# changelog

author: Sérgio Basto <sergio@serjux.com> - 2.2-2
changelog:
  - Updated the remove of cardsets already included in PySolFC package (PySolFC-Cardsets--Minimal-2.2.0)
  - Convert to SPDX License


author: José Matos <jamatos@fedoraproject.org> - 10.6.0-1
changelog:
  - update to 10.6.0
  - BR flexiblas for Fedora and lapack, openblas and atlas for EPEL
  - adapt armadillo-devel accordingly


author: Miroslav Suchý <msuchy@redhat.com> 1.97-1
changelog:
  - update copr keys
  - add script to check all keys
  - remove expired jenkins key
  - update expired intel security key
  - update expired navy linux key
  - update expired bluejeans key
  - add script to check expiration
  - Add the key for pkgs.k8s.io (Kubernetes)


author: Miroslav Suchý <msuchy@redhat.com> 1.99-1
changelog:
  - update copr keys
  - Add Qubes OS 4.2 release key
  - Split AlmaLinux OS 8 GPG public keys to fix microdnf
  - Update AlmaLinux OS 8 public key


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.96-2
changelog:
  - Fixed "tainted search query is not properly quoted" for greylisting,
    patch provided by Marcel Härry <mh+fedora@scrit.ch>


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.96.1-1
changelog:
  - New version
    Resolves: rhbz#2241735
    Resolves: rhbz#2241538
    Resolves: rhbz#2241540
    Resolves: rhbz#2241525
    Resolves: rhbz#2241526
    Resolves: rhbz#2241528
    Resolves: rhbz#2241530
    Resolves: rhbz#2241531
    Resolves: rhbz#2241533
    Resolves: rhbz#2241542
    Resolves: rhbz#2241543


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.97.1-1
changelog:
  - New version
    Resolves: rhbz#2256145
  - Fixed SMTP smuggling vulnerability
    Resolves: CVE-2023-51766


author: Fedora Release Engineering <releng@fedoraproject.org> - 7.1-1
changelog:
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.1
  - moved to jrd 7.1
  - added desp on java-diff and new cplc
  - fixed(?) procyon wrapper
    - todo procyon crashes witout trace
  - removed jd wrapper (was new in 7.1, maybe will be added)
  - split plugins to subpkgs
  - added jrd-hex launcher
  - added hex launcher, added jrd symlinks


author: Fedora Release Engineering <releng@fedoraproject.org> - 7.3-1
changelog:
  - moved to 7.3
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.3
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-7.2


author: Fedora Release Engineering <releng@fedoraproject.org> - 8.0-1
changelog:
  - update dto 8.0
  - https://github.com/pmikova/java-runtime-decompiler/releases/tag/java-runtime-decompiler-8.0


author: Fedora Release Engineering <releng@fedoraproject.org> - 9.1-1
changelog:
  - update dto 9.1
  - https://github.com/judovana/java-runtime-decompiler/releases/tag/java-runtime-decompiler-9.1
  - https://github.com/judovana/java-runtime-decompiler/releases/tag/java-runtime-decompiler-9.0


author: Wolfgang Ulbrich <fedora@raveit.de> - 1.24.0-2
changelog:
  - fixing a segfault on adding new location to calendar
  - https://github.com/mate-desktop/libmateweather/issues/75


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - open https://jira.mongodb.org/browse/MONGOCRYPT-451 build with shared libbson
  - open https://jira.mongodb.org/browse/MONGOCRYPT-460 ABI/API breakage


author: Paul Howarth <paul@city-fan.org> - 0.6600-1
changelog:
  - Update to 0.66
    - Fix for CVE-2023-7101 (unvalidated input can lead to arbitrary code
      execution vulnerability)
      https://github.com/runrig/spreadsheet-parseexcel/issues/33
  - Use author-independent source URL
  - Use SPDX-format license tag
  - No longer need to fix document file permissions
  - Fix permissions verbosely
  - Don't assume "pm" suffix on manpage files


author: Paul Howarth <paul@city-fan.org> - 1.3.6c-1
changelog:
  - Update to 1.3.6c
    - Use-after-free vulnerability in memory pools during data transfer
      (CVE-2020-9273, https://github.com/proftpd/proftpd/issues/903)
    - Fix mod_tls compilation with LibreSSL 2.9.x
      (https://github.com/proftpd/proftpd/issues/810)
    - MaxClientsPerUser was not enforced for SFTP logins when mod_digest was
      enabled (https://github.com/proftpd/proftpd/issues/750)
    - mod_sftp now handles an OpenSSH-specific private key format; it detects
      such keys, and logs a hint about reformatting them to a supported format
      (https://github.com/proftpd/proftpd/issues/793)
    - Directory listing was slower compared to previous ProFTPD versions
      (https://github.com/proftpd/proftpd/issues/793)
    - mod_sftp crashed when using pubkey-auth with DSA keys
      (https://github.com/proftpd/proftpd/issues/866)
    - Fix improper handling of TLS CRL lookups (CVE-2019-19269, CVE-2019-19270,
      https://github.com/proftpd/proftpd/issues/859)
    - Leaking PAM handler and data in case of unsuccessful authentication
      (https://github.com/proftpd/proftpd/issues/870)
    - SSH authentication failed for many clients due to receiving of
      SSH_MSG_IGNORE packet (http://bugs.proftpd.org/show_bug.cgi?id=4385)
    - SFTP publickey authentication failed unexpectedly when user had no shadow
      password info. (https://github.com/proftpd/proftpd/issues/890)
    - ftpasswd failed to restore password file permissions in some cases
      (https://github.com/proftpd/proftpd/issues/898)
    - Out-of-bounds read in mod_cap getstateflags() function; this has been
      addressed by updating the bundled version of libcap
      (CVE-2020-9272, https://github.com/proftpd/proftpd/issues/902)
      Note that this build of ProFTPD uses the system version of libcap and not
      the bundled version, and is not vulnerable to this issue


author: Paul Howarth <paul@city-fan.org> - 1.3.6c-2
changelog:
  - Retain a memory pool after an aborted transfer so that the %{transfer-status}
    LogFormat functionality still works
  - Own directory %{_sysconfdir}/logrotate.d


author: Paul Howarth <paul@city-fan.org> - 1.3.6c-3
changelog:
  - Avoid duplicate hostname and timestamps in syslog (#1808989)
    http://bugs.proftpd.org/show_bug.cgi?id=4185
    https://github.com/proftpd/proftpd/issues/1002
    https://github.com/proftpd/proftpd/pull/1009


author: Paul Howarth <paul@city-fan.org> - 1.3.6d-1
changelog:
  - Update to 1.3.6d
    - Fixed issue with FTPS uploads of large files using TLSv1.3
      (https://github.com/proftpd/proftpd/issues/959)
    - Fixed regression in the handling of '%{env:...}' configuration variables
      when the environment variable is not present
      (https://github.com/proftpd/proftpd/issues/857)
    - Second LIST of the same symlink shows different results
      (https://github.com/proftpd/proftpd/issues/940)
    - mod_sftp sends broken response when CREATETIME attribute is requested
      (https://github.com/proftpd/proftpd/issues/980)
    - Handle zero-length SFTP WRITE requests without error
      (http://bugs.proftpd.org/show_bug.cgi?id=4398)
    - PidFile should not be world-writable
      (https://github.com/proftpd/proftpd/issues/1018)
    - TLSv1.3 handshake fails due to missing session ticket key on some systems
      (https://github.com/proftpd/proftpd/issues/1014)
    - Lowercased FTP commands not properly identified
      (https://github.com/proftpd/proftpd/issues/1023)


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-1
changelog:
  - Update to 1.3.6e
    - Fixed null pointer dereference in mod_sftp when using SCP incorrectly
      (https://github.com/proftpd/proftpd/issues/1043)


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-3
changelog:
  - Avoid segfaults with TLSv1.3
    https://github.com/proftpd/proftpd/issues/1063
    https://github.com/proftpd/proftpd/commit/adf43dd4ddaab0332e74abc86bbcef9cf27ee54a
  - Use %license unconditionally


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-4
changelog:
  - Fix memory disclosure to RADIUS servers by mod_radius (#2001690)
    https://github.com/proftpd/proftpd/issues/1284
    https://github.com/proftpd/proftpd/pull/1285


author: Paul Howarth <paul@city-fan.org> - 1.3.6e-6
changelog:
  - Fix one-byte out-of-bounds read, and daemon crash, because of mishandling of
    quote/backslash semantics (#2255609, GH#1683, CVE-2023-51713)
  - Use SPDX-format license tag


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.80-1
changelog:
  - New version
    Resolves: rhbz#2255025
  - Fixed Terrapin vulnerability in some SSH protocol extensions
    Resolves: CVE-2023-48795


author: Paul Howarth <paul@city-fan.org> - 2.10.1-1
changelog:
  - Update to 2.10.1
    - CVE-2022-24302: Creation of new private key files using
      '~paramiko.pkey.PKey' subclasses was subject to a race condition between
      file creation and mode modification, which could be exploited by an
      attacker with knowledge of where the Paramiko-using code would write out
      such files; this has been patched by using 'os.open' and 'os.fdopen' to
      ensure new files are opened with the correct mode immediately (we've left
      the subsequent explicit 'chmod' in place to minimize any possible
      disruption, though it may get removed in future backwards-incompatible
      updates)
    - Add support for the '%C' token when parsing SSH config files (GH#1976)
    - Add support for OpenSSH's Windows agent as a fallback when Putty/WinPageant
      isn't available or functional (GH#1509, GH#1837, GH#1868)
    - Significantly speed up low-level read/write actions on
      '~paramiko.sftp_file.SFTPFile' objects by using 'bytearray'/'memoryview'
      (GH#892); this is unlikely to change anything for users of the higher level
      methods like 'SFTPClient.get' or 'SFTPClient.getfo', but users of
      'SFTPClient.open' will likely see orders of magnitude improvements for
      files larger than a few megabytes in size
    - Add 'six' explicitly to install-requires; it snuck into active use at some
      point but has only been indicated by transitive dependency on 'bcrypt'
      until they somewhat-recently dropped it (GH#1985); this will be short-lived
      until we drop Python 2 support


author: Paul Howarth <paul@city-fan.org> - 2.10.2-1
changelog:
  - Update to 2.10.2
    - Fix Python 2 compatibility breakage introduced in 2.10.1 (GH#2001)
  - Re-enable sftp tests, no longer failing under mock


author: Paul Howarth <paul@city-fan.org> - 2.10.3-1
changelog:
  - Update to 2.10.3
    - Certificate-based pubkey auth was inadvertently broken when adding SHA2
      support in version 2.9.0 (GH#1963, GH#1977)
    - Switch from module-global to thread-local storage when recording thread IDs
      for a logging helper; this should avoid one flavor of memory leak for
      long-running processes (GH#2002, GH#2003)


author: Paul Howarth <paul@city-fan.org> - 2.10.4-1
changelog:
  - Update to 2.10.4
    - Update 'camelCase' method calls against the 'threading' module to be
      'snake_case'; this and related tweaks should fix some deprecation warnings
      under Python 3.10 (GH#1838, GH#1870, GH#2028)
    - '~paramiko.pkey.PKey' instances' '__eq__' did not have the usual safety
      guard in place to ensure they were being compared to another 'PKey' object,
      causing occasional spurious 'BadHostKeyException', among other things
      (GH#1964, GH#2023, GH#2024)
    - Servers offering certificate variants of hostkey algorithms (e.g.
      'ssh-rsa-cert-v01@openssh.com') could not have their host keys verified by
      Paramiko clients, as it only ever considered non-cert key types for that
      part of connection handshaking (GH#2035)


author: Paul Howarth <paul@city-fan.org> - 2.11.0-1
changelog:
  - Update to 2.11.0
    - Align signature verification algorithm with OpenSSH re: zero-padding
      signatures that don't match their nominal size/length; this shouldn't
      affect most users, but will help Paramiko-implemented SSH servers handle
      poorly behaved clients such as PuTTY (GH#1933)
    - OpenSSH 7.7 and older has a bug preventing it from understanding how to
      perform SHA2 signature verification for RSA certificates (specifically
      certs - not keys), so when we added SHA2 support it broke all clients using
      RSA certificates with these servers; this has been fixed in a manner similar
      to what OpenSSH's own client does - a version check is performed and the
      algorithm used is downgraded if needed (GH#2017)
    - Recent versions of Cryptography have deprecated Blowfish algorithm support;
      in lieu of an easy method for users to remove it from the list of
      algorithms Paramiko tries to import and use, we've decided to remove it
      from our "preferred algorithms" list, which will both discourage use of a
      weak algorithm, and avoid warnings (GH#2038, GH#2039)
    - Windows-native SSH agent support as merged in 2.10 could encounter
      'Errno 22' 'OSError' exceptions in some scenarios (e.g. server not cleanly
      closing a relevant named pipe); this has been worked around and should be
      less problematic (GH#2008, GH#2010)
    - Add SSH config token expansion (eg '%h', '%p') when parsing 'ProxyJump'
      directives (GH#1951)
    - Apply unittest 'skipIf' to tests currently using SHA1 in their critical
      path, to avoid failures on systems starting to disable SHA1 outright in
      their crypto backends (e.g. RHEL 9) (GH#2004, GH#2011)


author: Paul Howarth <paul@city-fan.org> - 2.12.0-1
changelog:
  - Update to 2.12.0 (rhbz#2140281)
    - Add a 'transport_factory' kwarg to 'SSHClient.connect' for advanced users
      to gain more control over early Transport setup and manipulation (GH#2054,
      GH#2125)
    - Update '~paramiko.client.SSHClient' so it explicitly closes its wrapped
      socket object upon encountering socket errors at connection time; this
      should help somewhat with certain classes of memory leaks, resource
      warnings, and/or errors (though we hasten to remind everyone that Client
      and Transport have their own '.close()' methods for use in non-error
      situations!) (GH#1822)
    - Raise '~paramiko.ssh_exception.SSHException' explicitly when blank private
      key data is loaded, instead of the natural result of 'IndexError'; this
      should help more bits of Paramiko or Paramiko-adjacent codebases to
      correctly handle this class of error (GH#1599, GH#1637)
  - Use SPDX-format license tag


author: Paul Howarth <paul@city-fan.org> - 2.12.0-2
changelog:
  - Address CVE 2023-48795 (a.k.a. the "Terrapin Attack", a vulnerability found
    in the SSH protocol re: treatment of packet sequence numbers) as follows:
    - The vulnerability only impacts encrypt-then-MAC digest algorithms in tandem
      with CBC ciphers, and ChaCha20-poly1305; of these, Paramiko currently only
      implements ``hmac-sha2-(256|512)-etm`` in tandem with 'AES-CBC'
    - As the fix for the vulnerability requires both ends of the connection to
      cooperate, the below changes will only take effect when the remote end is
      OpenSSH ≥ 9.6 (or equivalent, such as Paramiko in server mode, as of this
      patch version) and configured to use the new "strict kex" mode
    - Paramiko will always attempt to use "strict kex" mode if offered by the
      server, unless you override this by specifying 'strict_kex=False' in
      'Transport.__init__'
    - Paramiko will now raise an 'SSHException' subclass ('MessageOrderError')
      when protocol messages are received in unexpected order; this includes
      situations like receiving 'MSG_DEBUG' or 'MSG_IGNORE' during initial key
      exchange, which are no longer allowed during strict mode
    - Key (re)negotiation, i.e. 'MSG_NEWKEYS', whenever it is encountered, now
      resets packet sequence numbers (this should be invisible to users during
      normal operation, only causing exceptions if the exploit is encountered,
      which will usually result in, again, 'MessageOrderError')
    - Sequence number rollover will now raise 'SSHException' if it occurs during
      initial key exchange (regardless of strict mode status)
  - Tweak 'ext-info-(c|s)' detection during KEXINIT protocol phase; the original
    implementation made assumptions based on an OpenSSH implementation detail
  - 'Transport' grew a new 'packetizer_class' kwarg for overriding the
    packet-handler class used internally; this is mostly for testing, but advanced
    users may find this useful when doing deep hacks
  - A handful of lower-level classes (notably 'paramiko.message.Message' and
    'paramiko.pkey.PKey') previously returned 'bytes' objects from their
    implementation of '__str__', even under Python 3, and there was never any
    '__bytes__' method; these issues have been fixed by renaming '__str__' to
    '__bytes__' and relying on Python's default "stringification returns the
    output of '__repr__'" behavior re: any real attempts to 'str()' such objects


