# changelog

author: Jiri Kucera <jkucera@redhat.com> - 1.13.0-1
changelog:
  - Backport patch to fix CompressedRowSparseMatrixTest.AppendRows test failure
    (see https://github.com/ceres-solver/ceres-solver/issues/383)
    Resolves: #1609969


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-3.el8
changelog:
  - edk2-UefiCpuPkg-PiSmmCpuDxeSmm-pause-in-WaitForSemaphore-.patch [bz#1861718]
  - Resolves: bz#1861718
    (Very slow boot when overcommitting CPU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-4.el8
changelog:
  - edk2-OvmfPkg-SmmControl2Dxe-negotiate-ICH9_LPC_SMI_F_CPU_.patch [bz#1849177]
  - edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-befo.patch [bz#1849177]
  - edk2-OvmfPkg-CpuHotplugSmm-fix-CPU-hotplug-race-just-afte.patch [bz#1849177]
  - edk2-CryptoPkg-OpensslLib-Upgrade-OpenSSL-to-1.1.1g.patch [bz#1893806]
  - edk2-redhat-bump-OpenSSL-dist-git-submodule-to-1.1.1g-RHE.patch [bz#1893806]
  - Resolves: bz#1849177
    (OVMF: negotiate "SMI on VCPU hotplug" with QEMU)
  - Resolves: bz#1893806
    (attempt advancing RHEL8 edk2's OpenSSL submodule to RHEL8 OpenSSL 1.1.1g (or later))


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-5.el8
changelog:
  - edk2-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch [bz#1892318]
  - edk2-redhat-add-OVMF-binary-that-will-support-SEV-ES.patch [bz#1956837]
  - Resolves: bz#1892318
    (edk2: possible heap corruption with LzmaUefiDecompressGetInfo [rhel-8])
  - Resolves: bz#1956837
    (Additional build of edk2 without SMM (dual build / sub-package) for SEV-ES)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-1
changelog:
  - Rebase to edk2-stable202105 [bz#1938238]
  - Resolves: bz#1938238
    ((edk2-rebase-rhel-8.5) - rebase edk2 to edk2-stable202105 for RHEL-8.5)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-2
changelog:
  - edk2-NetworkPkg-IScsiDxe-wrap-IScsiCHAP-source-files-to-8.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-simplify-ISCSI_CHAP_AUTH_DATA.In.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-ISCSI_CHAP_AUTH_DATA.Ou.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-library-class-dependenc.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-potential-integer-overflow-i.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-assert-that-IScsiBinToHex-always.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-reformat-IScsiHexToBin-leading-c.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-hex-parsing.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-buffer-overflo.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-check-IScsiHexToBin-return-value.patch [bz#1956408]
  - Resolves: bz#1956408
    (edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe [rhel-8.5.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-3
changelog:
  - edk2-MdeModulePkg-PartitionDxe-Ignore-PMBR-BootIndicator-.patch [bz#1988762]
  - Resolves: bz#1988762
    (edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-1.el8
changelog:
  - Rebase to latest upstream release [bz#2018386]
  - Resolves: bz#2018386
    ([rebase] update edk2 to nov '21 release (edk2-stable202111xx))


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-2
changelog:
  - edk2-OvmfPkg-AmdSev-SecretPei-Mark-SEV-launch-secret-area.patch [bz#2112307]
  - Resolves: bz#2112307
    (Mark SEV launch secret area as reserved)


author: Camilla Conte <cconte@redhat.com> - 20220126gitbb1bba3d77-3
changelog:
  - Bumping OpenSSL version [bz# 2074834]
  - Resolves: bz# 2074834
    (edk2: sync openssl sources with rhel openssl rpm)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-4
changelog:
  - edk2-openssl-update.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - Resolves: bz#2164531
    (CVE-2023-0286 edk2: openssl: X.400 address type confusion in X.509 GeneralName [rhel-8])
  - Resolves: bz#2164543
    (CVE-2022-4304 edk2: openssl: timing attack in RSA Decryption implementation [rhel-8])
  - Resolves: bz#2164558
    (CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-8])
  - Resolves: bz#2164581
    (CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-8])


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-6
changelog:
  - webui: Allow grace login limit
    Resolves: RHBZ#2109243
  - check_repl_update: in progress is a boolean
    Resolves: RHBZ#2117303
  - Disabling gracelimit does not prevent LDAP binds
    Resolves: RHBZ#2109236
  - Set passwordgracelimit to match global policy on group pw policies
    Resolves: RHBZ#2115475


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-8
changelog:
  - ipa man page format the EXAMPLES section
    Resolves: RHBZ#2129895
  - Fix canonicalization issue in Web UI
    Resolves: RHBZ#2127035
  - Remove idnssoaserial argument from dns zone API. 
    Resolves: RHBZ#2108630
  - Warn for permissions with read/write/search/compare and no attrs
    Resolves: RHBZ#2098187
  - Add PKINIT support to ipa-client-install
    Resolves: RHBZ#2075452
  - Generate CNAMEs for TXT+URI location krb records
    Resolves: RHBZ#2104185
  - Vault: fix interoperability issues with older RHEL systems
    Resolves: RHBZ#2144737
  - Fix typo on ipaupgrade.log chmod during RPM %post snipppet
    Resolves: RHBZ#2140994


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.11-1
changelog:
  - Rebase ipa to 4.9.11
    Resolves: RHBZ#2141316
  - updates: fix memberManager ACI to allow managers from a specified group
    Resolves: RHBZ#2056009
  - Defer creating the final krb5.conf on clients
    Resolves: RHBZ#2148259
  - Exclude installed policy module file from RPM verification
    Resolves: RHBZ#2149567
  - Spec file: ipa-client depends on krb5-pkinit-openssl
    Resolves: RHBZ#2149889


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.11-4
changelog:
  - trust-add: handle missinf msSFU30MaxGidNumber
    Resolves: RHBZ#2162355
  - Backport latest test fixes for python3-ipatests
    Resolves: RHBZ#2166929
  - server install: remove error log about missing bkup file
    Resolves: RHBZ#2160389
  - automember-rebuild: add a notice about high CPU usage
    Resolves: RHBZ#2018198
  - ipa-kdb: PAC consistency checker needs to handle child domains as well
    Resolves: RHBZ#2166324


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-2.el8
changelog:
  - ovt-Fix-a-memory-leak-reported-by-a-partner-from-their-C.patch [bz#1935807]
  - Resolves: bz#1935807
    ([ESXi][RHEL-8.5][open-vm-tools] Coverity detected an important defect in open-vm-tools-11.2.5 rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.3.0-1.el8
changelog:
  - Rebase to open-vm-tools 11.3.0 [bz#1974468]
  - Resolves: bz#1974468
    ([ESXi][RHEL8]Open-vm-tools release 11.3.0 has been released - please rebase)


author: Miroslav Rezanian <mrezanin@redhat.com> - 11.3.5-1
changelog:
  - Rebase to open-vm-tools 11.3.5 [bz#2008244]
  - Resolves: bz#2008244
    ([ESXi][RHEL8]Open-vm-tools release 11.3.5 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.0.0-1
changelog:
  - Rebase to open-vm-tools 12.0.0 [bz#2061189]
  - Resolves: bz#2061189
    ([ESXi][RHEL8]Open-vm-tools release 12.0.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.0.5-1
changelog:
  - Rebase to open-vm-tools 12.0.5 [bz#2090273]
  - Resolves: bz#2090273
    ([ESXi][RHEL8]Open-vm-tools release 12.0.5 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.0.5-2
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119284]
  - Resolves: bz#2119284
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.0-1
changelog:
  - Rebase to open-vm-tools 12.1.0
  - Resolves: bz#2121196
    ([ESXi][RHEL8]Open-vm-tools release 12.1.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.5-1
changelog:
  - Rebase to open-vm-tools 12.1.5 [bz#2150188]
  - Resolves: bz#2150188
    (ESXi][RHEL8]Open-vm-tools release 12.1.5 has been released - please rebase)


author: Andrew Lukoshko <alukoshko@almalinux.org> - 12.1.5-2.el8_8.alma
changelog:
  - [CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-1.el8
changelog:
  - Rebase to 11.2.5 [bz#1916561]
    ([ESXi][RHEL8.5]Open-vm-tools update release 11.2.5 has been released)


author: Javier Martinez Canillas <javierm@redhat.com> - 15-3
changelog:
  - Make EFI variable copying fatal only on secureboot enabled systems
    Resolves: rhbz#1704854
  - Fix booting shim from an EFI shell using a relative path
    Resolves: rhbz#1717063


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Backport this to EL 8 so we can build-dep on the right version.
    Related: CVE-2020-14372 (and others)


author: Javier Martinez Canillas <javierm@redhat.com> - 15-3
changelog:
  - Make EFI variable copying fatal only on secureboot enabled systems
    Resolves: rhbz#1715878
  - Fix booting shim from an EFI shell using a relative path
    Resolves: rhbz#1717064


author: Peter Jones <pjones@redhat.com> - 15-4
changelog:
  - Rebuild for bug fixes and new signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-5
changelog:
  - Once more with the MokListRT config table patch added.
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-7
changelog:
  - Implement Lenny's workaround
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Peter Jones <pjones@redhat.com> - 15-8
changelog:
  - Fix a load-address-dependent forever loop.
    Resolves: rhbz#1861977
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311
    Related: CVE-2020-15705
    Related: CVE-2020-15706
    Related: CVE-2020-15707


author: Lukáš Tyrychtr <lukastyrychtr@gmail.com> 2.5-9
changelog:
  - Add an obsoletes directive for the old speech-tools-libs as they're
    no longer part of the Festival package.


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


