# changelog

author: Solar Designer <solar@openwall.com> 8.7p1-34.3.el9_3.security.0.2
changelog:
  - Rebase 8.7p1-34.el9_3.security.0.1 on 8.7p1-34.3
  - Build without Kerberos support (shortens "ldd sshd" from 20 to 13 lines)


author: Solar Designer <solar@openwall.com> 8.7p1-34.3.el9_3.security.0.3
changelog:
  - Comment out GSSAPI* lines in /etc/ssh/ssh*_config.d/50-redhat.conf and patch
    the code to silently ignore GSSAPIKexAlgorithms when unsupported (like it is
    in our new without-Kerberos build)


author: Solar Designer <solar@openwall.com> - 2.34-60.el9.security.0.1
changelog:
  - Revise the texinfo documentation edit of glibc-2.34-alt-asprintf.patch via
    glibc-2.34-rocky-asprintf.patch


author: Solar Designer <solar@openwall.com> - 2.34-60.el9.security.0.2
changelog:
  - Add glibc-owl-alt-sanitize-env.patch stitched from several ALT Linux commits
    as none of their revisions matched this package's set of backports as-is
  - Add glibc-upstream-no-aaaa-CVE-2023-4527.patch based on upstream commit
    bd77dd7e73e3530203be1c52c8a29d08270cb25d fixing
    CVE-2023-4527: Stack read overflow with large TCP responses in no-aaaa mode


author: Solar Designer <solar@openwall.com> - 2.34-83.7.el9.security.0.3
changelog:
  - Rebase on 2.34-83.7, drop "our" CVE-2023-4527 patch in favor of RH's
    (a similar rebase was made on Oct 6 in 2.34-60.7.el9.security.0.3 for 9.2)


author: Solar Designer <solar@openwall.com> - 2.34-83.7.el9.security.0.4
changelog:
  - Harden syslog ident fallback initialization to use at most 64 characters of
    __progname when __libc_enable_secure, as inspired by Qualys' discovery of
    related vulnerabilities in newer glibc (not yet present in this version):
    https://www.openwall.com/lists/oss-security/2024/01/30/6
  - Harden qsort against nontransitive comparison functions as suggested by
    Qualys: https://www.openwall.com/lists/oss-security/2024/01/30/7


author: Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.5
changelog:
  - Rebase on 2.34-83.12
  - Add iconv() ISO-2022-CN-EXT CVE-2024-2961 fix from upstream glibc 2.34 branch


author: Solar Designer <solar@openwall.com> - 2.34-83.12.el9.security.0.6
changelog:
  - Add nscd CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602 fixes
    from upstream glibc 2.34 branch


