# changelog

author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.9.0-3
changelog:
  - Update circular-buffer dependency to version 2
  - Update License field based on a current build in Rawhide


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.98.1-1
changelog:
  - New version
    Resolves: rhbz#2346977
  - Fixed possible remote SQL injection
    Resolves: CVE-2025-26794
  - Updated exim maintainers keyring


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.21-1
changelog:
  - Update to 1.9.21
  - Security fix: CVE-2026-41054 — privilege escalation via command socket
  - Fix semaphore error handling (SEM_FAILED vs NULL)
  - Fix /dev/shm permissions (use 01777 with sticky bit)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-1
changelog:
  - Update to 1.9.23
  - Security: use O_EXCL with sem_open to prevent semaphore pre-planting attacks
  - Security: fix OOB memory access in safein()/safeout() on socket errors
  - Security: reject command socket connections from different user namespaces
  - Security: use O_NOFOLLOW for PID file to prevent symlink attacks
  - Harden: open random device with O_CLOEXEC, restrict semaphore to 0600
  - Fix stale semaphore recovery after SIGKILL
  - Fix compilation when NO_COMMAND_MODE is defined


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-2
changelog:
  - Add SELinux policy module to allow semaphore creation in /dev/shm
  - Add rpminspect.yaml to waive pre-existing annocheck false positive


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.23-3
changelog:
  - Fix rpminspect.yaml: use annocheck failure_severity instead of inspections toggle
    (annocheck is a security inspection and cannot be disabled via inspections section)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.24-1
changelog:
  - Update to 1.9.24
  - Disable command mode in long-running service (--no-command flag)
  - Enable PrivateNetwork=true in systemd service
  - Remove SELinux policy module (no longer needed without command mode)


author: Jirka Hladky <hladky.jiri@gmail.com> - 1.9.25-1
changelog:
  - Update to 1.9.25
  - Fix initramfs switch-root failure caused by --no-command (BZ#2491739)
  - Add haveged-initramfs.service for use inside the initramfs


author: Robert Scheck <robert@fedoraproject.org> 1.11.2-4
changelog:
  - Use 'systemctl try-reload-or-restart' in logrotate postrotate
    script (#2371326, thanks to Marcos Mello)


author: Bojan Smojver <bojan@rexursive com> - 4.5.1-5
changelog:
  - Drop unknown configure option --enable-tcpreplay-edit
  - Change tcpdump dependency to package
  - Remove checks for TX_RING support to avoid build problems


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.6-1
changelog:
  - Update to 0.10.6
  - CVE-2026-32105, CVE-2026-32107, CVE-2026-32623, CVE-2026-32624
  - CVE-2026-33145, CVE-2026-33516, CVE-2026-33689, CVE-2026-35512


author: Bojan Smojver <bojan@rexursive.com> - 1:0.10.6.1-1
changelog:
  - Update to 0.10.6.1
  - CVE-2026-41252, CVE-2026-41521, CVE-2026-44178, CVE-2026-42218
  - CVE-2026-44978, CVE-2026-54538, CVE-2026-55238, CVE-2026-55626
  - CVE-2026-55639, CVE-2026-55645


