# changelog

author: Semyon Klintsov <semen.klincov@red-soft.ru> - 0:1.17.2-7
changelog:
  - remove libcares.so* from base subpackage removed libcares.so* from the main due to file duplication in libcares subpackage


author: Elia Leontiev <ilya.leontiev@red-soft.ru> - 0:2023.2.62_v7.0.401-7
changelog:
  - Removing:
  -   # Certificate E-Tugra Certification Authority
  -   # Certificate GLOBALTRUST 2020
  -   # Certificate GLOBALTRUST 2015
  -   # Certificate GLOBALTRUST


author: Elia Leontiev <ilya.leontiev@red-soft.ru> - 2024.2.69_v8.0.303-2
changelog:
  - update for resolve some problems 
  - update-ca-trust: copy directory-hash symlinks to /etc/pki/tls/certs


author: Dmitry Safonov <dmitry.safonov@red-soft.ru> - 0:4.17.10-1m.el7.3
changelog:
  - Update to 4.17.10
  - with mitkrb5
  - fix CVE-2022-2127, CVE-2023-34966, CVE-2023-34967, CVE-2023-34968, CVE-2023-3347


author: Dmitry Safonov <dmitry.safonov@red-soft.ru> - 0:4.17.10-2h.el7.3
changelog:
  - Update to 4.17.10
  - without mitkrb5(heimdal)
  - fix CVE-2022-2127, CVE-2023-34966, CVE-2023-34967, CVE-2023-34968, CVE-2023-3347


author: Dmitry Safonov <dmitry.safonov@red-soft.ru> - 0:4.17.12-1m.el7.3
changelog:
  - Update to 4.17.12
  - fix CVE-2023-3961, CVE-2023-4091, CVE-2023-4154
    CVE-2023-42669, CVE-2023-42670
  - MIT


author: Dmitry Safonov <dmitry.safonov@red-soft.ru> - 0:4.17.12-2h.el7.3
changelog:
  - Update to 4.17.12
  - fix CVE-2023-3961, CVE-2023-4091, CVE-2023-4154
    CVE-2023-42669, CVE-2023-42670
  - Heimdal


author: Vladislav Mitin <vladislav.mitin@red-soft.ru> - 0:7.81.0-9
changelog:
  - fix CVE-2023-27534, CVE-2023-27533, CVE-2023-27538, CVE-2023-27537,
    CVE-2023-27536, CVE-2023-27535


author: Sergey Fadin <sergey.fadin@red-soft.ru> - 0:3.6.2-1
changelog:
  - Update upstream to 3.6.2
  - Added python3 package
  - Move python to python2 package
  - Used github source tarball


author: Sergey Fadin <sergey.fadin@red-soft.ru> - 4.2.23-2
changelog:
  - Rebuilt
  - Used compat_level=minimal
  - Clear specfile
  - Build with python2 and python3
  - Used dnf-yum package


author: Vladislav Mitin <vladislav.mitin@red-soft.ru> - 0:2.4.1-2
changelog:
  - Rebuild for os73-updates
  - Update fix with CVE-2022-25235, CVE-2022-25236, CVE-2022-25313, CVE-2022-25315, CVE-2022-25314
  - Without patch in xmltok_impl.c


author: Vitaly Peshcherov <vitaly.peshcherov@red-soft.ru> - 0:2.44.1-1
changelog:
  - Update to 2.44.1 for os73-updates {177718}
  - Fix CVE-2024-32004 CVE-2024-32020 CVE-2024-32021 CVE-2024-32465


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 2.65.3-3
changelog:
  - multiple GVariant security issues
  - CVE-2023-24593, CVE-2023-29499, CVE-2023-25180, CVE-2023-32611,
    CVE-2023-32636, CVE-2023-32643, CVE-2023-32665
  - CVE-2021-27218, CVE-2021-27219


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 0:1.1.1.0-0.4
changelog:
  - Use frpintf(stderr,...) instead of printf(...) in gost_eng.c
  - Because it brake some applications like git...


author: Dmitry Safonov <dmitry.safonov@red-soft.ru> - 0:1.1.1.0-0.6
changelog:
  - Changing the "openssl-switch-passhash" script
  - Now the files in the directory "/etc/pam.d/" are changed 
  - 	so that the script works equally on both the standard
  - 	and the certified OS version


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 1:2.06-63.3
changelog:
  - bundle fixedsys-regular-16.pf2 with image
  - set fixedsys-regular-16 as default font
  - fix boot from XFS partition
  - CVE-2024-1048


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 1:2.06-64.3
changelog:
  - fs/xfs: Handle non-continuous data blocks in directory extents
  - cmd/search: Rework of CVE-2023-4001 fix
  - grub-mkconfig.in: turn off executable owner bit


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 0:8.40-69.el7.2
changelog:
  * Mon Sep 12 2022 Anton Fadeev <anton.fadeev@red-soft.ru> - 8.40-68
  - Move man pages to grubby-deprecated package


author: Alexandr Subbotin <alexander.subbotin@red-soft.ru> - 5.15.35-5
changelog:
  - CVE-2022-2588
  - CVE-2022-2586
  - CVE-2021-33655
  - CVE-2022-29582
  - CVE-2022-34918
  - CVE-2022-2078 (BDU:2022-04090)


author: Artem Chernyshev <artem.chernyshev@red-soft.ru> - 5.15.72-1
changelog:
  - Update upstream to 5.15.72
  - Old patches removed

  - BDU-W-2022-00044
  - BDU-W-2022-00045
  - BDU-W-2022-00046
  - BDU-W-2022-00047
  - BDU-W-2022-00048


author: Artem Chernyshev <artem.chernyshev@red-soft.ru> - 5.15.78-1
changelog:
  - Update upstream to 5.15.78

  - CVE-2022-3435
  - CVE-2022-3521
  - CVE-2022-3534
  - CVE-2022-3577
  - CVE-2022-3606
  - CVE-2022-41848
  - CVE-2022-44032
  - CVE-2022-44033
  - CVE-2022-44034
  - CVE-2022-3566


author: Artem Chernyshev <artem.chernyshev@red-soft.ru> - 5.15.154-1
changelog:
  - Updated to 5.15.154
  - Mitigated problem with freeze after suspend on AlderLake CPU systems
  - Solved issue with screen rotate on certain systems
  - REISERFS was deprecated and currently removed from build
  - Kernel stack offset randomization and variable initialization on
  allocation was turned on for security reasons
  - Few unused protocols was turned off.
  - config options explicitly changed:
    * CONFIG_NET_9P=n
    * CONFIG_ROSE=n
    * CONFIG_REISERFS_FS=n
    * CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
    * CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
    * CONFIG_BMI160=m
    * CONFIG_BMI160_I2C=m
    * CONFIG_BMI160_SPI=m


author: Artem Chernyshev <artem.chernyshev@red-soft.ru> - 6.1.85-1
changelog:
  - Updated to 6.1.85
  - Mitigated problem with freeze after suspend on AlderLake CPU systems
  - Solved issue with screen rotate on certain systems
  - Fixed screen flickering issues observed in rare cases
  - REISERFS was deprecated and currently removed from build
  - Multi-gen Least Recently Used memory page reclaim algorithm using
  by default.
  - Kernel stack offset randomization and variable initialization on
  allocation was turned on for security reasons
  - Few unused protocols was turned off.
  - config options explicitly changed:
    * CONFIG_NET_9P=n
    * CONFIG_ROSE=n
    * CONFIG_REISERFS_FS=n
    * CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT=y
    * CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
    * CONFIG_BMI160=m
    * CONFIG_BMI160_I2C=m
    * CONFIG_BMI160_SPI=m
    * CONFIG_LRU_GEN=y
    * CONFIG_LRU_GEN_ENABLED=y


author: Artem Chernyshev <artem.chernyshev@red-soft.ru> - 6.1.128-2
changelog:
  - Updated to 6.1.128
  - Fix selinux issue in aarch64
  - config options explicitly changed:
    * CONFIG_BLK_CGROUP_IOPRIO=y
    * CONFIG_MD_CLUSTER=m
    * CONFIG_SECURITY_DMESG_RESTRICT=y
    * CONFIG_USB_SERIAL=m
    * CONFIG_X86_AMD_PSTATE=y
    * CONFIG_X86_AMD_PSTATE_UT=y


author: Artem Chernyshev <artem.chernyshev@red-soft.ru> - 6.1.143-1
changelog:
  - Updated to 6.1.143
  - added patch and corresponding boot option for vpd size fix
  - CONFIG_BLK_DEV_UBLK=m
  - CONFIG_FB_SM750=m
  - CONFIG_MPTCP_IPV6=y
  - CONFIG_MPTCP_KUNIT_TEST=m
  - CONFIG_MPTCP=y


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 2:1.45.5-11
changelog:
  - Backport 5ce5ef6a97a58c5e906083ad4e944545712b3f3f,
    216de164e091a5c36403f24901698044a43ae0d9,
    5858c2cf6c24b3776e3867eafd9d86a1f4912d9c
  - Fix VM conversation fail with new libvirt and qemu-kvm


author: Vyacheslav Borikov <vyacheslav.borikov@red-soft.ru> - 1.6.37-4
changelog:
  - Fix CVE-2025-64505, CVE-2025-64506, CVE-2025-64720, CVE-2025-65018,
        CVE-2025-66293, CVE-2026-22801


author: Vitaly Peshcherov <vitaly.peshcherov@red-soft.ru> - 0:2.74.3-1
changelog:
  - Update to 2.74.3 and fix some cve {202901}
  - CVE-2024-52530 CVE-2024-52531 CVE-2024-52532 CVE-2025-2784
  - CVE-2025-32050 CVE-2025-32052 CVE-2025-32053


author: Vitaly Peshcherov <vitaly.peshcherov@red-soft.ru> - 0:2.74.3-2
changelog:
  - Fixed some more cves {202901}
  - CVE-2025-32911 CVE-2025-32913 CVE-2025-32906
  - CVE-2025-32912 CVE-2025-32914 CVE-2025-32909
  - CVE-2025-32910


author: Vyacheslav Borikov <vyacheslav.borikov@red-soft.ru> - 0:1.11.1-1
changelog:
  - Update to v1.11.1 for fix CVE-2026-55200
  - Fix CVE-2026-7598, CVE-2026-55200, CVE-2026-55199, CVE-2025-15661


author: Ilya Leontiev <ilya.leontiev@red-soft.ru> - 4.5.1-11
changelog:
  - fix CVE-2025-9165, CVE-2025-9900,
    CVE-2025-8961,CVE-2025-8851,CVE-2025-8534,CVE-2024-13978,CVE-2025-8176,CVE-2025-8177


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 7.6.0-11
changelog:
  - Backport 70768cda9740d1fbc4b95460247bc5384d7e31a1 and db0564b4d34fb94fe59f04a4e411374ec1b6fc19
  - to prevent v2v crash when ethernet.networkName is missing


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 2:2.11.3-91
changelog:
  - Fix multiple CVEs (CVE-2024-22563, CVE-2023-1668, CVE-2023-5366, CVE-2022-4337, CVE-2022-4338)
  - Bump epoch to avoid conflicts with underlying repositories


author: Alexander Lushin <alexandr.lushin@red-soft.ru> - 2:2.16.0-5
changelog:
  - Fix ovsdb-server systemd unit. Now it additionaly setups openvswitch permissions to /etc/openvswitch and /run/openvswitch directory.


author: Alexander Lushin <alexandr.lushin@red-soft.ru> - 2:2.16.0-6
changelog:
  - Fix ovsdb-server systemd unit. Now it setups openvswitch permissions to /etc/openvswitch and others recursively.
  - Ipsec custom launch options
  - Fix default ovs paths for RED Virtualization directories


author: Richard W.M. Jones <rjones@redhat.com> - 4-1
changelog:
  - s390x is now a native architecture with OCaml 4.04 in Fedora >= 26.
  - Add riscv64 as a native arch using out of tree backend.


author: Maxim Noskov <maxin.noskov@red-soft.ru> - 1.4.0-11
changelog:
  - закрыта CVE-2025-6020,
    Добавлены pam_namespace_170.patch - синхронизация pam_namespace до версии 1.7.0.
    pam_namespace_post170-*.patch - добавлены изменения после версии 1.7.0 из дерева git upstream.
    pam_namespace_revert_abi.patch - откат изменений ABI для
    предотвращения непреднамеренных проблем при запуске демонов.
    CVE-2024-22365.patch: удален, включен в кластер патчей выше.


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 1:3.2.1-5.el7
changelog:
  - Bump epoch to avoid conflict with other repos
  - Fix CVE-2023-49083, CVE-2023-23931, CVE-2020-36242


author: Vyacheslav Borikov <vyacheslav.borikov> - 3.10.11-1
changelog:
  - Update to 3.10.11 for fix CVE-2024-27306, CVE-2024-42367, CVE-2024-30251, CVE-2024-52304
  - Fix CVE-2025-53643


author: Vyacheslav Borikov <vyacheslav.borikov> - 3.10.11-1
changelog:
  - Update to 3.10.11 for fix CVE-2024-27306, CVE-2024-42367, CVE-2024-30251,
    CVE-2024-52304
  - Fix CVE-2025-53643


author: Vyacheslav Borikov <vyacheslav.borikov> - 3.10.11-4
changelog:
  - Fix CVE-2025-69224, CVE-2025-69225, CVE-2025-69227, CVE-2025-69228,
        CVE-2025-69226, CVE-2025-69229


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 1:0.6.0-3
changelog:
  - Bump epoch to avoid conflicts with oither repos
  - Fix CVE-2024-28102, CVE-2023-6681, CVE-2022-3102


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 15:5.1.0-21
changelog:
  - Backport 9b6bb528 from upstream. Fix NULL dereference in bdrv_mirror_top_do_write
  - and bdrv_mirror_top_pwritev


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 0:3.14.5-53
changelog:
  - Fix RO_0004_allow_systemd_machined_userdbd_runtime_sock_files.patch
  - Enable daemons_enable_cluster_mode by default


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-55
changelog:
  - Allow domain stat /proc filesystem
  - Allow rngd process to perform: setuid , setgid and setcap.
  - Allow pppd create a file in the locks directory
  - Set default file context for /var/lib/ipsec/nss
  - drop ip-client module


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-56
changelog:
  - Allow tlp dbus-chat with NetworkManager
  - Remove the disk write permissions from tlp_t
  - Allow tlp get service units status
  - Allow tlp read its systemd unit
  - Allow domain stat the /sys filesystem
  - Allow rngd stat the /sys filesystem
  - Label NVMe devices as fixed_disk_device_t
  - Allow nsswitch_domain to connect to systemd-machined using a unix socket
  - Add chromium_sandbox_t setcap capability
  - Allow unconfined user filetrans chrome_sandbox_home_t
  - Allow systemd-logind read swap files
  - Dontaudit setsched for rndc


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-57
changelog:
  - Add context for new mariadbd executable files
  - Allow unconfined domains to bpf all other domains
  - drop "Allow local_logint_t and passwd_t getattr proc",
    replace by "Allow_domain_stat_proc_filesystem"
  - clean "allow_systemd_machined_userdbd_runtime_sock_files.patch"
  - Allow postfix_domain to sendto unix dgram sockets
  - Allow transition from xdm domain to unconfined_t domain
  - Allow rpcbind read network sysctls
  - Label selinux autorelabel with semanage_exec_t
  - Improve default file context(None) of authselect backup
  - Allow domain transition to sssd_t
  - Allow-systemd-hostnamed-read-udev-runtime-data
  - Label-run-systemd-default-hostname-with-hostname_etc
  - Allow-systemd_hostnamed-label-run-systemd-as-hostnam
  - selinux-tweak-selinux_get_enforce_mode-to-allow-stat
  - Remove-files_mmap_usr_files-call-for-systemd-domains
  - systemd-allow-all-systemd-services-to-check-selinux


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-58
changelog:
  - Rebuild with container-selinux-2.228.1
  - Allow domain mmap usr_t files
  - Add an alias for nvme_device_t


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-59
changelog:
  - Allow fprintd install a sleep delay inhibitor
  - Allow fprintd read and write hardware state informat


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-60
changelog:
  - Allow systemd gpt auto generator read udev pid files
  - Add missing declaration in rpm_named_filetrans
  - Add default file context specification for dnf log files
  - Allow systemd-io-bridge ioctl rpm_script_t
  - Change rpm_setattr_db_files to use a pattern
  - Support using systemd update helper in rpm scriptlet
  - Allow login_userdomain write to boltd named pipes


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-61
changelog:
  - Actualize Samba module
  - Allow systemd userdbd the sys_resource capability
  - Allow domain read usermodehelper state information
  - Dont audit winbind_rpcd_t write urandom
  - Dont audit winbind_t write urandom


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-63
changelog:
  - Allow sssd read symlinks in etc sssd
  - Creating interface sssd_run_sssd
  - Allow domtrans to sssd_t and role access to sssd
  - Allow mongodb read network sysctls
  - Allow mongodb read filesystem sysctls
  - Allow mongodb search nfs dir


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-64
changelog:
  - Fix typo in rsyncd.conf in rsync.if
  - Allow xdm connect to unconfined_service_t over a unix stream socket
  - Allow xdm_t read unconfined services state
  - Allow lldpad send to unconfined_t over a unix dgram socket
  - Allow lldpd use an snmp subagent over a tcp socket
  - Allow lldpd connect to snmpd with a unix domain streem
  - Allow lldpad connect to systemd userdbd over a unix dgram socket


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-65
changelog:
  - Allow chage domtrans to sssd
  - Allow lldpad create and use netlink_generic_socket
  - Allow nut-upsd system state information
  - Allow upsmon execute upsmon via a helper script


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-66
changelog:
  - Allow kdump load a new kernel
  - Label var lib kdump with kdump_var_lib_t
  - Allow kdump_t net_admin capability
  - Label var log kdump.log with kdump_log_t
  - Allow kexec manage generic tmp files
  - Allow kdump create and use its memfd objects
  - Allow kdumpctl_t to list all directories with a file
  - Allow haproxy list the sysfs directories-content
  - Support hitless reloads feature in haproxy
  - Allow haproxy get attributes of cgroup filesystems
  - Allow haproxy get attributes of filesystems with ext
  - Allow haproxy read hardware state information
  - Update policy for haproxyd
  - Dontaudit firewalld dac_override capability
  - Allow firewalld drop capabilities
  - Allow firewalld load kernel modules
  - Allow firewalld read the contents of the sysfs files


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 3.14.5-67
changelog:
  - Allow haproxy get attributes of ram filesystems
  - Dontaudit firewalld dac_raed_search capability
  - Allow webadm_t use generic ptys


author: Oleg Sviridov <oleg.sviridov@red-soft.ru> - 15.8-1.3
changelog:
  - update to 15.8, fix CVE:
    CVE-2023-40546 mok: fix LogError() invocation
    CVE-2023-40547 - avoid incorrectly trusting HTTP headers
    CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system
    CVE-2023-40549 Authenticode: verify that the signature header is in bounds.
    CVE-2023-40550 pe: Fix an out-of-bound read in verify_buffer_sbat()
    CVE-2023-40551: pe-relocate: Fix bounds check for MZ binaries


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 4.40.60.7-5
changelog:
  - Add "reservation_key file" to default multipath.conf to enable SCSI reservation
  - Rewrite spec to build with new RPM


author: Elia Leontiev <ilya.leontiev@red-soft.ru> - 2:9.1.774-1
changelog:
  - Build for fix 
      CVE-2024-47814
      CVE-2024-45306
      CVE-2024-43802
      CVE-2024-43374
      CVE-2024-43790


author: Anton Fadeev <anton.fadeev@red-soft.ru> - 1:1.45.90-9
changelog:
  - Backport 315c016dbea899587649a4bbf1865390cb4e1d3c
    Add support for Zstandard compressed kernel modules


