# changelog

author: Dimitri Savineau <dsavinea@redhat.com> - 2.15.3-1
changelog:
  - ansible-core 2.15.3 release
  - Use docs and examples from ansible-documentation project.
  - Build the manpages.


author: Satoe Imaishi <simaishi@redhat.com> - 2.15.5-1
changelog:
  - ansible-core 2.15.5 release
  - Fix CVE-2023-5115 (malicious role archive can cause ansible-galaxy to
    overwrite arbitrary files)


author: Satoe Imaishi <simaishi@redhat.com> - 4.4.2-1
changelog:
  - Update to 4.4.2
  - Fixes CVE-2023-24580 (Django: Potential denial-of-service vulnerability in
    file uploads)
  - Fixes CVE-2023-36053 (Django: Potential regular expression denial of service
    vulnerability in EmailValidator/URLValidator)


author: Satoe Imaishi <simaishi@redhat.com> - 4.4.3-1
changelog:
  - Update to 4.4.3
  - Fixes CVE-2023-23931 (cryptography: memory corruption via immutable objects)
  - Fixes CVE-2023-40267 (GitPython: Insecure non-multi options in clone and
    clone_from is not blocked)


author: Satoe Imaishi <simaishi@redhat.com> - 4.4.6-1
changelog:
  - Update to 4.4.6
  - Fix CVE-2023-41164 (Django: Potential denial of service vulnerability in
    django.utils.encoding.uri_to_iri())


author: Satoe Imaishi <simaishi@redhat.com> - 4.4.7-1
changelog:
  - Update to 4.4.7
  - Fix CVE-2023-43665 (Django: Denial-of-service possibility in
    django.utils.text.Truncator)


author: James Marshall <jamarsha@redhat.com> - 1.0-4
changelog:
  - Add uwsgi executions to allowed for awx
  - Specify awx languages for allowed operations
  - Choose the correct python version on install for awx_python


author: James Marshall <jamarsha@redhat.com> 1.0.3-1
changelog:
  - Bump release
  - Fix product name and version in UI
  - Remove ansible-rulebook installation requirement on API server
  - Add scheduler service
  - Split worker and activation queues


author: Evgeni Golov - 1.2.3-2
changelog:
  - reexec systemd after policy changes to make socket labeling work
    this is needed for systemd before 245, where the following bug is fixed
    https://github.com/systemd/systemd/issues/9997


author: Satoe Imaishi <simaishi@redhat.com> - 1.3.2-2
changelog:
  - Rebuild for multiple architectures
  - Rebuild for RHEL 9.0 support
  - Use python macro to set pulpcore rpm name


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.3.4-12
changelog:
  - Python 2 binary package renamed to python2-croniter
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.3.19-5
changelog:
  - Subpackage python2-croniter has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Toshio Kuratomi <toshio@fedoraproject.org> - - 2.1.0-1
changelog:
  - Update to newer upstream.
  - Create a python3 subpackage since upstream supports it
  - Note that newer upstream has relicensed to Apache 2.0


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.1.2-5
changelog:
  - Python 2 binary package renamed to python2-daemon
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Iryna Shcherbina <ishcherb@redhat.com> - 2.1.2-8
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.20-1
changelog:
  - Update to 3.2.20
  - Fix CVE-2023-36053 (Potential regular expression denial of service
    vulnerability in EmailValidator/URLValidator)


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.21-1
changelog:
  - Update to 3.2.21
  - Fix CVE-2023-41164 (Potential denial of service vulnerability in
    django.utils.encoding.uri_to_iri())


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.22-1
changelog:
  - Update to 3.2.22
  - Fix CVE-2023-43665 (Denial-of-service possibility in django.utils.text.Truncator)


author: Toshio Kuratomi <toshio.tiki-lounge.com> 0:0.3.5-0.fdr.1
changelog:
  - Update to 0.3.5.
  - Update spec style to latest fedora-rpmdevtools.
  - Merge everything into a single package.  There isn't very much space
    advantage to having separate packages in a package this small and in
    this case, the documentation on using docutils as a library is also a
    good example of how to write in ReSructuredText.


author: Toshio Kuratomi <toshio.tiki-lounge.com> 0:0.3.7-0.fdr.1
changelog:
  - Update to 0.3.7
  - Rename from python-docutils to docutils.
  - Make roman.py optionally a part of the files list.  In FC2, this will be
    included.  In FC3, this won't.
  - BuildConflict with self since the docutils build detects the presence
    of roman.py and doesn't reinstall itself.


author: Toshio Kuratomi <toshio.tiki-lounge.com> 0:0.3.7-0.fdr.2
changelog:
  - Special case roman.py to always install.  This is the behaviour we want
    unless something else provides it.  Will need to watch out for this in
    future Core and Extras packages, but the auto detection code makes it
    possible that builds will not be reproducible if roman.py were installed
    from another package.... Lesser of two evils here.
  - Provide python-docutils in case that package were preinstalled from
    another repository.


author: Toshio Kuratomi <toshio.tiki-lounge.com> 0:0.3.7-0.fdr.3
changelog:
  - Really install roman.py and build roman.py[co].  Needed to make sure I have
    docutils installed to test that it builds roman.py fine in that case.


author: Toshio Kuratomi <toshio-tiki-lounge.com> 0.3.9-1
changelog:
  - Update to version 0.3.9.
  - Use a dist tag as there aren't any differences between supported fc
    releases (FC3, FC4, devel.)


author: Toshio Kuratomi <toshio-tiki-lounge.com> 0.4-1
changelog:
  - Update to 0.4.
  - Scripted the listing of files in the python module.
  - Add a missingok requirement on python-imaging as docutils can make use of
    it when converting to formats that have images.


author: Toshio Kuratomi <toshio-tiki-lounge.com> 0.4-3
changelog:
  - Bump for FC6 rebuild.
  - Remove python byte compilation as this is handled automatically in FC4+.
  - No longer %ghost .pyo files.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.6-1
changelog:
  - Update for 0.6 release.
  - Switch from setuptools installed egg-info to distutils egg-info.  Note that
    this works because we're also changing docutils version.  To do this between
    0.5-4 and 0.5-5, for instance, we'd need to have %preun scriptlet to get rid
    of the egg-info directory.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.7-5
changelog:
  - Fix building with python-3.2 via a workaround.  Sent upstream awaiting
    feedback or a better fix.  Built in rawhide.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.8-0.1.20110517svn7036
changelog:
  - Ship a snapshot of 0.8 so that we can build on python-3.2.1
  - Unfortunately, 3.2.1 isn't out yet either.  So also apply a fix for building
    with 3.2.0 that we'll need to remove later.
  - The new docutils.math module is licensed Apache.  Update the license to reflect this


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.8-1
changelog:
  - Upgrade to 0.8 final.
  - Remove the two remaining Apache licensed files until their license is fixed.
  - Patch regressions that we had already submitted upstream -- resubmit


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.8.1-1
changelog:
  - Update to new upstream that has properly licensed files and a few bugfixes
  - Add a patch to fix tracebacks when wrong values are given to CLI apps


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.9.1-1
changelog:
  - New update from upstream
  - Fixes for previous patches incorporated there
  - roman.py has been moved into a docutils submodule
  - docutils doesn't work with PyXML.  before I poke around for the bug in PyXML,
    seeing if we're going to go through with deprecating it or if we can sanitize
    our python stdlib's handling of it.
  - Fix for traceback in https://bugzilla.redhat.com/show_bug.cgi?id=786867


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.10-0.1.20120730svn7490
changelog:
  - Update to snapshot that's supposed to take care of the date directive unicode
    problem in a different way
  - Patch to fix PyXML conflict without using rpm conflicts


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.10-0.5.20120824svn7502
changelog:
  - Rebase to new snapshot with some fixes integrated
  - Reenable one test that I can't replicate the failure with.


author: Toshio Kuratomi <toshio@fedoraproject.org> - 0.11-1
changelog:
  - 0.11 final tarball.
  - Remove flash file from the install (it was only used to run the unittests anyhow)


author: Orion Poplawski <orion@cora.nwra.com> - 0.13.1-3
changelog:
  - Fix broken python-docutils provides (bug #1399655)
  - Use %license, python build macro
  - Spec cleanup


author: Petr Viktorin <pviktori@redhat.com> - 0.14-5
changelog:
  - Fix specfile typos and oversights
    - Fix python3-setuptools dependency
    - Export RHEL workaround variables
    - Use {__python2} as RPM macro, not shell variable


author: Odilon Sousa <osousa@redhat.com> - 4.5.2-2
changelog:
  - Removing python-naya requirement, it was added on galaxy-ng, but it's a
    requirement for pulpcore


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.32-1
changelog:
  - Update to 3.1.32
  - Fix CVE-2023-40267 (Insecure non-multi options in clone and clone_from is not blocked)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:0.11.0-8
changelog:
  - Python 2 binary package renamed to python2-lockfile
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miro Hrončok <mhroncok@redhat.com> - 5.4.3-2
changelog:
  - Subpackage python2-pbr has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Panu Matilainen <pmatilai@welho.com> 0.999-0.fdr.1
changelog:
  - get rid of distrel munging, buildsys does that...
  - update to 0.999
  - update doc and example tarballs
  - fix build on python <> 2.2
  - use -O1 in install to generate .pyo files instead of manually creating the files
  - require python-abi = pyver to get dependencies right


author: Toshio Kuratomi <toshio@tiki-lounge.com> 0.999-2
changelog:
  - Use python_sitelib macro to resolve build issues on x86_64.
  - %ghost *.pyo
  - Install ANSI.py, screen.py, and FSM.py into the examples.  These are intended
    to suplement pexpect eventually but they are currently much less robust and
    not installed to by default.  But they are needed by some examples.
  - Use __python macro in build/install for consistency.
  - Add --skip-build to the invocation of setup.py in install.


author: Toshio Kuratomi <toshio@tiki-lounge.com> 0.99999b-2
changelog:
  - Add LICENSE File.
  - Make noarch.
  - Remove executable permissions from the modules copied to examples.


author: Toshio Kuratomi <toshio@tiki-lounge.com> - 2.1-2
changelog:
  - Remove pyver define as it's not needed with the automatic python(abi).
  - Stop ghosting .pyos.
  - Let automatic python compilation take care of creating pyos.
  - Rebuild for FC6.


author: Toshio Kuratomi <toshio@tiki-lounge.com> - 2.1-3
changelog:
  - Bump and rebuild for python 2.5 on devel.
  - Add BR: python-devel as it provides a header necessary for python modules
    on python 2.5.


author: Thomas Spura <tomspur@fedoraproject.org> - 3.0-0.1
changelog:
  - new upstream is github/pexpect/pexpect
  - update to rc3
  - build on noarch again
  - consistently use %{buildroot} everywhere
  - be more explicit in %files
  - remove CFLAGS


author: Paul Belanger <pabelanger@redhat.com> - 0.5.4-1
changelog:
  - Initial package.
  - Forked from https://fedora.pkgs.org/rawhide/fedora-x86_64/python3-resolvelib-0.5.5-2.fc35.noarch.rpm.html however
    downgraded to 0.5.4 due to 0.5.5 being yanked from pypi.


author: Satoe Imaishi <simaishi@redhat.com> - 1.26.18-1
changelog:
  - Update to 1.26.18
  - Fix CVE-2023-43804 (Cookie request header isn't stripped during cross-origin
    redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.2-1
changelog:
  - Update to 1.4.2
  - Fix CVE-2023-39325 (net/http, x/net/http2: rapid stream resets can cause
    excessive work)
  - Fix CVE-2023-44487 (golang: HTTP/2: Multiple HTTP/2 enabled web servers are
    vulnerable to a DDoS attack (Rapid Reset Attack))


author: Christian Adams <chadams@redhat.com> - 1.2.1-2
changelog:
  - Added work release --all option
  - Quick connections now utilize MaxIdleConnection
  - Support for pinned certificates
  - Added support for Go 1.17
  - Fixed deadlock in handleMessageData
  - Additional error handling and dependency updates


author: Kevin Fenzi <kevin@scrye.com> 3.1.3-1
changelog:
  - Update to 3.1.3
  - Move socket to /var/run/supervisor. Fixes bug #1247877
  - Clean up old spec cruft. Possibly fixes bug #1094933


author: Nils Philippsen <nils@redhat.com> - 3.2.3-1
changelog:
  - version 3.2.3
  - use python2 macros and package names
  - remove ZPLv2.1 from license
  - clean up some legacy cruft


author: Francisco Javier Tsao Santín <tsao@gpul.org> - 4.0.0.dev0-1
changelog:
  - Upgraded to 4.0.0.dev0 in order to remove python2 dependencies.
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Satoe Imaishi <simaishi@redhat.com> - 1:2.15.9-1
changelog:
  - ansible-core 2.15.9 release
  - Fix CVE-2024-0690 (possible information leak in tasks that ignore
    ANSIBLE_NO_LOG configuration)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.1-1
changelog:
  - Update to 4.5.1
  - Fix CVE-2023-43804 (urllib3: Cookie request header isn't stripped during
    cross-origin redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.4-1
changelog:
  - Update to 1.4.4
  - Fix CVE-2023-49295 (quic-go: memory exhaustion attack against QUIC's path
    validation mechanism)


author: Satoe Imaishi <simaishi@redhat.com> - 3.9.1-1
changelog:
  - Update to 3.9.1
  - Fix CVE-2023-49082 (CRLF injection if user controls the HTTP method using
    aiohttp client)
  - Fix CVE-2023-49081 (request modification)
  - Fix CVE-2023-47627 (numerous issues in HTTP parser with header parsing)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.3-1
changelog:
  - Update to 3.1.3
  - Fix CVE-2024-22195 (HTML attribute injection when passing user input as keys
    to xmlattr filter)


author: Satoe Imaishi <simaishi@redhat.com> - 10.0.1-1
changelog:
  - Update to 10.0.1
  - Fix CVE-2023-44271 (uncontrolled resource consumption when textlength in an
    ImageDraw instance operates on a long text argument)


author: Satoe Imaishi <simaishi@redhat.com> - 3.20.0-1
changelog:
  - Update to 3.20.0
  - Fix CVE-2023-52323 (side-channel leakage for OAEP decryption in PyCryptodome
    and pycryptodomex)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.5-2
changelog:
  - Update to 4.5.5
  - Fix CVE-2024-24680 (Django: denial-of-service in 'intcomma' template filter)
  - Fix CVE-2024-23829 (aiohttp: http request smuggling)
  - Fix CVE-2024-23334 (aiohttp: follow_symlinks directory traversal vulnerability)
  - Fix CVE-2024-22195 (jinja2: HTML attribute injection when passing user input
    as keys to xmlattr filter)
  - Fix CVE-2023-49083 (cryptography: NULL-dereference when loading PKCS7
    certificates)
  - Fix CVE-2023-47627 (aiohttp: numerous issues in HTTP parser with header parsing)
  - Fix CVE-2023-46137 (twisted: disordered HTTP pipeline response in twisted.web)
  - Fix CVE-2023-45857 (axios: exposure of confidential data stored in cookies)
  - Fix CVE-2023-41040 (GitPython: Blind local file inclusion)


author: Satoe Imaishi <simaishi@redhat.com> - 3.9.3-1
changelog:
  - Update to 3.9.3
  - Fix CVE-2024-23334 (follow_symlinks directory traversal vulnerability)
  - Fix CVE-2024-23829 (http request smuggling)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.11-1
changelog:
  - Update to 4.2.11
  - Fix CVE-2024-27351 (Potential regular expression denial-of-service in
    django.utils.text.Truncator.words())


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.5-1
changelog:
  - Update to 1.4.5
  - Fix CVE-2024-1394 (golang-fips/openssl: Memory leaks in code encrypting and
    decrypting RSA payloads)
  - Fix CVE-2023-39326 (golang: net/http/internal: Denial of Service (DoS) via
    Resource Consumption via HTTP requests)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.7-1
changelog:
  - Update to 4.5.7
  - Fix CVE-2024-30251 (aiohttp: DoS when trying to parse malformed POST requests)
  - Fix CVE-2024-27351 (Django: Potential regular expression denial-of-service in django.utils.text.Truncator.words())
  - Fix CVE-2024-3772 (pydantic: regular expression denial of service via crafted email string)
  - Fix CVE-2023-5752 (pip: Mercurial configuration injectable in repo revision when installing via pip)


author: Satoe Imaishi <simaishi@redhat.com> - 3.9.5-1
changelog:
  - Update to 3.9.5
  - Fix CVE-2024-27306 (XSS on index pages for static file handling)
  - Fix CVE-2024-30251 (DoS when trying to parse malformed POST requests)


author: Satoe Imaishi <simaishi@redhat.com> - 42.0.5-1
changelog:
  - Update to 42.0.5
  - Fix CVE-2023-49083 (NULL-dereference when loading PKCS7 certificates)
  - Fix CVE-2024-26130 (NULL pointer dereference with pkcs12.serialize_key_and_certificates
    when called with a non-matching certificate and private key and an hmac_hash override)


author: Satoe Imaishi <simaishi@redhat.com> - 22.0.0-1
changelog:
  - Update to 22.0.0
  - Fix CVE-2024-1135 (HTTP Request Smuggling due to improper validation of
    Transfer-Encoding headers)


author: Satoe Imaishi <simaishi@redhat.com> - 3.7-1
changelog:
  - Update to 3.7
  - Fix CVE-2024-3651 (potential DoS via resource consumption via specially
    crafted inputs to idna.encode())


author: Satoe Imaishi <simaishi@redhat.com> - 10.3.0-1
changelog:
  - Update to 10.3.0
  - Fix CVE-2023-50447 (Arbitrary Code Execution via the environment parameter)
  - Fix CVE-2024-28219 (buffer overflow in _imagingcms.c)


author: Satoe Imaishi <simaishi@redhat.com> - 1.10.15-1
changelog:
  - Update to 1.10.15
  - Fixes CVE-2024-3772 (regular expression denial of service via crafted email string)


author: Satoe Imaishi <simaishi@redhat.com> - 2.32.2-1
changelog:
  - Update to 2.32.2
  - Fix CVE-2024-35195 (subsequent requests to the same host ignore cert verification)


author: Satoe Imaishi <simaishi@redhat.com> - 5.4.1-1
changelog:
  - Update to 5.4.1
  - Fix CVE-2024-32879 (Improper Handling of Case Sensitivity in social-auth-app-django)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-1
changelog:
  - Update to 1.4.8
  - Fix CVE-2024-24783 (golang: crypto/x509: Verify panics on certificates with an
    unknown public key algorithm)
  - Fix CVE-2023-45290 (golang: net/http: memory exhaustion in Request.ParseMultipartForm)
  - Fix CVE-2023-45288 (golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.8-1
changelog:
  - Update to 4.5.8
  - Fix CVE-2024-35195 (requests: subsequent requests to the same host ignore cert verification)
  - Fix CVE-2024-34064 (jinja2: accepts keys containing non-attribute characters)
  - Fix CVE-2024-28102 (jwcrypto: malicious JWE token can cause denial of service)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.10-1
changelog:
  - Update to 4.5.10
  - Fix CVE-2024-42005 (Django: Potential SQL injection in QuerySet.values() and
    values_list())
  - Fix CVE-2024-41991 (Django: Potential denial-of-service vulnerability in
    django.utils.html.urlize() and AdminURLFieldWidget)
  - Fix CVE-2024-41990 (Django: Potential denial-of-service vulnerability in
    django.utils.html.urlize())
  - Fix CVE-2024-33663 (python-jose: algorithm confusion with OpenSSH ECDSA keys
    and other key formats)
  - Fix CVE-2024-32879 (social-auth-app-django: Improper Handling of Case Sensitivity)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.15-1
changelog:
  - Update to 4.2.15
  - Fix CVE-2024-42005 (Potential SQL injection in QuerySet.values() and values_list())
  - Fix CVE-2024-41991 (Potential denial-of-service vulnerability in django.utils.html.urlize()
    and AdminURLFieldWidget)
  - Fix CVE-2024-41990 (Potential denial-of-service vulnerability in django.utils.html.urlize())
  - Fix CVE-2024-41989 (Memory exhaustion in django.utils.numberformat.floatformat())
  - Fix CVE-2024-39614 (Potential denial-of-service in django.utils.translation.get_supported_language_variant())
  - Fix CVE-2024-39330 (Potential directory-traversal in django.core.files.storage.Storage.save())
  - Fix CVE-2024-39329 (Username enumeration through timing difference for users with
    unusable passwords)
  - Fix CVE-2024-38875 (Potential denial-of-service in django.utils.html.urlize())


author: Satoe Imaishi <simaishi@redhat.com> - 1.58.3-1
changelog:
  - Update to 1.58.3
  - Fix CVE-2024-7246 (client communicating with a HTTP/2 proxy can poison the
    HPACK table between the proxy and the backend)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.16-1
changelog:
  - Update to 4.2.16
  - Fix CVE-2024-45230 (Potential denial-of-service vulnerability in django.utils.html.urlize())


author: Satoe Imaishi <simaishi@redhat.com> - 3.28.32-1
changelog:
  - Update to 3.28.32
  - Fix CVE-2024-7143 (RBAC permissions incorrectly assigned in tasks that create objects)


author: Satoe Imaishi <simaishi@redhat.com> - 1.26.20-1
changelog:
  - Update to 1.26.20
  - Fix CVE-2024-37891 (proxy-authorization request header is not stripped during
    cross-origin redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-1.1
changelog:
  - Fix CVE-2024-24791 (net/http: Denial of service due to improper 100-continue
    handling in net/http)
  - Fix CVE-2024-24790 (golang: net/netip: Unexpected behavior from Is methods
    for IPv4-mapped IPv6 addresses)
  - Fix CVE-2024-24788 (golang: net: malformed DNS message can cause infinite loop)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.12-1
changelog:
  - Update to 4.5.12
  - Fix CVE-2024-21520 (djangorestframework: Cross-site Scripting (XSS) via break_long_headers)
  - Fix CVE-2024-37891 (urllib3: proxy-authorization request header is not
    stripped during cross-origin redirects)
  - Fix CVE-2024-41810 (twisted: Reflected XSS via HTML Injection in Redirect Response)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-1.1
changelog:
  - Fix CVE-2024-24790 (golang: net/netip: Unexpected behavior from Is methods
    for IPv4-mapped IPv6 addresses)
  - Fix CVE-2024-24788 (golang: net: malformed DNS message can cause infinite loop)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.9-1
changelog:
  - Update to 1.4.9
  - Fix CVE-2024-34158 (Calling Parse on a "// +build" build tag line with deeply nested expressions
    can cause a panic due to stack exhaustion)
  - Fix CVE-2024-34155 (Calling any of the Parse functions containing deeply nested literals can
    cause a panic/stack exhaustion
  - Fix CVE-2024-24791 (net/http: Denial of service due to improper 100-continue
    handling in net/http)
  - Fix CVE-2024-22189 (quic-go: memory exhaustion attack against QUIC's connection ID mechanism)
  - Add debug package


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.15.13-1
changelog:
  - ansible-core 2.15.13 release
  - Fix CVE-2024-8775 (Exposure of Sensitive Information in Ansible
    Vault Files Due to Improper Logging)
  - Fix CVE-2024-9902 (Ansible-core user may read/write unauthorized
    content)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.13-1
changelog:
  - Update to 4.5.13
  - Fix CVE-2024-52304 (aiohttp vulnerable to request smuggling due to incorrect
    parsing of chunk extensions)
  - Fix CVE-2024-45296 (path-to-regexp: Backtracking regular expressions cause ReDoS)
  - Require aap-metrics-utility


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.17-1
changelog:
  - Update to 4.5.17
  - Fix CVE-2024-56326 (Jinja has a sandbox breakout through indirect reference to format method)
  - Fix CVE-2024-56201 (Jinja has a sandbox breakout through malicious filenames)
  - Fix CVE-2024-53908 (Django: Potential SQL injection in HasKey(lhs, rhs) on Oracle)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.20-1
changelog:
  - Update to 4.5.20
  - Fix CVE-2025-27516 (Jinja sandbox breakout through attr filter selecting format method)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.6-1
changelog:
  - Update to 3.1.6
  - Fix CVE-2025-27516 (Jinja sandbox breakout through attr filter selecting format method)


author: Satoe Imaishi <simaishi@redhat.com> - 1.0.8-2
changelog:
  - Update to 1.0.8
  - Fix CVE-2025-2877 (exposure inventory passwords in plain text when starting a rulebook activation
    with verbosity set to debug in EDA)


