# changelog

author: Dimitri Savineau <dsavinea@redhat.com> - 2.15.3-1
changelog:
  - ansible-core 2.15.3 release
  - Use docs and examples from ansible-documentation project.
  - Build the manpages.


author: Satoe Imaishi <simaishi@redhat.com> - 2.15.5-1
changelog:
  - ansible-core 2.15.5 release
  - Fix CVE-2023-5115 (malicious role archive can cause ansible-galaxy to
    overwrite arbitrary files)


author: Satoe Imaishi <simaishi@redhat.com> - 1:2.15.9-1
changelog:
  - ansible-core 2.15.9 release
  - Fix CVE-2024-0690 (possible information leak in tasks that ignore
    ANSIBLE_NO_LOG configuration)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.1-1
changelog:
  - Update to 4.5.1
  - Fix CVE-2023-43804 (urllib3: Cookie request header isn't stripped during
    cross-origin redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.5-2
changelog:
  - Update to 4.5.5
  - Fix CVE-2024-24680 (Django: denial-of-service in 'intcomma' template filter)
  - Fix CVE-2024-23829 (aiohttp: http request smuggling)
  - Fix CVE-2024-23334 (aiohttp: follow_symlinks directory traversal vulnerability)
  - Fix CVE-2024-22195 (jinja2: HTML attribute injection when passing user input
    as keys to xmlattr filter)
  - Fix CVE-2023-49083 (cryptography: NULL-dereference when loading PKCS7
    certificates)
  - Fix CVE-2023-47627 (aiohttp: numerous issues in HTTP parser with header parsing)
  - Fix CVE-2023-46137 (twisted: disordered HTTP pipeline response in twisted.web)
  - Fix CVE-2023-45857 (axios: exposure of confidential data stored in cookies)
  - Fix CVE-2023-41040 (GitPython: Blind local file inclusion)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.7-1
changelog:
  - Update to 4.5.7
  - Fix CVE-2024-30251 (aiohttp: DoS when trying to parse malformed POST requests)
  - Fix CVE-2024-27351 (Django: Potential regular expression denial-of-service in django.utils.text.Truncator.words())
  - Fix CVE-2024-3772 (pydantic: regular expression denial of service via crafted email string)
  - Fix CVE-2023-5752 (pip: Mercurial configuration injectable in repo revision when installing via pip)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.8-1
changelog:
  - Update to 4.5.8
  - Fix CVE-2024-35195 (requests: subsequent requests to the same host ignore cert verification)
  - Fix CVE-2024-34064 (jinja2: accepts keys containing non-attribute characters)
  - Fix CVE-2024-28102 (jwcrypto: malicious JWE token can cause denial of service)


author: Satoe Imaishi <simaishi@redhat.com> - 4.5.10-1
changelog:
  - Update to 4.5.10
  - Fix CVE-2024-42005 (Django: Potential SQL injection in QuerySet.values() and
    values_list())
  - Fix CVE-2024-41991 (Django: Potential denial-of-service vulnerability in
    django.utils.html.urlize() and AdminURLFieldWidget)
  - Fix CVE-2024-41990 (Django: Potential denial-of-service vulnerability in
    django.utils.html.urlize())
  - Fix CVE-2024-33663 (python-jose: algorithm confusion with OpenSSH ECDSA keys
    and other key formats)
  - Fix CVE-2024-32879 (social-auth-app-django: Improper Handling of Case Sensitivity)


author: James Marshall <jamarsha@redhat.com> - 1.0-4
changelog:
  - Add uwsgi executions to allowed for awx
  - Specify awx languages for allowed operations
  - Choose the correct python version on install for awx_python


author: James Marshall <jamarsha@redhat.com> 1.0.3-1
changelog:
  - Bump release
  - Fix product name and version in UI
  - Remove ansible-rulebook installation requirement on API server
  - Add scheduler service
  - Split worker and activation queues


author: James Marshall <jamarsha@redhat.com> 1.1.0-1
changelog:
  - Rebuild for python 3.11
  - Removed ansible-rulebook and psycopg2 dependencies
  - Patched default settings.yaml path
  - Removed environment file settings dependency
  - Added ansible-core, ansible-runner,  psycopg3, xxhash, pyjwt+crypto
    and ecdsa dependencies
  - Added automation-eda-controller-service management script
  - Fixed strict requirement for workers target to main target unit file
  - Added worker services packages
  - Created a new target for all workers and the scheduler service
  - Removed UI package and UI components
  - Removed server subpackage in favor of nodetype subpackages


author: Satoe Imaishi <simaishi@redhat.com> - 1.3.2-2
changelog:
  - Rebuild for multiple architectures
  - Rebuild for RHEL 9.0 support
  - Use python macro to set pulpcore rpm name


author: Satoe Imaishi <simaishi@redhat.com> - 3.9.1-1
changelog:
  - Update to 3.9.1
  - Fix CVE-2023-49082 (CRLF injection if user controls the HTTP method using
    aiohttp client)
  - Fix CVE-2023-49081 (request modification)
  - Fix CVE-2023-47627 (numerous issues in HTTP parser with header parsing)


author: Satoe Imaishi <simaishi@redhat.com> - 3.9.3-1
changelog:
  - Update to 3.9.3
  - Fix CVE-2024-23334 (follow_symlinks directory traversal vulnerability)
  - Fix CVE-2024-23829 (http request smuggling)


author: Satoe Imaishi <simaishi@redhat.com> - 23.6.2-2
changelog:
  - Update to 23.6.2
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Dimitri Savineau <dsavinea@redhat.com> 22.12.0-2
changelog:
  - Update to 22.12.0
  - Fix CVE-2024-21503 (fix catastrophic performance in
    lines_with_leading_tabs_expanded())
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.1.2-5
changelog:
  - Python 2 binary package renamed to python2-daemon
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Iryna Shcherbina <ishcherb@redhat.com> - 2.1.2-8
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.20-1
changelog:
  - Update to 3.2.20
  - Fix CVE-2023-36053 (Potential regular expression denial of service
    vulnerability in EmailValidator/URLValidator)


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.21-1
changelog:
  - Update to 3.2.21
  - Fix CVE-2023-41164 (Potential denial of service vulnerability in
    django.utils.encoding.uri_to_iri())


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.22-1
changelog:
  - Update to 3.2.22
  - Fix CVE-2023-43665 (Denial-of-service possibility in django.utils.text.Truncator)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.11-1
changelog:
  - Update to 4.2.11
  - Fix CVE-2024-27351 (Potential regular expression denial-of-service in
    django.utils.text.Truncator.words())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.16-1
changelog:
  - Update to 4.2.16
  - Fix CVE-2024-45230 (Potential denial-of-service vulnerability in django.utils.html.urlize())
  - Fix CVE-2024-42005 (Potential SQL injection in QuerySet.values() and values_list())
  - Fix CVE-2024-41991 (Potential denial-of-service vulnerability in django.utils.html.urlize()
    and AdminURLFieldWidget)
  - Fix CVE-2024-41990 (Potential denial-of-service vulnerability in django.utils.html.urlize())
  - Fix CVE-2024-41989 (Memory exhaustion in django.utils.numberformat.floatformat())
  - Fix CVE-2024-39614 (Potential denial-of-service in django.utils.translation.get_supported_language_variant())
  - Fix CVE-2024-39330 (Potential directory-traversal in django.core.files.storage.Storage.save())
  - Fix CVE-2024-39329 (Username enumeration through timing difference for users with
    unusable passwords)
  - Fix CVE-2024-38875 (Potential denial-of-service in django.utils.html.urlize())


author: Petr Viktorin <pviktori@redhat.com> - 0.14-5
changelog:
  - Fix specfile typos and oversights
    - Fix python3-setuptools dependency
    - Export RHEL workaround variables
    - Use {__python2} as RPM macro, not shell variable


author: Satoe Imaishi <simaishi@redhat.com> - 0.20.1-2
changelog:
  - Update to 0.20.1
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 3.2.6-1
changelog:
  - Update to 3.2.6
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.32-1
changelog:
  - Update to 3.1.32
  - Fix CVE-2023-40267 (Insecure non-multi options in clone and clone_from is not blocked)


author: Satoe Imaishi <simaishi@redhat.com> - 1.58.3-1
changelog:
  - Update to 1.58.3
  - Fix CVE-2024-7246 (client communicating with a HTTP/2 proxy can poison the
    HPACK table between the proxy and the backend)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.3-1
changelog:
  - Update to 3.1.3
  - Fix CVE-2024-22195 (HTML attribute injection when passing user input as keys
    to xmlattr filter)


author: Satoe Imaishi <simaishi@redhat.com> - 1.0.1-2
changelog:
  - Update to 1.0.1
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:0.11.0-8
changelog:
  - Python 2 binary package renamed to python2-lockfile
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Satoe Imaishi <simaishi@redhat.com> - 6.0.0-2
changelog:
  - Update to 6.0.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 10.0.1-1
changelog:
  - Update to 10.0.1
  - Fix CVE-2023-44271 (uncontrolled resource consumption when textlength in an
    ImageDraw instance operates on a long text argument)


author: Satoe Imaishi <simaishi@redhat.com> - 0.3.0-1
changelog:
  - Update to 0.3.0
  - Split from python-pyasn1 and use package version as rpm version
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 3.20.0-1
changelog:
  - Update to 3.20.0
  - Fix CVE-2023-52323 (side-channel leakage for OAEP decryption in PyCryptodome
    and pycryptodomex)


author: Paul Belanger <pabelanger@redhat.com> - 0.5.4-1
changelog:
  - Initial package.
  - Forked from https://fedora.pkgs.org/rawhide/fedora-x86_64/python3-resolvelib-0.5.5-2.fc35.noarch.rpm.html however
    downgraded to 0.5.4 due to 0.5.5 being yanked from pypi.


author: Satoe Imaishi <simaishi@redhat.com> - 1.13.0-3
changelog:
  - Update to 1.13.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 4.9-2
changelog:
  - Update to 4.9
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 24.7.0-1
changelog:
  - Update to 24.7.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 1.26.18-1
changelog:
  - Update to 1.26.18
  - Fix CVE-2023-43804 (Cookie request header isn't stripped during cross-origin
    redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 1.26.20-1
changelog:
  - Update to 1.26.20
  - Fix CVE-2024-37891 (proxy-authorization request header is not stripped during
    cross-origin redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 5.0.2-1
changelog:
  - Update to 5.0.2
  - Remove obsoletes and rename files in bin dir
  - Add watchmedo extra
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 1.7.0-2
changelog:
  - Update to 1.7.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Charalampos Stratakis <cstratak@redhat.com> - 0.38.4-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Robert Kuska <rkuska@redhat.com>
        Slavek Kabrda <bkabrda@redhat.com>
        Tomas Hrnciar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.2-1
changelog:
  - Update to 1.4.2
  - Fix CVE-2023-39325 (net/http, x/net/http2: rapid stream resets can cause
    excessive work)
  - Fix CVE-2023-44487 (golang: HTTP/2: Multiple HTTP/2 enabled web servers are
    vulnerable to a DDoS attack (Rapid Reset Attack))


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.4-1
changelog:
  - Update to 1.4.4
  - Fix CVE-2023-49295 (quic-go: memory exhaustion attack against QUIC's path
    validation mechanism)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.5-1
changelog:
  - Update to 1.4.5
  - Fix CVE-2024-1394 (golang-fips/openssl: Memory leaks in code encrypting and
    decrypting RSA payloads)
  - Fix CVE-2023-39326 (golang: net/http/internal: Denial of Service (DoS) via
    Resource Consumption via HTTP requests)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-1
changelog:
  - Update to 1.4.8
  - Fix CVE-2024-24783 (golang: crypto/x509: Verify panics on certificates with an
    unknown public key algorithm)
  - Fix CVE-2023-45290 (golang: net/http: memory exhaustion in Request.ParseMultipartForm)
  - Fix CVE-2023-45288 (golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-1.1
changelog:
  - Fix CVE-2024-24790 (golang: net/netip: Unexpected behavior from Is methods
    for IPv4-mapped IPv6 addresses)
  - Fix CVE-2024-24788 (golang: net: malformed DNS message can cause infinite loop)


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.8-3
changelog:
  - Rebuild for python 3.11
  - Fix CVE-2024-34158 (Calling Parse on a "// +build" build tag line with deeply nested expressions
    can cause a panic due to stack exhaustion)
  - Fix CVE-2024-34155 (Calling any of the Parse functions containing deeply nested literals can
    cause a panic/stack exhaustion
  - Fix CVE-2024-24791 (net/http: Denial of service due to improper 100-continue
    handling in net/http)


author: Francisco Javier Tsao Santín <tsao@gpul.org> - 4.0.0.dev0-1
changelog:
  - Upgraded to 4.0.0.dev0 in order to remove python2 dependencies.
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.2-1
changelog:
  - Update to 4.6.2
  - Fix CVE-2024-45230 (Django: Potential denial-of-service vulnerability in django.utils.html.urlize())
  - Fix CVE-2024-41989 (Django: Memory exhaustion in django.utils.numberformat.floatformat())


author: Satoe Imaishi <simaishi@redhat.com> - 1.4.9-2
changelog:
  - Update to 1.4.9
  - Fix CVE-2024-22189 (quic-go: memory exhaustion attack against QUIC's connection ID mechanism)
  - Add debug package


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.13-1
changelog:
  - ansible-core 2.16.13 release
  - Fix CVE-2024-8775 (Exposure of Sensitive Information in Ansible
    Vault Files Due to Improper Logging)
  - Fix CVE-2024-9902 (Ansible-core user may read/write unauthorized
    content)


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.3-1
changelog:
  - Update to 4.6.3
  - Fix CVE-2024-52304 (aiohttp vulnerable to request smuggling due to incorrect
    parsing of chunk extensions)


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.14-1
changelog:
  - ansible-core 2.16.14 release
  - Fix license and manpages macros usage
  - Fix CVE-2024-11079 (Unsafe Tagging Bypass via hostvars Object in
    Ansible-Core)


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.6-1
changelog:
  - Update to 4.6.6
  - Fix CVE-2024-53908 (Django: Potential SQL injection in HasKey(lhs, rhs) on Oracle)
  - Fix CVE-2024-53907 (Django: Potential denial-of-service in django.utils.html.strip_tags())
  - Fix CVE-2024-11407 (grpcio: Denial of Service through Data corruption in gRPC-C++)


author: Satoe Imaishi <simaishi@redhat.com> - 3.10.11-1
changelog:
  - Update to 3.10.11
  - Fix CVE-2024-52304 (aiohttp vulnerable to request smuggling due to incorrect
    parsing of chunk extensions)


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.7-1
changelog:
  - Update to 4.6.7
  - Fix CVE-2024-56374 (Django: potential denial-of-service vulnerability in IPv6 validation)
  - Fix CVE-2024-56326 (Jinja has a sandbox breakout through indirect reference to format method)
  - Fix CVE-2024-56201 (Jinja has a sandbox breakout through malicious filenames)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.18-1
changelog:
  - Update to 4.2.18
  - Fix CVE-2024-56374 (potential denial-of-service vulnerability in IPv6 validation)
  - Fix CVE-2024-53907 (Potential denial-of-service in django.utils.html.strip_tags())


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.5-1
changelog:
  - Update to 3.1.5
  - Fix CVE-2024-56326 (Jinja has a sandbox breakout through indirect reference to format method)
  - Fix CVE-2024-56201 (Jinja has a sandbox breakout through malicious filenames)


author: Satoe Imaishi <simaishi@redhat.com> - 2.5.20250312-1
changelog:
  - Update to 2.5.20250312
  - Fix CVE-2025-26791 (Mutation XSS in DOMPurify Due to Improper Template Literal Handling)


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.10-1
changelog:
  - Update to 4.6.10
  - Fix CVE-2025-27516 (Jinja sandbox breakout through attr filter selecting format method)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.6-1
changelog:
  - Update to 3.1.6
  - Fix CVE-2025-27516 (Jinja sandbox breakout through attr filter selecting format method)


author: Satoe Imaishi <simaishi@redhat.com> - 1.1.4-2
changelog:
  - Update to 1.1.4
  - Fix CVE-2025-2877 (exposure inventory passwords in plain text when starting a rulebook activation
    with verbosity set to debug in EDA)


author: Satoe Imaishi <simaishi@redhat.com> - 4.6.12-1
changelog:
  - Update to 4.6.12
  - Fix CVE-2025-26699 (Django: Potential denial-of-service vulnerability in django.utils.text.wrap())


author: Gregory Shilin <gshilin@redhat.com> - 0.7.0-1
changelog:
  - Bump to v0.7.0
  - Add ability to create an AAP Oauth Application within flightctl-services sub-package


