# changelog

author: Benjamin A. Beasley <code@musicinmybrain.net> - 5.0.1-7
changelog:
  - Security fix for CVE-2022-28041
  - Drop dependency on pkgconfig(zzip-zlib-config), no longer available in
    zziplib; use zlib directly instead


author: Than Ngo <than@redhat.com> - 119.0.6045.199-2
changelog:
  - fixed bz#2242271, built with bundleminizip in fedora > 39
  - fixed bz#2251884, built with fstack-protector-strong for improved security


author: Than Ngo <than@redhat.com> - 120.0.6099.109-1
changelog:
  - update to 120.0.6099.109
     * High CVE-2023-6702: Type Confusion in V8
     * High CVE-2023-6703: Use after free in Blink
     * High CVE-2023-6704: Use after free in libavif
     * High CVE-2023-6705: Use after free in WebRTC
     * High CVE-2023-6706: Use after free in FedCM
     * Medium CVE-2023-6707: Use after free in CSS


author: Than Ngo <than@redhat.com> - 120.0.6099.199-1
changelog:
  - new gn update, drop workaround for broken gn on epel 8/9
  - update to 120.0.6099.199
     * CVE-2024-0222: Use after free in ANGLE
     * CVE-2024-0223: Heap buffer overflow in ANGLE
     * CVE-2024-0224: Use after free in WebAudio
     * CVE-2024-0225: Use after free in WebGPU


author: Jos de Kloe <josdekloe@gmail.com> - 2.29.0-1
changelog:
  - Upgrade to upstream version 2.29.0
    Note that the source code now uses g++ in stead of gcc for compilation.


author: David Michael <fedora.dm0@gmail.com> - 1.5-4
changelog:
  - Enable MicroLZMA support.
  - Switch the License tag to SPDX, and ship matching noneffective license files.


author: David Michael <fedora.dm0@gmail.com> - 1.6-3
changelog:
  - Backport patches for CVE-2023-33551 and CVE-2023-33552.
  - Change conditional build feature defaults for supporting EPEL 9.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.97.1-1
changelog:
  - New version
    Resolves: rhbz#2256145
  - Fixed SMTP smuggling vulnerability
    Resolves: CVE-2023-51766


author: Paul Howarth <paul@city-fan.org> - 3.3.112-1
changelog:
  - Update to 3.3.112
    - VCD reader fixes for unnamed Icarus begin blocks
    - String data type crash fix in fst.c
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 3.3.115-1
changelog:
  - Update to 3.3.115
    - Fix VZT reader with -fstrict-aliasing
    - Fix use_multi_state condition in vzt_write.c
    - Fix for UNDEF vs strings at start of a vzt file
    - Fix sleep() time scaling redefine for mingw
    - Use MapViewOfFileEx for mmap on Windows (fstapi)
    - Define FST_DO_MISALIGNED_OPS on AArch64 (fstapi)
    - Fixed attrbegin short length problem


author: Paul Howarth <paul@city-fan.org> - 3.3.116-1
changelog:
  - Update to 3.3.116
    - Fix manpage/odt for vcd2fst command switch documentation for zlibpack
    - Add GDK_WINDOWING_WAYLAND check for gdkwayland.h header usage
    - Change sprintf to snprintf in fstapi.c
    - Fix init crash on show_base_symbols enabled


author: Paul Howarth <paul@city-fan.org> - 3.3.118-1
changelog:
  - Update to 3.3.118
    - Update xml2stems to handle newer "loc" vs. "fl" xml tags
    - Change preg_regex_c_1 decl to use regex_t* as datatype
    - Move gtkwave.appdata.xml to io.github.gtkwave.GTKWave.metainfo.xml
    - Fixed popen security advisories:
      - TALOS-2023-1786 (CVE-2023-35963, CVE-2023-35960, CVE-2023-35964,
  		       CVE-2023-35959, CVE-2023-35961, CVE-2023-35962)
    - Fixed FST security advisories:
      - TALOS-2023-1777 (CVE-2023-32650)
      - TALOS-2023-1783 (CVE-2023-35704, CVE-2023-35703, CVE-2023-35702)
      - TALOS-2023-1785 (CVE-2023-35956, CVE-2023-35957, CVE-2023-35958,
  		       CVE-2023-35955)
      - TALOS-2023-1789 (CVE-2023-35969, CVE-2023-35970)
      - TALOS-2023-1790 (CVE-2023-35992)
      - TALOS-2023-1791 (CVE-2023-35994, CVE-2023-35996, CVE-2023-35997,
  		       CVE-2023-35995)
      - TALOS-2023-1792 (CVE-2023-35128)
      - TALOS-2023-1793 (CVE-2023-36747, CVE-2023-36746)
      - TALOS-2023-1797 (CVE-2023-36864)
      - TALOS-2023-1798 (CVE-2023-36915, CVE-2023-36916)
    - Fixed evcd2vcd security advisories:
      - TALOS-2023-1803 (CVE-2023-34087)
    - Fixed VCD security advisories:
      - TALOS-2023-1804 (CVE-2023-37416, CVE-2023-37419, CVE-2023-37420,
  		       CVE-2023-37418, CVE-2023-37417)
      - TALOS-2023-1805 (CVE-2023-37447, CVE-2023-37446, CVE-2023-37445,
  		       CVE-2023-37444, CVE-2023-37442, CVE-2023-37443)
      - TALOS-2023-1806 (CVE-2023-37576, CVE-2023-37577, CVE-2023-37573,
  		       CVE-2023-37578, CVE-2023-37575, CVE-2023-37574)
      - TALOS-2023-1807 (CVE-2023-37921, CVE-2023-37923, CVE-2023-37922)
    - Fixed VZT security advisories:
      - TALOS-2023-1810 (CVE-2023-37282)
      - TALOS-2023-1811 (CVE-2023-36861)
      - TALOS-2023-1812 (CVE-2023-38618, CVE-2023-38621, CVE-2023-38620,
  		       CVE-2023-38619, CVE-2023-38623, CVE-2023-38622)
      - TALOS-2023-1813 (CVE-2023-38649, CVE-2023-38648)
      - TALOS-2023-1814 (CVE-2023-38651, CVE-2023-38650)
      - TALOS-2023-1815 (CVE-2023-38653, CVE-2023-38652)
      - TALOS-2023-1816 (CVE-2023-35004)
      - TALOS-2023-1817 (CVE-2023-39235, CVE-2023-39234)
    - Fixed LXT2 security advisories:
      - TALOS-2023-1818 (CVE-2023-39273, CVE-2023-39271, CVE-2023-39274,
  		       CVE-2023-39275, CVE-2023-39272, CVE-2023-39270)
      - TALOS-2023-1819 (CVE-2023-34436)
      - TALOS-2023-1820 (CVE-2023-39316, CVE-2023-39317)
      - TALOS-2023-1821 (CVE-2023-35057)
      - TALOS-2023-1822 (CVE-2023-35989)
      - TALOS-2023-1823 (CVE-2023-38657)
      - TALOS-2023-1824 (CVE-2023-39413, CVE-2023-39414)
      - TALOS-2023-1826 (CVE-2023-39443, CVE-2023-39444)
      - TALOS-2023-1827 (CVE-2023-38583)


author: Vitaly Zaitsev <vitaly@easycoding.org> - 2.8.0-2
changelog:
  - Fixed metadata manifest. Enabled validator.
  - Fixed directories ownership.
  - Disabled HTML patching.


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - open https://jira.mongodb.org/browse/MONGOCRYPT-451 build with shared libbson
  - open https://jira.mongodb.org/browse/MONGOCRYPT-460 ABI/API breakage


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.2.rc3
changelog:
  - Update to 1.3.8rc3
    - Support SSH hostkey rotation via OpenSSH extensions (GH#1323)
    - NLST did not behave consistently for relative paths (GH#1325)
    - Support AES Galois Counter Mode (AES-GCM) in SSH; support for the
      "aes128-gcm@openssh.com" and "aes256-gcm@openssh.com" ciphers has been
      added to mod_sftp (Bug #3759)
    - Implement an LDAPConnectTimeout directive, to configure the timeout used
      when connecting to LDAP servers (GH#1333)
    - Implement OpenSSH "Encrypt-Then-MAC" (ETM) algorithm extensions (GH#1330)
    - Implement AllowForeignAddress class matching for passive data transfers
      (GH#1346)
    - Implement support for PCRE2 (GH#1353)
    - ProFTPD wouldn't start with several locales (Bug #4466)
    - Auth sources providing space-bearing user/group names caused compliance
      issues with MLSD/MLST responses (GH#1367)
    - DeleteAbortedStores removed successfully transferred files unexpectedly
      (Bug #4467)
    - Omit EPRT/EPSV from FEAT response when denied by <Limit> configuration
      (GH#1383)
    - Support uploading to symlinked files (GH#1379)
    - Keepalive socket options should be set using IPPROTO_TCP, not SOL_SOCKET
      (GH#1401)
    - TCP keepalive SocketOptions should apply to control as well as data
      connection (GH#1402)
    - ProFTPD always used the same PassivePorts port for first transfer (GH#1396)
    - mod_sftp needs to handle unknown SSH messages in an RFC-compliant manner,
      ignoring rather than disconnecting (GH#1410)
    - Improve handling of some globally applied configuration directives (GH#1418)
    - Name-based virtual hosts not working as expected after upgrade from 1.3.7a
      to 1.3.7b (GH#1369)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.3.rc4
changelog:
  - Update to 1.3.8rc4
    - mod_sftp should fail on startup when SFTP and TLS are both enabled for a
      vhost (GH#1434)
    - DelayTable not properly using documented default value; this is a
      regression caused by the changes for Bug#4020 (GH#1440)
    - Support customizing SSH ciphers, digests, key exchanges via SFTPClientMatch
      (GH#1444)
    - Ensure that mod_sftp algorithms work properly with OpenSSL 3.x (GH#1448)
    - BanOnEvent BadProtocol triggers segfault (GH#1445)
    - SFTP "check-file" implementation computes incorrect results (GH#1439)
    - Implement SFTPHostKeys directive for configuring the SSH host key
      algorithms (GH#1457)
    - Implement the "curve448-sha512" SSH key exchange algorithm (GH#1437)
    - Include directive broken when using wildcards for directory components
      (GH#1472)
    - mod_sftp fails to build using OpenSSL 1.0.x: undefined reference to
      'EVP_MD_CTX_reset' (Bug #4485)
    - Reload after omitting explicit ModulePath value causes fatal module load
      failures (GH#1476)
  - Drop pcre build dependency since we have been explicitly disabling it for the
    last 5 years anyway
  - Fix X448 support check to fail properly with OpenSSL 1.1.0 (GH#1488)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-0.4.rc4
changelog:
  - Update mod_vroot to 0.9.10
    - Fix unexpected filtering behaviour with mod_vroot (#2104972, GH#1491)


author: Paul Howarth <paul@city-fan.org> - 1.3.8-1
changelog:
  - Update to 1.3.8
    - 1.3.8rc4 failed to build mod_sftp with OpenSSL 1.1.0 due to X448 check
      (GH#1488)
    - 1.3.8rc4 failed to build on Solaris due to missing type declarations
      (GH#1494)
    - mod_ifsession doesn't change the effect of SFTPMaxChannels (GH#1500)
    - mod_tls module unexpectedly allows TLS handshake after authentication in
      some configurations (GH#1533)
    - Disable FSCachePolicy by default (GH#1528)
    - Avoid logging "session closed" messages unless there is a corresponding
      "session opened" log message, to avoid user confusion (GH#1539)
    - Implement support for the CSID FTP command (GH#1550)
    - Unable to verify signed data: signature type 'rsa-sha2-512' does not match
      publickey algorithm 'ssh-rsa' (Bug #4491)
    - mod_auth_otp improperly allows keyboard-interactive logins for users
      lacking OTP entries (GH#1560)
  - Update mod_vroot to 0.9.11
    - Addresses a bad interaction with mod_auth_file, and failed login attempts,
      which can lead to inexplicably "stuck" processes that cannot be terminated
      (https://github.com/proftpd/proftpd/issues/1384)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 1.3.8-4
changelog:
  - Ensure mod_rewrite is linked against libidn2 so that it loads properly
    (rhbz#2166454, https://github.com/proftpd/proftpd/issues/1590)
  - No longer need to explicitly remove libtool archives from Fedora 36 onwards


author: Paul Howarth <paul@city-fan.org> - 1.3.8a-1
changelog:
  - Update to 1.3.8a
    - Fix mod_sftp failure to handle SFTP requests to truncate files to zero size
      (GH#1581)
    - Fix mod_sftp improperly handling SFTP WRITE requests for files opened for
      appending (GH#1584)
    - Build-time detection of Linux POSIX ACL support was broken since 1.3.8rc2
      (GH#1568)
    - Fix failure to load mod_rewrite as a dynamic module due to
      incomplete/missing library linker flags (GH#1590)
    - <Class> section is allowed to be in <Global>, but From directive is not
      (GH#1597)
    - ExtendedLog SSH, SFTP classes not working as expected (GH#1617)
    - Fix mod_sftp not handling multiple concurrent open file handles/transfers
      well for logging (GH#1646)
    - "TLSRequired off" plus Protocols directive caused mod_tls to terminate the
      session abruptly (GH#1679)
    - Fix mod_tls failure to compile against OpenSSL 3.0.8 due to missing
      ENGINE_METHOD_ flags (GH#1689)
    - Unknown named connection error when using different SQL backends (GH#1659)
    - Fix mod_sql not properly closing all named backend connections on session
      exit (GH#1697)
    - SSH key exchanges failed unexpectedly with "unable to write X bytes of raw
      data" errors due to small ProFTPD buffer (GH#1694)
    - Fix high session memory usage caused by SFTP outgoing data buffering
      (GH#1678)
    - Out-of-bounds buffer read when handling FTP commands (GH#1683,
      CVE-2023-51713)
    - SFTP algorithm settings in <Global> section were not being used (GH#1712)


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-1
changelog:
  - Update to 1.3.8b
    - Compiling ProFTPD 1.3.8a mod_sftp, mod_tls using libressl 3.7.3 failed
      (GH#1735)
    - Build system failed for specific module names (GH#1756)
    - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
      (CVE-2023-48795, GH#1760)


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-2
changelog:
  - Use libsodium to provide ed25519 key support for mod_sftp (#2256340)
  - Update logrotate snippet to use try-reload-or-restart rather than reload
    for distributions with systemd 229 or later (PR#3)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.80-1
changelog:
  - New version
    Resolves: rhbz#2255025
  - Fixed Terrapin vulnerability in some SSH protocol extensions
    Resolves: CVE-2023-48795


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.18-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.18.
  - Added verification of upstream signature.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.19-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.19.
  - Update rules for AppStream metainfo and desktop files.


