# changelog

author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.13-1
changelog:
  - ansible-core 2.16.13 release
  - Fix CVE-2024-8775 (Exposure of Sensitive Information in Ansible
    Vault Files Due to Improper Logging)
  - Fix CVE-2024-9902 (Ansible-core user may read/write unauthorized
    content)


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.14-1
changelog:
  - ansible-core 2.16.14 release
  - Fix license and manpages macros usage
  - Fix CVE-2024-11079 (Unsafe Tagging Bypass via hostvars Object in
    Ansible-Core)


author: Satoe Imaishi <simaishi@redhat.com> - 26.3.1-2
changelog:
  - Update to 26.3.1
  - Fix CVE-2026-32274 (Arbitrary file writes from unsanitized user input in cache file name)


author: Satoe Imaishi <simaishi@redhat.com> - 8.3.3-1
changelog:
  - Update to 8.3.3
  - Fix CVE-2026-7246 (Arbitrary command execution via command injection in click.edit())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.25-1
changelog:
  - Update to 4.2.25
  - Fix CVE-2025-59682 (Potential partial directory-traversal via archive.extract())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.27-2
changelog:
  - Update to 4.2.27
  - Fix CVE-2025-64460 (Algorithmic complexity in XML Deserializer leads to denial of service)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.28-2
changelog:
  - Update to 4.2.28
  - Python 3.12 build
  - Fix CVE-2025-14550 (Django: Denial of Service via crafted request with duplicate headers)
  - Fix CVE-2026-1207 (Django: SQL Injection via RasterField band index parameter)
  - Fix CVE-2026-1285 (Django: Denial of Service via crafted HTML inputs)
  - Fix CVE-2026-1287 (Django: SQL Injection via crafted column aliases)
  - Fix CVE-2026-1312 (Django: SQL injection via crafted column aliases in QuerySet.order_by())


author: Satoe Imaishi <simaishi@redhat.com> - 6.0.0-2
changelog:
  - Update to 6.0.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Satoe Imaishi <simaishi@redhat.com> - 1.5.7-2
changelog:
  - Update to 1.5.7
  - Fix CVE-2025-22871 (Request smuggling due to acceptance of invalid chunked data in net/http)


author: Satoe Imaishi <simaishi@redhat.com> - 1.6.3-2
changelog:
  - Update to 1.6.3
  - Fix CVE-2025-61729 (Excessive resource consumption when printing error string for host certificate
    validation in crypto/x509)


author: Satoe Imaishi <simaishi@redhat.com> - 1.6.5-1
changelog:
  - Update to 1.6.5
  - Fix CVE-2026-32283 (Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages)
  - Fix CVE-2026-32282 (Root.Chmod can follow symlinks out of the root)
  - Fix CVE-2026-32280 (Go: Denial of Service vulnerability in certificate chain building)


