# changelog

author: Gael Duperrey <gduperrey@vates.fr> - 2.22.20-3.1
changelog:
  - initial package, version 2.22.20-3.1
  - Synced from XS driver SRPM intel-i40e-2.22.20-3.xs8~2_1.src.rpm


author: Gael Duperrey <gduperrey@vates.tech> - 2.22.20-5.1
changelog:
  - Synced with intel-i40e-2.22.20-5.xs8~2_1.src.rpm
  - *** Upstream changelog ***
  - * Tue Feb 27 2024 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.22.20-5
  - - CA-386057: Enable legacy-rx by default to resolve performance issue
  - - Note: 2.22.20-5 is for Yangtze, while 2.22.20-4 is for XS8 (rt-next)


author: Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.7
changelog:
  - CP-33305: Try and protect OVS from OOM
  - Roll CP-33305-dont-kill-ovs.patch into CP-15129-Convert-to-use-systemd-services.patch
  - CA-331103: Fix crash in mbundle_lookup()


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 2.5.3-2.3.10.2
changelog:
  - Rebuild for updated xs-openssl in XCP-ng 8.2.1
  - Not sure it's required but better safe than sorry


author: Gael Duperrey <gduperrey@vates.fr> - 2.5.3-2.3.11.2
changelog:
  - Sync to hotfix XS82ECU1008
  - *** Upstream changelog ***
  - * Thu Mar 24 2022 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.11
  - - CA-364343: Honour updelay when LACP is used
  - - CA-367973: Backport bond-related patches to fix XSI-1198


author: Gael Duperrey <gduperrey@vates.fr> - 2.5.3-2.3.12.1
changelog:
  - Sync to hotfix XS82ECU1017
  - *** Upstream changelog ***
  - * Mon Aug 08 2022 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.12
  - - CA-351960 / CA-369139: CVE-2020-35498: Support extra padding length
  - - CA-357261: Hide expected errors from logrotate script


author: David Morel <david.morel@vates.tech> - 2.5.3-2.3.12.2
changelog:
  - Comment out tests that fail
  - Enable make check in spec file, without parallel tests
  - Fix CVE-2023-5366, manual backport from 2.17
  - Backport fix for CVE-2023-1668 from XS 8.3/8.4 version 2.5.3-2.3.14
  - *** Upstream changelog ***
  - * Tue Apr 18 2023 Ross Lagerwall <ross.lagerwall@citrix.com> - 2.5.3-2.3.14
  - - CA-376367: Fix CVE-2023-1668


author: David Morel <david.morel@vates.tech> - 2.5.3-2.3.12.3
changelog:
  - link with xs-openssl instead of openssl
  - fix compilation with an openssl from 1.1.1 branch
  - add an openssl configuration to disable weak ciphers and older TLS versions


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1:1.1.1k-5.1
changelog:
  - Manually sync with CentOS 8's 1.1.1k-5 as Citrix did not update for CH 8.2.1
  - Use the hobbled sources instead of the full sources, as RHEL/CentOS does
  - Rediff Citrix's patch use-linux-random-header.patch


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1:1.1.1k-5.2
changelog:
  - Fix failing tests due to expired certificates in test data
  - Disable zlib to remove TLS compression support
  - Remove extraneous --system-ciphers-file configure option


author: Samuel Verschelde <stormi-xcp@ylix.fr> - 1:1.1.1k-6.1
changelog:
  - Sync with Centos 8 Stream's 1.1.1k-6.
  - *** Upstream changelog ***
  - * Wed Mar 23 2022 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
  - - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - - Resolves: rhbz#2067146


author: David Morel <david.morel@vates.fr> - 1:1.1.1k-9.1
changelog:
  - Sync with Centos 8 Stream's 1.1.1k-9.
  - Remove update-expired-SCT-certificates patch as it is integrated upstream
  - *** Upstream changelog ***
  - * Wed Feb 08 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
  - - Fixed Timing Oracle in RSA Decryption
  -   Resolves: CVE-2022-4304
  - - Fixed Double free after calling PEM_read_bio_ex
  -   Resolves: CVE-2022-4450
  - - Fixed Use-after-free following BIO_new_NDEF
  -   Resolves: CVE-2023-0215
  - - Fixed X.400 address type confusion in X.509 GeneralName
  -   Resolves: CVE-2023-0286
  - * Thu Jul 21 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-8
  - - Fix no-ec build
  -   Resolves: rhbz#2071020
  - * Tue Jul 05 2022 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
  - - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
  -   Resolves: CVE-2022-2097
  - - Update expired certificates used in the testsuite
  -   Resolves: rhbz#2092462
  - - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
  -   Resolves: rhbz#2090372
  - - Fix CVE-2022-2068: the c_rehash script allows command injection
  -   Resolves: rhbz#2098279


author: David Morel <david.morel@vates.tech> - 1:1.1.1k-12.1
changelog:
  - Sync with Centos 8 Stream's 1.1.1k-12.
  - Do not package openssl.cnf at all for xs-openssl, the system-wide one will be
    the one packaged with openssl.
  - *** Upstream changelog ***
  - * Thu Nov 30 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-12
  - - Backport implicit rejection mechanism for RSA PKCS#1 v1.5 to RHEL-8 series
  -   (a proper fix for CVE-2020-25659)
  -   Resolves: RHEL-17696
  - * Wed Nov 15 2023 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-11
  - - Fix CVE-2023-5678: Generating excessively long X9.42 DH keys or checking
  -   excessively long X9.42 DH keys or parameters may be very slow
  -   Resolves: RHEL-16538
  - * Thu Oct 19 2023 Clemens Lang <cllang@redhat.com> - 1:1.1.1k-10
  - - Fix CVE-2023-3446: Excessive time spent checking DH keys and parameters
  -   Resolves: RHEL-14245
  - - Fix CVE-2023-3817: Excessive time spent checking DH q parameter value
  -   Resolves: RHEL-14239


