Безопасность

- New version (Closes: 42217)
- Security fixes:
  + CVE-2022-0547: possible authentication bypass if multiple
    authentication plugins tries to do deferred authentication
- Fix build with new python3-module-docutils

- 0.103.6
  + CVE-2022-20770
  + CVE-2022-20796
  + CVE-2022-20771
  + CVE-2022-20785
  + CVE-2022-20792

- Version bump
- Many bugfixes, including security, including:
  Fixes: CVE-2022-24106, CVE-2022-27135

- Autobuild version bump to 6.1.7
- Fixes: CVE-2022-30333

- 2.5.0 (fixed CVE-2013-4289, CVE-2013-4290, CVE-2019-6988, 
  CVE-2018-20846, CVE-2018-16376, CVE-2021-29338)

- 7.83.1
- Fixes:
  * CVE-2022-30115: HSTS bypass via trailing dot
  * CVE-2022-27782: TLS and SSH connection too eager reuse
  * CVE-2022-27781: CERTINFO never-ending busy-loop
  * CVE-2022-27780: percent-encoded path separator in URL host
  * CVE-2022-27779: cookie for trailing dot TLD
  * CVE-2022-27778: curl removes wrong file on error

- 2.9.14 (Fixes: CVE-2022-29824, CVE-2022-23308)

- New version.
- Security fixes:
  + CVE-2021-28544 Subversion servers reveal copyfrom paths that should be hidden according to configured path-based authorization (authz) rules.
  + CVE-2022-24070 mod_dav_svn is prone to a use-after-free vulnerability when looking up path-based authorization rules, which can result in denial of service (crash of HTTPD worker handling the request).

- 3.2.12 -> 3.2.13
- Fixes:
  * CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra()
  * CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

- v1.2.11 -> v1.2.12 (fixes: CVE-2018-25032).

- 2.4.53 (Fixes:  CVE-2022-23943, CVE-2022-22721,  CVE-2022-22720, CVE-2022-22719)

- 9.11.36 -> 9.11.37 (fixes: CVE-2021-25220).

- 1.19.2 (Fixes: CVE-2021-37750)

- Security update (fixed: CVE-2021-4189 and CVE-2022-0391);
- Fixed FTBFS against libexpat >= 2.4.5.

- Updated to 2.4.7 (relax fix to CVE-2022-25236).

- E2K:
  + added mcst patches, mostly as-is except:
    - 0003-Add-copy-optimizations.patch: partially obsolete
    - 0006-Add-bug-workaround.patch: obsolete for arch > e2kv2
    - 0010-Restore-DRI1-support.{add,mod}.patch: need more reverts
    - 0040-Fix-CVE-2018-14665.patch: applied elsewhere upstream
    and specifically, including:
    - 0010-restore-DRI1-support-for-e1c.patch
    - mga2 related patch from mcst#5155
  + warning-related ftbfs workarounds

- NMU (fixes: CVE-2021-4034).
- Applied upstream fix for a trivially exploitable local root vulnerability,
  see https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

- E2K: apply mcst patches, including CVE-2018-6621 fix

- 4.4.1 (Fixes: CVE-2021-45387, CVE-2021-45386)

- 7.4.28 (Fixes: CVE-2021-21708)

- 5.8 -> 5.8.1.
- Fixes:
  + CVE-2021-45444

- new version 1.41 (Fixes: CVE-2022-23096, CVE-2022-23097, CVE-2022-23098)

- 1.12.4 (fixed CVE-2022-21682, CVE-2021-43860)

- 2.4.3 (Fixes: CVE-2021-4122).

- 2.1.38 -> 2.1.39 (fixes for CVE-2021-42097 and CVE-2021-44227).

- new version 1.0.13 (Fixes: CVE-2021-43612)
- migrate /var/run -> /run

- 1.10.6 -> 1.10.7 (Fixes: CVE-2021-41158, CVE-2021-41145, CVE-2021-41157,
  CVE-2021-41105, CVE-2021-37624, CVE-2021-36513)

- New version
- Security fixes:
  + CVE-2021-41099: buffer overflow with non-default configuration
  + CVE-2021-32762: buffer overflow issue in redis-cli and redis-sentinel
  + CVE-2021-32687: buffer overflow with non-default configuration
  + CVE-2021-32675: Denial Of Service when processing RESP request payloads
  + CVE-2021-32672: random heap reading issue with Lua Debugger
  + CVE-2021-32628: buffer overflow with non-default configuration
  + CVE-2021-32627: buffer overflow with non-default configuration
  + CVE-2021-32626: Lua scripts may result with Heap buffer overflow
  + CVE-2021-32761: integer overflow in BITFIELD on 32-bit versions

- Applied SUSE combchar.diff to prevent DoS via crafted UTF-8 character
  sequence (fixes CVE-2021-26937).

- 1.0.8 (Fixes: CVE-2020-0256, CVE-2021-0308)