# changelog

author: Remi Collet <remi@remirepo.net> - 2.3.3-1
changelog:
  - update to 2.3.3
  - open https://github.com/libgd/libgd/pull/766 missing macros
  - open https://github.com/libgd/libgd/pull/767 missing headers


author: Remi Collet <remi@remirepo.net> - 2.3.3-2
changelog:
  - Explicitly enable gd/gd2 formats, wanted by perl bindings (#2005916)
  - open https://github.com/libgd/libgd/pull/776


author: Remi Collet <remi@fedoraproject.org> - 1.0.16-2
changelog:
  - move libraries in new libs sub packages
  - add provides for bundled(bobjenkins-hash) #1041351
  - apply libpthread workaround #1037707
  - spec cleanups


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - drop dependency on zlib-devel and bzip2-devel no more
    referenced in libzip.pc
  - drop rpath patch merged upstream


author: Remi Collet <remi@remirepo.net> - 1.5.2-1
changelog:
  - update to 1.5.2
  - add all explicit cmake options to ensure openssl is used
    even in local build with other lilbraries available


author: Remi Collet <remi@remirepo.net> - 1.7.0-1
changelog:
  - update to 1.7.0
  - really enable lzma support (excepted on EL-6)
  - patch zipconf.h to re-add missing LIBZIP_VERSION_* macros


author: Remi Collet <remi@remirepo.net> - 1.7.2-1
changelog:
  - update to 1.7.2
  - fix installation layout using patch from
    https://github.com/nih-at/libzip/pull/190
  - fix pkgconfig usability using patch from
    https://github.com/nih-at/libzip/pull/191


author: Remi Collet <remi@remirepo.net> -6.9.4-1
changelog:
  - update to 6.9.4 (from Fedora)
  - report build failure on EL-6
    https://github.com/kkos/oniguruma/issues/166


author: Remi Collet <remi@remirepo.net> -6.9.5+rev1-4
changelog:
  - From Fedora: Revert fix for CVE-2020-26159, marked as false
    https://github.com/kkos/oniguruma/issues/221


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2
changelog:
  - do not try to use EC groups disallowed in FIPS mode
    in TLS
  - fix Valgrind regression with constant-time code


author: Robert Scheck <robert@fedoraproject.org> 1.1.1c-2
changelog:
  - backport from 1.1.1c-15: add selftest of the RAND_DRBG implementation
  - backport from 1.1.1c-14: fix incorrect error return value from FIPS_selftest_dsa
  - backport from 1.1.1c-14: S390x: properly restore SIGILL signal handler
  - backport from 1.1.1c-12: additional fix for the edk2 build
  - backport from 1.1.1c-9: disallow use of SHA-1 signatures in TLS in FIPS mode
  - backport from 1.1.1c-8: fix CVE-2019-1547 - side-channel weak encryption vulnerability
  - backport from 1.1.1c-8: fix CVE-2019-1563 - padding oracle in CMS API
  - backport from 1.1.1c-8: fix CVE-2019-1549 - ensure fork safety of the DRBG
  - backport from 1.1.1c-8: fix handling of non-FIPS allowed EC curves in FIPS mode
  - backport from 1.1.1c-8: fix TLS compliance issues
  - backport from 1.1.1c-7: backported ARM performance fixes from master
  - backport from 1.1.1c-6: backport of S390x ECC CPACF enhancements from master
  - backport from 1.1.1c-6: FIPS mode: properly disable 1024 bit DSA key generation
  - backport from 1.1.1c-6: FIPS mode: skip ED25519 and ED448 algorithms in openssl speed
  - backport from 1.1.1c-6: FIPS mode: allow AES-CCM ciphersuites
  - backport from 1.1.1c-5: make the code suitable for edk2 build
  - backport from 1.1.1c-4: backport of SSKDF from master
  - backport from 1.1.1c-3: backport of KBKDF and KRB5KDF from master


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-1
changelog:
  - backport from 1.1.1g-11: Further changes for SP 800-56A rev3 requirements
  - backport from 1.1.1g-9: Rewire FIPS_drbg API to use the RAND_DRBG
  - backport from 1.1.1g-9: Use the well known DH groups in TLS even for 2048 and 1024 bit parameters
  - backport from 1.1.1g-7: Disallow dropping Extended Master Secret extension on renegotiation
  - backport from 1.1.1g-7: Return alert from s_server if ALPN protocol does not match
  - backport from 1.1.1g-7: SHA1 is allowed in @SECLEVEL=2 only if allowed by TLS SigAlgs configuration
  - backport from 1.1.1g-6: Add FIPS selftest for PBKDF2 and KBKDF
  - backport from 1.1.1g-5: Allow only well known DH groups in the FIPS mode
  - backport from 1.1.1g-1: update to the 1.1.1g release
  - backport from 1.1.1g-1: FIPS module installed state definition is modified


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-2
changelog:
  - backport from 1.1.1g-12: Fix CVE-2020-1971 ediparty null pointer dereference
  - backport from 1.1.1g-11.1: Implemented new FIPS requirements in regards to KDF and DH selftests
  - backport from 1.1.1g-11.1: Disallow certificates with explicit EC parameters


author: Robert Scheck <robert@fedoraproject.org> 1.1.1g-3
changelog:
  - backport from 1.1.1g-15: version bump
  - backport from 1.1.1g-14: CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
  - backport from 1.1.1g-13: Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-1
changelog:
  - backport from 1.1.1k-4: Fixes bugs in s390x AES code
  - backport from 1.1.1k-4: Uses the first detected address family if IPv6 is not available
  - backport from 1.1.1k-4: Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx could
    early callback instead of servername callback. Resolves: rhbz#197821, related: rhbz#1934534
  - backport from 1.1.1k-3: Cleansup the peer point formats on renegotiation. Resolves rhbz#1965362
  - backport from 1.1.1k-2: Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - backport from 1.1.1k-2: Using safe primes for FIPS DH self-test
  - backport from 1.1.1k-1: Update to version 1.1.1k
  - backport from 1.1.1g-16: Use AI_ADDRCONFIG only when explicit host name is given
  - backport from 1.1.1g-16: Allow only curves defined in RFC 8446 in TLS 1.3


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-2
changelog:
  - backport from 1.1.1k-5: CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
    Resolves: rhbz#2005402


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-3
changelog:
  - backport from 1.1.1k-6: CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    Resolves: rhbz#2067145


author: Robert Scheck <robert@fedoraproject.org> 1.1.1k-4
changelog:
  - backport from 1.1.1k-7: CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - backport from 1.1.1k-7: Update expired certificates used in the testsuite
    Resolves: rhbz#2100554
  - backport from 1.1.1k-7: CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090371
  - backport from 1.1.1k-7: CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098278


author: Remi Collet <remi@remirepo.net> - 1:1.10.10-3
changelog:
  - update Archive_Tar to 1.4.9
  - add patch for XML_Util and PHP 7.4 from
    https://github.com/pear/XML_Util/pull/11


author: Valdur Palm <vpalm@perforce.com> - 7.2.34.8-2
changelog:
  - Download timezonedb.h from php-ce master, stop using system tzdb
  - Use release number from env PBLD_RPM_RELEASE


author: Remi Collet <remi@remirepo.net> - 3.1.4-2
changelog:
  - add upstream patch for test suite
  - add patch for PHP 8.0.0beta3 from
    https://github.com/igbinary/igbinary/pull/284


author: Remi Collet <remi@remirepo.net> - 3.4.4-10
changelog:
  - drop dependency on ImageMagick6-libs for EL-7.8
    see https://github.com/remicollet/remirepo/issues/144


author: Remi Collet <remi@remirepo.net> - 3.4.4-12
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/Imagick/imagick/pull/346 - SPL always there
    https://github.com/Imagick/imagick/pull/347 - thread limit per request
    https://github.com/Imagick/imagick/pull/348 - single thread


author: Remi Collet <remi@remirepo.net> - 3.4.4-13
changelog:
  - add patch for test suite with PHP 8 from
    https://github.com/Imagick/imagick/pull/350 - simpler warning


author: Remi Collet <remi@remirepo.net> - 3.1.5-3
changelog:
  - add patches for PHP 8 from
    https://github.com/php-memcached-dev/php-memcached/pull/461
    https://github.com/php-memcached-dev/php-memcached/pull/463


author: Remi Collet <remi@remirepo.net> - 2.0.6-2
changelog:
  - add fix for PHP 8 from
    https://github.com/php/pecl-web_services-oauth/pull/16
  - enable test suite


author: Remi Collet <remi@remirepo.net> - 5.3.1-2
changelog:
  - add patches for PHP 8 from upstream and
    https://github.com/phpredis/phpredis/pull/1845
  - disable msgpack serializer with PHP 8


author: Remi Collet <remi@remirepo.net> 1.0-2
changelog:
  - add conflict between php73-syspaths and php80-syspaths
  - add conflict between php74-syspaths and php80-syspaths


author: Valdur Palm <vpalm@perfporce.com> - 3.17.3-1
changelog:
  - ZendPHP fork from 3.5.0-13-el8, removed all except main library and devel packages
  - Added php extensions build


