# changelog

author: Xiaojie Chen <jackxjchen@tencent.com> - 5.2-3
changelog:
  - fix crash with unset arrays in arithmetic contexts
  - fix crash in readline when started with an invalid locale specification


author: Xin Cheng <denisecheng@tencent.com> - 9.18.18-4
changelog:
  - fix CVE-2023-4408: Parsing large DNS messages may cause excessive CPU load
  - fix CVE-2023-5517: Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled
  - fix CVE-2023-5679: Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution
  - fix CVE-2023-6516: Specific recursive query patterns may lead to an out-of-memory condition
  - fix CVE-2023-50387: KeyTrap - Extreme CPU consumption in DNSSEC validator
  - fix CVE-2023-50868: Preparing an NSEC3 closest encloser proof can exhaust CPU resources


author: Ze Zhang <bbrucezhang@tencent.com> - 3.8.2-4.oc9.1
changelog:
  - Fix error with /usr/lib/rpm/find-lang.sh /builddir/build/BUILDROOT/bison-3.8.2-4.oc9.1.aarch64 not being executed


author: Wang Guodong <gordonwwang@tencent.com> - 1.73.0-1
changelog:
  - Upgrade to 1.73.0
  - Add build target for x86_64-unknown-none, x86_64-unknown-uefi
  - Use emmalloc instead of CC0 dlmalloc when bundling wasi-libc


author: Qian Liang <renaliang@tencent.com> - 12.3.1-1
changelog:
  - updated to tgcc-12.3.1
  - Security updates: fix CVE-2023-4039. merge from https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=75c37e031408262263442f5b4cdb83d3777b6422
  - fix ICE in ipa profile multiple target speculative.


author: kianli <kianli@tencent.com> - 4.18.8-1
changelog:
  - Upgrade to 4.18.8
  - Security fix for CVE-2023-3961
  - Security fix for CVE-2023-4091
  - Security fix for CVE-2023-4154
  - Security fix for CVE-2023-42669
  - Security fix for CVE-2023-42670


author: cunshunxia <cunshunxia@tencent.com> - 20220826gitba0e0e4c6a17-4
changelog:
  - build aarch64 subpkg only on arm.

  -* Fri Mar 31 2023 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 20220826gitba0e0e4c6a17-3
  -- Rebuilt for OpenCloudOS Stream 23


author: Zhao Zhen <jeremiazhao@tencent.com> - 4.12.1-1
changelog:
  - updated fence-agents 4.12.1
  - disabled ppc64le temlpy
  - bootstrap aws/gce/compute/kubevirt/aliyun agents
  - disabled azure temply
  - added ecloud agents


author: Doris Chao <doriscchao@tencent.com> - 102.15.1-1
changelog:
  - Update to 102.15.1
  - Update nss, nspr version
  - App pacth from mozilla to fix CVE-2023-23604
  - App pacth from mozilla to fix CVE-2022-46884


author: Doris Chao <doriscchao@tencent.com> - 115.5.0-1
changelog:
  - Update to 115.5.0 to fix CVEs,include CVE-2023-6204,CVE-2023-6205,
  - CVE-2023-6206,CVE-2023-6207,CVE-2023-6208,CVE-2023-6209,CVE-2023-6212


author: Doris Chao <doriscchao@tencent.com> - 115.6.0-1
changelog:
  - Update to 115.6.0 to fix CVEs,include CVE-2023-6856,CVE-2023-6857,
  - CVE-2023-6858,CVE-2023-6859,CVE-2023-6860,CVE-2023-6861,CVE-2023-6862,
  - CVE-2023-6863,CVE-2023-6864,CVE-2023-6865,CVE-2023-687


author: Doris Chao <doriscchao@tencent.com> - 115.7.0-1
changelog:
  - Update to 115.7.0 to fix CVEs,include CVE-2023-6135,CVE-2024-0741,
  - CVE-2024-0742,CVE-2024-0753,CVE-2024-0746,CVE-2024-0747,CVE-2024-0749,
  - CVE-2024-0750,CVE-2024-0751,CVE-2024-0755


author: Doris Chao <doriscchao@tencent.com> - 115.8.0-1
changelog:
  - Update to 115.8.0 to fix CVEs,include CVE-2024-1546,CVE-2024-1547,
  - CVE-2024-1548,CVE-2024-1549,CVE-2024-1550,CVE-2024-1551,CVE-2024-1552,
  - CVE-2024-1553


author: Xiaojie Chen <jackxjchen@tencent.com> - 2.11.2-1
changelog:
  - Upgrade to upstream version 2.11.2
  - Fix CVE-2023-40589,CVE-2023-40569,CVE-2023-40567,CVE-2023-40188
  - Fix CVE-2023-40186,CVE-2023-40181,CVE-2023-39356,CVE-2023-39354
  - Fix CVE-2023-39353,CVE-2023-39352,CVE-2023-39351,CVE-2023-39350
  - Fix CVE-2022-41877,CVE-2022-39347,CVE-2022-39320,CVE-2022-39319
  - Fix CVE-2022-39318,CVE-2022-39317,CVE-2022-39316
  - Remove dbus, glib and gstreamer requirements


author: kianli <kianli@tencent.com> - 9.0.1-1
changelog:
  - Upgrade to 9.0.1
  - Security fix for CVE-2023-38406
  - Security fix for CVE-2023-38407
  - Security fix for CVE-2023-38802
  - Security fix for CVE-2023-41359
  - Security fix for CVE-2023-41909
  - Security fix for CVE-2023-41360
  - Security fix for CVE-2023-41361
  - Security fix for CVE-2023-41358
  - Security fix for CVE-2023-46752
  - Security fix for CVE-2023-46753


author: rockerzhu <rockerzhu@tencent.com> - 12.1-5
changelog:
  - Add sub-package of headless, avoiding rpm-build to require all gdb, but to require gdb-headless
    and not to require source-highlight.


author: rockerzhu <rockerzhu@tencent.com> - 12.1-6
changelog:
  - Add sub-package of minimal to provides /usr/bin/gdb-add-index(needed by rpm-build) and
    gdb.minimal(needed by /usr/bin/gdb-add-index)
  - Rebuilt with boost 1.82.0.


author: TencentOS Team <tencent_os@tencent.com> - 41.3-6.tl4.1
changelog:
  - Rebrand for TencentOS
  - Force the login screen to use Xorg to fix mouse residue issues on
    some physical machines in gc tl3.4


author: Shuo Wang <abushwang@tencent.com> - 2.38-5
changelog:
  - backport patch to fix CVE-2023-6246, CVE-2023-6779, CVE-2023-6780
  - Fix heap buffer overflow for syslog


author: Shuo Wang <abushwang@tencent.com> - 9.0.0-2
changelog:
  - backport patch to fix CVE-2023-46045:
  - gvc: detect plugin installation failure and display an error


author: rockerzhu <rockerzhu@tencent.com> - 17.2.5-6
changelog:
  - Rebuilt for boost 1.82.0 and add common-options-objs as a dependency
    of common-msg-objs, rados_snap_set_diff_obj and krbd.
  - Build with bundled boost until boost compatible to fix "'const class boost::core::basic_string_view'
    has no member named 'to_string'".


author: Jiaxin Yang <jiaxinyyang@tencent.com> - 1.13.1-1
changelog:
  - Fix bug with smaller width bigger size, resolve CVE-2023-44488
  - VP8: disallow thread count changes, resolve CVE-2023-5217


author: Shuo Wang <abushwang@tencent.com> - 20.10.21-3
changelog:
  - apply 
    
       GO111MODULE=off \
    go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-}  -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -linkmode=external -extldflags '-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/OpenCloudOS/OpenCloudOS-hardened-ld  -Wl,--build-id=sha1 '" -a -v -x macro;


author: Ze Zhang <bbrucezhang@tencent.com> - 0.32.5-3.oc9.1
changelog:
  - Fix error with /usr/lib/rpm/find-lang.sh /builddir/build/BUILDROOT/neon-0.32.5-3.oc9.1.aarch64 not being executed


author: Zhao Zhen <jeremiazhao@tencent.com> 18.18.2-1
changelog:
  - updated to upstream 18.18.2
  - switched to using original source tarball
  - fixed CVE-2023-45143 CVE-2023-39332 CVE-2023-39331 CVE-2023-38552 CVE-2023-32559 
    CVE-2023-32006 CVE-2023-32002 CVE-2023-30590 CVE-2023-30588 CVE-2023-30581


author: Xin Cheng <denisecheng@tencent.com> - 9.3p2-4
changelog:
  - CVE-2023-51385: forbid shell metasymbols in username/hostname
  - CVE-2023-51384: apply destination constraints to all p11 keys
  - CVE-2023-48795: fix Terrapin attack


author: doriscchao <doriscchao@tencent.com> - 2.7.6-1
changelog:
  - initial build, base version 2.7.6, update to upstream git commit 20200514 with gnulib 
    version 20200513 through patch0001.


author: Kairui Song <kasong@tencent.com> - 6.6.6-2401.0.1
changelog:
  - kabi: freeze kabi for x86_64 and arm64
  - x86/mpparse, kexec: switch apic driver early when x2apic is pre-enabled
  - tracing: workaround UAF caused by memory ordering issue
  - mm/slub.c: sanitize freelist pointer assignment even more
  - mm/slub.c: fix a potential UAF
  - cgroup: use a standalone workqueue for killing css
  - mm/vmscan.c: add cond_resched function call into __shrink_page_cache
  - swap: expose required symbols for some 3rd part modules
  - swapfile: add a helper get_cached_swap_page_of_type
  - mm: memcg: introduce v2's interface to v1
  - psi: only show SOME PSI for non-IRQ in cgroup v1
  - psi: support cgroup v1 psi accounting
  - psi: expose cgroup v1 interface for psi
  - psi: link legacy root to psi_system
  - sched/psi: simplify cgroup psi retrieving
  - arm64: fake a reliable stacktrace for livepath
  - arm64: enable livepatch without stable stacktrace
  - arm64: basic infrastructure for livepatch
  - pagecachelimit: limit the pagecache ratio of totalram
  - blkcg: add buffer IO throttle for cgroup v1
  - cgroupfs: support stat based on cpuacct
  - cgroupfs: fix non inited i_ino when inode created
  - cgroupfs: add files inside sys
  - cgroupfs: support for proc and sys
  - cgroupfs: quota aware support
  - cgroupfs: refactor cgroup resource statistics for reuse
  - memcg: make meminfo optionally recursive and rework
  - memcg: add meminfo and vmstat show
  - cpuset: add switch support for cpuset.stat in container
  - cpuset: fix cpuset.stat process field value exception
  - cpuset: add switch for cpuinfo in container
  - cpuset: add loadavg calc for each container
  - cpuset: add cpuinfo and stat show
  - sysfs: add sysfs attribute to hide disk devices
  - blkcg/diskstats/dm: add support for blkcg diskstats
  - blkcg/diskstats/md: add support for blkcg diskstats
  - blkcg/diskstats: add per blkcg diskstats support
  - ext4: Add an error info during new_inode
  - ext4: fix soft lockup caused by sbi->s_es_lru
  - ceph: add mds request pid info into debugfs
  - ceph: Add new mount option req_resend
  - ceph: re-send osd requests if timeout
  - nvme: add the hotplug info output about drive letter and BDF
  - nbd: add the nbd_ignore_blksize_set support
  - xfs: add kmem_alloc_by_vmalloc and kmem_alloc_large_dump_stack sysctl
  - xfs: set xfs default error level to 5
  - ceph: add sysctl to ignore error epoch barrier
  - ext3: set nobarrier as default
  - block: check whether queue is NULL or not in stats functions
  - net: modify default value of host max_orphan
  - net: namespaceify sysctl_tcp_max_orphans
  - vm: isolate max_map_count by pid namespace
  - cpuacct: get the uptime of container
  - proc: add pid mapping between host and container
  - taskstats: expose taskstats to all netspace
  - tcp: make TCP_RTO_MIN/MAX be tunable
  - tcp: support self define parameter to tune rto of syn/synack packets
  - tcp: introduce sysctl tcp_inherit_buffsize
  - net: ipv6 neigh tunnel bypass
  - net: add sysctl to control page frag
  - net: add sriov debug info
  - net: increase tcp listen hash
  - tcp: add TCP_FULLNAT_REAL setsockopt options for fullnat real ip
  - net: reduce the confliction while multi threads connecting same host
  - bonding: add broadcast_arp param to send arp broadcast
  - netlink: don't modprobe proto audit & selinux
  - tcp: add proc parameter to change init cwnd
  - net: add tcp_no_delay_ack to enable absolute quick ack
  - tcp: add tcp_loss_init_cwnd sysctl to tunnel packet numbers in loss
  - network: default zero bond_devices to support
  - tcp: double the default value of thash_entries
  - tcp: backoff the commit allowing timestamps even if SYN packet has tsval=0
  - net: dev ipv4/v6 stat
  - net: add tcp drop stats
  - ipmi: set kipmid_max_busy_us default to 1
  - sched: adaptive default skew_tick value
  - ipc/msg: increase defaults for shmmall, shmmax, msgmax and msgmnb
  - mm: increase dirty-ratio from 20 to 40
  - tkernel: netfilter: conntrack: add netagent extention slot
  - tkernel: net: add toa support
  - tkernel: mounts: add shield mountpoint in container support
  - tkernel: netatop: add netatop module in kernel/tkernel/
  - tkernel: ttools: add ttools module to support ptrace protect
  - tkernel: initial support and nonpriv_bind
  - sysrq: add ALT+LEFTCTRL to trigger crash dump
  - kabi: add paddings and optimize (part 3)
  - kabi: add paddings (part 2)
  - kabi: add paddings (part 1)
  - kabi: add kabi.h
  - kabi: modules: better vermagic check on module load
  - config: update config for ocks-2401
  - dist: config: update config from ocks-2303
  - dist: config: add default config files
  - dist: fix script checker
  - dist: tools/vm -> tools/mm
  - dist: move libcpupower.so to kernel-libs
  - dist: initial support
  - Linux 6.6.6


author: Xiaojie Chen <jackxjchen@tencent.com> - 2.206-1
changelog:
  - Upgrade to upstream version 2.206
  - Remove perl(MODULE_COMPAT) which will be generated by perl-generators >= 1.15


author: Xiaojie Chen <jackxjchen@tencent.com> - 6.04-1
changelog:
  - Upgrade to upstream version 6.04
  - Remove perl(MODULE_COMPAT) which will be generated by perl-generators >= 1.15


author: Xiaojie Chen <jackxjchen@tencent.com> - 3.19-1
changelog:
  - Upgrade to upstream version 3.19
  - Remove perl(MODULE_COMPAT) which will be generated by perl-generators >= 1.15


author: Xiaojie Chen <jackxjchen@tencent.com> - 3.81-1
changelog:
  - Upgrade to upstream version 3.81
  - Remove perl-libs which will be generated by perl-generators >= 1.15


author: Xiaojie Chen <jackxjchen@tencent.com> - 2.037-1
changelog:
  - Upgrade to upstream version 2.037
  - Remove perl-libs which will be generated by perl-generators >= 1.15


author: Xiaojie Chen <jackxjchen@tencent.com> - 1.33-1
changelog:
  - Upgrade to upstream version 1.33
  - Remove perl(MODULE_COMPAT) which will be generated by perl-generators >= 1.15


author: Wang Guodong <gordonwwang@tencent.com> - 15.4-1
changelog:
  - Upgrade to version 15.4
  - Use sysusers configuration to setup user & group
  - CVEs fixed: CVE-2023-39417 CVE-2023-39418


author: Wang Guodong <gordonwwang@tencent.com> - 1.22.0-2
changelog:
  - Set the environment variable(SETUPTOOLS_USE_DISTUTILS) to solve 
    setuptools-bundled distutils' LooseVersion issue.


author: Xin Cheng <denisecheng@tencent.com> - 1.17.1-4
changelog:
  - Fix CVE-2023-50387, DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers.
  - Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU.


author: Xiaojie Chen <jackxjchen@tencent.com> - 1.9.2-1
changelog:
  - Upgrade to upstream version 1.9.2 
  - Disable some tests until upstream adapts to changes in python 3.11


author: Xiaojie Chen <jackxjchen@tencent.com> - 7.0.14-1
changelog:
  - Upgrade to upstream version 7.0.14
  - Fix CVE-2023-41053 and CVE-2023-45145
  - Set jemalloc page size


author: Shuo Wang <abushwang@tencent.com> - 1.1.4-3
changelog:
  - apply 
    
       GO111MODULE=off \
    go build -buildmode pie -compiler gc -tags="rpm_crashtraceback ${BUILDTAGS:-}" -ldflags "${LDFLAGS:-}  -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \n') -compressdwarf=false -linkmode=external -extldflags '-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/OpenCloudOS/OpenCloudOS-hardened-ld  -Wl,--build-id=sha1 '" -a -v -x macro and enable debuginfo;


author: Xiaojie Chen <jackxjchen@tencent.com> - 6.5-1
changelog:
  - Upgrade to upstream version 6.5
  - Fix CVE-2023-46728, CVE-2023-46848 and CVE-2023-46847
  - Fix CVE-2023-46846, CVE-2023-5824 and CVE-2023-46724


author: Miaojun Dong <zoedong@tencent.com> - 0.13.0-1
changelog:
  - Bump version to 0.13.0
  - usbredirserver is deprecated in favor of usbredirect
  - usbredirect can be used as a client or server through different parameters


author: Zhao Zhen <jeremiazhao@tencent.com> - 9.0.2092-1
changelog:
  - updated to upstream version 9.0.2092
  - fixed CVE-2023-4735 CVE-2023-4736 CVE-2023-4734 CVE-2023-4738 CVE-2023-4752 
    CVE-2023-4781 CVE-2023-4733 CVE-2023-4750 CVE-2023-5344 CVE-2023-5441 CVE-2023-5535


author: Yi Lin <nilusyi@tencent.com> - 9.0.2092-2
changelog:
  - fixed CVE-2023-48231 CVE-2023-48232 CVE-2023-48233 CVE-2023-48234 CVE-2023-48235 
    CVE-2023-48236 CVE-2023-48237 CVE-2023-48706 CVE-2024-22667


