# changelog

author: Viktor Borzov <vborzov@cloudlinux.com> - 10.6.20-1.tuxcare.els1
changelog:
  - ELSCVE-131301: Fix CVE-2025-13699 - mariadb-dump -T directory traversal RCE via table/view names (MDEV-37483)


author: Viktor Borzov <vborzov@cloudlinux.com> - 10.6.20-1.tuxcare.els2
changelog:
  - ELSCVE-134075: Fix CVE-2026-44172 - big5 mysql_real_escape_string mishandling (CONC-819)
  - ELSCVE-134076: Fix CVE-2026-44171 - mbstream insufficient path validation (MDEV-39408)
  - ELSCVE-134210: Fix CVE-2026-49261 - wsrep_notify.cc command injection (MDEV-39721)
  - ELSCVE-134087: Fix CVE-2026-48165 - wsrep SST variable validation (MDEV-39676)
  - ELSCVE-134198: Fix CVE-2026-44168 - wsrep unsafe parameter handling, mariabackup SST (MDEV-39413)
  - ELSCVE-134085: Fix CVE-2026-48163 - wsrep_sst_rsync.sh unsafe parameter handling (MDEV-39648)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-3
changelog:
  - fix global ACL directory configuration search path (#1630380)
  - update first/last_valid_gid range patch (#1630409)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-5
changelog:
  - fix CVE-2019-3814: improper certificate validation (#1674369)
  - fix CVE-2019-7524: buffer overflow in indexer-worker process resulting in privilege 
    escalation (#1700398)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-6
changelog:
  - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte
    when scanning data in quoted strings, leading to out of bounds heap
    memory writes (#1741787)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.2.36-7.1
changelog:
  - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866752)
  - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866757)
  - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866764)


author: Viktor Borzov <vborzov@cloudlinux.com> - 1:2.2.36-8.tuxcare.els2
changelog:
  - CVE-2026-27857: improve fix by enforcing list_count_limit on '(' (open_list)
    instead of ')' (close_list); the previous fix did not actually limit memory
    growth from many '(' characters


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:2.2.36-8.tuxcare.els3
changelog:
  - CVE-2026-27858: fix pre-auth memory exhaustion in managesieve-login from
    an oversized AUTHENTICATE initial response


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.392.b08-1
changelog:
  - Update to shenandoah-jdk8u392-b08 (GA)
  - Update release notes for shenandoah-8u392-b08.
  - Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
  - Update bug URL for RHEL to point to the Red Hat customer portal
  - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
  - Regenerate PR2462 patch following JDK-8315135
  - Add backport of JDK-8312489 heading upstream for 8u402 (see OPENJDK-2095)
  - Add missing JFR alternative ghost
  - Move jcmd to the headless package
  - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
  - Resolves: RHEL-12212
  - Resolves: RHEL-13574
  - Resolves: RHEL-13575
  - Resolves: RHEL-13576
  - Resolves: RHEL-11319
  - Resolves: RHEL-13577


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 1:1.8.0.402.b06-1.tuxcare.els1
changelog:
  - Upgrade to shenandoah-jdk8u402-b06. That fixes following CVEs:
  - CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler
  - CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution
  - CVE-2024-20921: Range check loop optimization issue
  - CVE-2024-20926: Arbitrary Java code execution in Nashorn
  - CVE-2024-20945: Logging of digital signature private keys
  - CVE-2024-20952: RSA padding issue and timing side-channel attack against TLS
  - Remove JDK-8312489 patch which is already in the sources


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.8.0.412.b08-1.tuxcare.els1
changelog:
  - Upgrade to shenandoah-jdk8u412-b08. That fixes the following CVEs:
  - CVE-2024-21011: Denial of service due to long Exception message logging
  - CVE-2024-21085: Pack200 excessive memory allocation
  - CVE-2024-21068: Integer overflow in C1 compiler address generation
  - CVE-2024-21094: Unauthorized data modification due to C2 compilation failure
    with "Exceeded _node_regs array"


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1:1.8.0.422.b05-1.tuxcare.els1
changelog:
  - Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u422-b05. That fixes following CVEs:
  - CVE-2024-21131: UTF8 size overflow
  - CVE-2024-21138: Infinite loop vunlerability in SymbolTable
  - CVE-2024-21140: Int overflow/underflow in Range Check Elimination (RCE)
  - CVE-2024-21144: Invalid header validation leads to Pack200 excessive loading time
  - CVE-2024-21145: Out-of-bounds access in MaskFill
  - CVE-2024-21147: Out-of-bounds array index in Range Check Elimination (RCE)


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.8.0.452.b09-1.tuxcare.els1
changelog:
  - Upgrade openjdk-shenandoah-jdk8u-shenandoah-jdk8u452-b09. That fixes the following CVE:
    CVE-2025-21587, CVE-2025-30691 and CVE-2025-30698


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 1:1.8.0.462.b08-1.tuxcare.els1
changelog:
  - Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u462-b08 (GA). That fixes following CVEs:
  - CVE-2025-30749: better Glyph drawing
  - CVE-2025-30754: enhance TLS protocol support
  - CVE-2025-30761: improve scripting supports
  - CVE-2025-50106: glyph out-of-memory access and crash


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.8.0.482.b03-1.tuxcare.els1
changelog:
  - Update to openjdk-shenandoah-jdk8u-shenandoah-jdk8u482-b03.
  - CVE-2026-21945: Security component vulnerability allowing unauthenticated
    attacker with network access to cause hang or crash (DoS).


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1:1.8.0.492.b09-1.tuxcare.els1
changelog:
  - Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u492-b09 (GA). That
    fixes following CVEs:
  - CVE-2026-22003: hotspot DoS via sandboxed Java Web Start/applets with
    untrusted code (resource exhaustion)
  - CVE-2026-22007: Security component, local high-complexity low-impact
    info disclosure
  - CVE-2026-22013: JGSS, remote (user-interaction) high-confidentiality
    info disclosure
  - CVE-2026-22016: JAXP, remote unauth high-confidentiality info disclosure
  - CVE-2026-22018: Libraries, remote high-complexity DoS (low impact)
  - CVE-2026-22021: JSSE/HTTPS, remote unauth DoS (low impact)
  - CVE-2026-34268: Security component, local high-complexity low-impact
    info disclosure
  - CVE-2026-34282: Networking, remote unauth DoS (high availability impact)


author: Viktor Borzov <vborzov@cloudlinux.com> - 1:1.8.0.502.b07-1.tuxcare.els1
changelog:
  - Upgrade to openjdk-shenandoah-jdk8u-shenandoah-jdk8u502-b07 (GA). That
    fixes following CVEs:
  - CVE-2026-46968: JSSE, remote high-complexity high-integrity compromise via
    TLS (enhance TLS certificate handling)
  - CVE-2026-47010: ImageIO, remote high-complexity low-impact integrity
    compromise (enhance JPEG handling)
  - CVE-2026-47021: 2D, remote unauthenticated DoS with low availability
    impact (enhance XBM image support)
  - CVE-2026-47057: Scripting, improve Nashorn index handling
  - CVE-2026-47058: Scripting, enhance DataView implementation
  - CVE-2026-47063: Libraries, enhance Jar handling
  - The same upstream release also closes the remaining CVEs of the Oracle
    July 2026 CPU, tracked under separate ELS tickets:
  - CVE-2026-47027: Libraries, enhance Jar file processing
  - CVE-2026-47059: 2D, enhance AWT ImagingLib
  - CVE-2026-60147: Security, improve certification checking
  - CVE-2026-41254: bundled Little CMS updated to 2.19.1


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1:1.20.1-10.tuxcare.els5
changelog:
  - CVE-2026-49975: add max_headers directive (default 1000) to cap HTTP/2
    request-header memory exhaustion (HTTP/2 Bomb)


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.20.1-10.tuxcare.els6
changelog:
  - CVE-2026-42533: add script-engine buffer overrun protection to fix heap
    buffer overflow when a map regex capture (or a non-cacheable variable) is
    used in a string expression


author: Pavel Kopylov <pkopylov@cloudlinux.com> - 1:1.20.1-10.tuxcare.els7
changelog:
  - CVE-2026-49975: improve the max_headers patch to preserve binary
    compatibility with externally-built nginx modules


