# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-10
changelog:
  - Bump version to 1.3.7.5-10
  - Resolves: Bug 1464463 - Replication fails to start with CBCA (Certificate-Based Client Authentication) while FIPS mode is enabled.
  - Resolves: Bug 1465383 - Segmentation fault in valueset_array_to_sorted_quick
  - Resolves: Bug 1510865 - python-ldap is not a dependency of 389-ds-base
  - Resolves: Bug 1513467 - IPA upgrade fails for latest ipa package
  - Resolves: Bug 1192099 - IPA server replication broken, after DS stop-start, due to changelog reset
  - Resolves: Bug 1445188 - Misleading error message - Incoming BER Element was 3 bytes 
  - Resolves: Bug 1498980 - heap corruption during import
  - Resolves: Bug 1511462 - scope one searches give incorrect results
  - Resolves: Bug 1514033 - opened connection are hanging, no longer poll


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-11
changelog:
  - Bump version to 1.3.7.5-11
  - Resolves: Bug 1518069 - heap-buffer-overflow in ss_unescape
  - Resolves: Bug 1516676 - gssapi authentication fails after upgrading 389-ds-base
  - Resolves: Bug 1511885 - Automatically load /usr/lib/sysctl.d/70-dirsrv.conf after installing 389-ds-base
  - Resolves: Bug 1517980 - stack-buffer-overflow in slapi_pblock_get


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-12
changelog:
  - Bump version to 1.3.7.5-12
  - Resolves: Bug 1459946 - GetEffectiveRights gives false-negative with ACIs containing targetfilter
  - Resolves: Bug 1507194 - cleanallruv could break replication if anchor csn in ruv originated in deleted replica
  - Resolves: Bug 1517788 - password policy: minimum token length fails when the token length is equal to attribute length
  - Resolves: Bug 1518287 - heap-use-after-free in csn_as
  - Resolves: Bug 1531153 - Indexing of internationalized matching rules is failing
  - Resolves: Bug 1517383 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired
  - Resolves: Bug 1523183 - search with CoS attribute is getting slower after modifying/adding CosTemplate
  - Resolves: Bug 1457315 - cmocka tests are not executed during rpm build
  - Resolves: Bug 1516309 - After cleanALLruv, replication is looping on keep alive DEL


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-13
changelog:
  - Bump version to 1.3.7.5-13
  - Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
  - Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7
  - Resolves: Bug 1534379 - CVE-2017-15134: Remote DoS via search filters in slapi_filter_sprintf in slapd/util.c 
  - Resolves: Bug 1533571 - memberof: schema violation error message is confusing as memberof will likely repair target entry
  - Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-14
changelog:
  - Bump version to 1.3.7.5-14
  - Resolves: Bug 1519406 - New defects found in 389-ds-base-1.3.7.5-3.el7 (fix regression in -13)


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-15
changelog:
  - Bump version to 1.3.7.5-15
  - Resolves: Bug 1533828 - Server allows to set nsds5replicaid=65535 in the existing replica entry
  - Resolves: Bug 1535515 - local password policies should use the same defaults as the global policy
  - Resolves: Bug 1541108 - Allow CRL handling to be configurable for outgoing connections


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-16
changelog:
  - Bump version to 1.3.7.5-16
  - Resolves: Bug 1542645 - Outgoing secure connection is failing with recent OpenLDAP


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5.17
changelog:
  - Bump version to 1.3.7.5.17
  - Resolves: Bug 1539082 - Child entry cenotaphs should not prevent the deletion of the parent
  - Resolves: Bug 1540106 - CVE-2018-1054 - remote Denial of Service (DoS) via search filters in SetUnicodeStringFromUTF_8 
  - Resolves: Bug 1535538 - CVE-2017-15135 - Authentication bypass due to lack of size check in slapi_ct_memcmp


author: Matus Honek <mhonek@redhat.com> - 1.3.7.5-19
changelog:
  - Bump version to 1.3.7.5-19
  - Resolves: Bug 1563107 - IPA server is not responding, all authentication and admin tests failed [rhel-7.5.z]


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-20
changelog:
  - Bump version to 1.3.7.5-20
  - Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received 
  - Resolves: Bug 1559764 - memberof fails if group is moved into scope
  - Resolves: Bug 1554720 - "Truncated search results" pop-up appears in user details in WebUI 
  - Resolves: Bug 1553605 - ipa-server-install fails with Error: Upgrade failed with no such entry
  - Resolves: Bug 1559760 - ds-replcheck: add -W option to ask for the password from stdin instead of passing it on command line
  - Resolves: Bug 1559464 - replica_write_ruv log a failure even when it succeeds


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-21
changelog:
  - Bump version to 1.3.7.5-21
  - Resolves: Bug 1559818 - EMBARGOED CVE-2018-1089 389-ds-base: ns-slapd crash via large filter value in ldapsearch


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-22
changelog:
  - Bump version to 1.3.5.7-22
  - Resolves: Bug 1563079 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received
  - Resolves: Bug 1579702 - Replication stops working when MemberOf plugin is enabled on hub and consumer
  - Resolves: Bug 1579698 - replicated operations should be serialized
  - Resolves: Bug 1579700 - Upgrade script doesn't enable PBKDF password storage plug-in
  - Resolves: Bug 1580257 - ds-replcheck LDIF comparision fails when checking for conflicts
  - Resolves: Bug 1580523 - ns-slapd segfaults with ERR - connection_release_nolock_ext - conn=0 fd=0 Attempt to release connection that is not acquired


author: Mark Reynolds <mreynolds@redhat.com> - 1.3.7.5-23
changelog:
  - Bump version to 1.3.7.5-23
  - Resolves: Bug 1581588 - ACI deny rules do not work correctly
  - Resolves: Bug 1582747 - DS only accepts RSA and Fortezza cipher families


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-4
changelog:
  - settings: clear unsaved flag on new connections (rh #1525078)
  - platform-linux: reload qdiscs and tfilters after removing them (rh #1527197)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-5
changelog:
  - wwan: add default route even if modem didn't return a gateway (rh #1527934)
  - dhcp: fix assertion failure for dhcp-client-id (rh #1531173)


author: Thomas Haller <thaller@redhat.com> - 1:1.10.2-6
changelog:
  - core: use distinct route-metric to keep connectivity on first activated device (rh #1505893)
  - core: fix enabling connectivity-check-enabled via D-Bus (rh #1534477)
  - core: fix invalid assertion deleting volatile connection (rh #1506552)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-7
changelog:
  - po: import translations (rh #1481186)
  - device: increase carrier wait time to 6 seconds (rh #1520826)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-10
changelog:
  - device: skip IP configuration phase for external devices (rh #1530288)
  - platform: fix crash during route-get call (rh #1534721)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.10.2-11
changelog:
  - ovs-interface: avoid starting ip configuration twice (rh #1540063)
  - libnm-core: ensure alignment of team.config and other team properties (rh #1533830)
  - nmcli: clear link-watchers before adding the new ones (rh #1533926)
  - libnm-core: update team.runner description (rh #1533799)
  - libnm-core: team: fix runner sys_prio default value (rh #1533810)
  - libnm: avoid a symbol clash with json-glib (rh #1535905)
  - libnm-core: team: add support to runner "random" (rh #1538699)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-12
changelog:
  - ppp: don't start IPv6 configuration on the device (rh #1515829)
  - device: avoid setting the IPv4 rp_filter (rh #1492472)
  - nmcli: team: clear runner-tx-hash before adding new hashes (rh #1541922)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.10.2-14
changelog:
  - manager: retry activating devices when the parent becomes managed (rh #1553595)
  - manager: allow autoconnect-slaves to reconnect the same connection (rh #1548265)
  - manager: fix starting teamd after service restart  (rh #1551958)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-14
changelog:
  - Kdump: parse new options, EOL comments (RHBZ#1139298)
  - Rsyslog: parse property filters and templates (RHBZ#1138402)
  - Systemd: parse semicolons inside entry values (RHBZ#1139498)
  - Systemd: parse environment variables where value is quoted (RHBZ#1138508)


author: Dominic Cleal <dcleal@redhat.com> - 1.1.0-16
changelog:
  - Iptables: parse /etc/sysconfig/iptables.save (RHBZ#1144651)
  - Lvm: parse /etc/lvm/lvm.conf (RHBZ#1145495)
  - Shadow: add lens (RHBZ#1145249)


author: Dominic Cleal <dcleal@redhat.com> - 1.4.0-1
changelog:
  - Rebase to Augeas 1.4.0
  - Revert some changes for better compatibility with 1.1.0-17:
    * Dhcpd: keep 1.1.0 behaviour, add Dhcpd_140 for 1.4.0 features
    * Dnsmasq: revert splitting of address/server options
    * Dovecot: restore quotes within values
    * Jaas: revert semicolon and line break changes
    * Slapd: keep 1.1.0 behaviour, add Slapd_140 for 1.4.0 features
    * Sshd: keep 1.1.0 behaviour, add Sshd_140 for 1.4.0 features
    * Syslog: restore tree without protocol for UDP hosts
    * UpdateDB: keep Simplevars to load config by default


author: Pino Toscano <ptoscanoredhat.com> - 1.4.0-4
changelog:
  - Fix CVE-2017-7555, improper handling of escaped strings (RHBZ#1481546)
  - Skip testSaveNoPermission when running as root (RHBZ#1269817)
  - Chrony: allow signed numbers (RHBZ#1302017)
  - Krb5: support includedir (RHBZ#1406111)


author: Pino Toscano <ptoscanoredhat.com> - 1.4.0-5
changelog:
  - Cgconfig: allow fperm & dperm in admin & task (RHBZ#1325741)
  - Grub: handle top-level "boot" directive (RHBZ#1484261)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.14.28-5
changelog:
  - Append python-botocore and python-jmespath bundled directory to
    search path where needed

    Resolves: rhbz#1509434


author: Nick Clifton <nickc@redhat.com> 2.27-21.base
changelog:
  - Prevent the PowerPC64 linker from triggering a seg-fault when discarding dynamic sections.
    (#1513014)


author: Kai Engert <kaie@redhat.com> - 2017.2.11-71
changelog:
  - Update to CKBI 2.11 from NSS 3.28.1 with legacy modifications.
  - Use comments in extracted bundle files.
  - Change packaging script to support empty legacy bundles.


author: Kai Engert <kaie@redhat.com> - 2017.2.11-72
changelog:
  - Changed the packaged bundle to use the flexible p11-kit-object-v1 file format,
    as a preparation to fix bugs in the interaction between p11-kit-trust and
    Mozilla applications, such as Firefox, Thunderbird etc.
  - For CAs trusted by Mozilla, set attribute nss-mozilla-ca-policy: true
  - Require p11-kit 0.23.5
  - Added an utility to help with comparing output of the trust dump command.


author: Kai Engert <kaie@redhat.com> - 2017.2.16-71
changelog:
  - Update to CKBI 2.16 from NSS 3.32. In addition to removals/additions,
    Mozilla removed code signing trust from all CAs (rhbz#1472933)


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - add a yum var to route mirrorlist accurately
  - add CentOS-fastrack repo
  - Trim the CentOS-Debug-7 key
  - rename the Debug repo to base-debug so yum-utils can consume easier


author: Karanbir Singh <kbsingh@centos.org>
changelog:
  - Bump Release for 1503 
  - add ABRT specific content to os-release
  - split redhat-release from centos-release


author: Johnny Hughes <johnny@centos.org>
changelog:
  - Bump Release for 1511
  - Add CentOS-Media.repo and put CentOS-CR.repo in the
    tarball, then removed patch1000


author: Nalin Dahyabhai <nalin@redhat.com> 0.75.14-1
changelog:
  - make pathname canonicalization slightly smarter, to handle ".." in
    locations (#1131758)
  - updates to self-tests (#1144082)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-2
changelog:
  - backport dogtag-submit: accept additional options to pass to the server when
    approving requests using agent creds (#1165155)


author: Jan Cholasta <jcholast@redhat.com> - 0.75.14-3
changelog:
  - backport change from git to correctly retrieve string values from DBus
    property interface replies (#1181022)


author: Jan Cholasta <jcholast@redhat.com> - 0.78.1-1
changelog:
  - Resolves: #1140241 RFE: Add SCEP support to certmonger
  - Resolves: #1148001 ipa-getcert killed by SIGABRT
  - Resolves: #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.1


author: Jan Cholasta <jcholast@redhat.com> - 0.78.3-1
changelog:
  - Resolves: #1244914 scep ca helper does not parse command line options
    correctly
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.3


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-1
changelog:
  - Resolves: #1249753 challenge password not added in csr using start-tracking
  - Resolves: #1250397 Remove certmonger rekey feature in 7.2
    - Remove rekey feature
  - Related:  #1205756 Rebase certmonger to 0.77 or later
    - Update to upstream 0.78.4


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-2
changelog:
  - Resolves: #1345755 Support for specifying IPA lightweight CA
    - Add 'issuer' request option for specifying issuer
    - Documentation: mark $CERTMONGER_CA_ISSUER as 0.79
    - Comment/whitespace fixup
    - ipa-submit: Retry without "ca" on OptionError
    - getcert: fix a potential out-of-bounds
    - Document the -X option in the ipa-submit man page
  - Resolves: #1351052 certmonger build for RHEL 7.3 failure
    - Stop assuming RSA 512 works
    - Stop assuming RSA 512 works, part two
    - Fix a flakiness in the 028-dbus test


author: Jan Cholasta <jcholast@redhat.com> - 0.78.4-3
changelog:
  - Resolves: #1367683 getcert request command fails to use Sub CA using -X
    argument
    - Fix CA option name for ipa cert-request


author: Rob Crittenden <rcritten@redhat.com> - 0.78.4-3.1
changelog:
  - Use required DER encoding when setting CA basic constraint (#1560961)
  - NSS 3.34 more strictly enforces length checking when verifying signatures
    (#1560960)


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-18
changelog:
  - Start the cloud-init init local service after the dbus socket is created
    so that the hostnamectl command works.
    Resolves: rhbz#1450521


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-23
changelog:
  - Fix a bug tha caused cloud-init to fail as a result of trying
    to rename bonds.
    Resolves: rhbz#1512247


author: Ryan McCabe <rmccabe@redhat.com> 0.7.9-24
changelog:
  - Set DHCP_HOSTNAME on Azure to allow for the hostname to be
    published correctly when bouncing the network.
    Resolves: rhbz#1434109


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.7.9-24.el7_5.1
changelog:
  - ci-Revert-azure-Fix-publishing-of-hostname.patch [bz#1568717]
  - ci-DataSourceAzure.py-use-hostnamectl-to-set-hostname.patch [bz#1568717]
  - ci-sysconfig-Don-t-disable-IPV6_AUTOCONF.patch [bz#1578702]
  - Resolves: bz#1568717
    (Add patch to bounce NICs in Azure/update DNS [rhel-7.5.z])
  - Resolves: bz#1578702
    (cloud-init-0.7.9-9.el7_4.6 breaks IPv4/IPv6 dual-stack EC2 instances in AWS [rhel-7.5.z])


author: Andreas Schneider <asn@redhat.com> - 1.0.0-1
changelog:
  - Update to version 1.0.0:
    * Added new test runner with group fixtures. The old runner is deprecated
    * Added an extensible message output formatter
    * Added jUnit XML message output
    * Added subunit message output
    * Added Test Anything Protocol message output
    * Added skip() command
    * Added test_realloc()
    * Added a cmockery compat header
    * Fixed a lot of bugs on Windows


author: Andreas Schneider <asn@redhat.com> - 1.0.1-1
changelog:
  - Update to version 1.0.1:
    * Added a macro for assert_ptr_equal().
    * Fixed test_realloc() if 0 size is passed.
    * Fixed objects packaging bug.
    * Fixed building with newer gcc versions.


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-6
changelog:
  + control-center-3.26.2-6
  - Fix Clone MAC not being saved in Ethernet device properties
  - Resolves: #1467295


author: Bastien Nocera <bnocera@redhat.com> - 3.26.2-8
changelog:
  + control-center-3.26.2-8
  - Fix Wi-Fi networks not getting updated
  - Show "Wi-Fi disabled" page when Wi-Fi is disabled
  - Resolves: #1545713


author: Jiri Vanek <jvanek@redhat.com> - 1.1-3
changelog:
  - commented requires on lua posix to stop blocking composes.
  - changed it to 644 to dont mislead by executable flags
  - Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 1.1-5
changelog:
  - posttrans silenced, the error is appearing only in state, when there is nothing to copy
  - Resolves: rhbz#1296430


author: Jiri Vanek <jvanek@redhat.com> - 2.2-1
changelog:
  - added "jre/lib/security/blacklisted.certs" to cared files
  - moved to newest release 2.1
  - moved to new upstream at pagure.io
  - added new script of copy_jdk_configs_fixFiles.sh 
  - copy_jdk_configs.lua  aligned to it
  - Resolves: rhbz#1427463


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-4
changelog:
  - Resolves: rhbz#1367813

  - Man: Fix corosync-qdevice-net-certutil link (rhbz#1367813)
  - merge upstream commit 49a9f722bba13e4b2762151b7b96b1d4196fd5e0 (rhbz#1367813)
  - man: mention qdevice incompatibilites in votequorum.5 (rhbz#1367813)
  - merge upstream commit 0da1b7446239424b76b1d5eb7c3640afce9b054e (rhbz#1367813)
  - Qnetd LMS: Fix two partition use case (rhbz#1367813)
  - merge upstream commit b0c850f308d44ddcdf1a1f881c1e1142ad489385 (rhbz#1367813)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-6
changelog:
  - Resolves: rhbz#1371880

  - libvotequorum: Bump version (rhbz#1371880)
  - merge upstream commit 96f91f23a6a413535cc2f0e8492e2300373fed40 (rhbz#1371880)
  - votequorum: Don't update expected_votes display if value is too high (rhbz#1371880)
  - merge upstream commit 596433066805af029be1292a37a35ce31307f0bf (rhbz#1371880)
  - votequorum: simplify reconfigure message handling (rhbz#1371880)
  - merge upstream commit 4a385f2e94c7168dbd92168c54a80ee97a3c2140 (rhbz#1371880)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-7
changelog:
  - Related: rhbz#1371880

  - Fix build on RHEL7.3 latest (rhbz#1371880)
  - merge upstream commit 19e48a6eee20d5f34f79a3b8d4e1c694169c1d7b (rhbz#1371880)
  - Enable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-8
changelog:
  - Resolves: rhbz#1434528
  - Resolves: rhbz#1434529
  - Resolves: rhbz#1434534

  - cfg: Prevents use of uninitialized buffer (rhbz#1434528)
  - merge upstream commit 52e6ae57ea06d0bef61c5c9250881bef1372ead2 (rhbz#1434528)
  - man: Fix typos in man page (rhbz#1434529)
  - merge upstream commit b642904ea9640bd7a1573a8c0d2c5bcb43a10dfc (rhbz#1434529)
  - Fix typo: Destorying -> Destroying (rhbz#1434529)
  - merge upstream commit 117d9e4eb77ef9941fdeaf17ddfd892514da8143 (rhbz#1434529)
  - init: Add doc URIs to the systemd service files (rhbz#1434529)
  - merge upstream commit 21a728785027483786e41c19f6aff57a95b80aa5 (rhbz#1434529)
  - man: Modify man-page according to command usage (rhbz#1434529)
  - merge upstream commit 79898e8cb1715e79b7467b91661b7341e2664550 (rhbz#1434529)
  - Totempg: remove duplicate memcpy in mcast_msg func (rhbz#1434528)
  - merge upstream commit 4a8e9d80409590cb42732ae3105b5ae71fda52c1 (rhbz#1434528)
  - upstart: Add softdog module loading example (rhbz#1434529)
  - merge upstream commit 75474d69bebea6c9c4ef2252476ce738cf92f0f4 (rhbz#1434529)
  - Remove deprecated doxygen flags (rhbz#1434529)
  - merge upstream commit b252013e42007ea7284ae54d035a30ca40f20fc0 (rhbz#1434529)
  - Remove redundant header file inclusion (rhbz#1434528)
  - merge upstream commit d6c7ade277a4a23d84c56d7fde6b60b377a1023b (rhbz#1434528)
  - Qdevice: fix spell errors in qdevice (rhbz#1434529)
  - merge upstream commit d9caa09c45d4560c89a1ad873087c0476cabab46 (rhbz#1434529)
  - doc: document watchdog_device parameter (rhbz#1434529)
  - merge upstream commit a5f97ae1b99063383d8f45168125b34232b91faf (rhbz#1434529)
  - Logsys: Change logsys syslog_priority priority (rhbz#1434534)
  - merge upstream commit 609cc0cc100aa1070d97b405273373682da0e270 (rhbz#1434534)
  - logconfig: Do not overwrite logger_subsys priority (rhbz#1434534)
  - merge upstream commit c866a2f8603b44e89eb21a6cf7d88134af2e8b66 (rhbz#1434534)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-9
changelog:
  - Resolves: rhbz#1445001

  - Main: Call mlockall after fork (rhbz#1445001)
  - merge upstream commit 238e2e62d8b960e7c10bfa0a8281d78ec99f3a26 (rhbz#1445001)
  - Disable aarch64 build (bz#1422598)


author: Jan Friesse <jfriesse@redhat.com> 2.4.0-10
changelog:
  - Resolves: rhbz#1439205
  - Resolves: rhbz#1461450
  - Resolves: rhbz#1469170
  - Resolves: rhbz#1476214

  - main: Don't ask libqb to handle segv, it doesn't work (rhbz#1439205)
  - merge upstream commit c0da36a6c0ecf7bc7def252a06336a7088e68086 (rhbz#1439205)
  - totem: Propagate totem initialization failure (rhbz#1461450)
  - merge upstream commit 0413a8f4672352171f0df731b7d9c1fe20acbc4c (rhbz#1461450)
  - totemcrypto: Refactor symmetric key importing (rhbz#1461450)
  - merge upstream commit a885868181c07ba9ab5cdfdad1d66d387b2a4428 (rhbz#1461450)
  - totemcrypto: Use different method to import key (rhbz#1461450)
  - merge upstream commit 5dadebd21862074deaeb9a337fc9e49f5e9f692a (rhbz#1461450)
  - main: Add option to set priority (rhbz#1469170)
  - merge upstream commit a008448efb2b1d45c432867caf08f0bcf2b4b9b0 (rhbz#1469170)
  - main: Add support for libcgroup (rhbz#1476214)
  - merge upstream commit c56086c701d08fc17cf6d8ef603caf505a4021b7 (rhbz#1476214)
  - totemcrypto: Fix compiler warning (rhbz#1461450)
  - merge upstream commit fdeed33f514e0056e322a45d9a0a04ca4b9a2709 (rhbz#1461450)


author: Jan Friesse <jfriesse@redhat.com> 2.4.3-2
changelog:
  - Resolves: rhbz#1536219

  - logging: Make blackbox configurable (rhbz#1536219)
  - merge upstream commit 8af39f66e56e319b6b93804c0400e6e29737a90f (rhbz#1536219)
  - logging: Close before and open blackbox after fork (rhbz#1536219)
  - merge upstream commit 995ed0bd814ff3eacf6c09534841e6ce39ab6614 (rhbz#1536219)


author: Lukas Czerner <lczerner@redhat.com> - 1.42.9-4
changelog:
  - Fix posisble use after free in some error paths (#997982)
  - Enable lazy_itable_init even if ext4 module is not loaded (#1071909)
  - Remove any ocurence of ext4dev and test_fs from e2fsprogs (#1063801)
  - Allow to resize ext4 file system past 16TB (#982871)
  - Disable altivec instructions for libext2fs on ppc (#1074604)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-5
changelog:
  - Various manpage updates for chattr and mount (#1053885)
  - Fix resize2fs -P hang on corrupted filesystems (#1104612)


author: Eric Sandeen <sandeen@redhat.com> 1.42.9-8
changelog:
  - e4defrag: backwards-allocated files should be defragmented (#1176785)
  - tune2fs: allow removal of dirty journal with two "-f" options (#1212376)
  - mke2fs: prevent creation of filesystem with unsupported revision (#1212378)
  - libext2fs: prevent buffer overflows (#1293677)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-10
changelog:
  - libext2fs: don't ignore fsync errors (#1405049)
  - Fix nroff macro issue in chattr man page (#1429213)


author: Lukas Czerner <lczerner@redhat.com> 1.42.9-11
changelog:
  - libext2fs: skip start_blk adjustment when stride and flex_bg is set (#1503969)
  - tune2fs: edit dire warning about check intervals (#1433233)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-83
changelog:
  - fence_compute/fence_evacuate: add support for keystone v3 authentication
    Resolves: rhbz#1533170
  - fence_ilo3: default to onoff
    Resolves: rhbz#1519370


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-86
changelog:
  - fence-agents-all: remove fence-agents-aws and fence-agents-azure-arm
    dependencies
    Resolves: rhbz#1476009


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.0.11-86.1
changelog:
  - fence_azure_arm: add network-fencing
    Resolves: rhbz#1565670
  - fence_compute/fence_evacuate: fix parameters
    Resolves: rhbz#1565701


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.12-2
changelog:
  - Do not fail logrotate if radiusd is not running.
    Resolves: Bug#1365226 error running non-shared postrotate script for
                          /var/log/radius/radius.log of
                          '/var/log/radius/radius.log '
  - Fix output to log file specified with -l option.
    Resolves: Bug#1421207 radiusd does not work with log file specified by -l
                          option
  - Fix long hostnames interpreted as IP addresses.
    Resolves: Bug#1420359 radclient does not detect 4. level and higher domain
                          name as a domain name
  - Avoid clashes with libtool library symbols.
    Resolves: Bug#1391960 undefined symbol: get_vtable in
                          /usr/lib64/libtdsodbc.so.0 with freeradius-unixODBC
  - Remove mentions of Auth-Type = System from docs.
    Resolves: Bug#1420293 Freeradius does not know Auth-Type = System
  - Improve ip/v4/v6/addr documentation.
    Resolves: Bug#1179736 add description for ipaddr = hostname from DNS with A
                          and AAAA entries


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-1
changelog:
  - Upgrade to upstream v3.0.13 release.
    See upstream ChangeLog for details (in freeradius-doc subpackage).
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
    Resolves: Bug#1329181 freeradius-python fix libpython2.7.so dependency at
                          compile time
    Resolves: Bug#1425869 Radiusd does not trigger modules.sql.fail trap if it
                          can't connect to mysql server
    Resolves: Bug#1427829 Stack overflow when passing bare IPv6 to radclient


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-2
changelog:
  - Fix some issues found with static analyzers.
    Resolves: Bug#1432103 FreeRADIUS fails covscan checks
  - Revert rlm_eap_tnc removal, because the tncfhh package is still in RHEL.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-3
changelog:
  - Explicitly disable rlm_cache_memcached to avoid error when the module's
    dependencies are installed, and it is built, but not packaged.
    Related:  Bug#1202751 Rebase FreeRADIUS to 3.0.12 or later minor release
  - Prevent segfaults by adding a missing handling of connection errors in
    rlm_ldap.
    Resolves: Bug#1437409 [abrt] freeradius: radiusd killed by SIGSEGV
  - Make radtest use Cleartext-Password for EAP, fixing its support for eap-md5.
    Resolves: Bug#1436619 radtest does not work with eap-md5


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-4
changelog:
  - Disable internal OpenSSL cache.
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass
  - Check sizeof(*packet), not sizeof(packet) in EAP-PWD
    Resolves: Bug#1459073 Potential buffer overflow in FreeRADIUS EAP-PWD
  - Parse port as well as address for dhcpclient destination
    Resolves: Bug#1457825 dhcpclient does no accept IP:PORT


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-5
changelog:
  - Refer to correct package version in configuration comments for Bug#1458746
    (CVE-2017-9148) fix.
    Related: Bug#1458746  CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-6
changelog:
  - Avoid race condition when creating session cache file
    Resolves: Bug#1458746 CVE-2017-9148 freeradius: TLS resumption
                          authentication bypass


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-7
changelog:
  - Resolves: Bug#1469408 CVE-2017-10978 freeradius: Out-of-bounds read/write due
                          to improper output buffer size check in make_secret()
  - Resolves: Bug#1469412 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63
  - Resolves: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                          data2vp_wimax()
  - Resolves: Bug#1469416 CVE-2017-10985 freeradius: Infinite loop and memory
                          exhaustion with 'concat' attributes
  - Resolves: Bug#1469419 CVE-2017-10986 freeradius: Infinite read in
                          dhcp_attr2vp()
  - Resolves: Bug#1469422 CVE-2017-10987 freeradius: Buffer over-read in
                          fr_dhcp_decode_suboptions()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-8
changelog:
  - Avoid misinterpreting zero-size malloc in data2vp_extended() fix.
  - Related: Bug#1469415 CVE-2017-10984 freeradius: Out-of-bounds write in
                         data2vp_wimax()


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 3.0.13-9
changelog:
  - Fix double free in rlm_sql acct_redundant
    Resolves: Bug#1551069 Radius service crashes with "Bad talloc magic value -
                          unknown value" when using module sql rlm_sql


author: Marek Polacek <polacek@redhat.com> 4.8.5-20
changelog:
  - handle exceptions in basic_istream::sentry (#1469384)
  - don't run pr63354.c on ppc (#1468546)
  - ensure proxy privatization safety (#1491395)
  - fix incorrect codegen from rdseed intrinsic use (#1482762, CVE-2017-11671)
  - on aarch64, remove libatomic.so (#1465510)


author: Marek Polacek <polacek@redhat.com> 4.8.5-21
changelog:
  - fix 27_io/basic_fstream/53984.cc
  - fix for classes with bases with mutable members (PR c++/77375)
  - fix handling side-effects of parameters (PR c/77767)
  - fix combine's make_extraction (PR rtl-optimization/78378)
  - fix gimplification of const var initialization from COND_EXPR (PR c++/80129)
  - fix -A / -B to A / B folding (PR middle-end/80362)
  - fix comparison of decimal float zeroes (PR middle-end/80692)
  - fix __mulv[dt]i3 and expand_mul_overflow (PR target/82274)


author: Jeff Law <law@redhat.com> 4.8.5-24
changelog:
  - Sync gcc48-rh1469697-13 patch to upstream (#1469697)
  - Avoid probing in the red zone for noreturn functions (#1507980, #1469697)
  - Avoid infinite loop if probing interval is less than guard size (#1469697)
  - Fix debug information for large probing interval on aarch64 (#1469697)
  - Fix ICE on ppc port with large probing interval (#1469697)

  - rebuild to remove static relocations not known to older linkers (#1508968)


author: Jeff Law <law@redhat.com> 4.8.5-26
changelog:
  - Avoid red zone probing for zero residual dynamic allocation (#1469697)
  - Avoid bogus CFIs for probes in noreturn fucntions on x86/x86_64 (#1469697)


author: Marek Polacek <polacek@redhat.com> 4.8.5-28
changelog:
  - Minor testsuite fixes to clean up test results (#1469697)
  - retpoline support for spectre mitigation (#1535655)


author: Petr Stodulka <pstodulk@redhat.com> -1.8.3.1-9
changelog:
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1369173


author: Petr Stodulka <pstodulk@redhat.com> - 1.8.3.1-13
changelog:
  - fall back to Basic auth if Negotiate fails
    Resolves: #1490998
  - handle request-pull when multiple tags point to the same commit
    Resolves: #1192146


author: Pavel Cahyna <pcahyna@redhat.com> - 1.8.3.1-14
changelog:
  - Backport fix for CVE-2018-1123
  - Thanks to Jonathan Nieder <jrnieder@gmail.com> for backporting to 2.1.x
    and to Steve Beattie <sbeattie@ubuntu.com> for backporting to 1.9.1


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-73
changelog:
  - Resolves: #1499253 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-74
changelog:
  - Resolves: #1430640 - "ProxyAddHeaders Off" does not become effective
    when it's defined outside <Proxy> setting


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-75
changelog:
  - Resolves: #1448892 - Cannot override LD_LIBARY_PATH in Apache HTTPD
    using SetEnv or PassEnv. Needs documentation.


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-80.1
changelog:
  - Resolves: #1560609 - httpd: active connections being terminated when httpd
    gets gracefully stopped/restarted, GracefulShutdownTimeout is not being
    honored


author: CentOS Sources <bugs@centos.org> - 2.4.6-80.el7.centos.1
changelog:
  - Remove index.html, add centos-noindex.tar.gz
  - change vstring
  - change symlink for poweredby.png
  - update welcome.conf with proper aliases


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-3.el7
changelog:
  - Drop workaround for building on AArch64 (#1482244)
  - Temporarily reduce Requires on python-netaddr to 0.7.5-7 (#1506485)


author: Pavel Vomacka <pvomacka@redhat.com> - 4.5.4-4.el7
changelog:
  - Resolves: #1388135 [RFE] limit the retro changelog to dns subtree.
    - ldap: limit the retro changelog to dns subtree
  - Resolves: #1427798 Use X509v3 Basic Constraints "CA:TRUE" instead
    of "CA:FALSE" IPA CA CSR
    - Include the CA basic constraint in CSRs when renewing a CA
  - Resolves: #1493145 ipa-replica-install might fail because of an already
    existing entry cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,$SUFFIX
    - Checks if replica-s4u2proxy.ldif should be applied
  - Resolves: #1493150 [RFE] set nsslapd-ignore-time-skew: on by default
    - ds: ignore time skew during initial replication step
    - ipa-replica-manage: implicitly ignore initial time skew in force-sync 
  - Resolves: #1500218 Replica installation at domain-level 0 fails against
    upgraded ipa-server
    - Fix ipa-replica-conncheck when called with --principal
  - Resolves: #1506188 server-del doesn't remove dns-server configuration
    from ldap


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.5.4-5.el7
changelog:
  - Resolves: #1415162 ipa-exdom-extop plugin can exhaust DS worker threads
  - Resolves: #1378892 host-find slowness caused by missing host attributes in index


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-7.el7
changelog:
  - Resolves: #1421869 Unable to re-add broken AD trust - Unexpected Information received
    - adtrust: filter out subdomains when defining our topology to AD
  - Resolves: #1486286 IPA failing to authenticate via password+OTP on RHEL7.4 with fips enabled
    - Don't allow OTP or RADIUS in FIPS mode
  - Resolves: #1494226 IPA User Details not being displayed in WebUI
    - Fix cert-find for CA-less installations
  - Resolves: #1498387 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
    - 389-ds-base crashed as part of ipa-server-intall in ipa-uuid
  - Resolves: #1503022 ipa-getkeytab man page should have more details about consequences of krb5 key renewal
    - ipa-getkeytab man page: add more details about the -r option
  - Resolves: #1509288 IPA trust-add internal error (expected security.dom_sid got None)
    - ipaserver/plugins/trust.py; fix some indenting issues
    - trust: detect and error out when non-AD trust with IPA domain name exists
    - ipaserver/plugins/trust.py: pep8 compliance
  - Resolves: #1511019 ipa-restore broken with python2
    - Fix ipa-restore (python2)
  - Resolves: #1511607 ipa-backup does not backup Custodia keys and files
    - Backup ipa-custodia conf and keys
  - Resolves: #1512482 kra install fails after ipa cert renewed
    - Don't use admin cert during KRA installation
    - Prevent set_directive from clobbering other keys
    - pep8: reduce line lengths in CAInstance.__enable_crl_publish
    - installutils: refactor set_directive
    - Add tests for installutils.set_directive
    - Add safe DirectiveSetter context manager
    - Old pylint doesn't support bad python3 option
  - Resolves: #1514163 CA less IPA install with external certificates fails on RHEL 7 in FIPS mode
    - Fix ca less IPA install on fips mode


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-8.el7
changelog:
  - Resolves: #1477531 Incorrect attribute level rights (ipaallowedtoperform) of service object
    - WebUI: make keytab tables on service and host pages writable
  - Resolves: #1529444 ObjectclassViolation seen while adding idview with domain-resolution-order option
    - Idviews: fix objectclass violation on idview-add
  - Resolves: #1451576 ipa cert-request failed to generate certificate from csr
    - Fixing the cert-request comparing whole email address case-sensitively.


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-9.el7
changelog:
  - Resolves: #1458169 --force-join option is not mentioned in ipa-replica-install man page
    - Add --force-join into ipa-replica-install manpage
  - Resolves: #1457876 ipa-backup fails silently
    - Changed ownership of ldiffile to DS_USER
  - Resolves: #1409786 Second phase of --external-ca ipa-server-install setup fails when dirsrv is not running
    - Checks if Dir Server is installed and running before IPA installation
  - Resolves: #1452086 Pagination Size under Customization in IPA WebUI accepts negative values
    - WebUI: Add positive number validator
    - WebUI: change validator of page size settings
    - WebUI: fix jslint error


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-11.el7
changelog:
  - Resolves: #1565519 Clarify the need to restart services in ipa-server-certinstall(1)
    - Add a notice to restart ipa services after certs are installed
  - Resolves: #1564390 OTP and Radius Authentication does not work in FIPS mode
    - Fix OTP validation in FIPS mode
    - Increase the default token key size
    - Revert "Don't allow OTP or RADIUS in FIPS mode"
    - Log errors from NSS during FIPS OTP key import
  - Resolves: #1565520 ipa client pointing to replica shows KDC has no support for encryption type
    - ipa-replica-install: make sure that certmonger picks the right master
  - Resolves: #1565605 DNS records updated with all IPAddresses of an interface when IPA server/replica try to install with Specific IP address of that interface
    - replica-install: pass --ip-address to client install


author: Florence Blanc-Renaud <frenaud@redhat.com> - 4.5.4-10.el7.2
changelog:
  - Resolves: #1579189 nsds5ReplicaReleaseTimeout should be set by default
    - Add nsds5ReplicaReleaseTimeout to replica config
    - Fix upgrade (update_replica_config) in single master mode
  - Resolves: #1579190 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers
  - Resolves: #1579203 4.5.0 -> 4.5.4 upgrade breaks in ipa-server-upgrade: No such file or directory: '/var/lib/pki/pki-tomcat/conf/ca/CS.cfg'
    - Don't try to backup CS.cfg during upgrade if CA is not configured


author: Rob Crittenden <rcritten@redhat.com> - 4.5.4-10.el7.3
changelog:
  - Resolves: #1579190 Improve Custodia client and key distribution handling
    - Use single Custodia instance in installers


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-16
changelog:
  - Fix important coverity findings: missing include for flock and use bash for
    init script (RHBZ#1264399)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-17
changelog:
  - Fixed init script not to fail on missing restorecon (RHBZ#1246380)
  - Adapted man page snipplet for TRACE to use proper logging backend names
    (RHBZ#1261238)
  - Warn about use of DROP in nat table (RHBZ#1298879)
  - Fixed modules unload in init script (RHBZ#1324102)


author: Thomas Woerner <twoerner@redhat.com> 1.4.21-18
changelog:
  - Add support for --wait options to restore commands (RHBZ#1438597)
  - Do not set changed flag for rule check operations with module targets
    (RHBZ#1438597)
  - Add version option to restore commands (RHBZ#1438597)


author: Phil Sutter - 1.4.21-20
changelog:
  - Prevent iptables.service and ip6tables.service from running in parallel
    (RHBZ#1486803)
  - Don't restart services upon upgrade (RHBZ#1380141)


author: Phil Sutter - 1.4.21-24.1
changelog:
  - Fix for stopping iptables and ip6tables at the same time (RHBZ#1563168)
  - Propagate errors on service stop (RHBZ#1563168)
  - Avoid overwriting parent's return code (RHBZ#1563168)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.2
changelog:
  - Rebuild with RPM optimisation flags disabled due to issues on x86 multilib
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.3
changelog:
  - Bump release number to an unused one as rhel-7.5-z-java-unsafe-candidate wrongly using .el7
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.181-2.6.14.5
changelog:
  - added depndence on latest c-j-c who do not have the incorrect jre-abrt handling
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.162-0.b12
changelog:
  - Update to aarch64-jdk8u162-b12 and aarch64-shenandoah-jdk8u162-b12.
  - Remove upstreamed patches for 8181055/PR3394/RH1448880,
  -  8181419/PR3413/RH1463144, 8145913/PR3466/RH1498309,
  -  8168318/PR3466/RH1498320, 8170328/PR3466/RR1498321 and
  -  8181810/PR3466/RH1498319.
  - Resolves: rhbz#1559766


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-1.b10
changelog:
  - Cleanup from previous commit.
  - Remove unused upstream patch 8167200.hotspotAarch64.patch.
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add misisng ones
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-3.b10
changelog:
  - Fix jconsole.desktop.in subcategory, replacing "Monitor" with "Profiling" (PR3550)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.171-7.b10
changelog:
  - Bump release number to be greater than RHEL 7.6 package to allow build with .el7 suffix
  - Resolves: rhbz#1559766


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-4
changelog:
  - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4
  - Updated build requirements for NSPR
  - Updated build and runtime requirements for NSS
  - ## 'jss-post-rebase.patch' resolves the following issues ported from
    - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1
    code for RFC5272+ (cfu)
  - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata)
  - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket
    class. (edewata)
  - Mozilla Bugzilla #1348856 - SSL alert callback (edewata)
  - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata)
  - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole().
    (edewata)
  - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen)
  - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen)
  - Mozilla Bugzilla #1350130 - Missing
    CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-5
changelog:
  - Mozilla Bugzilla #1355268 - JSS 4.4 is incompatible with versions of
    idm-console-framework < 1.1.17-4
  - Red Hat Bugzilla #1435076 - Remove unused legacy lines from JSS spec files


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-6
changelog:
  - Mozilla Bugzilla #1352476 - RFE: Document on the README how to create a
    release tag (mharmsen)
  - Mozilla Bugzilla #1355358 - CryptoStore: add methods for importing and
    exporting EncryptedPrivateKeyInfo (ftweedal)
  - Mozilla Bugzilla #1359731 - CryptoStore.importPrivateKey enhancements
    (ftweedal)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.4.0-7
changelog:
  - Bump NSS dependencies from 4.28.3 to 4.28.4-6 to pick-up fix in
    Mozilla Bugzilla #1360207 - Fix incorrect if (ss->...) in SSL_ReconfigFD


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-8
changelog:
  - Bugzilla #1488846 - Fix HmacTest code for AES encrypt/unwrap [rhel-7.4.z]
    (jmagne)
  - Bugzilla #1490494 - PKCS12: (JSS) upgrade to at least AES and SHA2 (FIPS)
    [RHEL-7.4.z] (ftweedal)
  - Bugzilla #1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if
    export fails [rhel-7.4.z] (ftweedal)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-9
changelog:
  - Bugzilla #1505690 - new JSS failures: HMAC Unwrap and KeyWrapping
    FIPSMODE [rhel-7.4.z] (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-10
changelog:
  - Bugzilla #1506710 - JSS throws ObjectNotFoundException without message
    (edewata)
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.0-11
changelog:
  - Bugzilla #1506826 - org.mozilla.jss.pkix.cms.SignerInfo incorrectly
    producing signatures (especially for EC) (cfu,dstutzman)
  - Bugzilla #1533667 - Add: standard algorithm names for all ECC signature
    types (cfu,dstutzman)
  - Bugzilla #1534761 - SignerInfo class inserts wrong version # into the
    resulting structure (cfu,dstutzman)


author: Dogtag Team <pki-devel@redhat.com> 4.4.2-12
changelog:
  - Bugzilla #1579202 - JSS has wrong encoding for ecdsa with sha*
    AlgorithmIdentifier [rhel-7.5.z] (cfu)


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-858.el7]
changelog:
  - [tools] revert perf: Fix swap for samples with raw data (Jiri Olsa) [1458228]
  - [netdrv] ibmvnic: Fix early release of login buffer (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Clean RX pool buffers during device close (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Free RX socket buffer in case of adapter error (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Fix NAPI structures memory leak (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Fix login buffer memory leaks (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Wait until reset is complete to set carrier on (Desnes Augusto Nunes do Rosario) [1545578]
  - [block] disable runtime-pm for blk-mq (Ming Lei) [1548269]
  - [mm] revert memcontrol: fix cgroup creation failure after many small jobs (Aristeu Rozanski) [1548593 1517028]
  - [mm] revert cgroup: kill css_id (Aristeu Rozanski) [1548593 1517028]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-859.el7]
changelog:
  - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430] {CVE-2017-13166}
  - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
  - [fs] Revert dcache_readdir back to ->readdir() ("Eric W. Biederman") [1525541]
  - [md] dm-raid: fix incorrect sync_ratio when degraded (Mike Snitzer) [1547979]
  - [mm] page_alloc: fix memmap_init_zone pageblock alignment (Daniel Vacek) [1525121]
  - [mm] revert kvmalloc: stress the vmalloc path in the debugging kernel (Jeff Moyer) [1550094]
  - [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1543067]
  - [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1543067]
  - [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1543067]
  - [x86] kvm: vmx: Cache IA32_DEBUGCTL in memory (Paolo Bonzini) [1537379]
  - [x86] spec_ctrl: avoid rmb() on full retpoline kernels (Paolo Bonzini) [1537379]
  - [x86] spec_ctrl: replace boot_cpu_has with a static key for IBRS checks (Paolo Bonzini) [1537379]
  - [x86] spec_ctrl: actually use static key for retpolines (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: optimize IBRS handling at vmenter/vmexit (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: mark RDMSR path as unlikely (Paolo Bonzini) [1537379]
  - [x86] kvm: use native_read_msr to read SPEC_CTRL (Paolo Bonzini) [1537379]
  - [x86] kvm/nvmx: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 MSR bitmap (Paolo Bonzini) [1537379]
  - [x86] nvmx: Properly set spec_ctrl and pred_cmd before merging MSRs (Paolo Bonzini) [1537379]
  - [x86] kvm/vmx: Allow direct access to MSR_IA32_SPEC_CTRL (Paolo Bonzini) [1537379]
  - [x86] kvm: Add IBPB support (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: make MSR bitmaps per-VCPU (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: Do not disable intercepts for BNDCFGS (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: introduce alloc_loaded_vmcs (Paolo Bonzini) [1537379]
  - [x86] kvm: nvmx: Eliminate vmcs02 pool (Paolo Bonzini) [1537379]
  - [x86] kvm: nvmx: single function for switching between vmcs (Paolo Bonzini) [1537379]
  - [x86] kvm: Update the reverse_cpuid list to include CPUID_7_EDX (Paolo Bonzini) [1537379]
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Add Intel feature bits for Speculation Control (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Paolo Bonzini) [1537379]
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Paolo Bonzini) [1537379]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-860.el7]
changelog:
  - [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
  - [fs] gfs2: fixes to "implement iomap for block_map" (Andreas Grunbacher) [1542594]
  - [x86] kvm: svm: disable virtual GIF and VMLOAD/VMSAVE (Paolo Bonzini) [1552090]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-861.el7]
changelog:
  - [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1554590]
  - [nvme] validate admin queue before unquiesce (David Milburn) [1549733]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-862.el7]
changelog:
  - [netdrv] i40e: Fix attach VF to VM issue (Stefan Assmann) [1528123]
  - [netdrv] ixgbevf: Add check for ixgbe_mbox_api_13 to ixgbevf_probe when setting max_mtu (Ken Cox) [1556696]
  - [md] dm btree: fix serious bug in btree_split_beneath() (Mike Snitzer) [1557849]
  - [x86] pti: Disable PTI user page table update in EFI virtual mode (Waiman Long) [1540061]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.1.1.el7]
changelog:
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1565700 1540061]
  - [x86] pti: Rework the UEFI data corruption fix (Waiman Long) [1565700 1540061]
  - [powerpc] tm: Flush TM only if CPU has TM feature (David Gibson) [1563773 1544676] {CVE-2018-1091}
  - [gpu] drm/i915/glk: IPC linetime watermark workaround for GLK (Lyude Paul) [1563711 1548651]
  - [x86] apic: Remove the (now) unused disable_IO_APIC() function (Baoquan He) [1563108 1521003]
  - [x86] apic: Fix restoring boot IRQ mode in reboot and kexec/kdump (Baoquan He) [1563108 1521003]
  - [x86] apic: Split disable_IO_APIC() into two functions to fix CONFIG_KEXEC_JUMP=y (Baoquan He) [1563108 1521003]
  - [x86] apic: Split out restore_boot_irq_mode() from disable_IO_APIC() (Baoquan He) [1563108 1521003]
  - [netdrv] i40e: Close client on suspend and restore client MSIx on resume (Stefan Assmann) [1563106 1538847]
  - [fs] nfs: Fix unstable write completion (Scott Mayhew) [1563103 1544647]
  - [x86] kvm: Fix device passthrough when SME is active (Suravee Suthikulpanit) [1563098 1557911]
  - [powerpc] powernv: Support firmware disable of RFI flush (Mauricio Oliveira) [1563096 1553927]
  - [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1563096 1553927]
  - [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1563096 1553927]
  - [nvme] fixup nvme_sysfs_delete() (David Milburn) [1563092 1543716]
  - [x86] smpboot: Fix uncore_pci_remove() indexing bug when hot-removing a physical CPU (Prarit Bhargava) [1563091 1527731]
  - [x86] tsc: Fix erroneous TSC rate on Skylake Xeon (Prarit Bhargava) [1563088 1466058]
  - [x86] tsc: Print tsc_khz, when it differs from cpu_khz (Prarit Bhargava) [1563088 1466058]
  - [x86] tsc: Future-proof native_calibrate_tsc() (Prarit Bhargava) [1563088 1466058]
  - [scsi] csiostor: add support for 32 bit port capabilities (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4/cxgbvf: Handle 32-bit fw port capabilities (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4vf: define get_fecparam ethtool callback (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4: ethtool forward error correction management support (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4: core hardware/firmware support for Forward Error Correction on a link (Arjun Vynipadath) [1561906 1526163]
  - [iscsi-target] Fix panic when adding second TCP connection to iSCSI session (Maurizio Lombardi) [1561900 1544670]
  - [crypto] chelsio: Fix src buffer dma length (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: Move DMA un/mapping to chcr from lld cxgb4 driver (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: Remove unused parameter (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: Remove allocation of sg list to implement 2K limit of dsgl header (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: introduce __skb_put_zero() (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: make skb_put & friends return void pointers (Arjun Vynipadath) [1561899 1548047]
  - [gpu] drm/i915/cfl: Remove alpha support protection (Rob Clark) [1561897 1464911]
  - [gpu] drm/i915/cnl: Map VBT DDC Pin to BSpec DDC Pin (Rob Clark) [1561897 1464911]
  - [gpu] drm/i915: Add retries for LSPCON detection (Rob Clark) [1561897 1464911]
  - [gpu] drm/i915: Don't give up waiting on INVALID_MODE (Rob Clark) [1561897 1464911]
  - [nvme] pci: Fix EEH failure on ppc (Mauricio Oliveira) [1561894 1558499]
  - [net] netfilter: ebtables: fix erroneous reject of last rule (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] netfilter: bridge: ebt_among: add more missing match size checks (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] netfilter: bridge: ebt_among: add missing match size checks (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] ipsec: Fix aborted xfrm policy dump crash (Bruno Eduardo de Oliveira Meneguele) [1517292 1517290] {CVE-2017-16939}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.1.el7]
changelog:
  - [md] dm: fix dropped return code from dm_get_bdev_for_ioctl (Mike Snitzer) [1567746 1562962]
  - [crypto] aesni: Add support for 192 & 256 bit keys to AESNI RFC4106 (Bruno Eduardo de Oliveira Meneguele) [1570537 1568167]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.2.el7]
changelog:
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.3.el7]
changelog:
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}


author: Akemi Yagi <toracat@centos.org> [3.10.0-862.2.3.centos.plus]
changelog:
  - Apply debranding changes
  - Roll in i686 mods
     addmissing.patch  [puias]
     cpufreq.patch  [puias]
     i386-audit-stop-scri-stack-frame.patch  [puias]
     removejiffies.patch  [puias]
     undorhirqstat.patch  [puias]
     morefixes.patch      [puias+bug#12412]
     upstream-32bit-fixes-7_5.patch [puias+bug#12412]
     clear-32bit-Werror-warnings.patch  [bug#12412]
     qspinlock_types-32bit.patch   [ay]
     i686-7-4.patch [T.Kabe, bug#13890]
     firmware-efi-32bit.patch [ay]
     patch-spec_ctrl_i686.patch [T.Kabe bug#14353]
     686 mods for 7.5 [T.Kabe bug#14703]
  - Modify config file for x86_64 with extra features turned on including
    some network adapters, BusLogic, ReiserFS, TOMOYO
  - Add in a patch that allows non-LogiTech remote to work [bug#5780]
  - JFS enabled [bug#7350]
  - NUMACHIP enabled [bug#7498]
  - AIC7xxx enabled [bug#7552]
  - Enabled via_velocity [bug#7877]
  - Add in a patch that fixes em28xx-cards [bug#8285]
  - Enabled ECRYPT_FS with a patch to fix build error [bug#7369]
  - Enabled Keyboard GPIO [bug#9063]
  - Enabled XEN_FBDEV_FRONTEND [bug#9463]
  - Enabled LINE6_USB [bug#9569]
  - Enabled I2C_MUX [bug#9592]
  - Enabled spidev [bug#9955]
  - Add a patch [bug#10447]
  - Enable ATM drivers [bug#10845]
  - Add 9pfs config options [bug#10849]
  - Enable VFIO_PCI_VGA [bug#12435]
  - Rremove initramfs-xxxkdump.img upon kernel removal [bug#12703]
  - Add a patch from [bug#12841]
  - Add a patch from [bug#12818]
  - Enabled RT2800USB_RT3573 [bug#13162]
  - Enable LDM_PARTITION [bug#13526]
  - Add a patch to fix misleading warning [bug#13990]
  - Add BuildRequires: openssl-devel to the with_perf section [bug#13990]
  - Add a patch to fix build errors for EL7.5 [bug#14425]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.1.el7]
changelog:
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573173 1571162]
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.2.el7]
changelog:
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.3.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.4.1.el7]
changelog:
  - [powerpc] msi: Fix race condition in tearing down MSI interrupts (David Milburn) [1570511 1549680]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.5.1.el7]
changelog:
  - [netdrv] vmxnet3: use correct flag to indicate LRO feature (Neil Horman) [1567771 1558685]
  - [netdrv] vmxnet3: avoid xmit reset due to a race in vmxnet3 (Neil Horman) [1567771 1558685]
  - [kernel] ib/mlx5: Respect new UMR capabilities (Alaa Hleihel) [1579847 1573661]
  - [infiniband] ib/mlx5: Enable ECN capable bits for UD RoCE v2 QPs (Alaa Hleihel) [1579847 1573661]
  - [scsi] cdrom: do not call check_disk_change() inside cdrom_open() (Maurizio Lombardi) [1579834 1538362]
  - [hid] wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events (Benjamin Tissoires) [1579192 1551776]
  - [hid] wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection (Benjamin Tissoires) [1579192 1551776]
  - [hid] wacom: generic: Send BTN_STYLUS3 when both barrel switches are set (Benjamin Tissoires) [1579191 1551783]
  - [fs] eventpoll: fix uninitialized variable in epoll_ctl (Paul Moore) [1578734 1553256]
  - [fs] nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE (Scott Mayhew) [1578458 1574002]
  - [net] sock_diag: request _diag module only when the family or proto has been registered (Xin Long) [1578272 1544898]
  - [target] Re-add missing SCF_ACK_KREF assignment in (Mike Christie) [1578048 1561851]
  - [gpu] drm/nouveau: Fix deadlock in nv50_mstm_register_connector() (Lyude Paul) [1577792 1571927]
  - [netdrv] vmxnet3: segCnt can be 1 for LRO packets (Neil Horman) [1577790 1426680]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1577767 1558325]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1577767 1558325]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1577767 1558325]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1577767 1558325]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1577767 1558325]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1577767 1558325]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1577767 1558325]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1577767 1558325]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1577767 1558325]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1577767 1558325]
  - [s390] entry.s: fix spurious zeroing of r0 (Hendrik Brueckner) [1577767 1558325]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1577767 1558325]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1577767 1558325]
  - [s390] alternative: use a copy of the facility bit mask (Hendrik Brueckner) [1577767 1558325]
  - [gpu] drm/amdgpu: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
  - [gpu] drm/radeon: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
  - [gpu] drm/nouveau: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
  - [gpu] drm: Allow determining if current task is output poll worker (Lyude Paul) [1577760 1563957]
  - [gpu] workqueue: Allow retrieval of current task's work struct (1/5) (Lyude Paul) [1577760 1563957]
  - [md] dm: remove fmode_t argument from .prepare_ioctl hook (Mike Snitzer) [1576508 1562960]
  - [md] dm: hold DM table for duration of ioctl rather than use blkdev_get (Mike Snitzer) [1576508 1562960]
  - [scsi] iscsi: respond to netlink with unicast when appropriate (Chris Leech) [1576293 1330865]
  - [netdrv] i40e: fix incorrect UP-TC mapping (Stefan Assmann) [1574371 1558159]
  - [powerpc] System reset avoid interleaving oops using die synchronisation (Mauricio Oliveira) [1574366 1564126]
  - [powerpc] Do not send system reset request through the oops path (Mauricio Oliveira) [1574366 1564126]
  - [powerpc] crash: Remove the test for cpu_online in the IPI callback (Mauricio Oliveira) [1574366 1564126]
  - [sound] hda: Fix a wrong FIXUP for alc289 on Dell machines (Jaroslav Kysela) [1571581 1548969]
  - [sound] hda: Fix headset mic detection problem for two Dell machines (Jaroslav Kysela) [1571581 1548969]
  - [firmware] fw_cfg: write vmcoreinfo details (Marc-Andre Lureau) [1571369 1533367]
  - [kernel] crash: export paddr_vmcoreinfo_note() (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: add DMA register (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: add a public uapi header (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: handle fw_cfg_read_blob() error (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: remove inline from fw_cfg_read_blob() (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warnings around FW_CFG_FILE_DIR read (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warning reading FW_CFG_ID (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warnings with fw_cfg_file (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warnings in fw_cfg_sel_endianness() (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] revert "fw_cfg: add DMA register" (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] revert "fw_cfg: do DMA read operation" (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] revert "fw_cfg: write vmcoreinfo details" (Marc-Andre Lureau) [1571369 1533367]
  - [infiniband] mlx5: Set the default active rate and width to QDR and 4X (Honggang Li) [1570536 1554535]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Josh Poimboeuf) [1570532 1558668]
  - [x86] platform/uv: Fix critical UV MMR address error (Frank Ramsay) [1570520 1562945]
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] powernv: Use the security flags in pnv_setup_rfi_flush() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] powernv: Set or clear security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] lib: seq: Add seq_buf_printf() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1570509 1561785]
  - [fs] vfs: Remove incorrect debugging WARN in prepend_path (Frank Sorenson) [1568322 1481732]
  - [fs] xfs: fix transaction allocation deadlock in IO path (Eric Sandeen) [1568320 1551111]
  - [md] support to split big bio (Ming Lei) [1568070 1557434]
  - [block] introduce bio_split2() and bio_pair2_release() (Ming Lei) [1568070 1557434]
  - [netdrv] qed: Free reserved MR tid (Harish Patil) [1568069 1554217]
  - [netdrv] qed: Free RoCE ILT Memory on rmmod qedr (Harish Patil) [1568069 1554217]
  - [net] sctp: use right member as the param of list_for_each_entry (Xin Long) [1565983 1483445]
  - [net] sctp: reset owner sk for data chunks on out queues when migrating a sock (Xin Long) [1565983 1483445]
  - [net] xfrm: policy: check policy direction value (Bruno Eduardo de Oliveira Meneguele) [1479419 1479421] {CVE-2017-11600}
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.1.el7]
changelog:
  - [x86] microcode: Load microcode on all cpus (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Attempt late loading only when new microcode is present (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Do not upload microcode if CPUs are offline (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Writeback and invalidate caches before updating microcode (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Check microcode revision before updating sibling threads (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Get rid of struct apply_microcode_ctx (Prarit Bhargava) [1578047 1568249]
  - [x86] cpu: Add a microcode loader callback (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Propagate return value from updating functions (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/amd: Change load_microcode_amd()'s param to bool to fix preemptibility bug (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Add a helper which gives the microcode revision (Prarit Bhargava) [1578047 1568249]
  - [x86] cpu: Add native CPUID variants returning a single datum (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/amd: Move private inlines to .c and mark local functions static (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Simplify generic_load_microcode() (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Do not issue microcode updates messages on each CPU (Prarit Bhargava) [1578047 1568249]
  - [kernel] pidns: Don't have unshare(CLONE_NEWPID) imply CLONE_THREAD (Oleg Nesterov) [1578997 1577745]
  - [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581045 1581036] {CVE-2018-3639}
  - [powerpc] 64s: Move the data access exception out-of-line (Mauricio Oliveira) [1581045 1581036] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.2.el7]
changelog:
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: vmx: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: svm: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Add filter flag to opt-out of SSB mitigation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] prctl: Add force disable speculation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.3.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-44.el7a]
changelog:
  - [powerpc] powerpc/mm: Flush radix process translations when setting MMU type (Laurent Vivier) [1533718]
  - [powerpc] powerpc/mm/radix: Split linear mapping on hot-unplug (Suraj Jitindar Singh) [1516201]
  - [powerpc] KVM: PPC: Book3S: Add MMIO emulation for VMX instructions (Laurent Vivier) [1537935]
  - [powerpc] KVM: PPC: Book3S HV: Make HPT resizing work on POWER9 (Laurent Vivier) [1535789]
  - [powerpc] KVM: PPC: Book3S HV: Fix handling of secondary HPTEG in HPT resizing code (Laurent Vivier) [1535789]
  - [powerpc] KVM: PPC: Book3S HV: Drop locks before reading guest memory (Laurent Vivier) [1540077]
  - [powerpc] powerpc/64s/radix: Boot-time NULL pointer protection using a guard-PID (Mauricio Oliveira) [1539109]
  - [block] blk-mq-debugfs: don't allow write on attributes with seq_operations set (Ming Lei) [1543463]
  - [fs] dcache: Revert manually unpoison dname after allocation to shut up kasan's reports (Joe Lawrence) [1539609]
  - [fs] fs/dcache: Use read_word_at_a_time() in dentry_string_cmp() (Joe Lawrence) [1539609]
  - [lib] lib/strscpy: Shut up KASAN false-positives in strscpy() (Joe Lawrence) [1539609]
  - [kernel] compiler.h: Add read_word_at_a_time() function (Joe Lawrence) [1539609]
  - [kernel] compiler.h, kasan: Avoid duplicating __read_once_size_nocheck() (Joe Lawrence) [1539609]
  - [redhat] update handling for our additional certificates ("Herton R. Krzesinski") [1539015]
  - [redhat] make CONFIG_MODULE_SIG_SHA* common through all architectures ("Herton R. Krzesinski") [1539015]
  - [redhat] remove extra_certificates file ("Herton R. Krzesinski") [1539015]
  - [fs] xfs: truncate pagecache before writeback in xfs_setattr_size() (Bill O'Donnell) [1518553]
  - [fs] autofs: revert autofs: take more care to not update last_used on path walk (Ian Kent) [1535760]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-45.el7a]
changelog:
  - [netdrv] tg3: APE heartbeat changes (Jonathan Toppins) [1545870]
  - [redhat] fix rh_get_maintainer.pl (Andrew Jones)
  - [scsi] lpfc Fix SCSI io host reset causing kernel crash (Dick Kennedy) [1540693]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-46.el7a]
changelog:
  - [powerpc] ppc needs macro for spectre v1 mitigation (Christoph von Recklinghausen) [1538186]
  - [arm64] Add missing Falkor part number for branch predictor hardening (Spectre/Meltdown) (Steve Ulrich) [1545916]
  - [s390] kernel: fix rwlock implementation (Hendrik Brueckner) [1547423]
  - [redhat] s390/configs: enable KERNEL_NOBP for s390 (Hendrik Brueckner) [1532726]
  - [s390] spinlock: add __nospec_barrier memory barrier (Hendrik Brueckner) [1532726]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1532726]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1532726]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1532726]
  - [s390] add options to change branch prediction behaviour for the kernel (Hendrik Brueckner) [1532726]
  - [s390] s390/alternative: use a copy of the facility bit mask (Hendrik Brueckner) [1532726]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1532726]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1532726]
  - [s390] enable CPU alternatives unconditionally (Hendrik Brueckner) [1532726]
  - [s390] introduce CPU alternatives (Hendrik Brueckner) [1532726]
  - [security] KEYS: Use individual pages in big_key for crypto buffers (David Howells) [1510601]
  - [powerpc] powerpc/eeh: Fix crashes in eeh_report_resume() (Gustavo Duarte) [1546028]
  - [redhat] switch secureboot kernel image signing to release keys ("Herton R. Krzesinski")
  - [redhat] RHMAINTAINERS: update power management sections (Al Stone)
  - [fs] xfs: validate sb_logsunit is a multiple of the fs blocksize (Bill O'Donnell) [1538496]
  - [kernel] bpf: prevent out-of-bounds speculation (Mark Langsdorf) [1536036]
  - [arm64] kpti: Fix the interaction between ASID switching and software PAN (Mark Langsdorf) [1536036]
  - [arm64] SW PAN: Point saved ttbr0 at the zero page when switching to init_mm (Mark Langsdorf) [1536036]
  - [arm64] Re-order reserved_ttbr0 in linker script (Mark Langsdorf) [1536036]
  - [arm64] capabilities: Handle duplicate entries for a capability (Mark Langsdorf) [1536036]


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-47.el7a]
changelog:
  - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547583] {CVE-2018-6927}


author: Herton R. Krzesinski <herton@redhat.com> [4.14.0-49.el7a]
changelog:
  - [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1555032]
  - [powerpc] KVM: PPC: Book3S HV: Fix guest time accounting with VIRT_CPU_ACCOUNTING_GEN (Laurent Vivier) [1541614]
  - [powerpc] KVM: PPC: Book3S HV: Improve handling of debug-trigger HMIs on POWER9 (Gustavo Duarte) [1548423]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.1.1.el7a]
changelog:
  - [watchdog] sbsa: use 32-bit read for WCV (Robert Richter) [1564025 1553237]
  - [nvme] nvme-pci: Fix EEH failure on ppc (David Milburn) [1563570 1554747]
  - [nvme] nvme-pci: Fix queue double allocations (David Milburn) [1561916 1555296]
  - [powerpc] mm: Fixup tlbie vs store ordering issue on POWER9 (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm/radix: Move the functions that does the actual tlbie closer (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm/radix: Remove unused code (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv: Fix kexec crashes caused by tlbie tracing (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] 64s/radix: Optimize TLB range flush barriers (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] npu-dma.c: Fix crash after __mmu_notifier_register failure (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Fix deadlock in mmio_invalidate() (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm: Workaround Nest MMU bug with TLB invalidations (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] mm: Add tracking of the number of coprocessors using a context (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Don't explicitly flush nmmu tlb (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] powernv/npu: Use flush_all_mm() instead of flush_tlb_mm() (Mauricio Oliveira) [1561915 1559636]
  - [powerpc] kvm: ppc: book3s hv: Fix duplication of host SLB entries (Gustavo Duarte) [1561914 1559812]
  - [powerpc] 64s: Fix lost pending interrupt due to race causing lost update to irq_happened (Steve Best) [1561913 1558661]
  - [redhat] fix NVMe hotplug failure on some platforms (Steve Ulrich) [1561464 1557004]
  - [powerpc] powerpc/powernv: Support firmware disable of RFI flush (Mauricio Oliveira) [1561463 1554920]
  - [powerpc] powerpc/pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1561463 1554920]
  - [powerpc] cxl: read PHB indications from the device tree (Steve Best) [1560901 1563111 1558675 1553205]
  - [powerpc] powerpc/powernv: Enable tunneled operations (Steve Best) [1560901 1563111 1558675 1553205]
  - [misc] cxl: Fix timebase synchronization status on P9 (Steve Best) [1560901 1558675]
  - [powerpc] Fix DABR match on hash based systems (Steve Best) [1560900 1552080]
  - [powerpc] KVM: PPC: Book3S HV: Fix handling of large pages in radix page fault handler (Laurent Vivier) [1560899 1549933]
  - [powerpc] powerpc/64s: Fix NULL AT_BASE_PLATFORM when using DT CPU features (Steve Best) [1560897 1555236]
  - [powerpc] KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing (Laurent Vivier) [1559874 1552768]
  - [s390] KVM: s390: take care of clock-comparator sign control (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: consider epoch index on hotplugged CPUs (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: consider epoch index on TOD clock syncs (Thomas Huth) [1559871 1555263]
  - [s390] KVM: s390: provide only a single function for setting the tod (fix SCK) (Thomas Huth) [1559871 1555263]
  - [powerpc] KVM: PPC: Book3S HV: Fix trap number return from __kvmppc_vcore_entry (Laurent Vivier) [1559870 1555068]
  - [fs] NFS: Fix unstable write completion (Scott Mayhew) [1559869 1552471]
  - [redhat] hardcode .el7a dist tag (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.2.1.el7a]
changelog:
  - [pci] PCI: Remove redundant probes for device reset support (Robert Richter) [1564026 1553226]
  - [pci] PCI: Probe for device reset support during enumeration (Robert Richter) [1564026 1553226]


author: Frantisek Hrbata <fhrbata@hrbata.com> [4.14.0-49.2.2.el7a]
changelog:
  - [perf] hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569877 1569875] {CVE-2018-1000199}


author: Johnny Hughes <johnny@centos.org> [4.14.0-49.2.2.el7a]
changelog:
  - Rolled in CentOS certificates and signed modules with a CentOS certificate.
  - Turned off CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND and turned on CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE
  - added git as buildrequirement to do patches (if/when required)


author: Joe Chapman <jochapma@redhat.com> 6.1.0.97-11
changelog:
  - Default logical size is no longer over-provisioned
  - Remove debug logging when verifying dedupe advice
  - Resolves: rhbz#1519330


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.106-11
changelog:
  - Detect journal overflow after 160E of writes
  - Clean up UDS threads when removing last VDO
  - Resolves: rhbz#1512968
  - Resolves: rhbz#1523240


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.114-11
changelog:
  - /sys/uds permissions now resticted to superuser only
  - Remove /sys/uds files that should not be used in production
  - Removing kvdo module reports version
  - VDO automatically chooses the proper write policy by default
  - Fixed a Coverity-detected error path leak
  - Resolves: rhbz#1525305
  - Resolves: rhbz#1527734
  - Resolves: rhbz#1527737
  - Resolves: rhbz#1527924
  - Resolves: rhbz#1528399


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.124-11
changelog:
  - Fixed provisional referencing for dedupe.
  - Only log a bio submission from a VDO to itself.
  - vdoformat cleans up metadata properly after fail.
  - Resolves: rhbz#1511587
  - Resolves: rhbz#1520972
  - Resolves: rhbz#1532481


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.130-12
changelog:
  - Fix General Protection Fault unlocking UDS callback mutex
  - Removing kmod-kvdo package unloads kernel module
  - Fix URL to point to GitHub tree
  - Resolves: rhbz#1510176
  - Resolves: rhbz#1533260
  - Resolves: rhbz#1539061


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.146-13
changelog:
  - Module target is now "vdo" instead of "dedupe"
  - Fixed a bug where crash recovery led to failed kernel page request
  - Improved modification log messages
  - Improved package description and summary fields
  - Resolves: rhbz#1535127
  - Resolves: rhbz#1535597
  - Resolves: rhbz#1540696
  - Resolves: rhbz#1541409


author: - Andy Walsh <awalsh@redhat.com> - 6.1.0.168-16
changelog:
  - Updated source to use GitHub
  - Fixed module version checking for upgrades.
  - Removed debug kernel requirement from spec file.
  - Fixed a deadlock resulting from sleeping while holding a spinlock while
    getting statistics.
  - Resolves: rhbz#1567742
  - Fixed bugs arising from attempts to access sysfs nodes during startup and
    shutdown.
  - Resolves: rhbz#1567744
  - Removed the prepare_ioctl() function to avoid signature changes since this
    function currently does nothing.
  - Resolves: rhbz#1572494


author: Eugene Syromiatnikov <esyr@redhat.com> 07.702.06.00_rh2_dup7.5-1
changelog:
  - 1514ac33c3e6a00c504e6e5eb0289f3c23bb8aa4
  - Resolves: #bz1578455
  - megaraid_sas module for Driver Update Program


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.32.7-3
changelog:
  - Rebase to libguestfs 1.32 in RHEL 7.3
    resolves: rhbz#1218766
  - The full tests are now run after the package has been built.
  - New tool and subpackage: virt-dib (safe diskimage-builder replacement).
  - New subpackage libguestfs-inspect-icons to reduce dependencies of main pkg
    (see https://bugzilla.redhat.com/1194158).
  - New tool: virt-get-kernel.
  - Depend on java-headless instead of full java.
  - New tool: virt-v2v-copy-to-local.
  - Disable virt-v2v subpackage on ppc64 etc
    resolves: rhbz#1287826
  - v2v: Remove VirtualBox Additions correctly
    resolves: rhbz#1296606
  - Add clearer warnings sections to all man pages
    resolves: rhbz#1293527
  - v2v: Disable the --in-place option.
  - v2v: Support conversion of Windows > 7
    resolves: rhbz#1190669
  - Add code to verify tarball signatures.
  - General performance improvements.
  - v2v: Prevent duplicate -b, -n, -oa options
    resolves: rhbz#1326266
    resolves: rhbz#1325825
  - v2v: Unquote UUID and LABEL in fstab (util-linux 1335671)
  - v2v: Fix alignment issues in treeviews in conversion dialog
    resolves: rhbz#1340407
  - p2v: spinner should be hidden when it stops spinning
    resolves: rhbz#1341564
  - p2v: ethtool command is not supported on p2v client
    resolves: rhbz#1341608
  - p2v: Add ifconfig command to ISO
    resolves: rhbz#1342447
  - p2v: Warn if virt-p2v-make-disk used on a partition
    resolves: rhbz#1342337
  - Build using OCaml with fix for CVE-2015-8869.
    resolves: rhbz#1343101
  - customize: Add --uninstall option (upstream 1343375)
  - p2v: Document permissions on id_rsa file
    resolves: rhbz#1343414
  - p2v: Print full curl error message
    resolves: rhbz#1343423
  - get-kernel: Fix --format auto
    resolves: rhbz#1341984
  - v2v: Provide better <Origin/> information to RHEV-M
    resolves: rhbz#1342398
  - customize: Give an error if --truncate-recursive path does not exist
    resolves: rhbz#1345809
  - sysprep: Add --network option so that --install option can be used
    resolves: rhbz#1345813
  - p2v: Print proper error if incorrect password is given
    resolves: rhbz#1227599
  - p2v: Print ssh error if incorrect hostname is given
    resolves: rhbz#1167916
  - p2v: Display progress of operation in non-GUI mode
    resolves: rhbz#1229386
  - p2v: Add a dialog confirming the user really means to cancel
    resolves: rhbz#1340464
  - p2v: log window should process colour escapes and backspaces
    resolves: rhbz#1314244
  - v2v: Fix installation of virtio drivers with *.dll files
    resolves: rhbz#1311373
  - p2v: Improve error message when ssh login to conversion server fails
    resolves: rhbz#1348900
  - v2v: Remove --dcpath parameter from manual
    resolves: rhbz#1315237
  - v2v: Fix conversion of guests with floppy drives
    resolves: rhbz#1309706
  - p2v: Better error when sudo requires a password
    resolves: rhbz#1340809
  - v2v: Refuse to convert if there is < 1GB free in temporary directory
    resolves: rhbz#1316479
  - inspection: Get Windows drive letters for GPT disks
    resolves: rhbz#1349237
  - p2v: Add disk utils and display serial number of disks
    resolves: rhbz#855058
  - p2v: Fix timeout error when connecting to unresponsive ssh server
    resolves: rhbz#1350363
  - Remove external dependency generator.  Use supermin RPM deps instead.
    related: rhbz#1309796
  - p2v: Flush messages to the journal immediately
    resolves: rhbz#1229386
  - customize: Fix --install on ppc64le
    resolves: rhbz#1264835
  - lib: Fix finding icons in Windows 7 64 bit guests
    resolevs: rhbz#1352761
  - v2v: Add virsh --quiet flag when running virt-v2v --quiet
    resolves: rhbz#1358142
  - lib: Fix inspection of ISOs with latest libosinfo
    resolves: rhbz#1359652
  - dib: Fix run_command exit handlers on failure
    resolves: rhbz#1362357
  - dib: Rework run of extra-data.d hooks
    resolves: rhbz#1362354
  - Miscellaneous fixes to man pages and --help output
    resolves: rhbz#1362668
  - lib: Specify backing format for read-only files
    resolves: rhbz#1354335
  - Fix --selinux-relabel option
    resolves: rhbz#1362669
  - sparsify: Fix --in-place option with UEFI guest
    resolves: rhbz#1364347
  - p2v: Use latest linux-firmware in ISO
    resolves: rhbz#1364419
  - v2v: Fix guest name when using -i disk
    resolves: rhbz#1365005
  - p2v: Fix GUI message.
  - v2v: Make fstrim message clearer
    resolves: rhbz#1366456
  - v2v: Fix conversion of UEFI guests when Secure Boot OVMF installed
    resolves: rhbz#1367615
  - lib: Fix assert-fail if port is missing in libvirt XML
    resolves: rhbz#1370424


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.3-6
changelog:
  - Rebase to libguestfs 1.36 in RHEL 7.4.
    resolves: rhbz#1359086
  - v2v: always use names for libvirt pools
    resolves: rhbz#1141631
  - v2v: correctly find GRUB in RHEL UEFI guests
  - v2v: uninstall VMware tools packages from guests
    resolves: rhbz#1155150
  - v2v: install RHEV-APT only when using -o rhev/-o vdsm
    resolves: rhbz#1161019
  - New API: btrfs-filesystem-show
    resolves: rhbz#1164765
  - p2v: always enable debugging when running virt-v2v
    resolves: rhbz#1167623
  - libguestfs prefers virtio-pci on aarch64
    resolves: rhbz#1237250
  - v2v: make sure to copy all the driver files on Windows
    resolves: rhbz#1255610
  - Better tolerate corrupted Windows hivex; bump the hivex BuildRequires and
    Requires to >= 1.3.10-5.8.el7
    resolves: rhbz#1311890
  - v2v: ignore all the environment variables for proxy when exporting from
    vCenter
    resolves: rhbz#1354507
  - virt-sysprep can deal with full-LUKS encrypted guests
    resolves: rhbz#1362649
  - All the tools have bash completion scripts.
    resolves: rhbz#1367738
  - v2v: do not remove Processor and Intelppm nodes in Windows guests
    resolves: rhbz#1372668
  - Fix SELinux relabelling in old RHEL 6 guests, by adjusting a broken
    regular expression in file_contexts file
    resolves: rhbz#1374232
  - v2v: set all the properties on creation when exporting to Glance
    resolves: rhbz#1374405
  - v2v: set hw_video_model when exporting to Glance
    resolves: rhbz#1374651
  - v2v: fix OVA conversion as root using the libvirt backend
    resolves: rhbz#1375157
  - Various improvements and fixes to the documentation
    resolves: rhbz#1377081
    resolves: rhbz#1390876
    resolves: rhbz#1398070
    resolves: rhbz#1425306
  - v2v: support <listen type='socket'> and <listen type='none'>
    resolves: rhbz#1378022
  - v2v: allow libvirt >= 2.1.0 for vCenter conversions
    resolves: rhbz#1379240
  - p2v: enable mnemonics in the GUI
    resolves: rhbz#1379289
  - Split virt-p2v, and the tools for it, in an own package: virt-p2v-maker
    resolves: rhbz#1382275
  - Correctly parse mount options in btrfs entries in /etc/fstab.
    resolves: rhbz#1383517
  - Read secrets from libvirt domains, when inspecting them
    resolves: rhbz#1392798
  - v2v: add --vdsm-compat=1.1 flag for VDSM
    resolves: rhbz#1400205
  - Fix inspection with UsrMove and /usr in a separate partition
    resolves: rhbz#1401474
  - v2v: improve import compatibility with OVAs produced by AWS
    resolves: rhbz#1402301
  - resize: allow URIs for the output disk
    resolves: rhbz#1404182
  - Disable EDD when launching the appliance
    resolves: rhbz#1404287
  - v2v: increase the memory allocated to the appliance
    resolves: rhbz#1418283
  - p2v: switch from GTK+ 2 to GTK+ 3
  - p2v: add dbus-devel as BuildRequires to disable suspension during the
    conversion
  - libguestfs-java: bump the java-headless Require to >= 1.7.0, matching the
    Build-Require, and the generated bytecode
    resolves: rhbz#1364518
  - Do not try to use/write to /var/cache/yum & /var/log/yum.log
  - Bump ocaml-findlib-devel BuildRequires to >= 1.3.3-7.el7, because of
    RHBZ#1403897
  - v2v: remove --dcpath & --dcPath from --help output too
    resolves: rhbz#1429430
  - v2v: force VNC as display for -i disk, as SDL is not supported
    resolves: rhbz#1372671
  - v2v, p2v: rename rhvm network to ovirtmgmt
    resolves: rhbz#1429491
  - v2v: when exporting to local disk, check that UEFI firmware is installed
    before conversion
    resolves: rhbz#1429506
  - dib: actually generate SHA256 checksums when using --checksum
    resolves: rhbz#1430184
  - v2v: do not mention SUSE Xen hosts as supported
    resolves: rhbz#1430203
  - v2v: depend on OVMF/AAVMF, for converting EFI guests
    resolves: rhbz#1429643
  - v2v: use absolute path when using an OVA as backing file
    resolves: rhbz#1430680
  - v2v: support Debian/Ubuntu guests
    resolves: rhbz#1387213
  - sysprep: remove DHCP_HOSTNAME entries
    resolves: rhbz#1427529
  - v2v: avoid repeated "run virt-v2v -v -x" message on error
    resolves: rhbz#1167623
  - bash-completion: add script for virt-v2v-copy-to-local
    resolves: rhbz#1367738
  - v2v: fix virtio block driver installation for Windows 10 and Windows 2016
    resolves: rhbz#1434737
  - Replace the libosinfo dependency with osinfo-db, since we are only using
    the osinfo database.
  - v2v: fix virtio driver installation for Windows 8 UEFI
    resolves: rhbz#1431579
  - v2v: new 'vmx' import method
    resolves: rhbz#1441197
  - v2v: properly identify Windows 2016 guests when exporting them to RHV-M
    resolves: rhbz#1447202
  - Run pvresize in non-interactive mode
    resolves: rhbz#1460692
  - resize: make sure the input disk is read-only
    resolves: rhbz#1463714
  - Switch qemu-kvm-rhev dependency to qemu-kvm on aarch64
    resolves: rhbz#1463646


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.10-6
changelog:
  - Rebase to libguestfs 1.36.10 in RHEL 7.5.
    resolves: rhbz#1472272
  - Build against OCaml 4.05
    resolves: rhbz#1447981
  - Enable the copyonread flag when running the appliance using libvirt.
    resolves: rhbz#1466563
  - Make sure kernel-rt is never used as Requires.
    resolves: rhbz#1471651
  - v2v: disable unconfiguration of manually installed VMware tools.
    resolves: rhbz#1477905
  - v2v: prefer pigz or pxz for uncompressing OVA files, if available
    resolves: rhbz#1448739
  - resize: handle empty UUIDs for swap partitions
    resolves: rhbz#1482737
  - v2v: remove mention of --dcpath in an error message
    resolves: rhbz#1486197
  - Disables the QEMU image file locking when opening disks as read-only
    resolves: rhbz#1417306
    resolves: rhbz#1503497
  - Briefly document the format used for URIs
    resolves: rhbz#1450325
  - v2v: deal with grub2 configurations without a default set
    resolves: rhbz#1472288
  - v2v: warn when a guest has passthrough devices
    resolves: rhbz#1472719
  - v2v: fix three regular expressions
    resolves: rhbz#1494555
  - v2v: enable conversion of full-disk LUKS-encrypted Linux guests
    resolves: rhbz#1451665
  - v2v: new 'vddk' import method
    resolves: rhbz#1477912
    resolves: rhbz#1513884
  - Enable libguestfs to work on z Systems
    resolves: rhbz#1479526
  - p2v: fx check for sudo requiring a password
    resolves: rhbz#1500673
  - v2v: handle disks with snapshots in vCenter
    resolves: rhbz#1172425
  - rescue: backport improved version
    resolves: rhbz#1438710
  - v2v: improve bootloader detection
    resolves: rhbz#1508299
  - v2v: parse MAC address of network interfaces in OVF files
    resolves: rhbz#1506572
  - Unconditionally depend on libvirt-daemon-kvm >= 3.9.0-1, which will always
    pull the right qemu-kvm too, and thus remove the unversioned dependencies
    on it
    resolves: rhbz#1500870
  - v2v: fix RPM file owned test
    resolves: rhbz#1503958
  - Do not open read-only disks using <shareable/> in the libvirt backend
    resolves: rhbz#1518517
  - v2v: handle better when grubby does not report any default kernel
    resolves: rhbz#1519204
  - v2v: enhance vmx import method to access via SSH
    resolves: rhbz#1523767
  - builder: fix caching of templates when using --cache-all-templates
    resolves: rhbz#1523650


author: Paul Wouters <pwouters@redhat.com> - 3.22-2
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555)
  - Resolves: rhbz#1372050 RFE: Support IKE and ESP over TCP: RFC 8229


author: Paul Wouters <pwouters@redhat.com> - 3.22-3
changelog:
  - Resolves: rhbz#1475434 Add support for AES-GMAC for ESP (RFC-4543) to libreswan
  - Resolves: rhbz#1300759 Implement RFC-7427 Digital Signature authentication


author: Paul Wouters <pwouters@redhat.com> - 3.22-5
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1375776 [IKEv2 Conformance] Test IKEv2.EN.R.1.2.2.1: Receipt of retransmitted CREATE_CHILD_SA reques failed
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated for libunbound syscalls]
  - Resolves: rhbz#1300763 Implement draft-ietf-ipsecme-split-dns for libreswan


author: Paul Wouters <pwouters@redhat.com> - 3.23-0.1.rc4
changelog:
  - Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [client support]
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
  - Resolves: rhbz#1492501 Reboot or 'systemctl stop ipsec' brings down _ethernet_ interfaces on _both_ ends of ipv4 ipsec tunnel
  - Resolves: rhbz#1324421 libreswan works not well when setting leftid field to be email address
  - Resolves: rhbz#1136076 After IKE rekeying Pluto sends DPD even if there is active SA


author: Paul Wouters <pwouters@redhat.com> - 3.23-2
changelog:
  - Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
  - Resolves: rhbz#1375750 SECCOMP support for libreswan [updated]


author: Paul Wouters <pwouters@redhat.com> - 3.23-4
changelog:
  - Resolves: rhbz#1573949 ipsec newhostkey fails in FIPS mode when RSA key is generated
  - Resolves: rhbz#1574456 Shared IKE SA leads to rekey interop issues
  - Resolves: rhbz#1574457 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-7
changelog:
  - conf: Add infrastructure for disk source private data XML (rhbz#1523261)
  - util: storage: Add helpers to parse and format relPath into privateData (rhbz#1523261)
  - qemu: domain: Parse and format relPath into disk source private data (rhbz#1523261)
  - qemu: remove input device after receiving the event (rhbz#1524837)
  - conf: honor maxnames in nodeListDevices API (rhbz#1528572)
  - storage: Fixing missing 'backingStore' tag from volume XML dumps. (rhbz#1529663)
  - util: add virFileReadHeaderQuiet wrapper around virFileReadHeaderFD (CVE-2017-5715)
  - util: introduce virHostCPUGetMicrocodeVersion (CVE-2017-5715)
  - cpu_x86: Rename virCPUx86MapInitialize (CVE-2017-5715)
  - conf: include x86 microcode version in virsh capabiltiies (CVE-2017-5715)
  - qemu: capabilities: force update if the microcode version does not match (CVE-2017-5715)
  - cpu: add CPU features and model for indirect branch prediction protection (CVE-2017-5715)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-8
changelog:
  - qemuDomainAttachDeviceMknodHelper: Remove symlink before creating it (rhbz#1528502)
  - RHEL: cpu: Fix EPYC-IBRS CPU model (CVE-2017-5715)
  - cpu_x86: Copy CPU signature from ancestor (rhbz#1533125)
  - qemu: Ignore fallback CPU attribute on reconnect (rhbz#1532980)
  - qemu: Fix type of a completed job (rhbz#1523036)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-9
changelog:
  - qemu: Fix crash in offline migration (rhbz#1536351)
  - Revert "qemu: monitor: do not report error on shutdown" (rhbz#1536461)
  - qemu: Refresh caps cache after booting a different kernel (rhbz#1525182)
  - qemu: Don't initialize struct utsname (rhbz#1525182)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-10
changelog:
  - storage: util: Properly ignore errors when backing volume is inaccessible (rhbz#1540022)
  - util: json: Add helper to return string or number properties as string (rhbz#1540290)
  - util: storage: Parse 'lun' for iSCSI protocol from JSON as string or number (rhbz#1540290)
  - util: Introduce virFormatIntPretty (rhbz#1289368)
  - util: Make prefix optional in virBitampString (rhbz#1289368)
  - util: Rename virBitmapString to virBitmapToString (rhbz#1289368)
  - util: Rename virBitmapDataToString to virBitmapDataFormat (rhbz#1289368)
  - util: Don't output too many zeros from virBitmapToString (rhbz#1289368)
  - util: Introduce virBitmapNewString (rhbz#1289368)
  - util: Reintroduce virBitmapSubtract (rhbz#1289368)
  - util: Introduce virBitmapShrink (rhbz#1289368)
  - conf: Sort cache banks in capabilities XML (rhbz#1289368)
  - conf: Format cache banks in capabilities with virFormatIntPretty (rhbz#1289368)
  - tests: Remove executable bits on plain data files (rhbz#1289368)
  - tests: Minor adjustments for test data (rhbz#1289368)
  - tests: Add resctrl-skx-twocaches test case to vircaps2xmltest (rhbz#1289368)
  - util: Fix leak in virStringTrimOptionalNewline (rhbz#1289368)
  - Rename virResctrlInfo to virResctrlInfoPerCache (rhbz#1289368)
  - util: Add virResctrlInfo (rhbz#1289368)
  - conf: Use virResctrlInfo in capabilities (rhbz#1289368)
  - util: Remove now-unneeded resctrl functions (rhbz#1289368)
  - fixup_resctrlinfo (rhbz#1289368)
  - resctrl: Add functions to work with resctrl allocations (rhbz#1289368)
  - conf: Add support for cputune/cachetune (rhbz#1289368)
  - tests: Add virresctrltest (rhbz#1289368)
  - qemu: Add support for resctrl (rhbz#1289368)
  - tests: Clean up and modify some vircaps2xmldata (rhbz#1289368)
  - resctl: stub out functions with Linux-only APIs used (rhbz#1289368)
  - util: Check for empty allocation instead of just NULL pointer (rhbz#1289368)
  - util: Use "resctrl" instead of "resctrlfs" spelling (rhbz#1289368)
  - util: Make it possible for virResctrlAllocSetMask to replace existing mask (rhbz#1289368)
  - util: Remove unused variable in virResctrlGetInfo (rhbz#1289368)
  - util: Don't check if entries under /sys/fs/resctrl/(info/) are directories (rhbz#1289368)
  - util: Add helpers for getting resctrl group allocs (rhbz#1289368)
  - util: Use default group's mask for unspecified resctrl allocations (rhbz#1289368)
  - util: Don't overwrite mask in virResctrlAllocFindUnused (rhbz#1289368)
  - qemu: Restore machinename even without cgroups (rhbz#1289368)
  - util: Extract path formatting into virResctrlAllocDeterminePath (rhbz#1289368)
  - qemu: Restore resctrl alloc data after restart (rhbz#1289368)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-11
changelog:
  - qemu: migration: Refresh device information after transferring state (rhbz#1463168)
  - qemuDomainRemoveMemoryDevice: unlink() memory backing file (rhbz#1461214)
  - util: Fix possible leak in virResctrlAllocMasksAssign (rhbz#1540817)
  - util: Clear unused part of the map in virBitmapShrink (rhbz#1540817)
  - tests: Add test for properly removing cachetune entries (rhbz#1540817)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-12
changelog:
  - util: Check if kernel-provided info is consistent with itself (rhbz#1540780)
  - qemu: Refresh capabilities when creating resctrl allocation (rhbz#1540780)
  - qemu: Expose rx/tx_queue_size in qemu.conf too (rhbz#1541960)
  - util: bitmap: Fix value of 'map_alloc' when shrinking bitmap (rhbz#1540817)
  - qemu: driver: Extract vcpu halted state directly (rhbz#1534585)
  - qemu: Remove unused 'cpuhalted' argument from qemuDomainHelperGetVcpus (rhbz#1534585)
  - qemu: domain: Store vcpu halted state as a tristate (rhbz#1534585)
  - qemu: Limit refresh of CPU halted state to s390 (rhbz#1534585)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.1
changelog:
  - virDomainDeviceValidateAliasForHotplug: Use correct domain defintion (rhbz#1554928)
  - conf: Check for user aliases duplicates only (rhbz#1554962)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.3
changelog:
  - qemu_cgroup: Fix 'rc' argument on virDomainAuditCgroupPath() calls (rhbz#1564996)
  - util: Introduce virStringListMerge (rhbz#1564996)
  - util: Introduce virDevMapperGetTargets (rhbz#1564996)
  - qemu_cgroup: Handle device mapper targets properly (rhbz#1564996)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.4
changelog:
  - lxc: Drop useless check in live device update (rhbz#1557922)
  - Pass oldDev to virDomainDefCompatibleDevice on device update (rhbz#1557922)
  - qemu: Fix updating device with boot order (rhbz#1557922)
  - conf: Fix crash in virDomainDefCompatibleDevice (rhbz#1557922)
  - vmx: check for present/enabled devices earlier (rhbz#1566524)
  - vmx: allocate space for network interfaces if needed (rhbz#1566524)
  - internal: add STRCASEPREFIX (rhbz#1566524)
  - vmx: convert any amount of NICs (rhbz#1566524)
  - qemu: Use dynamic buffer for storing PTY aliases (rhbz#1566525)
  - qemu: avoid denial of service reading from QEMU monitor (CVE-2018-5748) (CVE-2018-5748)
  - qemu: avoid denial of service reading from QEMU guest agent (CVE-2018-1064) (CVE-2018-1064)


author: Jiri Denemark <jdenemar@redhat.com> - 3.9.0-14.el7_5.6
changelog:
  - logging: Don't inhibit shutdown in system daemon (rhbz#1573268)
  - util: don't check for parallel iteration in hash-related functions (rhbz#1581364)
  - cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)
  - virNumaGetHugePageInfo: Return page_avail and page_free as ULL (rhbz#1582418)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-10
changelog:
  - Fix CVE-2014-6051 (integer overflow in screen size handling) (bug #1157671)
  - Fix CVE-2014-6052 (NULL pointer dereference in framebuffer setup)
    (bug #1157671)
  - Fix CVE-2014-6053 (NULL pointer dereference in ClientCutText message
    handling) (bug #1157671)
  - Fix CVE-2014-6054 (server divide-by-zero in scaling factor handling)
    (bug #1157671)
  - Fix CVE-2014-6055 (server stacked-based buffer overflow in file transfer
    handling) (bug #1157671)


author: Petr Pisar <ppisar@redhat.com> - 0.9.9-11
changelog:
  - Fix a crash in the VNC server library on connecting an IPv4 client if the
    server could not start listening on an IPv6 socket (bug #1314814)


author: Jindrich Novy <jnovy@redhat.com> 1.3.2-2
changelog:
  - ship documentation only in -doc subpackage and only license
    in -devel (#540634) - thanks to Edward Sheldrake
  - -devel-doc subpackage requires -devel


author: Ville Skyttä <ville.skytta@iki.fi> - 1:1.3.3-3
changelog:
  - Run test suite during build.
  - Fix doc file permissions and duplicate doc dir ownership.
  - rpmlint warning fixes.


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Rafael Aquini <aquini@redhat.com> - 20171011-57.gitbf04291
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - ath10k: Update to the latest firmware released version (rhbz 1457363)
  - opa: update Intel Omni-Path Architecture firmware (rhbz 1452785)
  - chelsio: Pull in the latest firmware 1.16.63.0 (rhbz 1458328)
  - qla2xxx: Update firmware version to 8.07.00 (rhbz 1427148)


author: Rafael Aquini <aquini@redhat.com> - 20171127-58.git17e6288
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - iwlwifi: Firmware update for 3160, 3168, 7260, 7265 and 7265D WIFI devices (rhbz 1508709)
  - iwlwifi: Firmware update for 8260 and 8265 WIFI devices (rhbz 1508711)
  - iwlwifi: Firmware update for 9260 and 9560 WIFI devices (rhbz 1501166)
  - Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - netr: Add Netronome TC flower firmware (rhbz 1518900)
  - Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
  - nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
  - chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: John Dennis <jdennis@redhat.com> - 0.10.0-1
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply ECP pending patches
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-2
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.10.0-3
changelog:
  - Rebase to upstream 0.10.0 release
  - Apply upstream commits post 0.10.0 release
  - Apply revised ECP pending patches,
    fix patch to pickup change in configure script that causes
    HAVE_ECP to be defined
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-1
changelog:
  - Upgrade to upstream 0.11.0 release.
  - Includes ECP support, see NEWS for all changes.
  - Update mellon_create_metadata.sh to match internally generated metadata,
    includes AssertionConsumerService for postResponse, artifactResponse &
    paosResponse.
  - Add lasso 2.5.0 version dependency
  - Resolves: #1205345


author: John Dennis <jdennis@redhat.com> - 0.11.0-2
changelog:
  - Resolves: bug #1296286
    mod_auth_mellon emits CRITICAL warning message in Apache log when doing ECP
  - Resolves: bug #1324536
    Installing mod_auth_mellon causes working Kerberos authentication
    to start failing
  - Add ECP.rst documentation file that was erroneously omitted


author: John Dennis <jdennis@redhat.com> - 0.11.0-4
changelog:
  - Resolves: rhbz#1414021 - Incorrect Content-Type header in ECP PAOS
    Rebuilding due to missing comment in Changelog


author: John Dennis <jdennis@redhat.com> - 0.13.1-1
changelog:
  - Resolves: rhbz#1481332 Upgrade to current upstream 0.13.1
  - Adds the following upstream bug fixes on top of 0.13.1:
    * ee97812 Add Mellon User Guide
    * daa5d1e If no IdP's are defined explicitly log that fact
    * c291232 Make MellonUser case-insensitive.
    * 2c2e19d Fix incorrect error check for many `lasso_*`-functions.
    * 5c5ed1d Fix segmentation fault with POST field without a value.
    * 4c924d9 Fix some log message typos
    * 93faba4 Update log msg for Invalid Destination and Invalid Audience to
      show both the expected and received values.
  - Add new mellon user guide to installed docdir


author: John Dennis <jdennis@redhat.com> - 0.13.1-2
changelog:
  - Resolves: rhbz#1553854 Add diagnostic logging
  - Add MellonSignatureMethod config option to set signature method used
    to sign SAML messages sent by Mellon. Defaults to original sha1.


author: John Dennis <jdennis@redhat.com> - 0.13.1-3
changelog:
  - Resolves: rhbz#1553854 Add diagnostic logging
  - Add README.redhat.rst doc, explains how to enable diagnostic logging


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-8
changelog:
  - mwm: do not see outline of window when moving (RHBZ#1080548)
    Clone of RHBZ#997241
  - Fixed rendering issues seen while scrolling window (RHBZ#1134365)
    (MotifZone bug #1654)


author: Thomas Woerner <twoerner@redhat.com> - 2.3.4-9
changelog:
  - Fixed motif issue while navigating drop down menus with arrow keys
    (RHBZ#1396514) (MotifZone bug #1564)


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-10
changelog:
  - Fix last commit that is actually MotifZone#1565 and removes that patch since
    it was causing more problems. Fixes MotifZone#1576.
    Resolves: rhbz#1448509


author: Carlos Soriano <csoriano@redhat.com> - 2.3.4-13
changelog:
  - Fix motifzone 1665. Motif was deactivating shorcuts in cascade menus when
    closing them by mouse.
    Resolves: RHBZ#1467303


author: Florian Müllner <fmuellner@redhat.com> - 3.26.2-7
changelog:
  - Fix crash during session saving
    Resolves: #1535080
  - Fix XWayland prevented from starting
    Resolves: #1540986


author: Carlos Garnacho <cgarnach@redhat.com> - 3.26.2-10
changelog:
  - Detect CLUTTER_TOUCHPAD_DEVICE on all Synaptics devices
    Resolves: #1499788
  - Fix tablet pressure curve configuration not being applied
    Resolves: #1543693


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-27
changelog:
  - Allow clients to use UDPv6 addresses without 'udp6:' prefix (#1326850)
  - snmpd: Speed up ipAddressTable loading. (#1327240)
  - Fixed net-snmp segfault in netsnmp_copy_fd_set_to_large_fd_set (#1327200)
  - Fixed issue with net-snmp-perl dependency on net-snmp-devel (#1438875)


author: Josef Ridky <jridky@redhat.com> - 1:5.7.2-29
changelog:
  - Move net-snmp-config from devel package to general package (#1486733)
  - Fix SCTP parser (#1329338)
  - Fix strstr() crash (#1428609)
  - Add support for TCP and UDP 64 bit counters (#1448082)
  - Fix documentation lack for includeFile, includeDir and includeSearch options (#1464485)
  - Fix wrong usage of structure iterator (#1461666)
  - Fix issue with statistics from autofs (#1501144)


author: Elio Maldonado <emaldona@redhat.com> 4.10.6-2
changelog:
  - Generic 32/64 bit platform detection (fix ppc64le build)
  - Resolves: Bug 1126243 - Ensure nspr is built for 64 bit on ppc64le


author: Elio Maldonado <emaldona@redhat.com> - 4.10.6-3
changelog:
  - Restore s390x related patch as it hasn't been applied upstream yet
  - Resolves: Bug 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269363 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297941 - Rebase RHEL 7.3 to NSS 3.21 in preparation for Firefox 45


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-3
changelog:
  - Decrease the iteration count of PKCS#12 for compatibility with Windows
  - Fix deadlock when a token is re-inserted while a client process is running


author: Daiki Ueno <dueno@redhat.com> - 3.36.0-0.1.beta
changelog:
  - Update to NSS 3.36 BETA
  - Remove upstreamed nss-softokn-3.16-add_encrypt_derive.patch
  - Remove upstreamed nss-softokn-3.28-fix-fips-login.patch
  - Remove upstreamed nss-softokn-fix-ecc-post.patch


author: Richard W.M. Jones <rjones@redhat.com> - 10.0.5-2
changelog:
  - Rebase to open-vm-tools 10.0.5 (from Fedora Rawhide)
    resolves: rhbz#1268537
  - Remove PAM calls to pam_unix2.so module
    resolves: rhbz#1313071


author: Richard W.M. Jones <rjones@redhat.com> - 10.0.5-4
changelog:
  - Fix failure to quiesce filesystem when Docker containers are running
    resolves: rhbz#1406483
  - Fix for deadlock when taking a snapshot
    resolves: rhbz#1398802


author: Richard W.M. Jones <rjones@redhat.com> - 10.1.5-1
changelog:
  - Rebase to open-vm-tools 10.1.5 from Fedora Rawhide
    resolves: rhbz#1406901
  - Enable vgauthd.
    resolves: rhbz#1269243
  - Add runtime dependency on pciutils (1388766).


author: Matus Honek <mhonek@redhat.com> - 2.4.44-10
changelog:
  - Drop update-ppolicy-schema.sh scriptlet's output (#1487857)
  - Fix issues in MozNSS compatibility layer (#1400578)
    + Force write file with fsync to avoid race conditions
    + Always filestamp both sql and dbm NSS DB variants to not rely on default DB type prefix
    + Allow missing cert and key which is a valid usecase
    + Create extraction folder only in /tmp to simplify selinux rules
    + Fix Covscan issues


author: Matus Honek <mhonek@redhat.com> - 2.4.44-11
changelog:
  - MozNSS Compat. Layer: Enable usage of NSS DB with PEM cert/key (#1525485)
    + Fix a possible invalid dereference (covscan)


author: Matus Honek <mhonek@redhat.com> - 2.4.44-12
changelog:
  - MozNSS Compat. Layer: Ensure consistency of a PEM dir before usage (#1516409)
    + Warn just before use of a PIN about key file extraction


author: Matus Honek <mhonek@redhat.com> - 2.4.44-13
changelog:
  - MozNSS Compat. Layer: fix recursive directory deletion (#1516409)
  - MozNSS Compat. Layer: fix PIN disclaimer not always shown (#1516409)
  - MozNSS Compat. Layer: fix incorrect parsing of CACertDir (#1533955)


author: Martin Preisler <mpreisle@redhat.com> - 1.2.14-2
changelog:
  - RPM probes to return not applicable on non-rpm systems (#1447629)
  - fixed sysctl tests on s390x architecture (#1447649)
  - Revert warning by default in oscap tool, our message categories are not ready for it (#1447341)


author: Jan Černý <jcerny@redhat.com> - 1.2.15-1
changelog:
  - upgrade to the latest upstream release
  - short profile names can be used instead of long IDs
  - new option --rule allows to evaluate only a single rule
  - new option --fix-type in "oscap xccdf generate fix" allows choosing
    remediation script type without typing long URL
  - "oscap info" shows profile titles
  - OVAL details in HTML report are easier to read
  - HTML report is smaller because unselected rules are removed
  - HTML report supports NIST 800-171 and CJIS
  - remediation scripts contain headers with useful information (#1439813)
  - remediation scripts report progress when they run
  - basic support for Oracle Linux (CPEs, runlevels)
  - remediation scripts can be generated from datastreams that contain
    multiple XCCDF benchmarks
  - basic support for OVAL 5.11.2 (only schemas, no features)
  - enabled offline RPM database in rpminfo probe
  - added Fedora 28 CPE
  - fixed oscap-docker with Docker >= 2.0
  - fixed behavior of sysctl probe to be consistent with sysctl tool
  - fixed generating remediation scripts
  - severity of tailored rules is not discarded
  - fixed errors in RPM probes initialization
  - oscap-docker shows all warnings reported by oscap
  - fixed pkgconfig file


author: Matěj Týč <matyc@redhat.com> - 1.2.16-1
changelog:
  - upgrade to the latest upstream release
  - moved oscap-chroot to openscap-scanner because it's a thin wrapper script with no dependencies


author: Matěj Týč <matyc@redhat.com> - 1.2.16-2
changelog:
  - moved oscap-docker to newly created openscap-containers.
  - moved man of oscap-chroot to oscap-scanner.


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-4
changelog:
  - Rebase to upstream 1a4ef7d180e77bcd6423f342d62e05e516c4e852 (1.1.18-rc4)
  - Resolves: rhbz#1381754
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-5
changelog:
  - Properly clean up primitive inside bundle
  - Scalability improvements
  - Resolves: rhbz#1499217
  - Resolves: rhbz#1508373


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-6
changelog:
  - Rebase to upstream 2b07d5c5a908998891c3317faa30328c108d3a91 (1.1.18)
  - If on-fail=ignore, migration-threshold should also be ignored
  - Resolves: rhbz#1474428
  - Resolves: rhbz#1507344


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-7
changelog:
  - Avoid node attribute write delay when corosync.conf has only IP addresses
  - Fix regressions in "pcs resource cleanup" behavior
  - Restore ordering of unfencing before fence device starts
  - Ensure --wait options work when bundles are in use
  - Fix possible invalid transition with bundle ordering constraints
  - Resolves: rhbz#1454960
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1517796
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1522822


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-10
changelog:
  - Always trigger transition when quorum changes
  - Match clone names correctly with crm_resource --cleanup
  - Fix pcs resource --wait timeout when bundles are used
  - Observe colocation constraints correctly with bundles in master role
  - Resolves: rhbz#1464068
  - Resolves: rhbz#1508350
  - Resolves: rhbz#1519812
  - Resolves: rhbz#1527072


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.1
changelog:
  - Do not schedule notifications for unrunnable actions
  - Do not expire remote failures if fencing is pending
  - Do not consider attribute order difference as CIB change in crm_diff
  - Resolves: rhbz#1563345
  - Resolves: rhbz#1566533
  - Resolves: rhbz#1568720


author: Ken Gaillot <kgaillot@redhat.com> - 1.1.18-11.3
changelog:
  - Fix regression in handling of mixed-case node names
  - Avoid multiple recovery of stonith devices
  - Resolves: rhbz#1583747
  - Resolves: rhbz#1585741


author: Ivan Devat <idevat@redhat.com> - 0.9.158-5
changelog:
  - `pcs cluster setup` uses existing pacemaker authkey if it exists
  - `pcs resource create` shows only warning when case of remote node is detected
  - Resolves: rhbz#1459503


author: Ivan Devat <idevat@redhat.com> - 0.9.158-6
changelog:
  - It is now possible to disable, enable, unmanage and manage bundle resources and set their meta attributes
  - Fixed timeout when cluster setup takes long time in web UI
  - It is now mandatory to specify container type in the "resource bundle create" command
  - Resolves: rhbz#1447910 rhbz#1284404


author: Ivan Devat <idevat@redhat.com> - 0.9.160-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1443647 rhbz#1432283 rhbz#1421702 rhbz#1443418 rhbz#1464781 rhbz#1435697 rhbz#1441673 rhbz#1420437 rhbz#1388783 rhbz#1463327 rhbz#1418199 rhbz#1341582 rhbz#1489682 rhbz#1491631 rhbz#1213946


author: Ivan Devat <idevat@redhat.com> - 0.9.161-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1499749 rhbz#1415197 rhbz#1501274 rhbz#1502715 rhbz#1230919 rhbz#1503110


author: Ondrej Mular <omular@redhat.com> - 0.9.162-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Resolves: rhbz#1389943 rhbz#1389209 rhbz#1506220 rhbz#1508351 rhbz#1415197 rhbz#1506864 rhbz#1367808 rhbz#1499749


author: Ivan Devat <idevat@redhat.com> - 0.9.162-2
changelog:
  - Changed snmp agent logfile path
  - It is now possible to set the `action` option of stonith devices in GUI by using force
  - Do not crash when `--wait` is used in `pcs stonith create`
  - A warning is displayed in `pcs status` and a stonith device detail in web UI  when a stonith device has its `method` option set to `cycle`
  - Resolves: rhbz#1367808 rhbz#1421702 rhbz#1522813 rhbz#1523378


author: Ivan Devat <idevat@redhat.com> - 0.9.162-3
changelog:
  - Pcs now properly exits with code 1 when an error occurs in pcs cluster node add-remote and pcs cluster node add-guest commands
  - Fixed a crash in the pcs booth sync command
  - Resolves: rhbz#1464781 rhbz#1527530


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5
changelog:
  - Fixed `pcs cluster auth` in a cluster when not authenticated and using a non-default port
  - Fixed `pcs cluster auth` in a cluster when previously authenticated using a non-default port and reauthenticating using an implicit default port
  - Resolves: rhbz#1415197


author: Ondrej Mular <omular@redhat.com> - 0.9.162-5.el7_5.1
changelog:
  - Fixed CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
  - Fixed CVE-2018-1079 pcs: Privilege escalation via authorized user malicious REST call
  - Fixed CVE-2018-1000119 rack-protection: Timing attack in authenticity_token.rb
  - Resolves: rhbz#1557253


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-5
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1466066 - CC: Secure removal of secret data storage
    (jmagne)
  - Bugzilla Bug #1518096 - ExternalCA: Failures in ExternalCA when tried to
    setup with CMC signed certificates (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core, and


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-6
changelog:
  - Updated jss, nuxwdog, and openssl dependencies
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    (RHEL)
  - Bugzilla Bug #1402280 - CA Cloning: Failed to update number range in
    few cases (ftweedal)
  - Bugzilla Bug #1428021 - CC: shared token storage and retrieval
    mechanism (cfu)
  - Bugzilla Bug #1447145 - CMC: cmc.popLinkWitnessRequired=false
    would cause error (cfu)
  - Bugzilla Bug #1498957 - pkidestroy does not work with nuxwdog
     (alee)
  - Bugzilla Bug #1520277 - PR_FILE_NOT_FOUND_ERROR during
    pkispawn (alee)
  - Bugzilla Bug #1520526 - p12 admin certificate is missing when
    certificate is signed Externally (edewata)
  - Bugzilla Bug #1523410 - Unable to have non "pkiuser" owned CA
     instance (alee)
  - Bugzilla Bug #1523443 - HAProxy rejects OCSP responses due to
    missing nextupdate field (ftweedal)
  - Bugzilla Bug #1526881 - Not able to setup CA with ECC (mharmsen)
  - Bugzilla Bug #1532759 - pkispawn seems to be leaving our passwords
    in several different files after installation completes (alee)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-7
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1522938 - CC: Missing faillure resumption detection and
    audit event logging at startup (jmagne)
  - Bugzilla Bug #1523410 -  Unable to have non "pkiuser" owned CA instance
    (alee)
  - Bugzilla Bug #1525306 - CC: missing CMC request and response record
    (cfu)
  - Bugzilla Bug #1532933 - Installing subsystems with external CMC
    certificates in HSM environment shows import error (edewata)
  - Bugzilla Bug #1535797 - ExternalCA: Failures when installed with hsm
    (edewata)
  - Bugzilla Bug #1539125 - restrict default cipher suite to those ciphers
    permitted in fips mode (mharmsen)
  - Bugzilla Bug #1539198 - Inconsistent CERT_REQUEST_PROCESSED
    outcomes. (edewata)
  - Bugzilla Bug #1540440 - CMC: Audit Events needed for failures in
    SharedToken scenario's (cfu)
  - Bugzilla Bug #1541526 - CMC: Revocation works with an unknown
    revRequest.issuer (cfu)
  - Bugzilla Bug #1541853 - ProfileService: config values with
    backslashes have backslashes removed (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit
    - # Bugzilla Bug #1501436 - TPS CS.cfg should be reflected with the


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-8
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1542210 - pki console configurations that involves ldap
    passwords leave the plain text password in debug logs (jmagne)
  - Bugzilla Bug #1543242 - Regression in lightweight CA key replication
    (ftweedal)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-9
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - # Bugzilla Bug #1473452 - Rebase pki-core to latest upstream 10.5.x release
    - Bugzilla Bug #1445532 - CC: Audit Events: Update the default audit event
    set (RHEL) (edewata)
  - Bugzilla Bug #1532867 - Inconsistent key ID encoding (edewata)
  - Bugzilla Bug #1540687 - CC: External OCSP Installation failure with HSM
    and FIPS (edewata)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,
    - # Bugzilla Bug #1404075 - CC: Audit Events: Update the default audit event


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-10
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1550581 - CMCAuth throws
    org.mozilla.jss.crypto.TokenException: Unable to insert certificate into
    temporary database [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1551067 - [MAN] Add --skip-configuration
    and --skip-installation into pkispawn man page. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1552241 - Make sslget aware of TLSv1_2 ciphers
    [rhel-7.5.z] (cheimes, mharmsen)
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd entry
    in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1554727 - Permit additional FIPS ciphers to be enabled
    by default for RSA . . . [rhel-7.5.z] (mharmsen, cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557883 - Console: Adding ACL from pki-console gives
    StringIndexOutOfBoundsException [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1558919 - Not able to generate certificate request
    with ECC using pki client-cert-request [rhel-7.5.z] (akahat)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-11
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1554726 - Need ECC-specific Enrollment Profiles for
    standard conformance [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1557880 - [MAN] Missing Man pages for tools
    CMCRequest, CMCResponse, CMCSharedToken [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1560233 - libtps does not directly depend on libz


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-12
changelog:
  - Updated "jss" build and runtime requirements (mharmsen)
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1571582 - [MAN] Missing Man pages for tools CMCRequest,
    CMCResponse, CMCSharedToken (typos) [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1572548 - IPA install with external-CA is failing when
    FIPS mode enabled. [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1574848 - servlet profileSubmitCMCSimple throws NPE
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1575521 - subsystem -> subsystem SSL handshake issue
    with TLS_ECDHE_RSA_* on Thales HSM [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581134 - ECC installation for non CA subsystems needs
    improvement [rhel-7.5.z] (jmagne)
  - Bugzilla Bug #1581135 - SAN in internal SSL server certificate in
    pkispawn configuration step [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581167 - CC: CMC profiles: Some CMC profiles have wrong
    input class_id [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1581382 - ECDSA Certificates Generated by Certificate System
    9.3 fail NIST validation test with parameter field. [rhel-7.5.z] (cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Dogtag Team <pki-devel@redhat.com> 10.5.1-13
changelog:
  - ##########################################################################
  - # RHEL 7.5:
  - ##########################################################################
  - Bugzilla Bug #1553068 - Using a Netmask produces an odd
    entry in a certifcate [rhel-7.5.z] (ftweedal)
  - Bugzilla Bug #1585945 - CMC CRMF requests result in
    InvalidKeyFormatException when signing algorithm is ECC
    [rhel-7.5.z] (cfu)
  - Bugzilla Bug #1587826 - ExternalCA: Installation failed during
    csr generation with ecc [rhel-7.5.z] (rrelyea, gkapoor)
  - Bugzilla Bug #1588944 - Cert validation for installation with
    external CA cert [rhel-7.5.z] (edewata)
  - Bugzilla Bug #1588945 - CRMFPopClient tool - should allow
    option to do no key archival (cfu)
  - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled
    ACL configuration in AAclAuthz.java reverses rules that allow
    and deny access [rhel-7.5.z] (ftweedal, cfu)
  - ##########################################################################
  - # RHCS 9.3:
  - ##########################################################################
  - # Bugzilla Bug #1471303 - Rebase redhat-pki, redhat-pki-theme, pki-core,


author: Java SIG <java-devel@lists.fedoraproject.org> - 0:2.2-5
changelog:
  - Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
  - Replace maven BuildRequires with maven-local


author: Mikolaj Izdebski <mizdebsk@redhat.com> - 0:2.3-1
changelog:
  - Update to upstream version 2.3
  - Use apache-commons-compress for bzip2 (de)compression
  - Resolves: CVE-2012-2098


author: Stanislav Ochotnicky <sochotnicky@redhat.com> - 0:2.4.2-2
changelog:
  - Update to latest packaging guidelines
  - Remove MIT license (only applies to test cases not binary rpm)


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-4
changelog:
  - don't use removed macro %add_to_maven_depmap (#992816)
  - lint: trim-lines, reuse %{name} macro, fedora-review fixes
  - merge cleanup changes by Stano Ochotnicky


author: Pavel Raiskup <praiskup@redhat.com> - 9.2.1002-6
changelog:
  - fix incompatibility with 9.6+ (rhbz#1547424)
  - it's unnecessary to depend on whole java (rhbz#1406931)


author: Jan Rybar <jrybar@redhat.com> - 3.3.10-10
changelog:
  - Fixes sysinfo - devices with name longer than 20 chars are mistaken for partitions
  - Resolves: rhbz#1169349


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 1.4.6-4
changelog:
  - Append python-botocore and python-jmespath bundled directories to
    search path where needed

    Resolves: rhbz#1509439


author: Andy Grover <agrover@redhat.com> - 1:1.1.fb9-1
changelog:
  - New upstream release
  - Remove dependency on python-simpleparse in favor of pyparsing
  - Remove BuildRequires


author: Maurizio Lombardi <mlombard@redhat.com> - 1:1.1.fb23-4
changelog:
  - Fix failure when parsing parameters
  - Add 0003-Fix-failing-to-pasre-par-val-parameters.patch
  - Add 0004-Fix-failing-to-pasre-param-like-cfgstr-par-val.patch


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb63-5
changelog:
  - rtslib never creates hba directories without a storage object within it,
    but if under some circumstance these existed then we should remove them.


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-148.el7
changelog:
  - kvm-multiboot-validate-multiboot-header-address-values.patch [bz#1501121]
  - kvm-qemu-option-reject-empty-number-value.patch [bz#1417864]
  - Resolves: bz#1417864
    (Qemu-kvm starts with unspecified port)
  - Resolves: bz#1501121
    (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-149.el7
changelog:
  - kvm-block-linux-aio-fix-memory-and-fd-leak.patch [bz#1491434]
  - kvm-linux-aio-Fix-laio-resource-leak.patch [bz#1491434]
  - kvm-slirp-cleanup-leftovers-from-misc.h.patch [bz#1508745]
  - kvm-Avoid-embedding-struct-mbuf-in-other-structures.patch [bz#1508745]
  - kvm-slirp-Fix-access-to-freed-memory.patch [bz#1508745]
  - kvm-slirp-fix-clearing-ifq_so-from-pending-packets.patch [bz#1508745]
  - kvm-qcow2-Prevent-backing-file-names-longer-than-1023.patch [bz#1459714]
  - kvm-qemu-img-Use-strerror-for-generic-resize-error.patch [bz#1459725]
  - kvm-qcow2-Avoid-making-the-L1-table-too-big.patch [bz#1459725]
  - Resolves: bz#1459714
    (Throw error if qemu-img rebasing backing file is too long or provide way to fix a "too long" backing file.)
  - Resolves: bz#1459725
    (Prevent qemu-img resize from causing "Active L1 table too large")
  - Resolves: bz#1491434
    (KVM leaks file descriptors when attaching and detaching virtio-scsi block devices)
  - Resolves: bz#1508745
    (CVE-2017-13711 qemu-kvm: Qemu: Slirp: use-after-free when sending response [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-150.el7
changelog:
  - kvm-Build-only-x86_64-packages.patch [bz#1520793]
  - Resolves: bz#1520793
    (Do not build non-x86_64 subpackages)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-151.el7
changelog:
  - kvm-fw_cfg-remove-support-for-guest-side-data-writes.patch [bz#1411490]
  - kvm-fw_cfg-prevent-selector-key-conflict.patch [bz#1411490]
  - kvm-fw_cfg-prohibit-insertion-of-duplicate-fw_cfg-file-n.patch [bz#1411490]
  - kvm-fw_cfg-factor-out-initialization-of-FW_CFG_ID-rev.-n.patch [bz#1411490]
  - kvm-Implement-fw_cfg-DMA-interface.patch [bz#1411490]
  - kvm-fw_cfg-avoid-calculating-invalid-current-entry-point.patch [bz#1411490]
  - kvm-fw-cfg-support-writeable-blobs.patch [bz#1411490]
  - kvm-Enable-fw_cfg-DMA-interface-for-x86.patch [bz#1411490]
  - kvm-fw_cfg-unbreak-migration-compatibility.patch [bz#1411490]
  - kvm-i386-expose-fw_cfg-QEMU0002-in-SSDT.patch [bz#1411490]
  - kvm-fw_cfg-add-write-callback.patch [bz#1411490]
  - kvm-hw-misc-add-vmcoreinfo-device.patch [bz#1411490]
  - kvm-vmcoreinfo-put-it-in-the-misc-device-category.patch [bz#1411490]
  - kvm-fw_cfg-enable-DMA-if-device-vmcoreinfo.patch [bz#1411490]
  - kvm-build-sys-restrict-vmcoreinfo-to-fw_cfg-dma-capable-.patch [bz#1411490]
  - kvm-dump-Make-DumpState-and-endian-conversion-routines-a.patch [bz#1411490]
  - kvm-dump.c-Fix-memory-leak-issue-in-cleanup-processing-f.patch [bz#1411490]
  - kvm-dump-Propagate-errors-into-qmp_dump_guest_memory.patch [bz#1411490]
  - kvm-dump-Turn-some-functions-to-void-to-make-code-cleane.patch [bz#1411490]
  - kvm-dump-Fix-dump-guest-memory-termination-and-use-after.patch [bz#1411490]
  - kvm-dump-allow-target-to-set-the-page-size.patch [bz#1411490]
  - kvm-dump-allow-target-to-set-the-physical-base.patch [bz#1411490]
  - kvm-dump-guest-memory-cleanup-removing-dump_-error-clean.patch [bz#1411490]
  - kvm-dump-guest-memory-using-static-DumpState-add-DumpSta.patch [bz#1411490]
  - kvm-dump-guest-memory-add-dump_in_progress-helper-functi.patch [bz#1411490]
  - kvm-dump-guest-memory-introduce-dump_process-helper-func.patch [bz#1411490]
  - kvm-dump-guest-memory-disable-dump-when-in-INMIGRATE-sta.patch [bz#1411490]
  - kvm-DumpState-adding-total_size-and-written_size-fields.patch [bz#1411490]
  - kvm-dump-do-not-dump-non-existent-guest-memory.patch [bz#1411490]
  - kvm-dump-add-guest-ELF-note.patch [bz#1411490]
  - kvm-dump-update-phys_base-header-field-based-on-VMCOREIN.patch [bz#1411490]
  - kvm-kdump-set-vmcoreinfo-location.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Move-constants-to-the-t.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Make-methods-functions.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Improve-python-3-compat.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Cleanup-functions.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-Introduce-multi-arch-su.patch [bz#1411490]
  - kvm-Fix-typo-in-variable-name-found-and-fixed-by-codespe.patch [bz#1411490]
  - kvm-scripts-dump-guest-memory.py-add-vmcoreinfo.patch [bz#1411490]
  - kvm-dump-guest-memory.py-fix-No-symbol-vmcoreinfo_find.patch [bz#1411490]
  - kvm-dump-guest-memory.py-fix-You-can-t-do-that-without-a.patch [bz#1411490]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-152.el7
changelog:
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-153.el7
changelog:
  - kvm-i386-update-ssdt-misc.hex.generated.patch [bz#1411490]
  - kvm-main-loop-Acquire-main_context-lock-around-os_host_m.patch [bz#1435432 bz#1473536]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
  - Resolves: bz#1435432
    (Emulated ISA serial port hangs randomly when sending lots of data from guest -> host)
  - Resolves: bz#1473536
    (Hangs in serial console under qemu)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-154.el7
changelog:
  - kvm-virtio-net-validate-backend-queue-numbers-against-bu.patch [bz#1460872]
  - kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1411490]
  - kvm-qxl-add-migration-blocker-to-avoid-pre-save-assert.patch [bz#1536883]
  - Resolves: bz#1411490
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm))
  - Resolves: bz#1460872
    (Aborted(core dumped) when booting guest with "-netdev tap....vhost=on,queues=32")
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-155.el7
changelog:
  - kvm-qdev-Fix-assert-in-PCI-address-property-when-used-by.patch [bz#1538866]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534691]
  - kvm-savevm-Improve-error-message-for-blocked-migration.patch [bz#1536883]
  - kvm-savevm-fail-if-migration-blockers-are-present.patch [bz#1536883]
  - Resolves: bz#1534691
    (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
  - Resolves: bz#1536883
    ([abrt] [faf] qemu-kvm: unknown function(): /usr/libexec/qemu-kvm killed by 6)
  - Resolves: bz#1538866
    (qemu will coredump after executing info qtree)


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7
changelog:
  - kvm-vnc-Fix-qemu-crashed-when-vnc-client-disconnect-sudd.patch [bz#1527405]
  - kvm-fix-full-frame-updates-for-VNC-clients.patch [bz#1527405]
  - kvm-vnc-update-fix.patch [bz#1527405]
  - kvm-vnc-return-directly-if-no-vnc-client-connected.patch [bz#1527405]
  - kvm-buffer-add-buffer_move_empty.patch [bz#1527405]
  - kvm-buffer-add-buffer_move.patch [bz#1527405]
  - kvm-vnc-kill-jobs-queue-buffer.patch [bz#1527405]
  - kvm-vnc-jobs-move-buffer-reset-use-new-buffer-move.patch [bz#1527405]
  - kvm-vnc-zap-dead-code.patch [bz#1527405]
  - kvm-vnc-add-vnc_width-vnc_height-helpers.patch [bz#1527405]
  - kvm-vnc-factor-out-vnc_update_server_surface.patch [bz#1527405]
  - kvm-vnc-use-vnc_-width-height-in-vnc_set_area_dirty.patch [bz#1527405]
  - kvm-vnc-only-alloc-server-surface-with-clients-connected.patch [bz#1527405]
  - kvm-ui-fix-refresh-of-VNC-server-surface.patch [bz#1527405]
  - kvm-ui-move-disconnecting-check-to-start-of-vnc_update_c.patch [bz#1527405]
  - kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527405]
  - kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527405]
  - kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527405]
  - kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527405]
  - kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527405]
  - kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527405]
  - kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527405]
  - kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527405]
  - kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527405]
  - kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527405]
  - kvm-io-skip-updates-to-client-if-websocket-output-buffer.patch [bz#1518711]
  - Resolves: bz#1518711
    (CVE-2017-15268 qemu-kvm: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
  - Resolves: bz#1527405
    (CVE-2017-15124 qemu-kvm: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.1
changelog:
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1567913]
  - kvm-vga-fix-region-calculation.patch [bz#1567913]
  - Resolves: bz#1567913
    (CVE-2018-7858 qemu-kvm: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.2
changelog:
  - kvm-i386-define-the-ssbd-CPUID-feature-bit-CVE-2018-3639.patch [bz#1574075]
  - Resolves: bz#1574075
    (EMBARGOED CVE-2018-3639 qemu-kvm: Kernel: omega-4 [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.5.3-156.el7_5.3
changelog:
  - kvm-i386-Define-the-Virt-SSBD-MSR-and-handling-of-it-CVE.patch [bz#1584363]
  - kvm-i386-define-the-AMD-virt-ssbd-CPUID-feature-bit-CVE-.patch [bz#1584363]
  - Resolves: bz#1584363
    (CVE-2018-3639 qemu-kvm: hw: cpu: AMD: speculative store bypass [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-13.el7
changelog:
  - kvm-target-ppc-Add-POWER9-DD2.0-model-information.patch [bz#1523235]
  - kvm-block-vxhs-improve-error-message-for-missing-bad-vxh.patch [bz#1505654]
  - kvm-qemu-img-Clarify-about-relative-backing-file-options.patch [bz#1451269]
  - kvm-nbd-server-CVE-2017-15119-Reject-options-larger-than.patch [bz#1518529 bz#1518551]
  - kvm-nbd-server-CVE-2017-15118-Stack-smash-on-large-expor.patch [bz#1516545 bz#1518548]
  - kvm-vfio-Fix-vfio-kvm-group-registration.patch [bz#1520294]
  - Resolves: bz#1451269
    (Clarify the relativity of backing file and created image in "qemu-img create")
  - Resolves: bz#1505654
    (Missing libvxhs share-able object  file when try to query vxhs protocol)
  - Resolves: bz#1516545
    (CVE-2017-15118 qemu-kvm-rhev: qemu NBD server vulnerable to stack smash from client requesting long export name [rhel-7.5])
  - Resolves: bz#1518529
    (CVE-2017-15119 qemu-kvm-rhev: qemu: DoS via large option request [rhel-7.5])
  - Resolves: bz#1518548
    (CVE-2017-15118 qemu-kvm-ma: Qemu: stack buffer overflow in NBD server triggered via long export name [rhel-7.5])
  - Resolves: bz#1518551
    (CVE-2017-15119 qemu-kvm-ma: qemu: DoS via large option request [rhel-7.5])
  - Resolves: bz#1520294
    (Hot-unplug the second pf cause qemu promote " Failed to remove group $iommu_group_num from KVM VFIO device:")
  - Resolves: bz#1523235
    (Pegas1.0 - qemu cpu information is not up-to-date (qemu-kvm))


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-14.el7
changelog:
  - kvm-spapr-don-t-initialize-PATB-entry-if-max-cpu-compat-.patch [bz#1525866]
  - kvm-block-avoid-recursive-AioContext-acquire-in-bdrv_ina.patch [bz#1520824]
  - kvm-io-send-proper-HTTP-response-for-websocket-errors.patch [bz#1518649]
  - kvm-io-include-full-error-message-in-websocket-handshake.patch [bz#1518649]
  - kvm-io-use-case-insensitive-check-for-Connection-Upgrade.patch [bz#1518649]
  - kvm-ui-Always-remove-an-old-VNC-channel-watch-before-add.patch [bz#1518649]
  - kvm-io-Small-updates-in-preparation-for-websocket-change.patch [bz#1518649]
  - kvm-io-Add-support-for-fragmented-websocket-binary-frame.patch [bz#1518649]
  - kvm-io-Allow-empty-websocket-payload.patch [bz#1518649]
  - kvm-io-Ignore-websocket-PING-and-PONG-frames.patch [bz#1518649]
  - kvm-io-Reply-to-ping-frames.patch [bz#1518649]
  - kvm-io-Attempt-to-send-websocket-close-messages-to-clien.patch [bz#1518649]
  - kvm-io-add-trace-events-for-websockets-frame-handling.patch [bz#1518649]
  - kvm-io-monitor-encoutput-buffer-size-from-websocket-GSou.patch [bz#1518650]
  - kvm-io-simplify-websocket-ping-reply-handling.patch [bz#1518649]
  - kvm-io-get-rid-of-qio_channel_websock_encode-helper-meth.patch [bz#1518649]
  - kvm-io-pass-a-struct-iovec-into-qio_channel_websock_enco.patch [bz#1518649]
  - kvm-io-get-rid-of-bounce-buffering-in-websock-write-path.patch [bz#1518649]
  - kvm-io-cope-with-websock-Connection-header-having-multip.patch [bz#1518649]
  - kvm-io-add-trace-points-for-websocket-HTTP-protocol-head.patch [bz#1518649]
  - kvm-io-fix-mem-leak-in-websock-error-path.patch [bz#1518649]
  - kvm-io-Add-missing-GCC_FMT_ATTR-fix-Werror-suggest-attri.patch [bz#1518649]
  - kvm-qemu.py-make-VM-a-context-manager.patch [bz#1519721]
  - kvm-iotests.py-add-FilePath-context-manager.patch [bz#1519721]
  - kvm-qemu-iothread-IOThread-supports-the-GMainContext-eve.patch [bz#1519721]
  - kvm-qom-provide-root-container-for-internal-objs.patch [bz#1519721]
  - kvm-iothread-provide-helpers-for-internal-use.patch [bz#1519721]
  - kvm-iothread-export-iothread_stop.patch [bz#1519721]
  - kvm-iothread-delay-the-context-release-to-finalize.patch [bz#1519721]
  - kvm-aio-fix-assert-when-remove-poll-during-destroy.patch [bz#1519721]
  - kvm-blockdev-hold-AioContext-for-bdrv_unref-in-external_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-external_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-drive_bac.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-blockdev_.patch [bz#1519721]
  - kvm-block-don-t-keep-AioContext-acquired-after-internal_.patch [bz#1519721]
  - kvm-iothread-add-iothread_by_id-API.patch [bz#1519721]
  - kvm-blockdev-add-x-blockdev-set-iothread-testing-command.patch [bz#1519721]
  - kvm-qemu-iotests-add-202-external-snapshots-IOThread-tes.patch [bz#1519721]
  - kvm-blockdev-add-x-blockdev-set-iothread-force-boolean.patch [bz#1519721]
  - kvm-iotests-add-VM.add_object.patch [bz#1519721]
  - kvm-iothread-fix-iothread_stop-race-condition.patch [bz#1519721]
  - kvm-qemu-iotests-add-203-savevm-with-IOThreads-test.patch [bz#1519721]
  - Resolves: bz#1518649
    (Client compatibility flaws in VNC websockets server)
  - Resolves: bz#1518650
    (CVE-2017-15268 qemu-kvm-rhev: Qemu: I/O: potential memory exhaustion via websock connection to VNC [rhel-7.5])
  - Resolves: bz#1519721
    (Both qemu and guest hang when performing live snapshot transaction with data-plane)
  - Resolves: bz#1520824
    (Migration with dataplane, qemu processor hang, vm hang and migration can't finish)
  - Resolves: bz#1525866
    (P9 to P8 guest migration fails when kernel is not started)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-15.el7
changelog:
  - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
  - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-16.el7
changelog:
  - kvm-gicv3-Convert-to-DEFINE_PROP_LINK.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Fix-the-VM-termination-in-vm_c.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Don-t-abort-on-table-save-fail.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Don-t-call-post_load-on-reset.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Implement-a-minimalist-reset.patch [bz#1513323]
  - kvm-linux-headers-Partial-header-update-against-v4.15-rc.patch [bz#1513323]
  - kvm-hw-intc-arm_gicv3_its-Implement-full-reset.patch [bz#1513323]
  - kvm-block-throttle-groups.c-allocate-RestartData-on-the-.patch [bz#1525868]
  - kvm-redhat-Fix-permissions-of-dev-kvm-on-a-freshly-boote.patch [bz#1527947]
  - Resolves: bz#1513323
    (vITS reset)
  - Resolves: bz#1525868
    (Guest hit core dump with both IO throttling and data plane)
  - Resolves: bz#1527947
    (Pegas1.1 - virsh domcapabilities doesn't report KVM capabilities on s390x)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-17.el7
changelog:
  - kvm-tools-kvm_stat-fix-command-line-option-g.patch [bz#1529676]
  - kvm-redhat-globally-limit-the-maximum-number-of-CPUs.patch [bz#1527449]
  - kvm-redhat-remove-manual-max_cpus-limitations-for-ppc.patch [bz#1527449]
  - kvm-dump-guest-memory.py-fix-You-can-t-do-that-without-a.patch [bz#1398633]
  - kvm-hw-ppc-spapr.c-abort-unplug_request-if-previous-unpl.patch [bz#1528173]
  - kvm-spapr-Correct-compatibility-mode-setting-for-hotplug.patch [bz#1528234]
  - kvm-ui-fix-dcl-unregister.patch [bz#1510809]
  - kvm-block-Open-backing-image-in-force-share-mode-for-siz.patch [bz#1526212]
  - kvm-fw_cfg-fix-memory-corruption-when-all-fw_cfg-slots-a.patch [bz#1462145]
  - kvm-block-Don-t-use-BLK_PERM_CONSISTENT_READ-for-format-.patch [bz#1515604]
  - kvm-block-Don-t-request-I-O-permission-with-BDRV_O_NO_IO.patch [bz#1515604]
  - kvm-block-Formats-don-t-need-CONSISTENT_READ-with-NO_IO.patch [bz#1515604]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1462145
    (Qemu crashes when all fw_cfg slots are used)
  - Resolves: bz#1510809
    (qemu-kvm core dumped when booting up guest using both virtio-vga and VGA)
  - Resolves: bz#1515604
    (qemu-img info: failed to get "consistent read" lock on a mirroring image)
  - Resolves: bz#1526212
    (qemu-img should not need a write lock for creating the overlay image)
  - Resolves: bz#1527449
    (qemu-kvm-ma: vCPU count should be limited to 240 on all arches)
  - Resolves: bz#1528173
    (Hot-unplug memory  during booting early stage induced qemu-kvm coredump)
  - Resolves: bz#1528234
    (Pegas1.1 Alpha: Hotplugged vcpu does not guarantee CPU P8compat mode on POWER9 host (qemu-kvm))
  - Resolves: bz#1529676
    (kvm_stat: option '--guest' doesn't work)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-18.el7
changelog:
  - kvm-serial-always-transmit-send-receive-buffers-on-migra.patch [bz#1459945]
  - kvm-hw-acpi-Move-acpi_set_pci_info-to-pcihp.patch [bz#1507693]
  - kvm-scsi-block-Add-share-rw-option.patch [bz#1518482]
  - kvm-scsi-generic-Add-share-rw-option.patch [bz#1518482]
  - kvm-target-i386-sanitize-x86-MSR_PAT-loaded-from-another.patch [bz#1529461]
  - kvm-scsi-disk-release-AioContext-in-unaligned-WRITE-SAME.patch [bz#1526423]
  - kvm-hw-pci-bridge-fix-QEMU-crash-because-of-pcie-root-po.patch [bz#1520858]
  - kvm-spapr-Capabilities-infrastructure.patch [bz#1523414]
  - kvm-spapr-Treat-Hardware-Transactional-Memory-HTM-as-an-.patch [bz#1523414]
  - kvm-spapr-Validate-capabilities-on-migration.patch [bz#1523414]
  - kvm-spapr-Handle-VMX-VSX-presence-as-an-spapr-capability.patch [bz#1523414]
  - kvm-spapr-Handle-Decimal-Floating-Point-DFP-as-an-option.patch [bz#1523414]
  - kvm-hw-ppc-spapr_caps-Rework-spapr_caps-to-use-uint8-int.patch [bz#1523414]
  - kvm-spapr-Remove-unnecessary-options-field-from-sPAPRCap.patch [bz#1523414]
  - kvm-ppc-Change-Power9-compat-table-to-support-at-most-8-.patch [bz#1529243]
  - kvm-target-ppc-Clarify-compat-mode-max_threads-value.patch [bz#1529243]
  - kvm-spapr-Allow-some-cases-where-we-can-t-set-VSMT-mode-.patch [bz#1529243]
  - kvm-spapr-Adjust-default-VSMT-value-for-better-migration.patch [bz#1529243]
  - kvm-qemu-img-info-Force-U-downstream.patch [bz#1535992]
  - kvm-dump-guest-memory.py-fix-python-2-support.patch [bz#1398633]
  - kvm-spapr-fix-device-tree-properties-when-using-compatib.patch [bz#1535752]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1459945
    (migration fails with hungup serial console reader on -M pc-i440fx-rhel7.0.0 and pc-i440fx-rhel7.1.0)
  - Resolves: bz#1507693
    (Unable to hot plug device to VM reporting libvirt errors.)
  - Resolves: bz#1518482
    ("share-rw" property is unavailable on scsi passthrough devices)
  - Resolves: bz#1520858
    (qemu-kvm core dumped when booting guest with more pcie-root-ports than available slots and io-reserve=0)
  - Resolves: bz#1523414
    ([POWER guests] Verify compatible CPU & hypervisor capabilities across migration)
  - Resolves: bz#1526423
    (QEMU hang with data plane enabled after some sg_write_same operations in guest)
  - Resolves: bz#1529243
    (Migration from P9 to P8, migration failed and qemu quit on dst end with "error while loading state for instance 0x0 of device 'ics'")
  - Resolves: bz#1529461
    (On amd hosts, after migration from rhel6.9.z to rhel7.5, CPU utilization of qemu-kvm is always more than 100% on destination rhel7.5 host)
  - Resolves: bz#1535752
    (Device tree incorrectly advertises compatibility modes for secondary CPUs)
  - Resolves: bz#1535992
    (Set force shared option "-U" as default option for "qemu-img info")


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-19.el7
changelog:
  - kvm-Drop-105th-key-from-en-us-keymap.patch [bz#1513870]
  - kvm-linux-headers-update.patch [bz#1535606]
  - kvm-s390x-kvm-Handle-bpb-feature.patch [bz#1535606]
  - kvm-s390x-kvm-provide-stfle.81.patch [bz#1535606]
  - kvm-osdep-Retry-SETLK-upon-EINTR.patch [bz#1529053]
  - kvm-vga-check-the-validation-of-memory-addr-when-draw-te.patch [bz#1534682]
  - kvm-usb-storage-Fix-share-rw-option-parsing.patch [bz#1525324]
  - kvm-spapr-disable-memory-hotplug.patch [bz#1535952]
  - Resolves: bz#1513870
    (For VNC connection, characters '|' and '<' are both recognized as '>' in linux guests, while '<' and '>' are both recognized as '|' in windows guest)
  - Resolves: bz#1525324
    (2 VMs both with 'share-rw=on' appending on '-device usb-storage' for the same source image can not be started at the same time)
  - Resolves: bz#1529053
    (Miss the handling of EINTR in the fcntl calls made by QEMU)
  - Resolves: bz#1534682
    (CVE-2018-5683 qemu-kvm-rhev: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
  - Resolves: bz#1535606
    (Spectre mitigation patches for qemu-kvm-ma on z Systems)
  - Resolves: bz#1535952
    (qemu-kvm-ma differentiation - memory hotplug)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-20.el7
changelog:
  - kvm-console-fix-dpy_gfx_replace_surface-assert.patch [bz#1505696]
  - kvm-ui-add-tracing-of-VNC-operations-related-to-QIOChann.patch [bz#1527404]
  - kvm-ui-add-tracing-of-VNC-authentication-process.patch [bz#1527404]
  - kvm-ui-remove-sync-parameter-from-vnc_update_client.patch [bz#1527404]
  - kvm-ui-remove-unreachable-code-in-vnc_update_client.patch [bz#1527404]
  - kvm-ui-remove-redundant-indentation-in-vnc_client_update.patch [bz#1527404]
  - kvm-ui-avoid-pointless-VNC-updates-if-framebuffer-isn-t-.patch [bz#1527404]
  - kvm-ui-track-how-much-decoded-data-we-consumed-when-doin.patch [bz#1527404]
  - kvm-ui-introduce-enum-to-track-VNC-client-framebuffer-up.patch [bz#1527404]
  - kvm-ui-correctly-reset-framebuffer-update-state-after-pr.patch [bz#1527404]
  - kvm-ui-refactor-code-for-determining-if-an-update-should.patch [bz#1527404]
  - kvm-ui-fix-VNC-client-throttling-when-audio-capture-is-a.patch [bz#1527404]
  - kvm-ui-fix-VNC-client-throttling-when-forced-update-is-r.patch [bz#1527404]
  - kvm-ui-place-a-hard-cap-on-VNC-server-output-buffer-size.patch [bz#1527404]
  - kvm-ui-add-trace-events-related-to-VNC-client-throttling.patch [bz#1527404]
  - kvm-ui-mix-misleading-comments-return-types-of-VNC-I-O-h.patch [bz#1527404]
  - kvm-ui-avoid-sign-extension-using-client-width-height.patch [bz#1527404]
  - kvm-ui-correctly-advance-output-buffer-when-writing-SASL.patch [bz#1527404]
  - kvm-dump-guest-memory.py-skip-vmcoreinfo-section-if-not-.patch [bz#1398633]
  - kvm-virtio-gpu-disallow-vIOMMU.patch [bz#1540182]
  - Resolves: bz#1398633
    ([RFE] Kernel address space layout randomization [KASLR] support (qemu-kvm-rhev))
  - Resolves: bz#1505696
    (Qemu crashed when open the second display of virtio video)
  - Resolves: bz#1527404
    (CVE-2017-15124 qemu-kvm-rhev: Qemu: memory exhaustion through framebuffer update request message in VNC server [rhel-7.5])
  - Resolves: bz#1540182
    (QEMU: disallow virtio-gpu to boot with vIOMMU)


author: Miroslav Rezanina <mrezanin@redhat.com> - 2.10.0-21.el7
changelog:
  - kvm-migration-Recover-block-devices-if-failure-in-device.patch [bz#1538494]
  - kvm-migration-savevm.c-set-MAX_VM_CMD_PACKAGED_SIZE-to-1.patch [bz#1540003]
  - kvm-pci-bus-let-it-has-higher-migration-priority.patch [bz#1538953]
  - kvm-spapr-set-vsmt-to-MAX-8-smp_threads.patch [bz#1542421]
  - kvm-target-ppc-spapr_caps-Add-macro-to-generate-spapr_ca.patch [bz#1532050]
  - kvm-target-ppc-kvm-Add-cap_ppc_safe_-cache-bounds_check-.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-support-for-tristate-spapr.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_cach.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_boun.patch [bz#1532050]
  - kvm-target-ppc-spapr_caps-Add-new-tristate-cap-safe_indi.patch [bz#1532050]
  - kvm-target-ppc-introduce-the-PPC_BIT-macro.patch [bz#1532050]
  - kvm-target-ppc-spapr-Add-H-Call-H_GET_CPU_CHARACTERISTIC.patch [bz#1532050]
  - kvm-spapr-add-missing-break-in-h_get_cpu_characteristics.patch [bz#1532050]
  - kvm-vfio-pci-Add-option-to-disable-GeForce-quirks.patch [bz#1508330]
  - kvm-Disable-GeForce-quirks-in-vfio-pci-for-RHEL-machines.patch [bz#1508330]
  - Resolves: bz#1508330
    (Interrupt latency issues with vGPU on KVM hypervisor.)
  - Resolves: bz#1532050
    ([CVE-2017-5754] Variant3: POWER {qemu-kvm-rhev} (rhel 7.5))
  - Resolves: bz#1538494
    (Guest crashed on the source host when cancel migration by virDomainMigrateBegin3Params sometimes)
  - Resolves: bz#1538953
    (IOTLB entry size mismatch before/after migration during DPDK PVP testing)
  - Resolves: bz#1540003
    (Postcopy migration failed with "Unreasonably large packaged state")
  - Resolves: bz#1542421
    (Pegas1.1 Snapshot1 [4.14.0-35.el7a.ppc64le] [qemu-kvm-ma-2.10.0-18.el7.ppc64le] qemu-kvm behaves incorrectly for guest boot with invalid threads)


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.1
changelog:
  - kvm-memory-inline-some-performance-sensitive-accessors.patch [bz#1554930]
  - kvm-address_space_write-address_space_to_flatview-needs-.patch [bz#1554930]
  - kvm-address_space_read-address_space_to_flatview-needs-R.patch [bz#1554930]
  - kvm-address_space_access_valid-address_space_to_flatview.patch [bz#1554930]
  - kvm-address_space_map-address_space_to_flatview-needs-RC.patch [bz#1554930]
  - kvm-address_space_rw-address_space_to_flatview-needs-RCU.patch [bz#1554930]
  - kvm-ppc-spapr-caps-Change-migration-macro-to-take-full-s.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Disallow-setting-workaround-for-spapr.patch [bz#1554957]
  - kvm-target-ppc-Check-mask-when-setting-cap_ppc_safe_indi.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Add-support-for-custom-spapr_capabili.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-cfpc-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-sbbc-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Convert-cap-ibs-to-custom-spapr-cap.patch [bz#1554957]
  - kvm-ppc-spapr-caps-Define-the-pseries-2.12-sxxm-machine-.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.5-sxxm-machine-type.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.4-sxxm-machine-type.patch [bz#1554957]
  - kvm-redhat-Define-the-pseries-rhel7.3-sxxm-machine-type.patch [bz#1554957]
  - Resolves: bz#1554930
    (incorrect locking (possible use-after-free) with bug 1481593 fix [rhel-7.5.z])
  - Resolves: bz#1554957
    ([CVE-2017-5754] Variant3: POWER {qemu-kvm-ma} Add machine type variants [rhel-7.5.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - ma-2.10.0-21.el7_5.2
changelog:
  - kvm-block-Fix-flags-in-reopen-queue.patch [bz#1557206]
  - kvm-iotests-Add-regression-test-for-commit-base-locking.patch [bz#1557206]
  - kvm-vga-add-ram_addr_t-cast.patch [bz#1566878]
  - kvm-vga-fix-region-calculation.patch [bz#1566878]
  - Resolves: bz#1557206
    ([Regression] Cannot delete VM's snapshot [rhel-7.5.z])
  - Resolves: bz#1566878
    (CVE-2018-7858 qemu-kvm-ma: Qemu: cirrus: OOB access when updating vga display [rhel-7] [rhel-7.5.z])


author: Jarod Wilson <jarod@redhat.com> 13-6
changelog:
  - Clean up htonll/ntohll handling for opa-ff/infiniband-diags compile
  - Add necessary Provides/Obsoletes for old -static packages
  - Remove ibverbs providers that we aren't currently able to support
  - Resolves: rhbz#1453096, rhbz#1451607


author: Jarod Wilson <jarod@redhat.com> 15-2
changelog:
  - Fix ibacm segfault and improper multicast handling
  - Resolves: rhbz#1502745
  - Resolves: rhbz#1502759


author: Honggang Li <honli@redhat.com> 15-3
changelog:
  - srp_daemon: Don't create async_ev_thread if only run once
  - srp_daemon: Remove unsupported systemd configurations
  - srp_daemon: Start srp_daemon service after network target
  - Resolves: bz1525193
  - Resolves: bz1528671


author: Jarod Wilson <jarod@redhat.com> 15-4
changelog:
  - Add support for extended join multicast API in librdmacm
  - Add support for striding RQ on mlx5
  - Resolves: rhbz#1515487, rhbz#1516571


author: Jarod Wilson <jarod@redhat.com> 15-5
changelog:
  - libmlx4: report RSS caps for improved DPDK support
  - Fix double mutex unlock in iwpmd
  - Resolves: rhbz#1527350
  - Resolves: rhbz#1542362


author: Jarod Wilson <jarod@redhat.com> 15-7
changelog:
  - i40iw: revoke systemd udev rules auto-load on i40e hardware, due to
    causing problems with suspend and resume, and fall back to load via
    systemd rdma initscript.
  - Resolves: rhbz#1568325


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-8
changelog:
  RHEL 7.4 ERRATUM
  - added dependency automake autoconf libtool due to yum-builddep
  - reenable omruleset module
    resolves: rhbz#1431615
    resolves: rhbz#1428403
    resolves: rhbz#1427821(fix regression, failed QA)
    resolves: rhbz#1432069
  - resolves: rhbz#1165236
    resolves: rhbz#1419228
    resolves: rhbz#1431616 
    resolves: rhbz#1196230(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-9
changelog:
  RHEL 7.4 ERRATUM
  - added autoreconf call
  - added patch to replace gethostbyname with getaddrinfo call
    resolves: rhbz#1056548(failed QA)


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-10
changelog:
  RHEL 7.4 ERRATUM
  - edited patches Patch19 and Patch21
    resolves: rhbz#1419228(coverity scan problems)
    resolves: rhbz#1056548(failed QA, coverity scan problems)


author: Radovan Sroka <rsroka@redhat.com> - 8.24.0-11
changelog:
  RHEL 7.4 ERRATUM
  - added new patch that backports num2ipv4 due to rhbz#1427821
    resolves: rhbz#1427821
  - enable pmrfc3164sd module
    resolves: rhbz#1431616


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-13
changelog:
  RHEL 7.5 ERRATUM
  - added patch to properly resolve FQDN
    resolves: rhbz#1401456
  - added documentation patch correcting qeues default values
    resolves: rhbz#1459896
  - added patch adjusting log level of journal reloaded msg
    resolves: rhbz#1497985 
  - added patch to prevent crash with invalid set statement
    this also obsoletes patch2 (for 1188503) 
    resolves: rhbz#1462160
  - added patch with nullptr check to prevent ABRT
    resolves: rhbz#1488186


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-14
changelog:
  RHEL 7.5 ERRATUM
  - renamed patch for undocumented recover_qi script to correct bz number
    resolves: rhbz#1507028
  - added patch ensuring relp conneciton is active before closing it
    resolves: rhbz#1505103


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-15
changelog:
  RHEL 7.5 ERRATUM
  - made rsyslog-doc noarch and fixed search on doc regeneration
    resolves: rhbz#1507028


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16
changelog:
  RHEL 7.5 ERRATUM
  - edited the patch to conform to latest upstream doc
    resolves: rhbz#1459896 (failedQA)
  - disabled 32-bit builds on all arches as they are not shipped
    anymore in RHEL7


author: Jiri Vymazal <jvymazal@redhat.com> - 8.24.0-16.5
changelog:
  RHEL 7.5.z ERRATUM
  - fixed imjournal duplicating msgs under some conditions
    resolves: rhbz#1545582


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-1
changelog:
  - Update to upstream release 0.1.36
  - Introduction of SCAP Security Guide Test Suite
  - Better alignment of RHEL6 and RHEL7 with DISA STIG
  - Remove JBoss EAP5 content due to being End-of-Life
  - New STIG Profile for JBOSS EAP 6
  - Updates in C2S Profile for RHEL 7
  - Variables can be directly tailored in Ansible roles
  - Content presents less false positives in containers
  - Changes in directory layout


author: Matěj Týč <matyc@redhat.com> - 0.1.36-5
changelog:
  - Patched not to check library ownership in libexec.
  - Patched to fix title of DISA STIG profile.
  - Patched to deprecate RhostsRSAAuthentication.
  - Patched to fix umask_for_daemons.


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-7
changelog:
  - Fix sshd_required unset (RHBZ#1522956)
  - Fix missing bash remediation functions include (RHBZ#1524738)
  - Fix empty columns in SRG HTML Table (RHBZ#1531105)
  - Fix reference to oudated PAM config manual (RHBZ#1447760)


author: Watson Yuuma Sato <wsato@redhat.com> - 0.1.36-8
changelog:
  - Allow AIDE to notify other emails than only root (RHBZ#1571315)
  - Fix some failing rules from profiles PCI-DSS, DISA STIG and USGCB (RHBZ#1571312)
  - Fix kernel module loading rules (RHBZ#1571319)


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-186
changelog:
  - Allow virt_domains to acces infiniband pkeys.
  Resolves: rhbz#1533183
  - Label /usr/libexec/ipsec/addconn as ipsec_exec_t to run this script as ipsec_t instead of init_t
  Resolves: rhbz#1535133
  - Allow audisp_remote_t domain write to files on all levels
  Resolves: rhbz#1534924


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-187
changelog:
  - Allow openvswitch_t domain to read cpuid, write to sysfs files and creating openvswitch_tmp_t sockets
  Resolves: rhbz#1535196
  - Add new interface ppp_filetrans_named_content()
  Resolves: rhbz#1530601
  - Allow keepalived_t read sysctl_net_t files
  Resolves: rhbz#1477542
  - Allow puppetmaster_t domtran to puppetagent_t
  Resolves: rhbz#1376893
  - Allow kdump_t domain to read kernel ring buffer
  Resolves: rhbz#1540004
  - Allow ipsec_t domain to exec ifconfig_exec_t binaries.
  Resolves: rhbz#1539416
  - Allow unconfined_domain_typ to create pppd_lock_t directory in /var/lock
  Resolves: rhbz#1530601
  - Allow updpwd_t domain to create files in /etc with shadow_t label
  Resolves: rhbz#1412838
  - Allow iptables sysctl load list support with SELinux enforced
  Resolves: rhbz#1535572


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-188
changelog:
  - Allow svirt_domain to create socket files in /tmp with label svirt_tmp_t
  Resolves: rhbz#1540702
  - Allow keepalived_t domain getattr proc filesystem
  Resolves: rhbz#1477542
  - Rename svirt_sandbox_file_t to container_file_t and svirt_lxc_net_t to container_t
  Resolves: rhbz#1538544
  - Allow ipsec_t nnp transistions to domains ipsec_mgmt_t and ifconfig_t
  Resolves: rhbz:#1539416
  - Allow systemd_logind_t domain to bind on dhcpd_port_t,pki_ca_port_t,flash_port_t
  Resolves: rhbz#1479350


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-189
changelog:
  - Allow dirsrv_t domain to create tmp link files
  Resolves: rhbz#1536011
  - Label /usr/sbin/ldap-agent as dirsrv_snmp_exec_t
  Resolves: rhbz#1428568
  - Allow ipsec_mgmt_t execute ifconfig_exec_t binaries
  - Allow ipsec_mgmt_t nnp domain transition to ifconfig_t
  Resolves: rhbz#1539416


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-190
changelog:
  - Allow openvswitch domain to manage svirt_tmp_t sock files
  Resolves: rhbz#1540702
  - Fix broken systemd_tmpfiles_run() interface


author: Lukas Vrabec <lvrabec@redhat.com> - 3.13.1-192
changelog:
  - Label /usr/libexec/dbus-1/dbus-daemon-launch-helper  as dbusd_exec_t to have systemd dbus services running in the correct domain instead of unconfined_service_t if unconfined.pp module is enabled.
  Resolves: rhbz#1546721


author: Pavel Moravec <pmoravec@redhat.com> = 3.4-7
changelog:
  - [openstack plugins] Tripleo specific containerized services
    Resolves: bz1463635
  - [jars] Scan only /usr/{share,lib}/java by default
    Resolves: bz1482574
  - [gluster_block] Added new plugin gluster_block
    Resolves: bz1491964


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-2
changelog:
  - [vdo] revise collected files
    Resolves: bz1509079
  - further updates to OSP plugins in containerized environment
    Resolves: bz1506908
  - [opendaylight] new plugin
    Resolves: bz1483414
  - collect all keystone domains
    Resolves: bz1491042
  - haproxy, etcd and docker tracebacks
    Resolves: bz1519267
  - [origin] fix typo in oc adm diagnostics
    Resolves: bz1463509
  - [postgresql] Call SCL pg_dump with proper path
    Resolves: bz1494420


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-4
changelog:
  - [pcp] really apply sizelimit to logs collected
    Resolves: bz1353873
  - [opendaylight] collect more logs and puppet config
    Resolves: bz1483414
  - [plugins] allow add_cmd_output to collect binary output
    Resolves: bz1494420
  - [openstack_ironic] collect drivers, ports and much more
    Resolves: bz1517767
  - [openstack_cinder] check for api service running
    Resolves: bz1506908


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-5
changelog:
  - [rabbitmq] Log collection when run in containerized OSP
    Resolves: bz1525620
  - [ipa] add KRA logs and correct PKI directories
    Resolves: bz1535390
  - [opendaylight] Enable plugin by puppet-opendaylight package
    Resolves: bz1483414
  - [etcd] Do not collect private etcd keys
    Resolves: bz1539038


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-7
changelog:
  - [kernel] Disable gathering /proc/timer* statistics
    Resolves: bz1568884
  - [openstack_octavia] Add new plugin
    Resolves: bz1568882
  - [ovirt-provider-ovn] A new plugin
    Resolves: bz1568960


author: Pavel Moravec <pmoravec@redhat.com> = 3.5-8
changelog:
  - [docker] backport three container related patches
    Resolves: bz1580526
  - [ovn] add two OpenVSwitch plugins
    Resoles: bz1580525


author: Christophe Fergeau <cfergeau@redhat.com> 0.12.8-3
changelog:
  - Prevent potential buffer/integer overflows with invalid MonitorsConfig messages
    sent from an authenticated client
    Resolves: CVE-2017-7506


author: Christophe Fergeau <cfergeau@redhat.com> - 0.14.0-2.3
changelog:
  - Revert back to spice 0.12 behaviour where QXL guest resources for cursor
    commands are only released when the current cursor is replaced. This avoids
    a QEMU regression causing crashes during migration
    Resolves: rhbz#1572489


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-2
changelog:
  - Add missing patch for rebase
    Resolves: rhbz#1402474
  - Add obsoletes to the spec file to ease updates
    Resolves: rhbz#1432776
  - Fix black screen in virt-manager
    Resolves: rhbz#1433242
  - Make connection error message more clear
    Resolves: rhbz#1365736


author: Victor Toso <victortoso@redhat.com> - 0.33-3
changelog:
  - Avoid CRITICALs on copy-paste
    Resolves: rhbz#1440096
  - Avoid assertions on file-xfer while agent disconnects
    Related: rhbz#1440096


author: Pavel Grunt <pgrunt@redhat.com> - 0.33-4
changelog:
  - Make connection error message more clear
    Resolves: rhbz#1365736
  - Improve audio debug
    Resolves: rhbz#1436249
  - Fix wrong encoding of transferred files
    Resolves: rhbz#1440206


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-15
changelog:
  - Resolves: rhbz#1517971 - AD Domain goes offline immediately during
                             subdomain initialization - IPA AD Trust
  - Related: rhbz#1482555 - sysdb index improvements - missing ghost
                            attribute indexing, unneeded objectclass index
                            etc..
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]
  - Resolves: rhbz#1527149 - AD provider - AD BUILTIN groups are cached with
                             gidNumber = 0
  - Related: rhbz#1461899 - Loading enterprise principals doesn't work with
                            a primed cache
  - Related: rhbz#1473571 - ipa-extdom-extop plugin can exhaust DS worker
                            threads


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-16
changelog:
  - Resolves: rhbz#1538643 - SSSD crashes when retrieving a Desktop Profile
                             with no specific host/hostgroup set
  - Related: rhbz#1441908 - SELINUX: Use getseuserbyname to get IPA seuser
  - Related: rhbz#1327705 - [RFE] Automatic creation of user private groups
                            on RHEL clients joined to AD via sssd [RHEL 7]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-17
changelog:
  - Resolves: rhbz#1523282 - sssd used wrong search base with wrong AD
                             server


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-18
changelog:
  - Resolves: rhbz#1543348 - sssd_be consumes more memory on RHEL 7.4 systems.
  - Resolves: rhbz#1544943 - sssd goes offline when renewing expired ticket


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.1
changelog:
  - Resolves: rhbz#1570527 - memory management issue in the sssd_nss_ex interface can cause the ns-slapd process on IPA server to crash [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.2
changelog:
  - Resolves: rhbz#1579703 - crash in nss_protocol_fill_netgrent. sssd_nss[19234]: segfault at 80 ip 000055612688c2a0 sp 00007ffddf9b9cd0 error 4 in sssd_nss[55612687e000+39000] [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.4
changelog:
  - Resolves: rhbz#1580281 - Samba can not register sss idmap module because it's using an outdated SMB_IDMAP_INTERFACE_VERSION [rhel-7.5.z]


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.16.0-19.5
changelog:
  - Resolves: rhbz#1583746 - The SSSD IPA provider allocates information about external groups on a long lived memory context, causing memory growth of the sssd_be process [rhel-7.5.z]


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-5
changelog:
  - RHEL 7.4 erratum
  - added doc patch about sudo lookup issue
    Resolves: rhbz#1293306
  - added test suite patch
    Resolves: rhbz#1360687
  - fixed use after free fqdn problem
    Resolves: rhbz#1360687


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.19p2-7
changelog:
  - RHEL 7.4 erratum
  - added patch to fix output truncation (in some cases) when log_output
    option is enabled
    Resolves: rhbz#1454571


author: Jakub Jelen <jjelen@redhat.com> - 1.8.19p2-8
changelog:
  - RHEL 7.4 erratum
  - Fixes CVE-2017-1000367: Privilege escalation in via improper get_process_ttyname() parsing
    Resolves: rhbz#1455402


author: Radovan Sroka <rsroka@redhat.com> - 1.8.19p2-9
changelog:
  - RHEL 7.4 erratum
  - removed patch for output truncation (1454571) which introduced regression
    Resolves: rhbz#1360687


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-12
changelog:
  - RHEL 7.5 erratum
  - Fixed exit codes for `sudo -l -U <user>`
  - Fixed truncated output when log_output is enabled
  - Updated use_pty and IO logging manpage

    Resolves: rhbz#1458696
    Resolves: rhbz#1454571
    Resolves: rhbz#1490358

  - Fixed second pass LDAP filter expression in the sudoers ldap backend
    - inclomplete patch for rhbz#1485397


author: Radovan Sroka <rsroka@redhat.com> 1.8.19p2-13
changelog:
  - RHEL 7.5 erratum
  - Fixed sudo -l checking results whether user should be authenticated
  - Enabled LDAP filter patch
  - Fixed double free in sssd

    Resolves: rhbz#1505409
    Resolves: rhbz#1511850
    Resolves: rhbz#1518104


author: David Smith <dsmith@redhat.com> - 3.1-3
changelog:
  - Added patches for:
  - rhbz1425568 task_dentry_path() fix
  - rhbz1431263 arm64 hardware breakpoint crash fix
  - rhbz1430828 replace task_exe_file() with current_exe_file()
  - rhbz1436845 adapt stapdyn to the dyninst 9.3.1 library search model
  - rhbz1433391 workaround parser issue in nfs_proc.stp
  - rhbz1428120 update lookup_bad_addr()


author: Frank Ch. Eigler <fche@redhat.com> - 3.2-3
changelog:
  - rhbz1506230 (netif_receive_skb_internal probing)
  - rhbz1490862 (f2fs tracepoint header workarounds)


author: Maurizio Lombardi <mlombard@redhat.com> - 2.1.fb46-4
changelog:
  - Properly detect errors when writing backup files. (Closes: #80) (#81)
  - Read number of backup files to keep from file
  - config: defend on '/etc/target/backup' directory
  - config: backup when current config is different from recent backup copy
  - config: rename key 'kept_backups' as 'max_backup_files'
  - backup: global option to tune max no. of backup conf files


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a.
    - Mongolia no longer observes DST. (BZ #1425214)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1414829)


author: Patsy Franklin <pfrankli@redhat.com> - 2017c-1
changelog:
  - Rebase to tzdata-2017c.
    - Northern Cyprus will revert to using EQ rules on October 29, 2017.
    - Sudan will switch from +03 to +02 on November 1, 2017.
    - Tonga will not change it's clocks on Novemeber 5, 2017 ending it's
      experiment with DST.
    - Fiji DST will end on January 14, 2018 rather than January 21, 2018.
    - Namibia - starting September 3, 2017 switches from +)1 with DST to
      +02 all year.  This change takes effect April 1, 2018.
    - Turks & Caicos changes from -04 all year to -05 with US DST starting
      on March 11, 2018.  Effective change date is November 4, 2018. 
    - tzdata now includes two text versions of the time zone data - tzdata.zi
      and leapseconds. 
    - Includes two patches to deal with build issues.


author: Patsy Franklin <pfrankli@redhat.com> - 2018b-1
changelog:
  - Rebase to tzdata-2018b
    - São Tomé and Príncipe changed from +00 to +01 on January 1, 2018
    - Brazil's DST will start on the first Sunday in November
    - Irish standard time is in the summer now, not the winter.
    - Support for the new zic -t option.
    - Add back pacificnew file omitted in tzdata-2018a


author: Patsy Franklin <pfrankli@redhat.com> - 2018d-1
changelog:
  - Rebase to tzdata-2018d
    - DST for Asia/Gaza and Asia/Hebron has changed from March 31 to March 24.
    - Antarctica/Casey station changed to UTC+8 on March 11.


author: Patsy Franklin <pfrankli@redhat.com> - 2018e-2
changelog:
  - Rebase to tzdata-2018e
    - North Korea changed from UTC+8:30 to UTC+9 on May 5, 2018.
    - In this update, the upstream project now defaults to using
      the "vanguard" data implementation which includes negative DST offsets.
      However, we are continuing to provide the "rearguard" format
      for data which does not use negative DST offsets to provide
      better compatibility with existing tools.  We intend to transition
      to the "vanguard" data implementation in the future.


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.97-13
changelog:
  - Remove vdo --noRun option
  - Clean up vdo error handling
  - Prevent python stack traces on vdo errors
  - Add more bounds checking to indexMem
  - Resolves: rhbz#1508544
  - Resolves: rhbz#1508918
  - Resolves: rhbz#1520991
  - Resolves: rhbz#1522754


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.106-13
changelog:
  - Handle bogus --confFile and --logfile arguments
  - Produce more informative vdo manager high-level help
  - Generate command-specific unrecognized argument messages
  - Resolves: rhbz#1520927
  - Resolves: rhbz#1522750
  - Resolves: rhbz#1525560


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.114-14
changelog:
  - VDO automatically chooses the proper write policy by default
  - Package uninstall removes vdo.service symlinks
  - Resolves: rhbz#1525305
  - Resolves: rhbz#1531047


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.130-15
changelog:
  - vdo growLogical by less than 4K gives correct error
  - Fix URL to point to GitHub tree
  - Resolves: rhbz#1532653
  - Resolves: rhbz#1539059


author: - Joseph Chapman <jochapma@redhat.com> - 6.1.0.146-16
changelog:
  - VDO start command now does index memory checking
  - Module target is now "vdo" instead of "dedupe"
  - VDO remove with no device no longer puts a spurious file in /dev
  - ANsible module no longer fails on modification operations
  - Resolves: rhbz#1510567
  - Resolves: rhbz#1530358
  - Resolves: rhbz#1535597
  - Resolves: rhbz#1536214


author: - Andy Walsh <awalsh@redhat.com> - 6.1.0.168-17
changelog:
  - Updated source to use GitHub
  - Fixed bug where VDO would always be created with a dense index even when
    a sparse index was requested.
  - Resolves: rhbz#1572496


author: Christopher Snyder <csnyder@redhat.com> 0.20-1
changelog:
  - 1389729: Add missing xml section for test (fran@caosdigital.com)
  - 1389729: virt-who incorrectly reports 'name' instead of 'hostname' for RHEV
    hosts (fran@caosdigital.com)
  - 1450747: Continue running destination threads on internal failure
    (csnyder@redhat.com)
  - 1444718: Log name of config when duplicate reports are retrieved
    (csnyder@redhat.com)
  - 1447264: Keep running on InvalidPasswordFormat given other valid configs
    (csnyder@redhat.com)
  - 1448267: Fix polling behavior for oneshot, CTRL-C, 429 responses
    (csnyder@redhat.com)
  - 1369107: Update docs and log messages to show the *.conf requirement
    (csnyder@redhat.com)
  - 1436517: Fix api base detection for rhevm version 3 and 4
    (csnyder@redhat.com)
  - 1442337: Send updates immediately the first run (csnyder@redhat.com)
  - Do not join threads not started, fix up fake backend (csnyder@redhat.com)
  - 1439317: Ensure reports are still sent despite duplicate configurations
    (csnyder@redhat.com)
  - DestinationThreads now send all reports (csnyder@redhat.com)
  - Adds IntervalThread base class and refactors Virt classes
    (csnyder@redhat.com)
  - Remove reference to nonexistant method _set_option (csnyder@redhat.com)
  - Update ConfigManager to produce destination and source mappings.
    (csnyder@redhat.com)
  - Implemements a threadsafe datastore (csnyder@redhat.com)
  - Move from using processes to threads (csnyder@redhat.com)
  - 1436517: Set Version header for version detect (pcreech@redhat.com)
  - 1403640: Fix syntax error in exception handling (pcreech@redhat.com)
  - Update the spec file for builds on more downstream platforms
    (csnyder@redhat.com)
  - Add releaser for rhel-7.4 (khowell@redhat.com)
  - 1391512: Handle utf-8 within Xmlrpc transport (pcreech@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.20.2-1
changelog:
  - 1458184: better reading of environment variables (jhnidek@redhat.com)
  - 1401867: Enable logging of rhsm module to rhsm.log (jhnidek@redhat.com)
  - 1404117: Check parameter consistency and refactoring (jhnidek@redhat.com)
  - Adds a patch number to virt-who versioning (csnyder@redhat.com)
  - 1401420: xen supports only uuid/hostname as hypervisor_id
    (jhnidek@redhat.com)
  - 1458674: Update use of result data to match the new async api
    (csnyder@redhat.com)
  - 1452436: virt-who prints host-to-quest mapping everytime (jhnidek@redhat.com)
  - 1357761: Do not check passwords to be in latin1 encoding (jhnidek@redhat.com)
  - 1457101: Continue running despite malformed configs (csnyder@redhat.com)
  - 1409984: Retry initial report retrieval on connection timeout
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.0-1
changelog:
  - Update hypervisorCheckInAsync test for new config sections
    (csnyder@redhat.com)
  - Update Config Refactor with changes from master (csnyder@redhat.com)
  - Removed usage of old Config (not unit tests) (jhnidek@redhat.com)
  - Further clean up of unit tests (jhnidek@redhat.com)
  - Create Xen Config Subclass (jhnidek@redhat.com)
  - Create Rhevm Config Subclass (jhnidek@redhat.com)
  - Create VDSM config subclass (wpoteat@redhat.com)
  - Clean up ConfigSection Unit tests (jhnidek@redhat.com)
  - Adds FakeVirtConfigSection (csnyder@redhat.com)
  - Configuration subclass for hyperv (wpoteat@redhat.com)
  - Implement EsxConfigSection (khowell@redhat.com)
  - Libvirtd ConfigSection Subclass (jhnidek@redhat.com)
  - Adds EffectiveConfig, ConfigSection (csnyder@redhat.com)
  - Adds warning message for deprecated env vars (csnyder@redhat.com)
  - 1503700: Updates to the job polling frequency (csnyder@redhat.com)
  - 1502821: Remove undocumented, broken env var "VIRTWHO_DISABLE_ASYNC"
    (csnyder@redhat.com)
  - 1466015: Warn of deprecation of command line options in next release
    (wpoteat@redhat.com)
  - remove non-existant variable fake_is_hypervisor (adarshvritant@gmail.com)
  - 1485865: Do not replace /etc/virt-who.conf on rpm upgrade
    (csnyder@redhat.com)
  - Utilize the owner from the first report seen, if we do not know the owner
    (csnyder@redhat.com)
  - Updates based on review (use str.format) (csnyder@redhat.com)
  - Fix example fake config in man docs (adarshvritant@gmail.com)
  - Add m2crypto dependency (adarshvritant@gmail.com)
  - 1211435: Don't send host-to-geust mapping, when env, owner are wrong
    (jhnidek@redhat.com)
  - 1408556: Log which owner updated mappings are being sent to
    (csnyder@redhat.com)


author: Kevin Howell <khowell@redhat.com> 0.21.1-1
changelog:
  - 1511308: Only ESX supports: exclude_host_parents and filter_host_parents.
    (jhnidek@redhat.com)
  - 1509596: Use qemu+ssh transport if not provided (libvirt)
    (csnyder@redhat.com)
  - 1511308: Xen and Hyper-V do not support some filter options
    (jhnidek@redhat.com)
  - 1510760: Ensure virt-who exits properly (w/ no good conf)
    (csnyder@redhat.com)
  - 1509606: Remove duplicate output of validation messages (csnyder@redhat.com)
  - 1509597: Fix issue with cli consistancy check for vdsm (csnyder@redhat.com)
  - 1509595: Only expect owner on HostGuestAssociationReports
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.2-1
changelog:
  - 1510310: Ensure that owner and env are required where necessary
    (csnyder@redhat.com)
  - 1512778: ESX should require username, password, and server values
    (csnyder@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 0.21.4-1
changelog:
  - 1353119: Add JSON-RPC support for VDSM (khowell@redhat.com)
  - 1509597: Enable to use virt-who with VDSM again (jhnidek@redhat.com)


author: Alexander Kurtakov <akurtako@redhat.com> 1:3.1.3-5
changelog:
  - Remove javax.xml.bind from osgi imports - it's part of the JVM now.
  - Drop the ws-jaxme dependency for the same reason.


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-2
changelog:
  - Add Pressure2K option for backwards-compatibility with applications that
    hardcode the previous pressure range (#1457024)


author: Peter Hutterer <peter.hutterer@redhat.com> 0.34.2-3
changelog:
  - Fix hang after unplugging a device (#1496650)
  - Correct device flags for some Cintiqs and Intuos pros (#1496659)


