# changelog

author: Kamil Dudka <kdudka@redhat.com> - 7.76.1-24
changelog:
  - fix SSH connection too eager reuse still (CVE-2023-27538)
  - fix GSS delegation too eager connection re-use (CVE-2023-27536)
  - fix FTP too eager connection reuse (CVE-2023-27535)
  - fix SFTP path ~ resolving discrepancy (CVE-2023-27534)
  - fix TELNET option IAC injection (CVE-2023-27533)


author: Jacek Migacz <jmigacz@redhat.com> - 7.76.1-26
changelog:
  - unify the upload/method handling (CVE-2023-28322)
  - fix host name wildcard checking (CVE-2023-28321)


author: Jacek Migacz <jmigacz@redhat.com> - 7.76.1-28
changelog:
  - return error if hostname too long for remote resolve (CVE-2023-38545)
  - fix cookie injection with none file (CVE-2023-38546)
  - cap SFTP packet size sent (RHEL-14697)
  - lowercase the domain names before PSL checks (CVE-2023-46218)


author: Jacek Migacz <jmigacz@redhat.com> - 7.76.1-31.el9_6.1
changelog:
  - make up incomplete patch for host name wildcard checking (RHEL-5675)
  - eliminate use of obsolete patch syntax (RHEL-65791)
  - http2: make sure pause is done on HTTP (RHEL-86805)


author: Marek Kasik <mkasik@redhat.com> - 2.10.4-1
changelog:
  - Update to 2.10.4
  - Test bitmap size earlier for PNGs
  - Fix memory leak in pngshim.c
  - Enable man pages for demos
  - Resolves: #1887084, #1890211


author: Akira TAGOH <tagoh@redhat.com> - 2.10.4-3
changelog:
  - Enable HarfBuzz support
  - Add bootstrap without HarfBuzz
  - Resolves: #1853937
  - Resolves: #1906714


author: Jakub Jelen <jjelen@redhat.com> - 2.3.3-3
changelog:
  - Mark SHA-1 digest as weak to follow SHA-1 disablement in RHEL9 (#2070722)
  - Fix interaction with SSH by not requiring the MD5 digest (#2073567)
  - Fix creation of AEAD packets (#2128058)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-4
changelog:
  - Backport ppc hardware flags detection (#2051307)
  - Disable PKCS#1.5 encryption in FIPS mode (#2061328)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-5
changelog:
  - Allow signature verification with smaller RSA keys (#2083846)
  - Allow short salt for KDF (#2114870)
  - Reseed the kernel DRBG by using GRND_RANDOM (#2118695)
  - Address FIPS review comments around selftests (#2118695)
  - Disable RSA-OAEP in FIPS mode (#2118695)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-6
changelog:
  - Fix SHA3 digests with large inputs (#2129150)
  - Fix FIPS RSA PCT (#2128455)
  - Fix RSA FIPS Keygen that non-deterministically fails (#2130275)
  - Get max 32B from getrandom in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-7
changelog:
  - Properly enforce KDF limits in FIPS mode (#2130275)
  - Fix memory leak in large digest test (#2129150)
  - Fix function name FIPS service indicator by disabling PK encryption and decryption (#2130275)
  - Skip RSA encryption/decryption selftest in FIPS mode (#2130275)


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-8
changelog:
  - Fix unneeded PBKDF2 passphrase length limitation in FIPS mode
  - Enforce HMAC key lengths in MD API in FIPS mode


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-9
changelog:
  - Avoid usage of invalid arguments sizes for PBKDF2 in FIPS mode
  - Do not allow large salt lengths with RSA-PSS padding
  - Disable X9.31 key generation in FIPS mode
  - Update the FIPS integrity checking code to upstream version
  - Update cipher modes FIPS indicators for AES WRAP and GCM
  - Disable jitter entropy generator


author: Jakub Jelen <jjelen@redhat.com> - 1.10.0-10
changelog:
  - Provide FIPS indicators for MD and HMACs
  - Improve PCT tests for ECDSA and always run them after key is generated
  - Add missing guards for FIPS status in md_sign/verify function
  - Provider FIPS indicators for public key operation flags


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-10
changelog:
  - Fix CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576
  - Resolves: CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-11
changelog:
  - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175
  - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-14
changelog:
  - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-17337)


