<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="49">
<package pkgid="0b7c0fa4400b7fc3468779a03ce08e99730540e7808e07d2109196602734a36f" name="bitcoin-core-debuginfo" arch="s390x">
  <version epoch="0" ver="31.1" rel="1.el10_2"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 30.2-4" date="1777723200">- RPMAUTOSPEC: unresolvable merge</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-1" date="1777723201">- Update to 31.0</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-2" date="1777723202">- Replace bitcoin-core-devel with libbitcoinkernel-devel</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.1-1" date="1784548800">- Update to 31.1</changelog>
</package>
<package pkgid="776ae48dbb88b3e384de53ad15832da5db5d7741940178d7f0baab667c36abf9" name="bitcoin-core-debugsource" arch="s390x">
  <version epoch="0" ver="31.1" rel="1.el10_2"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 30.2-4" date="1777723200">- RPMAUTOSPEC: unresolvable merge</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-1" date="1777723201">- Update to 31.0</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-2" date="1777723202">- Replace bitcoin-core-devel with libbitcoinkernel-devel</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.1-1" date="1784548800">- Update to 31.1</changelog>
</package>
<package pkgid="e38ac54c04816bffa7727bad31922618241e0497a7721651b3aea6d5023b8a54" name="bitcoin-core-desktop-debuginfo" arch="s390x">
  <version epoch="0" ver="31.1" rel="1.el10_2"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 30.2-4" date="1777723200">- RPMAUTOSPEC: unresolvable merge</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-1" date="1777723201">- Update to 31.0</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-2" date="1777723202">- Replace bitcoin-core-devel with libbitcoinkernel-devel</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.1-1" date="1784548800">- Update to 31.1</changelog>
</package>
<package pkgid="f1a85843e1eb2e25dbf655a01388b0b4ee1e9b9edfa8e3b5dd2b05a49b4b34a1" name="bitcoin-core-server-debuginfo" arch="s390x">
  <version epoch="0" ver="31.1" rel="1.el10_2"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 30.2-4" date="1777723200">- RPMAUTOSPEC: unresolvable merge</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-1" date="1777723201">- Update to 31.0</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-2" date="1777723202">- Replace bitcoin-core-devel with libbitcoinkernel-devel</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.1-1" date="1784548800">- Update to 31.1</changelog>
</package>
<package pkgid="0b7743600d82d2bfe3341019b8b4e37c50602485f7c56204eac663a8b720308b" name="bitcoin-core-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="31.1" rel="1.el10_2"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 30.2-4" date="1777723200">- RPMAUTOSPEC: unresolvable merge</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-1" date="1777723201">- Update to 31.0</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-2" date="1777723202">- Replace bitcoin-core-devel with libbitcoinkernel-devel</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.1-1" date="1784548800">- Update to 31.1</changelog>
</package>
<package pkgid="fcdcc4ae118c3cacd0e19971eafe62668f572f21674c31b4597a54cef05f5763" name="converseen-debuginfo" arch="s390x">
  <version epoch="0" ver="0.15.2.7" rel="2.el10_2"/>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.2-1" date="1774526400">- update to 0.15.2.2</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.3-1" date="1776081600">- update to 0.15.2.3 fixes rhbz#2457847</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.3-2" date="1780142400">- opt-in to packit</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.4-1" date="1780142401">- Update to 0.15.2.4 upstream release
- Resolves: rhbz#2480322</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.15.2.5-1" date="1780315200">- Update to 0.15.2.5 upstream release
- Resolves: rhbz#2483749</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.15.2.6-1" date="1783512000">- Update to 0.15.2.6 upstream release
- Resolves: rhbz#2498237</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.15.2.6-2" date="1784116800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.6-3" date="1784462400">- drop ix86 support</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.15.2.7-1" date="1784548800">- Update to 0.15.2.7 upstream release
- Resolves: rhbz#2502842</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.7-2" date="1784548801">- simplify .gitignore file</changelog>
</package>
<package pkgid="e14e9244a5acc3cdadc931da404d1b9c8b771f48f93cb7845c46c36e2be14193" name="converseen-debugsource" arch="s390x">
  <version epoch="0" ver="0.15.2.7" rel="2.el10_2"/>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.2-1" date="1774526400">- update to 0.15.2.2</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.3-1" date="1776081600">- update to 0.15.2.3 fixes rhbz#2457847</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.3-2" date="1780142400">- opt-in to packit</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.4-1" date="1780142401">- Update to 0.15.2.4 upstream release
- Resolves: rhbz#2480322</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.15.2.5-1" date="1780315200">- Update to 0.15.2.5 upstream release
- Resolves: rhbz#2483749</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.15.2.6-1" date="1783512000">- Update to 0.15.2.6 upstream release
- Resolves: rhbz#2498237</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.15.2.6-2" date="1784116800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.6-3" date="1784462400">- drop ix86 support</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.15.2.7-1" date="1784548800">- Update to 0.15.2.7 upstream release
- Resolves: rhbz#2502842</changelog>
  <changelog author="Filipe Rosset &lt;rosset.filipe@gmail.com&gt; - 0.15.2.7-2" date="1784548801">- simplify .gitignore file</changelog>
</package>
<package pkgid="f3458326b6f1c332f465ed5b11ae8081398a9145ce2cf2d1eafd3d4daac99921" name="cube-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.1" rel="2.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.2-5" date="1737028800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Jan Andre Reuter &lt;j.reuter@fz-juelich.de&gt; - 4.8.2-6" date="1745496000">- Fix bash-completion (rhbz#2315798)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-1" date="1745496001">- Update to v4.9
- Remove el7 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9-2" date="1753272000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-3" date="1761220800">- Reinstate cube-devel package (#2406039)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-1" date="1767787200">- Update to v4.9.1 [#2427578]</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-2" date="1784548800">- Don't include libcube4gui.so in cube-libs-devel</changelog>
</package>
<package pkgid="31d52b58cb531c0df2626eefad17e0a67cd326058eff372dad40a31a5b8927d9" name="cube-debugsource" arch="s390x">
  <version epoch="0" ver="4.9.1" rel="2.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.2-5" date="1737028800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Jan Andre Reuter &lt;j.reuter@fz-juelich.de&gt; - 4.8.2-6" date="1745496000">- Fix bash-completion (rhbz#2315798)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-1" date="1745496001">- Update to v4.9
- Remove el7 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9-2" date="1753272000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-3" date="1761220800">- Reinstate cube-devel package (#2406039)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-1" date="1767787200">- Update to v4.9.1 [#2427578]</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-2" date="1784548800">- Don't include libcube4gui.so in cube-libs-devel</changelog>
</package>
<package pkgid="771b01ad3e0fa56df4d86e83f277825581de8481dfae70b9ca76768979e82b4a" name="cube-guilib-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.1" rel="2.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.2-5" date="1737028800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Jan Andre Reuter &lt;j.reuter@fz-juelich.de&gt; - 4.8.2-6" date="1745496000">- Fix bash-completion (rhbz#2315798)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-1" date="1745496001">- Update to v4.9
- Remove el7 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9-2" date="1753272000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-3" date="1761220800">- Reinstate cube-devel package (#2406039)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-1" date="1767787200">- Update to v4.9.1 [#2427578]</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-2" date="1784548800">- Don't include libcube4gui.so in cube-libs-devel</changelog>
</package>
<package pkgid="1d61d48fdc0ca445663f075e2e923bc05ee02de4a25a3a0bf997116a687608bf" name="cube-guilib-devel-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.1" rel="2.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.2-5" date="1737028800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Jan Andre Reuter &lt;j.reuter@fz-juelich.de&gt; - 4.8.2-6" date="1745496000">- Fix bash-completion (rhbz#2315798)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-1" date="1745496001">- Update to v4.9
- Remove el7 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9-2" date="1753272000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-3" date="1761220800">- Reinstate cube-devel package (#2406039)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-1" date="1767787200">- Update to v4.9.1 [#2427578]</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-2" date="1784548800">- Don't include libcube4gui.so in cube-libs-devel</changelog>
</package>
<package pkgid="694bbf2db88af2e2d82d78ee1cdcca232fb98e5b0704b081f6e4ca7010543a90" name="cube-libs-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.1" rel="2.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.2-5" date="1737028800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Jan Andre Reuter &lt;j.reuter@fz-juelich.de&gt; - 4.8.2-6" date="1745496000">- Fix bash-completion (rhbz#2315798)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-1" date="1745496001">- Update to v4.9
- Remove el7 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9-2" date="1753272000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-3" date="1761220800">- Reinstate cube-devel package (#2406039)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-1" date="1767787200">- Update to v4.9.1 [#2427578]</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-2" date="1784548800">- Don't include libcube4gui.so in cube-libs-devel</changelog>
</package>
<package pkgid="1fde0a182d7ffa3d3951ae94e436e0d5d559acb8709f07d760855b20d07cc8e1" name="cube-libs-devel-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.1" rel="2.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.2-5" date="1737028800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Jan Andre Reuter &lt;j.reuter@fz-juelich.de&gt; - 4.8.2-6" date="1745496000">- Fix bash-completion (rhbz#2315798)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-1" date="1745496001">- Update to v4.9
- Remove el7 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9-2" date="1753272000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9-3" date="1761220800">- Reinstate cube-devel package (#2406039)</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-1" date="1767787200">- Update to v4.9.1 [#2427578]</changelog>
  <changelog author="Dave Love &lt;loveshack@fedoraproject.org&gt; - 4.9.1-2" date="1784548800">- Don't include libcube4gui.so in cube-libs-devel</changelog>
</package>
<package pkgid="31c1653cdf8a0759133bf2dcbed1d09c8ec9f0d4b2450abb932e6a41fcbcb5af" name="haveged-debuginfo" arch="s390x">
  <version epoch="0" ver="1.9.26" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.9.18-10" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.9.18-11" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.21-1" date="1779278400">- Update to 1.9.21
- Security fix: CVE-2026-41054 — privilege escalation via command socket
- Fix semaphore error handling (SEM_FAILED vs NULL)
- Fix /dev/shm permissions (use 01777 with sticky bit)</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.22-1" date="1779364800">- Update to 1.9.22
- Fix systemd sandboxing: add ReadWritePaths=/dev/shm for semaphore creation</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.23-1" date="1781784000">- Update to 1.9.23
- Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
- Security: fix OOB memory access in safein()/safeout() on socket errors
- Security: reject command socket connections from different user namespaces
- Security: use O_NOFOLLOW for PID file to prevent symlink attacks
- Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
- Fix stale semaphore recovery after SIGKILL
- Fix compilation when NO_COMMAND_MODE is defined</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.23-2" date="1781784001">- Add SELinux policy module to allow semaphore creation in /dev/shm
- Add rpminspect.yaml to waive pre-existing annocheck false positive</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.23-3" date="1781870400">- Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
  (annocheck is a security inspection and cannot be disabled via inspections section)</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.24-1" date="1781870401">- Update to 1.9.24
- Disable command mode in long-running service (--no-command flag)
- Enable PrivateNetwork=true in systemd service
- Remove SELinux policy module (no longer needed without command mode)</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.25-1" date="1782302400">- Update to 1.9.25
- Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
- Add haveged-initramfs.service for use inside the initramfs</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.26-1" date="1782302401">- Update to 1.9.26
- Fix 100% CPU spin when --no-command is used (BZ#2492029)</changelog>
</package>
<package pkgid="ace4a2d7505644cf8b2eb179159f6d34532f613489dedf28acacf336d797649f" name="haveged-debugsource" arch="s390x">
  <version epoch="0" ver="1.9.26" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.9.18-10" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.9.18-11" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.21-1" date="1779278400">- Update to 1.9.21
- Security fix: CVE-2026-41054 — privilege escalation via command socket
- Fix semaphore error handling (SEM_FAILED vs NULL)
- Fix /dev/shm permissions (use 01777 with sticky bit)</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.22-1" date="1779364800">- Update to 1.9.22
- Fix systemd sandboxing: add ReadWritePaths=/dev/shm for semaphore creation</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.23-1" date="1781784000">- Update to 1.9.23
- Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
- Security: fix OOB memory access in safein()/safeout() on socket errors
- Security: reject command socket connections from different user namespaces
- Security: use O_NOFOLLOW for PID file to prevent symlink attacks
- Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
- Fix stale semaphore recovery after SIGKILL
- Fix compilation when NO_COMMAND_MODE is defined</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.23-2" date="1781784001">- Add SELinux policy module to allow semaphore creation in /dev/shm
- Add rpminspect.yaml to waive pre-existing annocheck false positive</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.23-3" date="1781870400">- Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
  (annocheck is a security inspection and cannot be disabled via inspections section)</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.24-1" date="1781870401">- Update to 1.9.24
- Disable command mode in long-running service (--no-command flag)
- Enable PrivateNetwork=true in systemd service
- Remove SELinux policy module (no longer needed without command mode)</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.25-1" date="1782302400">- Update to 1.9.25
- Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
- Add haveged-initramfs.service for use inside the initramfs</changelog>
  <changelog author="Jirka Hladky &lt;hladky.jiri@gmail.com&gt; - 1.9.26-1" date="1782302401">- Update to 1.9.26
- Fix 100% CPU spin when --no-command is used (BZ#2492029)</changelog>
</package>
<package pkgid="41dbbeb9562e0a4cd92aa48f7cbdaa6061e64cf4558563f8aac946f638f64d7f" name="libbitcoinkernel-debuginfo" arch="s390x">
  <version epoch="0" ver="31.1" rel="1.el10_2"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 30.2-4" date="1777723200">- RPMAUTOSPEC: unresolvable merge</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-1" date="1777723201">- Update to 31.0</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-2" date="1777723202">- Replace bitcoin-core-devel with libbitcoinkernel-devel</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.1-1" date="1784548800">- Update to 31.1</changelog>
</package>
<package pkgid="215b4ba4921dde05f60b7cec949dd07bf11a1d1ff65d495694b2ab3b7da108c8" name="libbitcoinkernel-devel-debuginfo" arch="s390x">
  <version epoch="0" ver="31.1" rel="1.el10_2"/>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 30.2-4" date="1777723200">- RPMAUTOSPEC: unresolvable merge</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-1" date="1777723201">- Update to 31.0</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.0-2" date="1777723202">- Replace bitcoin-core-devel with libbitcoinkernel-devel</changelog>
  <changelog author="Simone Caronni &lt;negativo17@gmail.com&gt; - 31.1-1" date="1784548800">- Update to 31.1</changelog>
</package>
<package pkgid="cad64572c6df5a03f36e8518bb0a3e03376a4f6131412464fe68f26847505b33" name="mapserver-debuginfo" arch="s390x">
  <version epoch="0" ver="8.6.5" rel="1.el10_2"/>
  <changelog author="Elliott Sales de Andrade &lt;quantum.analyst@gmail.com&gt; - 8.6.0-4" date="1769342400">- Drop support for i686</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.1-1" date="1774612800">- Update to 8.6.1</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.2-1" date="1776859200">- Update to 8.6.2</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.3-1" date="1778241600">- Update to 8.6.3</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-1" date="1780401600">- Update to 8.6.4</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 8.6.4-2" date="1780488000">- Rebuilt for Python 3.15</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 8.6.4-3" date="1781265600">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-4" date="1781870400">- Rebuild (gdal)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 8.6.4-5" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.5-1" date="1784289600">- Update to 8.6.5</changelog>
</package>
<package pkgid="b2f139a66e60e792ccbe6bf3075b9ad8cc46817fe9de6e128624fc30ffd2d5ae" name="mapserver-debugsource" arch="s390x">
  <version epoch="0" ver="8.6.5" rel="1.el10_2"/>
  <changelog author="Elliott Sales de Andrade &lt;quantum.analyst@gmail.com&gt; - 8.6.0-4" date="1769342400">- Drop support for i686</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.1-1" date="1774612800">- Update to 8.6.1</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.2-1" date="1776859200">- Update to 8.6.2</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.3-1" date="1778241600">- Update to 8.6.3</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-1" date="1780401600">- Update to 8.6.4</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 8.6.4-2" date="1780488000">- Rebuilt for Python 3.15</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 8.6.4-3" date="1781265600">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-4" date="1781870400">- Rebuild (gdal)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 8.6.4-5" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.5-1" date="1784289600">- Update to 8.6.5</changelog>
</package>
<package pkgid="98f142a42ff80ecd0ce7d4a24f21c03783e9c6a4c11ad13928bf0b99ce862505" name="mapserver-libs-debuginfo" arch="s390x">
  <version epoch="0" ver="8.6.5" rel="1.el10_2"/>
  <changelog author="Elliott Sales de Andrade &lt;quantum.analyst@gmail.com&gt; - 8.6.0-4" date="1769342400">- Drop support for i686</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.1-1" date="1774612800">- Update to 8.6.1</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.2-1" date="1776859200">- Update to 8.6.2</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.3-1" date="1778241600">- Update to 8.6.3</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-1" date="1780401600">- Update to 8.6.4</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 8.6.4-2" date="1780488000">- Rebuilt for Python 3.15</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 8.6.4-3" date="1781265600">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-4" date="1781870400">- Rebuild (gdal)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 8.6.4-5" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.5-1" date="1784289600">- Update to 8.6.5</changelog>
</package>
<package pkgid="195ec1af928b872702833d869a06658a64e44a4a09540e7d992fa0d741a6e86a" name="mimedefang-debuginfo" arch="s390x">
  <version epoch="0" ver="3.7.1" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.4.1-8" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 3.6-1" date="1740830400">- Upgrade to 3.6 (#2301647)</changelog>
  <changelog author="Jitka Plesnikova &lt;jplesnik@redhat.com&gt; - 3.6-2" date="1751889600">- Perl 5.42 rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.6-3" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.6-4" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.6-5" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 3.7.1-1" date="1784548800">- Upgrade to 3.7.1 (#2500792)</changelog>
</package>
<package pkgid="221042358ab6e33b7ce4c574bc41cc26d9a8827ed205ac64cc92e4c2d328c07b" name="mimedefang-debugsource" arch="s390x">
  <version epoch="0" ver="3.7.1" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.4.1-8" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 3.6-1" date="1740830400">- Upgrade to 3.6 (#2301647)</changelog>
  <changelog author="Jitka Plesnikova &lt;jplesnik@redhat.com&gt; - 3.6-2" date="1751889600">- Perl 5.42 rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.6-3" date="1753358400">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.6-4" date="1768564800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 3.6-5" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 3.7.1-1" date="1784548800">- Upgrade to 3.7.1 (#2500792)</changelog>
</package>
<package pkgid="6364fad2a17c52d3c47311f0b04a636f9fec3338b6b38ef0a6b53043dbb8ffd4" name="ntfs-3g-debuginfo" arch="s390x">
  <version epoch="2" ver="2022.10.3" rel="10.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-6" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Miroslav Such&#xFD; &lt;msuchy@redhat.com&gt; - 2:2022.10.3-7" date="1721995200">- convert license to SPDX</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-8" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Tom Callaway &lt;spot@fedoraproject.org&gt; - 2:2022.10.3-9" date="1749124800">- apply upstream fixes committed after 2022.10.3</changelog>
  <changelog author="Carl George &lt;carlwgeorge@gmail.com&gt; - 2:2022.10.3-10" date="1784116800">- Backport upstream fix for CVE-2026-40706</changelog>
</package>
<package pkgid="e59e7659d31581d8cbda56aa90cd69877f8adc7f5368963eaf5650e935963fd8" name="ntfs-3g-debugsource" arch="s390x">
  <version epoch="2" ver="2022.10.3" rel="10.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-6" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Miroslav Such&#xFD; &lt;msuchy@redhat.com&gt; - 2:2022.10.3-7" date="1721995200">- convert license to SPDX</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-8" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Tom Callaway &lt;spot@fedoraproject.org&gt; - 2:2022.10.3-9" date="1749124800">- apply upstream fixes committed after 2022.10.3</changelog>
  <changelog author="Carl George &lt;carlwgeorge@gmail.com&gt; - 2:2022.10.3-10" date="1784116800">- Backport upstream fix for CVE-2026-40706</changelog>
</package>
<package pkgid="9c181930e378ded1c29c4980a92c0fb44aac9d0c563edda5452153a64d0f0aeb" name="ntfs-3g-libs-debuginfo" arch="s390x">
  <version epoch="2" ver="2022.10.3" rel="10.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-6" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Miroslav Such&#xFD; &lt;msuchy@redhat.com&gt; - 2:2022.10.3-7" date="1721995200">- convert license to SPDX</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-8" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Tom Callaway &lt;spot@fedoraproject.org&gt; - 2:2022.10.3-9" date="1749124800">- apply upstream fixes committed after 2022.10.3</changelog>
  <changelog author="Carl George &lt;carlwgeorge@gmail.com&gt; - 2:2022.10.3-10" date="1784116800">- Backport upstream fix for CVE-2026-40706</changelog>
</package>
<package pkgid="cc0596703e2af2bfd180d6976bf860bdbcf7ac2fac84fbd4d5d925688e68ad48" name="ntfsprogs-debuginfo" arch="s390x">
  <version epoch="2" ver="2022.10.3" rel="10.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-6" date="1721304000">- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild</changelog>
  <changelog author="Miroslav Such&#xFD; &lt;msuchy@redhat.com&gt; - 2:2022.10.3-7" date="1721995200">- convert license to SPDX</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 2:2022.10.3-8" date="1737115200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Tom Callaway &lt;spot@fedoraproject.org&gt; - 2:2022.10.3-9" date="1749124800">- apply upstream fixes committed after 2022.10.3</changelog>
  <changelog author="Carl George &lt;carlwgeorge@gmail.com&gt; - 2:2022.10.3-10" date="1784116800">- Backport upstream fix for CVE-2026-40706</changelog>
</package>
<package pkgid="11dd451a5ac20111156897a50a982b80e50330eed9b98faaf651956ff0d72f5c" name="openbao-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="1.el10_2"/>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.4.3-1" date="1761220800">- update to upstream 2.4.3</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.4.3-2" date="1763467200">- add hsm build tag</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.4.4-1" date="1763985600">- update to 2.4.4</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.0-1" date="1770206400">- update to 2.5.0</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.1-1" date="1771934400">- update to upstream 2.5.1</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.2-1" date="1774440000">- update to upstream 2.5.2</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.3-1" date="1776772800">- update to upstream 2.5.3</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.4-1" date="1779278400">- update to upstream 2.5.4</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.5-1" date="1781697600">- update to upstream 2.5.5</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.6.0-1" date="1784030400">- update to 2.6.0</changelog>
</package>
<package pkgid="498978b5e61be5ad0871a03c38883c2a3048d9bc482cc5f15db9fbbc5fbdfec1" name="openbao-debugsource" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="1.el10_2"/>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.4.3-1" date="1761220800">- update to upstream 2.4.3</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.4.3-2" date="1763467200">- add hsm build tag</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.4.4-1" date="1763985600">- update to 2.4.4</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.0-1" date="1770206400">- update to 2.5.0</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.1-1" date="1771934400">- update to upstream 2.5.1</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.2-1" date="1774440000">- update to upstream 2.5.2</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.3-1" date="1776772800">- update to upstream 2.5.3</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.4-1" date="1779278400">- update to upstream 2.5.4</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.5.5-1" date="1781697600">- update to upstream 2.5.5</changelog>
  <changelog author="Dave Dykstra &lt;2129743+DrDaveD@users.noreply.github.com&gt; - 2.6.0-1" date="1784030400">- update to 2.6.0</changelog>
</package>
<package pkgid="e5d8147e9191558ebb79c309869211b30c7dc171be64791e4e27100abde3f5bf" name="opkssh-debuginfo" arch="s390x">
  <version epoch="0" ver="0.16.0" rel="1.el10_2"/>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.13.0-5" date="1773576000">- Add logrotate config file</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.13.0-6" date="1773576001">- Properly use GO_LDFLAGS to overwrite ldflags</changelog>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.13.0-7" date="1773576002">- Add missing version ldflag</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.13.0-8" date="1775908800">- Update bundled go-jose to v4.1.4</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.14.0-1" date="1777809600">- Update to 0.14.0</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.14.0-2" date="1778673600">- Overwrite logfile path with a patch</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.14.0-3" date="1782129600">- Update bundled golang.org/x/crypto to 0.53.0</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.15.0-1" date="1782993600">- Update to 0.15.0</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.15.0-2" date="1782993601">- Drop obsolete golang.org/x/crypto override</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.16.0-1" date="1784462400">- Update to 0.16.0</changelog>
</package>
<package pkgid="11b336d77bbf250f242224a432b94e4dd37bdc5fb73fbe4f0bc8a4a0d1f7af99" name="opkssh-debugsource" arch="s390x">
  <version epoch="0" ver="0.16.0" rel="1.el10_2"/>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.13.0-5" date="1773576000">- Add logrotate config file</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.13.0-6" date="1773576001">- Properly use GO_LDFLAGS to overwrite ldflags</changelog>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.13.0-7" date="1773576002">- Add missing version ldflag</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.13.0-8" date="1775908800">- Update bundled go-jose to v4.1.4</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.14.0-1" date="1777809600">- Update to 0.14.0</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.14.0-2" date="1778673600">- Overwrite logfile path with a patch</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.14.0-3" date="1782129600">- Update bundled golang.org/x/crypto to 0.53.0</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.15.0-1" date="1782993600">- Update to 0.15.0</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.15.0-2" date="1782993601">- Drop obsolete golang.org/x/crypto override</changelog>
  <changelog author="Till Hofmann &lt;thofmann@fedoraproject.org&gt; - 0.16.0-1" date="1784462400">- Update to 0.16.0</changelog>
</package>
<package pkgid="670e38c169bcae437a14a5a289212a0bb9334e5911f743ff1e4079c3bfd56a04" name="perl-YAML-Syck-debuginfo" arch="s390x">
  <version epoch="0" ver="1.47" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.36-2" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.37-1" date="1773921600">- Update to 1.37
  Features:
  - Add LoadBytes, LoadUTF8, DumpBytes, DumpUTF8 functions (GH#51)
  Fixes:
  - Fix heap buffer overflow in the YAML emitter - CVE-2026-4177 (GH#67)
  - Fix DumpFile with tied filehandles (IO::String, IO::Scalar) (GH#22)
  - Fix _is_glob to recognize IO::Handle subclasses (GH#23)
  - Fix memory leak when dumping filehandles (CPAN RT#41199, GH#42)
  - Fix dumping of tied hashes (GH#31)
  - Fix dumping strings starting with '...' as unquoted plain scalars (GH#34)
  - Fix dumping strings with tabs and carriage returns as plain scalars (GH#59)
  - Fix double-dash YAML parsing (RT#34073, GH#35)
  - Fix extra newline after empty arrays/hashes in YAML output (GH#36)
  - Remove trailing whitespace from YAML output lines (GH#37, GH#38, GH#39)
  - Fix quoting of \r and \t in YAML output instead of emitting raw bytes
    (GH#40)
  - Fix growing !!perl/regexp objects in round-trips (GH#43)
  - Fix quoted '=' being transformed into 'str' (GH#45)
  - Fix backslash-space escape in double-quoted YAML strings (GH#61)
  - Fix flow sequence comma separator not recognized without trailing space
    (GH#60)
  - Fix wide character warning in DumpFile (GH#28)
  - Fix inline arrays without space after comma (GH#25)
  - Fix: quote strings matching YAML implicit types to prevent round-trip
    failures (GH#26)
  - Fix JSON::Syck::Dump to use JSON-valid \uXXXX escapes in output (GH#21)
  - Fix JSON::Syck::Load decoding of \/ and \uXXXX escape sequences (GH#30)
  - Fix: apply JSON postprocessing to JSON::Syck::DumpFile output (GH#104)
  - Fix: add tied-filehandle fallback to JSON::Syck::DumpFile (GH#98)
  - Fix: handle JSON escape sequences in SingleQuote mode Load (GH#99)
  - Fix: restore Perl 5.8 compatibility in test suite (GH#121)
  - Fix: correct copy-paste error in Makefile.PL clean target (GH#101)
  - Fix: correct $SortKeys POD default from false to true (GH#100)
  - Fix: correct POD documentation errors (GH#103)
  Maintenance:
  - Add C23-compatible function prototypes for GCC 15 compatibility (GH#112)
  - Silence macOS compiler warnings (GH#92)
  - Guard stdint.h include for portability (HP-UX 11.11) (GH#33)
  - Guard stdint.h include in syck_st.h for portability (GH#24)
  - Update ppport.h to 3.68
  - Add regression tests for magical variable dumping (GH#32)
  - CI: modernize GitHub Actions workflow (GH#123, GH#124)
  - CI: add disttest job to validate MANIFEST completeness
- Use %{make_build} and %{make_install}
- Drop workaround for C23 incompatibility</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.39-1" date="1774180800">- Update to 1.39
  Bug Fixes:
  - Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety
    (GH#125, GH#130)
  - Fix: anchor tracking for blessed scalar refs in Dump (GH#126, GH#131)
  - Fix: prevent buffer underflow in base60 (sexagesimal) parsing (GH#133)
  - Fix: guard against NULL type from strtok in tag parsing (GH#135)
  - Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (GH#137)
  - Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls
    (GH#138, GH#139)
  Improvements:
  - Resolve TODO tests for empty/invalid YAML to match actual behaviour
    (GH#127, GH#129)
  Maintenance:
  - Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (GH#129)
  - Add comprehensive implicit type resolution test suite (GH#137)
  - Update MANIFEST to include all unit tests
  - Clean up test names to remove unnecessary numbering</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.41-1" date="1774267200">- Update to 1.41
  Bug Fixes:
  - Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of
    strtod() so that floats like -3.14 are not corrupted by double-precision
    rounding artifacts (GH#140, GH#141)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.42-1" date="1774612800">- Update to 1.42
  Bug Fixes:
  - Fix: Replace strtok() with strpbrk() and fix sign-compare warnings in
    perl_syck.h (GH#145)
  - Fix: Terminate plain scalars at document boundaries --- and ... (GH#150)
  - Fix: Skip %TAG and %YAML directives in document header (GH#151)
  - Fix: Plug SV leak when eval_pv croaks on bad perl/code blocks (GH#153)
  - Fix: Allow non-specific tag '!' before block scalars (GH#27, GH#102)
  - Fix: Remove spurious %type &lt;nodeId&gt; for indent_open in gram.y
    (GH#157, GH#158)
  - Fix: Use modern bison %define api.prefix directive (GH#159, GH#160)
  Improvements:
  - Implement YAML merge key (&lt;&lt;) support (GH#149)
  Maintenance:
  - Remove dead Perl 5.6/5.8 version guards from test files (GH#146)
  - Add YAML 1.0 spec compliance audit and coverage tests (GH#148)
  - Add comprehensive round-trip tests for YAML 1.0 spec features (GH#152)
  - Remove unneeded TODO in t/json-basic.t (GH#154)
  - Add regex Dump/Load/round-trip tests to perl tag scheme (GH#155)
  - Do not require a .y file to build YAML::Syck; add brew support for bison
  - Don't ship docs/ directory in tarball</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.43-1" date="1775131200">- Update to 1.43
  Bug Fixes:
  - Fix: Prevent resource leaks on croak/early-return paths in Dump (GH#161)
  - Fix: Prevent output SV leaks on croak in Dump/DumpFile callers (GH#163)
  - Fix: Load() in list context returns empty list for empty/undef input; also
    applies to LoadBytes and LoadUTF8 (GH#164, GH#165)
  - Fix: DumpCode serializes prototype string instead of code body (GH#168)
  - Fix: Memory leak in !perl/scalar Load - newRV_inc should be newRV_noinc
    (GH#170)
  - Fix: Add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl
    (GH#175, GH#176)
  - Fix: Add TODO guard for eval_pv leak on Perl &lt; 5.14 (GH#179, GH#180)
  - Fix: Negative hex and octal values parsed as 0 with ImplicitTyping (GH#183)
  - Fix: Negative int#base60 values produce unsigned wraparound (GH#185)
  Improvements:
  - Modernize META_MERGE for CPANTS compliance (GH#162)
  - Fix hash table size handling and remove compile warnings in syck_st (GH#174)
  Maintenance:
  - Restore TODO guard for Dump code leak test on Perl &lt; 5.26 (GH#167)
  - Resolve 2010 TODO in perl_json_postprocess with test coverage (GH#166)
  - CI: Upgrade actions to resolve Node.js 20 deprecation warnings (GH#177)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.44-1" date="1775217600">- Update to 1.44
  Bug Fixes:
  - Fix: Positive hex and octal values parsed as 0 with ImplicitTyping (GH#187)
  - Fix: Resolve uintptr_t redefinition error on Win64 MinGW (GH#186)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.45-1" date="1777291200">- Update to 1.45
  Bug Fixes:
  - Fix: Use syck_base64_free() to fix Windows "Free to wrong pool" crash in
    base64 encode/decode buffers; also plugs a memory leak (GH#189)
  - Fix: Clear type tag on blessed scalar alias early-return so the stale tag
    no longer leaks onto the next emitted item (GH#193, GH#194, rhbz#2459200)
  - Fix: Negative float#base60 values produce wrong results; strip sign before
    accumulating and avoid negative zero for portable stringification (GH#191)
  - Fix: Prevent memory leaks when Load/LoadJSON croak on parse errors (GH#192)
  Maintenance:
  - Test: Add coverage for SortKeys and JSON MaxDepth (GH#188)
  - Test: Add error handling coverage for LoadFile/DumpFile (GH#190)
  - Update README</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.46-1" date="1779710400">- Update to 1.46
  Bug Fixes:
  - Preserve string nature of numeric-looking values in Dump; pure strings (POK
    only, no IOK/NOK) are now quoted to maintain roundtrip fidelity
    (GH#199, GH#200)
  - Accept trailing commas in flow sequences and mappings ([a, b,] and
    {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH#195, GH#196)
  Maintenance:
  - CI: upgrade install-with-cpm to v2 for compatibility with Perl versions
    prior to 5.24 in perldocker containers (GH#197, GH#198)
  - Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries,
    exclude .claude/ from distribution</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.47-1" date="1784030400">- Update to 1.47
  Security:
  - Fix four libsyck memory-safety CVEs reachable from the default
    YAML::Syck::Load() path on untrusted input with no special flags (GH#213)
    - CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder
      caused by signed-char indexing of the decode table on !!binary input
    - CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared
      between the node and the anchors table
    - CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer
      newline scan during block-scalar parsing (incomplete-fix follow-on
      to CVE-2025-11683)
    - CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an
      anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input
  - Harden syck_base64dec() to bounds-check each read so it cannot run past a
    non-NUL-terminated input buffer (defense-in-depth for callers passing raw
    buffers; GH#213)
  Bug Fixes:
  - Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply
    nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512,
    matching Dump (GH#204)
  - Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in
    Dump so they roundtrip with ImplicitTyping instead of reloading as plain
    strings (GH#201)
  Maintenance:
  - CI: add an AddressSanitizer job that builds the XS with
    -fsanitize=address and runs the suite plus the CVE trigger inputs to catch
    libsyck memory-safety defects; de-pin the libasan version so it tracks the
    runner's GCC (GH#213)</changelog>
</package>
<package pkgid="7a7b7956ee1c181ba70b3c40e0f8c9c346c0392f9cc2a99e9d05e21502a8f826" name="perl-YAML-Syck-debugsource" arch="s390x">
  <version epoch="0" ver="1.47" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.36-2" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.37-1" date="1773921600">- Update to 1.37
  Features:
  - Add LoadBytes, LoadUTF8, DumpBytes, DumpUTF8 functions (GH#51)
  Fixes:
  - Fix heap buffer overflow in the YAML emitter - CVE-2026-4177 (GH#67)
  - Fix DumpFile with tied filehandles (IO::String, IO::Scalar) (GH#22)
  - Fix _is_glob to recognize IO::Handle subclasses (GH#23)
  - Fix memory leak when dumping filehandles (CPAN RT#41199, GH#42)
  - Fix dumping of tied hashes (GH#31)
  - Fix dumping strings starting with '...' as unquoted plain scalars (GH#34)
  - Fix dumping strings with tabs and carriage returns as plain scalars (GH#59)
  - Fix double-dash YAML parsing (RT#34073, GH#35)
  - Fix extra newline after empty arrays/hashes in YAML output (GH#36)
  - Remove trailing whitespace from YAML output lines (GH#37, GH#38, GH#39)
  - Fix quoting of \r and \t in YAML output instead of emitting raw bytes
    (GH#40)
  - Fix growing !!perl/regexp objects in round-trips (GH#43)
  - Fix quoted '=' being transformed into 'str' (GH#45)
  - Fix backslash-space escape in double-quoted YAML strings (GH#61)
  - Fix flow sequence comma separator not recognized without trailing space
    (GH#60)
  - Fix wide character warning in DumpFile (GH#28)
  - Fix inline arrays without space after comma (GH#25)
  - Fix: quote strings matching YAML implicit types to prevent round-trip
    failures (GH#26)
  - Fix JSON::Syck::Dump to use JSON-valid \uXXXX escapes in output (GH#21)
  - Fix JSON::Syck::Load decoding of \/ and \uXXXX escape sequences (GH#30)
  - Fix: apply JSON postprocessing to JSON::Syck::DumpFile output (GH#104)
  - Fix: add tied-filehandle fallback to JSON::Syck::DumpFile (GH#98)
  - Fix: handle JSON escape sequences in SingleQuote mode Load (GH#99)
  - Fix: restore Perl 5.8 compatibility in test suite (GH#121)
  - Fix: correct copy-paste error in Makefile.PL clean target (GH#101)
  - Fix: correct $SortKeys POD default from false to true (GH#100)
  - Fix: correct POD documentation errors (GH#103)
  Maintenance:
  - Add C23-compatible function prototypes for GCC 15 compatibility (GH#112)
  - Silence macOS compiler warnings (GH#92)
  - Guard stdint.h include for portability (HP-UX 11.11) (GH#33)
  - Guard stdint.h include in syck_st.h for portability (GH#24)
  - Update ppport.h to 3.68
  - Add regression tests for magical variable dumping (GH#32)
  - CI: modernize GitHub Actions workflow (GH#123, GH#124)
  - CI: add disttest job to validate MANIFEST completeness
- Use %{make_build} and %{make_install}
- Drop workaround for C23 incompatibility</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.39-1" date="1774180800">- Update to 1.39
  Bug Fixes:
  - Fix: escape solidus (/) as \/ in JSON::Syck::Dump for XSS safety
    (GH#125, GH#130)
  - Fix: anchor tracking for blessed scalar refs in Dump (GH#126, GH#131)
  - Fix: prevent buffer underflow in base60 (sexagesimal) parsing (GH#133)
  - Fix: guard against NULL type from strtok in tag parsing (GH#135)
  - Fix: correct copy-paste bug in syck_seq_assign() ASSERT macros (GH#137)
  - Fix t/yaml-implicit-typing.t failure with -Duselongdouble perls
    (GH#138, GH#139)
  Improvements:
  - Resolve TODO tests for empty/invalid YAML to match actual behaviour
    (GH#127, GH#129)
  Maintenance:
  - Remove dead Perl 5.6 TODOs and convert 5.8 TODO to SKIP (GH#129)
  - Add comprehensive implicit type resolution test suite (GH#137)
  - Update MANIFEST to include all unit tests
  - Clean up test names to remove unnecessary numbering</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.41-1" date="1774267200">- Update to 1.41
  Bug Fixes:
  - Fix float parsing on -Dusequadmath perls: use Perl's Atof() instead of
    strtod() so that floats like -3.14 are not corrupted by double-precision
    rounding artifacts (GH#140, GH#141)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.42-1" date="1774612800">- Update to 1.42
  Bug Fixes:
  - Fix: Replace strtok() with strpbrk() and fix sign-compare warnings in
    perl_syck.h (GH#145)
  - Fix: Terminate plain scalars at document boundaries --- and ... (GH#150)
  - Fix: Skip %TAG and %YAML directives in document header (GH#151)
  - Fix: Plug SV leak when eval_pv croaks on bad perl/code blocks (GH#153)
  - Fix: Allow non-specific tag '!' before block scalars (GH#27, GH#102)
  - Fix: Remove spurious %type &lt;nodeId&gt; for indent_open in gram.y
    (GH#157, GH#158)
  - Fix: Use modern bison %define api.prefix directive (GH#159, GH#160)
  Improvements:
  - Implement YAML merge key (&lt;&lt;) support (GH#149)
  Maintenance:
  - Remove dead Perl 5.6/5.8 version guards from test files (GH#146)
  - Add YAML 1.0 spec compliance audit and coverage tests (GH#148)
  - Add comprehensive round-trip tests for YAML 1.0 spec features (GH#152)
  - Remove unneeded TODO in t/json-basic.t (GH#154)
  - Add regex Dump/Load/round-trip tests to perl tag scheme (GH#155)
  - Do not require a .y file to build YAML::Syck; add brew support for bison
  - Don't ship docs/ directory in tarball</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.43-1" date="1775131200">- Update to 1.43
  Bug Fixes:
  - Fix: Prevent resource leaks on croak/early-return paths in Dump (GH#161)
  - Fix: Prevent output SV leaks on croak in Dump/DumpFile callers (GH#163)
  - Fix: Load() in list context returns empty list for empty/undef input; also
    applies to LoadBytes and LoadUTF8 (GH#164, GH#165)
  - Fix: DumpCode serializes prototype string instead of code body (GH#168)
  - Fix: Memory leak in !perl/scalar Load - newRV_inc should be newRV_noinc
    (GH#170)
  - Fix: Add pTHX_ to SAVEDESTRUCTOR_X callback for threaded Perl
    (GH#175, GH#176)
  - Fix: Add TODO guard for eval_pv leak on Perl &lt; 5.14 (GH#179, GH#180)
  - Fix: Negative hex and octal values parsed as 0 with ImplicitTyping (GH#183)
  - Fix: Negative int#base60 values produce unsigned wraparound (GH#185)
  Improvements:
  - Modernize META_MERGE for CPANTS compliance (GH#162)
  - Fix hash table size handling and remove compile warnings in syck_st (GH#174)
  Maintenance:
  - Restore TODO guard for Dump code leak test on Perl &lt; 5.26 (GH#167)
  - Resolve 2010 TODO in perl_json_postprocess with test coverage (GH#166)
  - CI: Upgrade actions to resolve Node.js 20 deprecation warnings (GH#177)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.44-1" date="1775217600">- Update to 1.44
  Bug Fixes:
  - Fix: Positive hex and octal values parsed as 0 with ImplicitTyping (GH#187)
  - Fix: Resolve uintptr_t redefinition error on Win64 MinGW (GH#186)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.45-1" date="1777291200">- Update to 1.45
  Bug Fixes:
  - Fix: Use syck_base64_free() to fix Windows "Free to wrong pool" crash in
    base64 encode/decode buffers; also plugs a memory leak (GH#189)
  - Fix: Clear type tag on blessed scalar alias early-return so the stale tag
    no longer leaks onto the next emitted item (GH#193, GH#194, rhbz#2459200)
  - Fix: Negative float#base60 values produce wrong results; strip sign before
    accumulating and avoid negative zero for portable stringification (GH#191)
  - Fix: Prevent memory leaks when Load/LoadJSON croak on parse errors (GH#192)
  Maintenance:
  - Test: Add coverage for SortKeys and JSON MaxDepth (GH#188)
  - Test: Add error handling coverage for LoadFile/DumpFile (GH#190)
  - Update README</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.46-1" date="1779710400">- Update to 1.46
  Bug Fixes:
  - Preserve string nature of numeric-looking values in Dump; pure strings (POK
    only, no IOK/NOK) are now quoted to maintain roundtrip fidelity
    (GH#199, GH#200)
  - Accept trailing commas in flow sequences and mappings ([a, b,] and
    {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH#195, GH#196)
  Maintenance:
  - CI: upgrade install-with-cpm to v2 for compatibility with Perl versions
    prior to 5.24 in perldocker containers (GH#197, GH#198)
  - Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries,
    exclude .claude/ from distribution</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.47-1" date="1784030400">- Update to 1.47
  Security:
  - Fix four libsyck memory-safety CVEs reachable from the default
    YAML::Syck::Load() path on untrusted input with no special flags (GH#213)
    - CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder
      caused by signed-char indexing of the decode table on !!binary input
    - CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared
      between the node and the anchors table
    - CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer
      newline scan during block-scalar parsing (incomplete-fix follow-on
      to CVE-2025-11683)
    - CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an
      anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input
  - Harden syck_base64dec() to bounds-check each read so it cannot run past a
    non-NUL-terminated input buffer (defense-in-depth for callers passing raw
    buffers; GH#213)
  Bug Fixes:
  - Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply
    nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512,
    matching Dump (GH#204)
  - Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in
    Dump so they roundtrip with ImplicitTyping instead of reloading as plain
    strings (GH#201)
  Maintenance:
  - CI: add an AddressSanitizer job that builds the XS with
    -fsanitize=address and runs the suite plus the CVE trigger inputs to catch
    libsyck memory-safety defects; de-pin the libasan version so it tracks the
    runner's GCC (GH#213)</changelog>
</package>
<package pkgid="fcd1424b0f10dadb9c432b073714fe4db01ab071ad7e0d62d2f7bb0f17c91059" name="php-mapserver-debuginfo" arch="s390x">
  <version epoch="0" ver="8.6.5" rel="1.el10_2"/>
  <changelog author="Elliott Sales de Andrade &lt;quantum.analyst@gmail.com&gt; - 8.6.0-4" date="1769342400">- Drop support for i686</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.1-1" date="1774612800">- Update to 8.6.1</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.2-1" date="1776859200">- Update to 8.6.2</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.3-1" date="1778241600">- Update to 8.6.3</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-1" date="1780401600">- Update to 8.6.4</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 8.6.4-2" date="1780488000">- Rebuilt for Python 3.15</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 8.6.4-3" date="1781265600">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.4-4" date="1781870400">- Rebuild (gdal)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 8.6.4-5" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Sandro Mani &lt;manisandro@gmail.com&gt; - 8.6.5-1" date="1784289600">- Update to 8.6.5</changelog>
</package>
<package pkgid="302d0b429db1ccf7bee3ff0bdb6a345ce57413fb3d2342ce950af905cdee56da" name="proftpd-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="e22d3b1e46e31de1c16441fecb8801f37c94de04a02d8991b8aedc9aba7e17bf" name="proftpd-debugsource" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="9f2c81318c09b80b8830b2881c4fbfdb5e04b0f4e48952a5a32f12f366dc8705" name="proftpd-ldap-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="8362690f647152037d40cb15372567ffc2be36f942c7b3ced43a44e4d18efe63" name="proftpd-mysql-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="ee6f3ebea0d4082b094c64f59b36f41e3efdd080165fce0b3f1556017d00565f" name="proftpd-postgresql-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="9bb51779402afc84f8fc8c0478b46b67561902171d6d6b5457d399a75cc1fa51" name="proftpd-proxy-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="194fa5e9b0f0cd43f936058fce518e5ab3572a832447099cb82584e596e42b82" name="proftpd-sqlite-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="32810c47b8824a84134d4f9753fd180d513fde5bdb7ae4e64c3923c1a56b2eaf" name="proftpd-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9c" rel="3.el10_2"/>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.8b-8" date="1728648000">- Drop EL-7 support
  - Drop mod_geoip support
  - Drop mod_wrap support
  - Always build mod_proxy
  - Always use libpcre2
  - Always use maridb client library in preference to mysql
  - Always use libpq client library in preference to postgresql
  - Always use OpenSSL Cipher Profiles
- Explicitly switch from libmemcached to libmemcached-awesome from Fedora 35
  onwards</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.1.rc2" date="1728648001">- Update to 1.3.9rc2
  - Fix mod_tls build failing for OpenSSL before 1.1.x (Bug #4494)
  - Fix mod_sftp not advertising standard extensions for protocol version 3
    (GH#1570)
  - Fix mod_sftp "check-file" extension using wrong block size when offset and
    length are specified (GH#1569)
  - Use JSON for Controls protocol messages (GH#379)
  - Provide richer exit status values for ftpdctl for better scripting (GH#1114)
  - Enforce requirement of preceding RewriteCondition for RewriteRule directives
    to avoid confusion (Bug #4495)
  - Implement LogFormat variable for data transfer average speed (GH#535)
  - Optimize per-connection file I/O when reading SFTPHostKey from disk
    (GH#1596)
  - ProFTPD did not detect FIPS when using OpenSSL 3.x built with FIPS support
    (GH#1610)
  - Reduce latency due to signal handling in the daemon process (GH#1623)
  - SSH key exchange requests should be classified into the "SEC" ExtendedLog
    class (GH#1626)
  - Update mod_exec to use the Jot API for resolving variables (GH#1630)
  - Use system TCP backlog value by default (GH#1636)
  - Gracefully handle directory creation requests when the directory already
    exists (GH#1639)
  - Remove asynchronous FTP responses emitted while computing digest values
    (GH#1661)
  - Support terminating connection after USER command when TLS is required
    (GH#1640)
  - Support OPTS commands for querying configured policy for resumed uploads,
    downloads (GH#1676)
  - MaxStoreFileSize for single user was not properly honored for SFTP uploads
    (GH#1686)
  - DisplayChdir using absolute path should work properly with DefaultRoot
    (GH#1688)
  - Clients should be disconnected when unable to be added to the
    ScoreboardFile (GH#1700)
  - Support injecting random delay when clients connect via DelayOnEvent
    (GH#1701)
  - Support OpenSSH FIDO security keys in mod_sftp (GH#1118)
  - Support obtaining default UID/GID values for AD directories in mod_ldap
    (GH#1716)
  - Update upload progress in scoreboard when throttling (GH#1433)
  - Null pointer reference encountered for FTPS connection due to config
    parser ignoring Include file problem (GH#1721)
  - Support the chacha20-poly1305@openssh.com SSH cipher (GH#456)
  - mod_auth_otp should require per-user OTP entries by default (GH#1562)
  - 1.3.9rc1 mod_sftp failed to compile if EVP_chacha20 was unavailable, as
    when using older OpenSSL versions (GH#1730)
  - Error resolving DNS name for implicit "server config" vhost lead to
    DelayTable not being found (GH#1746)
  - Log message for exceeding quota did not include the user/group/class quota
    type (GH#1749)
  - Build system failed for specific module names (GH#1756)
  - "Terrapin" Prefix Truncation Attacks in SSH Specification affected mod_sftp
    (CVE-2023-48795, GH#1760)
- Additional C compatibility fix</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.2.rc3" date="1734004800">- Update to 1.3.9rc3
  - Bad handling of lack of extended attributes lead to SFTP out of memory
    error (GH#1785)
  - Using mod_facl and mod_vroot at same time caused unexpected permissions
    issues (GH#1780)
  - mod_sftp_sql logged "header value too long" due to unexpected key header
    text (GH#1529)
  - SFTP statvfs extension failed when mod_vroot was in use (GH#1792)
  - Implement limits@openssh.com SFTP extension (GH#1798)
  - Implement SFTPAuthPublicKeys directive for configuring the list of public
    key algorithms allowed for authentication (GH#1806)
  - Fix stack trace changing to directory with DisplayChdir file using %F
    variable on a large filesystem (GH#1819)
  - Remove inherited supplemental groups when started with root privileges
    (GH#1836)
  - SSH ECDSA host key algorithms were not being used as expected despite
    configuring appropriate key (GH#1839)
  - RADIUS Message-Authenticator verification failed with ProFTPD mod_radius
    (GH#1840)
  - Supplemental group inheritance granted unintended access to GID 0 due to
    lack of supplemental groups from mod_sql (GH#1830)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-0.3.rc3" date="1734004801">- Update mod_vroot to 0.9.12
  - Implement a realpath(3) callback for the FSIO API, for better
    interoperability of other modules when mod_vroot is in effect</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9-1" date="1742385600">- Update to 1.3.9
  - Use of HideNoAccess for SFTP sessions could lead to segfault and/or
    unexpected behavior (GH#1855)
  - Avoid NULL pointer dereferences in mod_ls (GH#1866, CVE-2024-57392)
  - Added Polish translation (Bug #4511)
  - SFTP channel allocations can lead to high memory utilization over time
    (GH#1876)
  - Update libtool.m4 for better MacOSX support (GH#1878)
- Update mod_proxy to 0.9.5
  - Implemented new IgnoreForeignAddress ProxyOption
  - Fixed passive data transfers to backend IPv4 address when IPv6 support is
    enabled</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-1" date="1777550400">- Update to 1.3.9a
  - SCP transfers failed for files with spaces in their names (GH#1886)
  - LDAPDefaultGID ignored since 1.3.9 (GH#1898)
  - Compilation of mod_wrap2 failed when the --enable-wrapper-options configure
    option was used (Bug #4512)
  - mod_sftp failed to parse authorized user/host public keys with CRLF line
    endings (GH#1904)
  - Uploads using MODE Z sometimes resulted in corrupted files or broken
    transfers (GH#1896)
  - Remove usage of the deprecated MySQL_OPT_RECONNECT option for newer MySQL
    versions (GH#1911)
  - Update usage of MySQL API for SSL/TLS connections to server (GH#340)
  - mod_sftp leaked file descriptor when reading SFTPHostKey file (GH#1959)
  - Large/slow SCP downloads could be unnecessarily truncated by TimeoutStalled
    (GH#1964)
  - Handling of CRLs in mod_tls was incorrect, leading to confusing errors
    (GH#1960)
  - Resumed SSL_SESSION management in mod_tls lead to memory growth, infinite
    loop using newer OpenSSL versions (GH#1963)
  - mod_quotatab_ldap interactions could lead to segfault due to stale pointer
    (GH#1984)
  - RNTO before authentication lead to out-of-order response codes (GH#2003)
  - MaxLoginAttemptsFromUser event never triggered in mod_ban for SFTP sessions
    (GH#2009)
  - Using toupper(3) on non-ASCII FTP command bytes might cause remote DoS
    (GH#2019)
  - Out-of-bounds single byte read when FTP command input buffer starts with LF
    (GH#2020)
  - FTP command LIST/NLST -B could cause buffer overflow when listing certain
    crafted filenames (GH#2030)
  - Memory exhaustion with mod_log_forensic when downloading very large files
    via SFTP (GH#2043)
  - Setting process groups during authentication crashed when using mod_radius
    and &lt;IfGroup&gt; (GH#2046)
  - SQL injection possible via mod_sql because of is_escaped_text() logic error
    (GH#2052, CVE-2026-42167)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9a-2" date="1778500800">- Additional escaping for avoidance of SQL injection issues with %{note:...}
  and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in
  1.3.9a
- Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname
  (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9b-1" date="1780920000">- Update to 1.3.9b
  - Fix SQL Injection in mod_wrap2_sql via reverse DNS hostname (GH#2057,
    CVE-2026-44331)
  - Additional fix for session management with OpenSSL 3.2.x or later, when
    using TLSv1.2 or earlier; this complements the fix for GH#1963 (GH#2096)
  - Hard quota limits on uploads do not cause SFTP WRITE requests to fail as
    expected (GH#2098)
  - Fix SSH payload length underflow calculation for ETM/ChaChaPoly algorithms
    in mod_sftp (GH#2102)
  - SSH packet with empty payload triggered null pointer dereference in
    mod_sftp (GH#2104)
  - Bad DSA signatures could lead to out-of-bounds read of heap memory in
    mod_sftp (GH#2106)
  - Mismatched RSA/DSA algorithm signatures could lead to null dereference in
    mod_sftp (GH#2108)
  - SFTP request payload length underflow calculation in mod_sftp
    (GH#2115, CVE-2026-53994)
  - Several modules failed to build using OpenSSL 4.0 (GH#2120)
- Update mod_proxy to 0.9.7
  - Add a check on the maximum allowed SSH payload (vs. packet) length (GH#291)
  - Set the payload_len field before checking its value (GH#292)
  - Keep the SSH packet reading code in mod_proxy more in line with what is
    done in mod_sftp, for legibility (GH#294)
  - Implement support for the OpenSSH-specific ChaChaPoly SSH algorithm
    (GH#295, GH#296)
  - Correct misspellings noted by codespell (GH#297)
  - Use clang-tidy to start polishing the codebase (GH#298)
  - Disable the Nagle algorithm by default on our TCP connections to back-end
    servers (GH#299)
  - Require OpenSSL for building (GH#249, GH#300)
  - Documentation fixes
  - Implement a limit on the number of EXT_INFO extensions we'll be willing to
    accept (GH#303)
  - Comparison of expected/provided MAC data should be done in a constant-time
    manner
  - Support PKCS11-stored private keys
  - Implement the "mlkem768x25519-sha256" and "sntrup761x25519-sha512"
    post-quantum SSH key exchange mechanisms (GH#306)
  - Add sanity check for SRV record lengths
  - Ensure that the SSH payload length computation, for ETM/ChaChaPoly packets,
    does not underflow
  - If we detect a bad DSA signature length, properly error out
  - Ensure that RSA/DSA signatures match their expected algorithm types, and
    avoid null pointer dereferences
  - Update to build against OpenSSL 4.x (GH#313)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-1" date="1783512000">- Update to 1.3.9c
  - ExecEnviron values not passed due to regression since 1.3.8.d (GH#2135)
  - Stack buffer overflow in MLSD/MLST handling for long path names (GH#2146)
  - MaxTransfersPerUser no longer enforces configured limits (GH#2158)
  - AdminControlsACLs for config, get actions not honored as they should be
    (GH#2163)
  - Memcached/Redis-cached JSON TLS session/OCSP entries decoded into fixed
    buffers without bounds checking (GH#2166)
  - RewriteMap unescape builtin use causes one-byte out-of-bounds write, fails
    to reject illegal characters (GH#2173)
  - SQL group name lookup concatenates client-provided group names without
    escaping (GH#2188)
  - Authenticated SFTP sessions can overflow the SFTP packet buffer
    (GH#2190, CVE-2026-63090)
  - Default Controls socket ACLs unintentionally allow all users access for
    sending Controls requests (GH#2210)
  - Exercise caution when reading the client-provided file size for SCP
    uploads, as it could possibly overflow our size type (CVE-2026-63091)</changelog>
  <changelog author="Paul Howarth &lt;paul@city-fan.org&gt; - 1.3.9c-3" date="1784635200">- Add mod_procfs, enabled by default, to address CVE-2026-35025 (ACL bypass via
  /proc/self/root path prefix); this module disallows file accesses via procfs
  filesystems</changelog>
</package>
<package pkgid="545215420b16e623f48fe4c4f942626e29cc8bedda1da691921e78d2c9fdef92" name="radsecproxy-debuginfo" arch="s390x">
  <version epoch="0" ver="1.11.3" rel="1.el10_2"/>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.1-1" date="1733486400">- Upgrade to 1.11.1 (#2330848)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.1-2" date="1737201600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.2-1" date="1742904000">- Upgrade to 1.11.2 (#2354876)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.2-2" date="1753444800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.2-3" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.2-4" date="1780574400">- Use 'systemctl try-reload-or-restart' in logrotate postrotate
  script (#2371326, thanks to Marcos Mello)</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 1.11.2-5" date="1781265600">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.2-6" date="1781784000">- Add upstream patch for OpenSSL 4.0 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.2-7" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.3-1" date="1784289600">- Upgrade to 1.11.3 (#2499720)</changelog>
</package>
<package pkgid="b83e1c0ebb7fadf11e49e6a3e2f61340fb63cbade0a3fe239c6321d64d22ace4" name="radsecproxy-debugsource" arch="s390x">
  <version epoch="0" ver="1.11.3" rel="1.el10_2"/>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.1-1" date="1733486400">- Upgrade to 1.11.1 (#2330848)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.1-2" date="1737201600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.2-1" date="1742904000">- Upgrade to 1.11.2 (#2354876)</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.2-2" date="1753444800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.2-3" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.2-4" date="1780574400">- Use 'systemctl try-reload-or-restart' in logrotate postrotate
  script (#2371326, thanks to Marcos Mello)</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 1.11.2-5" date="1781265600">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.2-6" date="1781784000">- Add upstream patch for OpenSSL 4.0 support</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 1.11.2-7" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Robert Scheck &lt;robert@fedoraproject.org&gt; 1.11.3-1" date="1784289600">- Upgrade to 1.11.3 (#2499720)</changelog>
</package>
<package pkgid="ae030bbf943f2b6f706a974e2e0033f2927c10d8350f2856b62f498bd247f433" name="restic-debuginfo" arch="s390x">
  <version epoch="0" ver="0.19.1" rel="1.el10_2"/>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.18.0-1" date="1752235200">- Update to 0.18.0 - Closes rhbz#2355627 rhbz#2354447 rhbz#2352331
  rhbz#2350845 rhbz#2348839 rhbz#2331990</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.0-2" date="1753444800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Maxwell G &lt;maxwell@gtmx.me&gt; - 0.18.0-4" date="1755259200">- Rebuild for golang-1.25.0</changelog>
  <changelog author="Alejandro S&#xE1;ez &lt;asm@redhat.com&gt; - 0.18.0-5" date="1760097600">- rebuild</changelog>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.18.1-1" date="1763985600">- Update to 0.18.1 - Closes rhbz#2397204 rhbz2416773</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-2" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Maxwell G &lt;maxwell@gtmx.me&gt; - 0.18.1-3" date="1770120000">- Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26</changelog>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.19.0-1" date="1781092800">- Update to 0.19.0 - Closes rhbz#2487290</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.19.1-1" date="1784548800">- Update to 0.19.1 upstream release
- Resolves: rhbz#2497130</changelog>
</package>
<package pkgid="854f36181e4d645156b5ce30a02f6abe5065172b319fbccab9445da20f31e7e4" name="restic-debugsource" arch="s390x">
  <version epoch="0" ver="0.19.1" rel="1.el10_2"/>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.18.0-1" date="1752235200">- Update to 0.18.0 - Closes rhbz#2355627 rhbz#2354447 rhbz#2352331
  rhbz#2350845 rhbz#2348839 rhbz#2331990</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.0-2" date="1753444800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild</changelog>
  <changelog author="Maxwell G &lt;maxwell@gtmx.me&gt; - 0.18.0-4" date="1755259200">- Rebuild for golang-1.25.0</changelog>
  <changelog author="Alejandro S&#xE1;ez &lt;asm@redhat.com&gt; - 0.18.0-5" date="1760097600">- rebuild</changelog>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.18.1-1" date="1763985600">- Update to 0.18.1 - Closes rhbz#2397204 rhbz2416773</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.18.1-2" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="Maxwell G &lt;maxwell@gtmx.me&gt; - 0.18.1-3" date="1770120000">- Rebuild for https://fedoraproject.org/wiki/Changes/golang1.26</changelog>
  <changelog author="Mikel Olasagasti Uranga &lt;mikel@olasagasti.info&gt; - 0.19.0-1" date="1781092800">- Update to 0.19.0 - Closes rhbz#2487290</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.19.0-2" date="1784203200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 0.19.1-1" date="1784548800">- Update to 0.19.1 upstream release
- Resolves: rhbz#2497130</changelog>
</package>
<package pkgid="3f0963d2d7c5d2a544738e01d136143df7f457abf3f572ea6462a2e228c42a5b" name="weechat-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.4" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.1-3" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.8.2-1" date="1773057600">- Update to 4.8.2</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.8.2-2" date="1774785600">- Drop unnecessary -DPREFIX cmake arg</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.0-1" date="1774785601">- Update to 4.9.0</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.1-1" date="1780228800">- Update to 4.9.1</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 4.9.1-2" date="1780488000">- Rebuilt for Python 3.15</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.2-1" date="1780833600">- Update to 4.9.2</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.3-1" date="1783252800">- Update to 4.9.3</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9.3-2" date="1784289600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.4-1" date="1784462400">- Update to 4.9.4</changelog>
</package>
<package pkgid="77e0c529e4b03793b53d5e40d6f5608a5f30a65a537f3ff30cd7374b082b259b" name="weechat-debugsource" arch="s390x">
  <version epoch="0" ver="4.9.4" rel="1.el10_2"/>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.8.1-3" date="1768651200">- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.8.2-1" date="1773057600">- Update to 4.8.2</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.8.2-2" date="1774785600">- Drop unnecessary -DPREFIX cmake arg</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.0-1" date="1774785601">- Update to 4.9.0</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.1-1" date="1780228800">- Update to 4.9.1</changelog>
  <changelog author="Python Maint &lt;python-maint@redhat.com&gt; - 4.9.1-2" date="1780488000">- Rebuilt for Python 3.15</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.2-1" date="1780833600">- Update to 4.9.2</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.3-1" date="1783252800">- Update to 4.9.3</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 4.9.3-2" date="1784289600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="LuK1337 &lt;priv.luk@gmail.com&gt; - 4.9.4-1" date="1784462400">- Update to 4.9.4</changelog>
</package>
<package pkgid="d3bb1c48936ada7d5a131dc5c6dcf8ce9ee74a76c4d4414999d4bf7faf192bc8" name="xrootd-s3-http-debuginfo" arch="s390x">
  <version epoch="0" ver="0.6.9" rel="1.el10_2"/>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.1-1" date="1768910400">- Update to version 0.6.1</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.3-1" date="1769601600">- Update to version 0.6.3
- Drop patches accepted upstream</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.4-1" date="1770724800">- Update to version 0.6.4</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.5-1" date="1772625600">- Update to version 0.6.5</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.6-1" date="1775131200">- Update to version 0.6.6</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.6-2" date="1776772800">- Rebuilt for xrootd 6</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 0.6.6-3" date="1781352000">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.8-1" date="1781956800">- Update to version 0.6.8</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.6.8-2" date="1784289600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Mattias Ellert  &lt;mattias.ellert@physics.uu.se&gt; - 0.6.9-1" date="1784462400">- Update to version 0.6.9</changelog>
</package>
<package pkgid="a0efd24a32977429e84a9a338839203c6bcaf6b04dac01459ae65b9db7cd1300" name="xrootd-s3-http-debugsource" arch="s390x">
  <version epoch="0" ver="0.6.9" rel="1.el10_2"/>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.1-1" date="1768910400">- Update to version 0.6.1</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.3-1" date="1769601600">- Update to version 0.6.3
- Drop patches accepted upstream</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.4-1" date="1770724800">- Update to version 0.6.4</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.5-1" date="1772625600">- Update to version 0.6.5</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.6-1" date="1775131200">- Update to version 0.6.6</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.6-2" date="1776772800">- Rebuilt for xrootd 6</changelog>
  <changelog author="Yaakov Selkowitz &lt;yselkowi@redhat.com&gt; - 0.6.6-3" date="1781352000">- Rebuilt for openssl 4.0</changelog>
  <changelog author="Mattias Ellert &lt;mattias.ellert@physics.uu.se&gt; - 0.6.8-1" date="1781956800">- Update to version 0.6.8</changelog>
  <changelog author="Fedora Release Engineering &lt;releng@fedoraproject.org&gt; - 0.6.8-2" date="1784289600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild</changelog>
  <changelog author="Mattias Ellert  &lt;mattias.ellert@physics.uu.se&gt; - 0.6.9-1" date="1784462400">- Update to version 0.6.9</changelog>
</package>
</otherdata>