_devices (amulhern)
    Related: rhbz#1090009


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.23-1
changelog:
  - Raise a more descriptive exception for corrupt gpt disklabels. (dlehman)
    Resolves: rhbz#1123450
  - Don't raise an exception for failure to scan an ignored disk. (dlehman)
    Related: rhbz#1123450
  - Try to deactivate lvm on corrupted gpt disks. (dlehman)
    Related: rhbz#1123450


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.25-1
changelog:
  - Fallback implicit partition size must be big enough for BTRFS (vpodzime)
    Related: rhbz#1171116
  - Make implicit partitions smaller if real requests don't fit anywhere
    (vpodzime)
    Resolves: rhbz#1171116
  - Revert "Try to deactivate lvm on corrupted gpt disks." (dlehman)
    Resolves: rhbz#1186317


author: Brian C. Lane <bcl@redhat.com> - 0.61.0.26-1
changelog:
  - Use a safer method to get a dm partition's disk name. (dlehman)
    Resolves: rhbz#1190886
    Related: rhbz#1181336


author: Ralph Bean <rbean@redhat.com> - 1.5-3
changelog:
  - Renamed patches to python-urllib3-*
  - Fixed ssl check patch to use the correct cert path for Fedora.
  - Included dependency on ca-certificates
  - Cosmetic indentation changes to the .spec file.


author: Ralph Bean <rbean@redhat.com> - 1.5-4
changelog:
  - Upstream patch to fix Accept header when behind a proxy.
  - Reorganize patch numbers to more clearly distinguish them.


author: bkabrda <bkabrda@redhat.com> - 1.10.2-2
changelog:
  - Fix the way we unbundle six to make ovirt work even when they remove .py files
  Resolves: rhbz#1247189


author: David Vossel <dvossel@redhat.com> - 3.9.5-32
changelog:
  - Fixes iSCSILogicalUnit syntax error
  - Fixes mysql stop operation when db storage is unavailable

    Resolves: rhbz#1118029
    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-33
changelog:
  - Merges latest upstream patches for galera agent
  - Merges latest upstream patchs for exit reason string

    Resolves: rhbz#1116166
    Resolves: rhbz#1128933


author: David Vossel <dvossel@redhat.com> - 3.9.5-34
changelog:
  - Fixes mysql agents behavior when monitoring resource instance
    when environment validation fails.

    Resolves: rhbz#1138871


author: David Vossel <dvossel@redhat.com> - 3.9.5-35
changelog:
  - Introduces docker resource-agent for managing docker containers.
    The docker agent is being released as tech preview.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-36
changelog:
  - Fixes cleaning up stale docker containers during stop if
    container instance failed.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-37
changelog:
  - Rename docker agent's 'container' arg to 'name' to avoid confusion
    with pacemaker's metadata 'container' argument.
  - Introduce monitor_cmd into docker agent.

    Resolves: rhbz#1135026


author: David Vossel <dvossel@redhat.com> - 3.9.5-40.6
changelog:
  - Improve galera resource-agent to not require use of read-only
    mode to retrieve last known write sequence number.

    Resolves: rhbz#1242339


author: Michal Sekletar <msekleta@redhat.com> - 0.17-71
changelog:
  - resolves: RHBZ #737244 #896583 #947213
  - migrate from xinetd to systemd configuration
  - close pam session correctly when client does not ask for separate error channel
  - fix pty handling which was broken by changes in /bin/login


author: Michal Sekletar <msekleta@redhat.com> - 0.17-72
changelog:
  - unit files must not be marked as config files
  - fix handling of non-native IPv6 connections via AF_INET6 socket


author: Lubos Kardos <lkardos@redhat.com> - 20130529-10
changelog:
  - Allow to use vendor prefix in packages names
  - Include %nfsmountable macro into scl's rpm macros file


author: Jan Zeleny <jzeleny@redhat.com> - 20130529-13
changelog:
  - bump the version to get in sync with 7.1 branch
  - Reflect the state of %nfsmountable macro in collections' rpm macro files
  - escape all the % chars in changelog


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23.el7_1.7
changelog:
  - Label /usr/libexec/postgresql-ctl as postgresql_exec_t
  - Update virt_read_pid_files() interface to allow read also symlinks with virt_var_run_t type.
  - Add labeling for /usr/libexec/mysqld_safe-scl-helper.
  - Add support for /usr/libexec/mongodb-scl-helper RHSCL helper script.
  Resolves:#1209942 
  - Allow mysqld_t to use pam.It is needed by MariDB if auth_apm.so auth plugin is used
  Resolves:#1214236
  - Added label mysqld_etc_t for /etc/my.cnf.d/ dir.
  Resolves:#1214235
  - Add support for mongod/mongos systemd unit files.
  Resolves:#1214194


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23.el7_1.8
changelog:
  - Back port passenger fixes from RHEL-7.2
  - Back port httpd fixes related to gluster+nagios.
  - Back port glusterd changs from RHEL-7.2 related to Gluster.
  - Back port ctdbd changs from RHEL-7.2 related to Gluster.
  - Back port nagios changs from RHEL-7.2 related to Gluster.
  - Back port samba changs from RHEL-7.2 related to Gluster.
  Resolves:#1230292
  Resolves:#1230299
  Resolves:#1231649
  Resolves:#1231930
  Resolves:#1231942


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23.el7_1.9
changelog:
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  - Allow glusterd to interact with gluster tools running in a user domain
  - nrpe needs kill capability to make gluster moniterd nodes working.
  Resolves:#1238964
  - Add cron_system_cronjob_use_shares boolean to allow system cronjob to be executed from shares - NFS, CIFS, FUSE. It requires "entrypoint" permissios on nfs_t, cifs_t and fusefs_t SELinux types.
  - Allow ctdb_t sending signull to smbd_t, for checking if smbd process exists.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23.el7_1.10
changelog:
  - Allow gluster to connect to all ports. It is required by random services executed by gluster.
  - Allow glusterd to execute showmount in the showmount domain.
  - Add samba_signull_unconfined_net()
  - Add samba_signull_winbind()
  Resolves:#1232755
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
  Resolves:#1238963
  - Label gluster python hooks also as bin_t.
  Resolves:#1238965
  - We allow can_exec() on ssh_keygen on gluster. But there is a transition defined by init_initrc_domain() because we need to allow execute unconfined services by glusterd. So ssh-keygen ends up with ssh_keygen_t and we need to allow to manage /var/lib/glusterd/geo-replication/secret.pem.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23.el7_1.11
changelog:
  - Allow glusterd to manage nfsd and rpcd services.
  - Allow samba_t net_admin capability to make CIFS mount working.
  Resolves:#1238965
  - Dontaudit smbd_t block_suspend capability.


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23.el7_1.13
changelog:
  - glusterd call pcs utility which calls find for cib.* files and runs pstree under glusterd. Dontaudit access to security files and update gluster boolean to reflect these changes.
  -  Allow glusterd to communicate with cluster domains over stream socket.
  Resolves:#1238963


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-21
changelog:
  - pkcsslotd_lock_t should be an alias for pkcs_slotd_lock_t.
  - Allow fowner capability for sssd because of selinux_child handling.
  - ALlow bind to read/write inherited ipsec pipes
  - Allow hypervkvp to read /dev/urandom and read  addition states/config files.
  - Allow gluster rpm scripletto create glusterd socket with correct labeling. This is a workaround until we get fix in glusterd.
  - Add glusterd_filetrans_named_pid() interface
  - Allow radiusd to connect to radsec ports.
  - Allow setuid/setgid for selinux_child
  - Allow lsmd plugin to connect to tcp/5988 by default.
  - Allow lsmd plugin to connect to tcp/5989 by default.
  - Update ipsec_manage_pid() interface.
  Resolves:#1184978


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23
changelog:
  - Update seutil_manage_config() interface.
  Resolves:#1185962
  - Allow pki-tomcat relabel pki_tomcat_etc_rw_t.
  - Turn on docker_transition_unconfined by default


author: Miroslav Grepl <mgrepl@redhat.com> 3.13.1-23.el7_7.3
changelog:
  - Dontaudit ifconfig writing inhertited /var/log/pluto.log.
  Resolves:#1205580
  - Update init_rw_tcp_sockets() interface to use getopt and setopt.


author: Nalin Dahyabhai <nalin@redhat.com> - 0.50-1
changelog:
  - if we get an EPIPE while registering with rpcbind, try to reconnect and
    retransmit before giving up


author: Nalin Dahyabhai <nalin@redhat.com> - 0.51-1
changelog:
  - fix another request argument memory leak in NIS server (#1040159)
  - fix miscellaneous items found by static analysis


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-1
changelog:
  - correctly reflect whether or not we're built with transaction support in
    the module's nsslapd-pluginVersion attribute
  - fix a couple of should've-used-memmove()-instead-of-memcpy() cases which
    would hit when removing maps or groups of maps (#1043546/#1043638)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-3
changelog:
  - remove ExclusiveArch if %{rhel} is 7 or higher, because 389-ds-base gets
    built for everything now (#1055711)


author: Nalin Dahyabhai <nalin@redhat.com> - 0.52-5
changelog:
  - backport correction to the default settings for hosts.byname and
    hosts.byaddr NIS maps, so that their data items start with the host's
    address rather than a name (#1090948)


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-1
changelog:
  - Add support for IDM's ID views
  - Allow searching SSSD-provided users as memberUid case-insensitevly
  - Resolves: #1151436


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.54-2
changelog:
  - Complete ID views support to BIND operation
  - Ignore ID views outside schema-compat subtrees
  - Use 389-ds API compatible with RHEL 7.0
  - Resolves: #1151436


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-8
changelog:
  - [kpatch] do not attempt to collect data if kpatch is not installed
    Resolves: bz1110918
  - [archive] drop support for Zip archives
    Resolves: bz1118152


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-9
changelog:
  - [navicli] catch exceptions if stdin is unreadable
    Resolves: bz1166039
  - [docs] update man page for new options
    Resolves: bz1171658
  - [sosreport] make all utf-8 handling user errors=ignore
    Resolves: bz1164267


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-11
changelog:
  - [sosreport] do not make logging calls after OSError
    Resolves: bz1087977
  - [sosreport] catch OSError exceptions in SoSReport.execute()
    Resolves: bz1087977
  - [anaconda] make useradd password regex tolerant of whitespace
    Resolves: bz1112175


author: Bryn M. Reeves <bmr@redhat.com> = 3.2-12
changelog:
  - [plugin] limit path names to PC_NAME_MAX
    Resolves: bz1026962
  - [squid] collect files from /var/log/squid
    Resolves: bz1026962
  - [sosreport] log plugin exceptions to a file
    Resolves: bz1026962
  - [ctdb] fix collection of /etc/sysconfig/ctdb
    Resolves: bz1026962
  - [sosreport] fix silent exception handling
    Resolves: bz1026962


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-15.3
changelog:
  - [openstack_neutron] neutron configuration and logs files not captured
    Resolves: bz1213315
  - [ovirt] remove ovirt-engine setup answer file password leak
    Resolves: bz1162788
  - [networking] network plugin fails if NetworkManager is disabled
    Resolves: bz1206633


author: Pavel Moravec <pmoravec@redhat.com> = 3.2-15.6
changelog:
  - [hpasm] hpasmcli commands hang under timeout
    Resolves: bz1237029
  - [mysql] Collect log file
    Resolves: bz1238200
  - [openstack_neutron] Obscure passwords and secrets
    Resolves: bz1242871


author: Lukas Nykryn <lnykryn@redhat.com> - 208-13
changelog:
  - tmpfiles: minor modernizations (#1147524)
  - install: when looking for a unit file for enabling, search for templates only after traversing all search directories (#1147524)
  - install: remove unused variable (#1147524)
  - bootctl: typo fix in help message (#1147524)
  - logind: ignore failing close() on session-devices (#1147524)
  - sysfs-show.c: return negative error (#1147524)
  - core: only send SIGHUP when doing first kill, not when doing final sigkill (#1147524)
  - cgroup: make sure to properly send SIGCONT to all processes of a cgroup if that's requested (#1147524)
  - core: don't send duplicate SIGCONT when killing units (#1147524)
  - efi: fix Undefined reference efi_loader_get_boot_usec when EFI support is disabled (#1147524)
  - macro: better make IN_SET() macro use const arrays (#1147524)
  - macro: make sure we can use IN_SET() also with complex function calls as first argument (#1147524)
  - core: fix property changes in transient units (#1147524)
  - load-modules: properly return a failing error code if some module fails to load (#1147524)
  - core/unit: fix unit_add_target_dependencies() for units with no dependencies (#1147524)
  - man: there is no ExecStopPre= for service units (#1147524)
  - man: document that per-interface sysctl variables are applied as network interfaces show up (#1147524)
  - journal: downgrade vaccuum message to debug level (#1147524)
  - logs-show: fix corrupt output with empty messages (#1147524)
  - journalctl: refuse extra arguments with --verify and similar (#1147524)
  - journal: assume that next entry is after previous entry (#1147524)
  - journal: forget file after encountering an error (#1147524)
  - man: update link to LSB (#1147524)
  - man: systemd-bootchart - fix spacing in command (#1147524)
  - man: add missing comma (#1147524)
  - units: Do not unescape instance name in systemd-backlight@.service (#1147524)
  - manager: flush memory stream before using the buffer (#1147524)
  - man: multiple sleep modes are to be separated by whitespace, not commas (#1147524)
  - man: fix description of systemctl --after/--before (#1147524)
  - udev: properly detect reference to unexisting part of PROGRAM's result (#1147524)
  - gpt-auto-generator: don't return OOM on parentless devices (#1147524)
  - man: improve wording of systemctl's --after/--before (#1147524)
  - cgroup: it's not OK to invoke alloca() in loops (#1147524)
  - core: don't try to relabel mounts before we loaded the policy (#1147524)
  - systemctl: --kill-mode is long long gone, don't mention it in the man page (#1147524)
  - ask-password: when the user types a overly long password, beep and refuse (#1147524)
  - logind: don't print error if devices vanish during ACL-init (#1147524)
  - tty-ask-password-agent: return negative errno (#1147524)
  - journal: cleanup up error handling in update_catalog() (#1147524)
  - bash completion: fix __get_startable_units (#1147524)
  - core: check the right variable for failed open() (#1147524)
  - man: sd_journal_send does nothing when journald is not available (#1147524)
  - man: clarify that the ExecReload= command should be synchronous (#1147524)
  - conf-parser: never consider it an error if we cannot load a drop-in file because it is missing (#1147524)
  - socket: properly handle if our service vanished during runtime (#1147524)
  - Do not unescape unit names in [Install] section (#1147524)
  - util: ignore_file should not allow files ending with '~' (#1147524)
  - core: fix invalid free() in killall() (#1147524)
  - install: fix invalid free() in unit_file_mask() (#1147524)
  - unit-name: fix detection of unit templates/instances (#1147524)
  - journald: make MaxFileSec really default to 1month (#1147524)
  - bootchart: it's not OK to return -1 from a main program (#1147524)
  - journald: Fix off-by-one error in "Missed X kernel messages" warning (#1147524)
  - man: drop references to removed and obsolete 'systemctl load' command (#1147524)
  - units: fix BindsTo= logic when applied relative to services with Type=oneshot (#1147524)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-15
changelog:
  - core: do not segfault if /proc/swaps cannot be opened (#1151239)
  - man: we don't have 'Wanted' dependency (#1152487)
  - environment: append unit_id to error messages regarding EnvironmentFile (#1147691)
  - udevd: add --event-timeout commandline option (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-16
changelog:
  - logind: use correct "who" enum values with KillUnit. (#1155502)
  - logind: always kill session when termination is requested (#1155502)
  - udev: net_id - correctly name netdevs based on dev_port when set (#1155996)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-17
changelog:
  - udev: net_id dev_port is base 10 (#1155996)
  - udev: Fix parsing of udev.event-timeout kernel parameter (#1154778)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-20
changelog:
  - core: introduce new Delegate=yes/no property controlling creation of cgroup subhierarchies (#1139223)
  - core: don't migrate PIDs for units that may contain subcgroups, do this only for leaf units (#1139223)
  - mount: use libmount to enumerate /proc/self/mountinfo (#1161417)
  - mount: monitor for utab changes with inotify (#1161417)
  - mount: add remote-fs dependencies if needed after change (#1161417)
  - mount: check options as well as fstype for network mounts (#1161417)
  - rules: don't enable usb pm for Avocent devices (#1155370)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-20.1
changelog:
  - shared/install: avoid prematurely rejecting "missing" units (#1199981)
  - core: fix enabling units via their absolute paths (#1199981)


author: Lukas Nykryn <lnykryn@redhat.com> - 208-20.4
changelog:
  - run: drop mistakenly committed test code (#1220272)
  - cgroup: downgrade log messages when we cannot write to cgroup trees that are mounted read-only (#1220298)


author: Frank Ch. Eigler <fche@redhat.com> - 2.6-3
changelog:
  - Added probinson's patch BZ1141919 for enabling more ppc64/aarch64 facilities,
    with some staplog.c followup


author: Frank Ch. Eigler <fche@redhat.com> - 2.6-6
changelog:
  - rhbz1164373 (fix ppc64 kprobes via KERNEL_RELOC_SYMBOL)
  - rhbz1119335 (document STAP_FIPS_OVERRIDE in staprun.8)
  - rhbz1127591 (ppc64 hcall_* tracepoint blacklisting)


author: Matthew Harmsen <mharmsen@redhat.com> 6.0.2-1
changelog:
  - Bugzilla Bug #734590 - Refactor JNI libraries for Fedora 16+ . . . (mharmsen)
  - Bugzilla Bug #699809 - Convert CS to use systemd (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 7.0.0-3
changelog:
  - PKI TRAC Ticket #283 - Dogtag 10: Integrate Tomcat 6 'tomcatjss.jar' and
    Tomcat 7 'tomcat7jss.jar' in Fedora 18 tomcatjss package


author: Christina Fu <cfu@redhat.com> - 7.1.0-5
changelog:
  - Bugzilla Bug #1058366 NullPointerException in tomcatjss searching
    for attribute "clientauth" (cfu)
  - Bugzilla Bug #871171 - Provide Tomcat support for TLS v1.1 and
    TLS v1.2 (cfu)


author: Christina Fu <cfu@redhat.com> 7.1.0-6
changelog:
  - Bugzilla Bug #1198450 - Support for Tomcat 8 (edewata)
  - Eclipse support - 2 patches(alee)
  - Add nuxwdog support (alee)


author: Patsy Franklin <pfrankli@redhat.com> - 2014b-1
changelog:
  - Rebase to 2014b
    - Crimea switches to Moscow time on 2014-03-30 at 02:00 local time.
    - New entry for Troll station, Antarctica.


author: Patsy Franklin <pfrankli@redhat.com> - 2014d-1
changelog:
  - Rebase to 2014d
    - zic no longer generates files containing time stamps before
      the Big Bang.  This works around GNOME bug 730332


author: Patsy Franklin <pfrankli@redhat.com> - 2014e-1
changelog:
  - Rebase to 2014e
    - Morrocco suspends DTS for Ramadan 
         June 28 at 03:00 and August 2 at 02:00
    - Egypt suspends DTS for Ramadan
         June 26 and July 31 at 24:00


author: Patsy Franklin <pfrankli@redhat.com> - 2014f-1
changelog:
  - Rebase to 2014f
    - Several Russian time zones changes effective on 2014-10-26 
      at 02:00 local time.  See NEWS file for additional details.


author: Patsy Franklin <pfrankli@redhat.com> - 2014g-1
changelog:
  - Rebase to 2014g
    - Turks & Caicos is switching from US eastern time to UTC-4
      year-round, modeled as a switch from EST/EDT to AST
      on 2014-11-02 at 02:00.


author: Petr Machata <pmachata@redhat.com> - 2014h-1
changelog:
  - Rebase to 2014h
    - Changes to historical transitions in America/Jamaica and
      Asia/Novokuznetsk.
    - Africa/{Blantyre, Bujumbura, Gaborone, Harare, Kigali, Lubumbashi,
      Lusaka} now alias Africa/Maputo, because they don't differ in
      post-1970 stamps.
    - Africa/Maseru and Africa/Mbabane now alias Africa/Johannesburg for
      the same reason.


author: Patsy Franklin <pfrankli@redhat.com> - 2014i-1
changelog:
  - Rebase to 2014i
    - Pacific/Fiji will observe DST from 2014-11-02 02:00 to 2015-01-18 03:00.
    - A new Zone Pacific/Bougainville, for the part of Papua New Guinea
      that plans to switch from UTC+10 to UTC+11 on 2014-12-28 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2014j-1
changelog:
  - Rebase to 2014j
    - Turks & Caicos' switch from US eastern time to UTC-4 year-round
      did not occur on 2014-11-02 at 02:00.  It's currently scheduled
      for 2015-11-01 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new 
      standard time will be its old daylight saving time.  This affects 
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015a-1
changelog:
  - Rebase to 2015a
    - New leap second 2015-06-30 23:59:60 UTC as per IERS Bulletin C 49.
    - The Mexican state of Quintana Roo, represented by America/Cancun,
      will shift from Central Time with DST to Eastern Time without DST
      on 2015-02-01 at 02:00.
    - Chile will not change clocks in April or thereafter; its new
      standard time will be its old daylight saving time.  This affects
      America/Santiago, Pacific/Easter, and Antarctica/Palmer.


author: Patsy Franklin <pfrankli@redhat.com> - 2015b-1
changelog:
  - Rebase to 2015b
    - Mongolia will start observing DST again this year, from the last
      Saturday in March at 02:00 to the last Saturday in September at 00:00.
    - Palestine will start DST on March 28, not March 27.  Also,
      correct the fall 2014 transition from September 26 to October 24.
      Adjust future predictions accordingly.


author: Patsy Franklin <pfrankli@redhat.com> - 2015c-1
changelog:
  - Rebase to 2015c
    - Egypt's spring-forward transition is at 24:00 on April's last Thursday,
      not 00:00 on April's last Friday.  2015's transition will therefore be on
      Thursday, April 30 at 24:00, not Friday, April 24 at 00:00.  Similar fixes
      apply to 2026, 2037, 2043, etc.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-1
changelog:
  - Rebase to 2015d:
    - The Egyptian Cabinet announced that DST will be cancelled for 2015.
    - The abbreviations for Hawaii-Aleutian standard and daylight times
      have been changed from HAST/HADT to HST/HDT, as per US Government
      Printing Office style. This affects only America/Adak since 1983,
      as America/Honolulu was already using the new style.


author: Patsy Franklin <pfrankli@redhat.com> - 2015d-3
changelog:
  -  Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
     not 06-13 and 07-18 as we had guessed.


author: Patsy Franklin <pfrankli@redhat.com> - 2015e-1
changelog:
  - Rebase to 2015e:
    - Morocco will suspend DST from 2015-06-14 03:00 through 2015-07-19 02:00,
      not 06-13 and 07-18 as we had guessed.  (Thanks to Milamber.)
    - Assume Cayman Islands will observe DST starting next year, using US rules.
      Although it isn't guaranteed, it is the most likely.


author: Patsy Franklin <pfrankli@redhat.com> - 2015f-1
changelog:
  - Rebase to 2015f
    - North Korea switches to +0830 on 2015-08-15. 
      The abbreviation remains "KST". 
    - Uruguay no longer observes DST.


author: Tom Callaway <spot@fedoraproject.org> - 6.0-9
changelog:
  - Apply changes to match.c to sync with recmatch from util.c (from zip 3.0)
    This also resolves the license issue in that file.


author: Petr Stodulka <pstodulk@redhat.com> - 6.0-15
changelog:
  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141
    Resolves: #1196134 #1196122 #1196126 #1196130


author: Karel Zak <kzak@redhat.com> 2.23.2-15
changelog:
  - fix #1078618 - flock nfs file fails on nfsv4
  - fix #1047376 - blkid hangs while reading from /dev/fd0
  - fix #1079931 - fsck: warning on kdump boot


author: Karel Zak <kzak@redhat.com> 2.23.2-17
changelog:
  - fix #1067354 - dmesg -w output not line-buffered
  - fix #1072298 - util-linux/lscpu: '--sysroot' broken on XFS
  - fix #1072930 - hwclock --systohc can hang on busy or virtual machine
  - fix #1077310 - wipefs problem with some live .isos
  - fix #1077864 - swapon: allow a more flexible swap discard policy
  - fix #1080407 - libblkid XFS detection is too fragile
  - fix #1115442 - kill(1) doesn't check errno after calling strtol()
  - fix #1127823 - losetup does not accept offset
  - fix #1127891 - wipefs 4k disks and gpt partitions
  - fix #1136111 - "findmnt" returns incomplete output on kernel-3.14
  - fix #1140591 - improve mount --move documentation
  - fix #1131522 - backport --fork and --mount-proc to unshare(1)
  - fix #1113043 - backport lslogins(1)


author: <danw@redhat.com> - 1:2.0-15
changelog:
  - Add domain_match config option from upstream (rh #1178263)
  - Include peer certificate in EAP events for use by clients


author: Kalev Lember <kalev@smartlink.ee> - 3.1.1-1
changelog:
  - Update to 3.1.1
  - Dropped CVE-2009-1885 patch.
  - Use dos2unix -k instead of unrecognized option -U
  - Removed the multilib conflict workaround as Xerces_autoconf_config.hpp
    no longer contains the conflicting XERCES_SIZEOF_LONG define.


author: James Antill <james@fedoraproject.org> - 5.0.2-7
changelog:
  - Remove unneeded build require on tetex.
  - Resolves: rhbz#1037828
  - Depend on hostname package instead of /bin/hostname.


