# changelog

author: Sander Hoentjen <shoentjen@antagonist.nl> - 2.0.3-1
changelog:
  - Update to new upstream
  - Fixes #2453419 (CVE-2026-27854)
  - Fixes #2453421 (CVE-2026-27853)
  - Fixes #2453426 (CVE-2026-24030)
  - Fixes #2453427 (CVE-2026-0397)
  - Fixes #2453429 (CVE-2026-24029)
  - Fixes #2453430 (CVE-2026-0396)
  - Fixes #2453431 (CVE-2026-24028)


author: Jens Petersen <petersen@redhat.com> - 2.31.5-1
changelog:
  - rebase to nix-2.31.5 using libgit_1.9
  - fixes GHSA-vh5x-56v6-4368
  - https://nix.dev/manual/nix/2.31/release-notes/rl-2.31.html


author: Paul Howarth <paul@city-fan.org> - 2.83-1
changelog:
  - Update to 2.83
    - Fix missing PNG regression (CPAN RT#153923) on old systems without the .pc,
      but gdlib-config (the check was too strict)


author: Paul Howarth <paul@city-fan.org> - 2.84-1
changelog:
  - Update to 2.84
    - Added Makefile.PL --with and --without options to bypass autodetection
      errors or upstream libgd or subsequent library errors (GH#55)
    - Better support MSWin32 without gdlib.pc (requires manual --options and
      --lib_gd_path)
    - Work around broken ExtUtils::PkgConfig->find (GH#61)
    - Fixed snprintf for newer MSVC (>= VS 2015)
    - Added GD::Image::supported() image types method
    - Added newFromTiffData() method
    - Fixed t/GD.t for unsupported image types
    - Add GIFANIM to the default since 2.0.33 (GH#56)
    - Honor PKG_CONFIG_PATH for finding gdlib.pc (GH#57)
    - Add demos/png2jpeg.pl
  - Don't disable XPM support if GD config doesn't explicitly require -lX11
  - Use %{make_build} and %{make_install}


author: Paul Howarth <paul@city-fan.org> - 2.85-1
changelog:
  - Update to 2.85
    - Tolerate runtime TIFF decode failures in autodetect (GH#62)
    - Replace cpm with cpanm in github actions
    - Fixed a minor precedence bug in t/z_manifest.t


author: Remi Collet <rcollet@redhat.com> - 8.3.12-1
changelog:
  - rebase to 8.3.12
  - disable pspell and imap extensions
  - disable pdo_dblib (missing freetds)
  - disable pdo_firebird (missing firebird)


author: Remi Collet <rcollet@redhat.com> - 8.3.12-3
changelog:
  - Fix Integer overflow in the dblib/firebird quoter causing OOB writes
    CVE-2024-11236
  - enable pdo_dblib extension


author: Remi Collet <rcollet@redhat.com> - 8.4.14-1
changelog:
  - build as php8.4-extras
  - update to 8.4.14
  - drop pspell an imap subpackages
  - add sodium-devel subpackage


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-6
changelog:
  - Fix support for building with no ENGINE support in OpenSSL (GH#1816)
  - Avoid potential null pointer dereference in mod_tls and mod_proxy (GH#1817)


author: Paul Howarth <paul@city-fan.org> - 1.3.8b-8
changelog:
  - Drop EL-7 support
    - Drop mod_geoip support
    - Drop mod_wrap support
    - Always build mod_proxy
    - Always use libpcre2
    - Always use maridb client library in preference to mysql
    - Always use libpq client library in preference to postgresql
    - Always use OpenSSL Cipher Profiles
  - Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
    onwards


author: Paul Howarth <paul@city-fan.org> - 1.3.9-0.1.rc2
changelog:
  - Update to 1.3.9rc2
    - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
    - Fix mod_sftp not advertising standard extensions for protocol version 3
      (GH#1570)
    - Fix mod_sftp "check-file" extension using wrong block size when offset and
      length are specified (GH#1569)
    - Use JSON for Controls protocol messages (GH#379)
    - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
    - Enforce requirement of preceding RewriteCondition for RewriteRule directives
      to avoid confusion (Bug #4495)
    - Implement LogFormat variable for data transfer average speed (GH#535)
    - Optimize per-connection file I/O when reading SFTPHostKey from disk
      (GH#1596)
    - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
      (GH#1610)
    - Reduce latency due to signal handling in the daemon process (GH#1623)
    - SSH key exchange requests should be classified into the "SEC" ExtendedLog
      class (GH#1626)
    - Update mod_exec to use the Jot API for resolving variables (GH#1630)
    - Use system TCP backlog value by default (GH#1636)
    - Gracefully handle directory creation requests when the directory already
      exists (GH#1639)
    - Remove asynchronous FTP responses emitted while computing digest values
      (GH#1661)
    - Support terminating connection after USER command when TLS is required
      (GH#1640)
    - Support OPTS commands for querying configured policy for resumed uploads,
      downloads (GH#1676)
    - MaxStoreFileSize for single user was not properly honored for SFTP uploads
      (GH#1686)
    - DisplayChdir using absolute path should work properly with DefaultRoot
      (GH#1688)
    - Clients should be disconnected when unable to be added to the
      ScoreboardFile (GH#1700)
    - Support injecting random delay when clients connect via DelayOnEvent
      (GH#1701)
    - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
    - Support obtaining default UID/GID values for AD directories in mod_ldap
      (GH#1716)
    - Update upload progress in scoreboard when throttling (GH#1433)
    - Null pointer reference encountered for FTPS connection due to config
      parser ignoring Include file problem (GH#1721)
    - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
    - mod_auth_otp should require per-user OTP entries by default (GH#1562)
    - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
      when using older OpenSSL versions (GH#1730)
    - Error resolving DNS name for implicit "server config" vhost lead to
      DelayTable not being found (GH#1746)
    - Log message for exceeding quota did not include the user/group/class quota
      type (GH#1749)
    - Build system failed for specific module names (GH#1756)
    - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
      (CVE-2023-48795, GH#1760)
  - Additional C compatibility fix


author: Paul Howarth <paul@city-fan.org> - 1.3.9-0.2.rc3
changelog:
  - Update to 1.3.9rc3
    - Bad handling of lack of extended attributes lead to SFTP out of memory
      error (GH#1785)
    - Using mod_facl and mod_vroot at same time caused unexpected permissions
      issues (GH#1780)
    - mod_sftp_sql logged "header value too long" due to unexpected key header
      text (GH#1529)
    - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
    - Implement limits@openssh.com SFTP extension (GH#1798)
    - Implement SFTPAuthPublicKeys directive for configuring the list of public
      key algorithms allowed for authentication (GH#1806)
    - Fix stack trace changing to directory with DisplayChdir file using %F
      variable on a large filesystem (GH#1819)
    - Remove inherited supplemental groups when started with root privileges
      (GH#1836)
    - SSH ECDSA host key algorithms were not being used as expected despite
      configuring appropriate key (GH#1839)
    - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
      (GH#1840)
    - Supplemental group inheritance granted unintended access to GID 0 due to
      lack of supplemental groups from mod_sql (GH#1830)


author: Paul Howarth <paul@city-fan.org> - 1.3.9-0.3.rc3
changelog:
  - Update mod_vroot to 0.9.12
    - Implement a realpath(3) callback for the FSIO API, for better
      interoperability of other modules when mod_vroot is in effect


author: Paul Howarth <paul@city-fan.org> - 1.3.9-1
changelog:
  - Update to 1.3.9
    - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
      unexpected behavior (GH#1855)
    - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
    - Added Polish translation (Bug #4511)
    - SFTP channel allocations can lead to high memory utilization over time
      (GH#1876)
    - Update libtool.m4 for better MacOSX support (GH#1878)
  - Update mod_proxy to 0.9.5
    - Implemented new IgnoreForeignAddress ProxyOption
    - Fixed passive data transfers to backend IPv4 address when IPv6 support is
      enabled


author: Paul Howarth <paul@city-fan.org> - 1.3.9a-1
changelog:
  - Update to 1.3.9a
    - SCP transfers failed for files with spaces in their names (GH#1886)
    - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
    - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
      option was used (Bug #4512)
    - mod_sftp failed to parse authorized user/host public keys with CRLF line
      endings (GH#1904)
    - Uploads using MODE Z sometimes resulted in corrupted files or broken
      transfers (GH#1896)
    - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
      versions (GH#1911)
    - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
    - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
    - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
      (GH#1964)
    - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
      (GH#1960)
    - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
      loop using newer OpenSSL versions (GH#1963)
    - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
      (GH#1984)
    - RNTO before authentication lead to out-of-order response codes (GH#2003)
    - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
      (GH#2009)
    - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
      (GH#2019)
    - Out-of-bounds single byte read when FTP command input buffer starts with LF
      (GH#2020)
    - FTP command LIST/NLST -B could cause buffer overflow when listing certain
      crafted filenames (GH#2030)
    - Memory exhaustion with mod_log_forensic when downloading very large files
      via SFTP (GH#2043)
    - Setting process groups during authentication crashed when using mod_radius
      and <IfGroup> (GH#2046)
    - SQL injection possible via mod_sql because of is_escaped_text() logic error
      (GH#2052, CVE-2026-42167)


author: Paul Howarth <paul@city-fan.org> - 1.3.9a-2
changelog:
  - Additional escaping for avoidance of SQL injection issues with %{note:...}
    and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
    1.3.9a
  - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
    (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)


author: Paul Howarth <paul@city-fan.org> - 1.3.9b-1
changelog:
  - Update to 1.3.9b
    - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
      CVE-2026-44331)
    - Additional fix for session management with OpenSSL 3.2.x or later, when
      using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
    - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
      expected (GH#2098)
    - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
      in mod_sftp (GH#2102)
    - SSH packet with empty payload triggered null pointer dereference in
      mod_sftp (GH#2104)
    - Bad DSA signatures could lead to out-of-bounds read of heap memory in
      mod_sftp (GH#2106)
    - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
      mod_sftp (GH#2108)
    - SFTP request payload length underflow calculation in mod_sftp (GH#2115)
    - Several modules failed to build using OpenSSL 4.0 (GH#2120)
  - Update mod_proxy to 0.9.7
    - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
    - Set the payload_len field before checking its value (GH#292)
    - Keep the SSH packet reading code in mod_proxy more in line with what is
      done in mod_sftp, for legibility (GH#294)
    - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
      (GH#295, GH#296)
    - Correct misspellings noted by codespell (GH#297)
    - Use clang-tidy to start polishing the codebase (GH#298)
    - Disable the Nagle algorithm by default on our TCP connections to back-end
      servers (GH#299)
    - Require OpenSSL for building (GH#249, GH#300)
    - Documentation fixes
    - Implement a limit on the number of EXT_INFO extensions we'll be willing to
      accept (GH#303)
    - Comparison of expected/provided MAC data should be done in a constant-time
      manner
    - Support PKCS11-stored private keys
    - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
      post-quantum SSH key exchange mechanisms (GH#306)
    - Add sanity check for SRV record lengths
    - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
      does not underflow
    - If we detect a bad DSA signature length, properly error out
    - Ensure that RSA/DSA signatures match their expected algorithm types, and
      avoid null pointer dereferences
    - Update to build against OpenSSL 4.x (GH#313)


author: Robert Scheck <robert@fedoraproject.org> 13.0.2-4
changelog:
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371331, thanks to Marcos Mello)
  - Do not use removed /etc/pki/tls/certs/ca-bundle.crt bundle file
    for Fedora 43 >= and RHEL >= 11


author: Tom Callaway <spot@fedoraproject.org> - 13.0.4-2
changelog:
  - rebuild for lua 5.5
  - apply upstream fix for configure
  - make a new patch to actually support lua 5.5


author: Robert Scheck <robert@fedoraproject.org> 1.11.2-4
changelog:
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371326, thanks to Marcos Mello)


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 0.18.0-1
changelog:
  - Update to 0.18.0 - Closes rhbz#2355627 rhbz#2354447 rhbz#2352331
    rhbz#2350845 rhbz#2348839 rhbz#2331990


author: David Trudgian <dtrudg@sylabs.io> - 4.4.2-1
changelog:
  - Upgrade to 4.4.2 upstream version.
  - Fix rhbz#2452368
  - Fix rhbz#2453084
  - Fix rhbz#2455643
  - Fix rhbz#2458928
  - Fix CVE-2026-47215


author: Marcel Härry <mh+fedora@scrit.ch>- 0.4.8.21-2
changelog:
  - Fix build issue on newer glibc - https://gitlab.torproject.org/tpo/core/tor/-/issues/41170
  - Include /etc/torrc.d/*.conf by default to avoid modifications from the core package (bz#2338912)


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.5-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-9-5/21227
  - Enable seccomp on aarch64, which is now supported


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.6-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-23-and-0-4-9-6/21386


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.9.8-1
changelog:
  - Update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-25-and-0-4-9-8/21559
  - Fix CVE-2026-44600 (bz#2476455 / bz#2476454)
  - Fix CVE-2026-44599 (bz#2476453 / bz#2476452)
  - Fix CVE-2026-44597 (bz#2476451 / bz#2476450)
  - Fix CVE-2026-44601 (bz#2467732 / bz#2467731)
  - Fix CVE-2026-44603 (bz#2467720 / bz#2467719)
  - Fix CVE-2026-44602 (bz#2467718 / nz@2467717)


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.0-1
changelog:
  - update to 1.33.0 rhbz#2342073
    Fix GHSA-f7r5-w49x-gxm3 Getting access to the Admin Panel via CSRF
    Fix CVE-2025-24364 RCE in the admin panel
    Fix CVE-2025-24365 escalation of privilege via variable confusion in OrgHeaders trait


author: Jonathan Wright <jonathan@almalinux.org> - 1.33.2-1
changelog:
  - update to 1.33.2 rhbz#2343535
    Fix CVE-2025-0977 ssl::select_next_proto use after free rhbz#2344558


author: Jonathan Wright <jonathan@almalinux.org> - 1.36.0-1
changelog:
  - update to 1.36.0 rhbz#2368636
  - Fix bitwarden mobile app not working rhbz#2437599
  - Fix CVE-2025-58160 vaultwarden: Tracing log pollution
  - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass
  - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack
  - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions
  - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update
  - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control
  - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion


