# changelog

author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.13-1
changelog:
  - ansible-core 2.16.13 release
  - Fix CVE-2024-8775 (Exposure of Sensitive Information in Ansible
    Vault Files Due to Improper Logging)
  - Fix CVE-2024-9902 (Ansible-core user may read/write unauthorized
    content)


author: Dimitri Savineau <dsavinea@redhat.com> - 1:2.16.14-1
changelog:
  - ansible-core 2.16.14 release
  - Fix license and manpages macros usage
  - Fix CVE-2024-11079 (Unsafe Tagging Bypass via hostvars Object in
    Ansible-Core)


author: Satoe Imaishi <simaishi@redhat.com> - 26.3.1-1
changelog:
  - Update to 26.3.1
  - Fix CVE-2026-32274 (Arbitrary file writes from unsanitized user input in cache file name)


author: Satoe Imaishi <simaishi@redhat.com> - 8.3.3-1
changelog:
  - Update to 8.3.3
  - Fix CVE-2026-7246 (Arbitrary command execution via command injection in click.edit())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.18-1
changelog:
  - Update to 4.2.18
  - Fix CVE-2024-56374 (potential denial-of-service vulnerability in IPv6 validation)
  - Fix CVE-2024-53907 (Potential denial-of-service in django.utils.html.strip_tags())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.25-1
changelog:
  - Update to 4.2.25
  - Fix CVE-2025-59682 (Potential partial directory-traversal via archive.extract())


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.27-1
changelog:
  - Update to 4.2.27
  - Fix CVE-2025-64460 (Algorithmic complexity in XML Deserializer leads to denial of service)


author: Satoe Imaishi <simaishi@redhat.com> - 4.2.28-1
changelog:
  - Update to 4.2.28
  - Python 3.12 build
  - Fix CVE-2025-14550 (Django: Denial of Service via crafted request with duplicate headers)
  - Fix CVE-2026-1207 (Django: SQL Injection via RasterField band index parameter)
  - Fix CVE-2026-1285 (Django: Denial of Service via crafted HTML inputs)
  - Fix CVE-2026-1287 (Django: SQL Injection via crafted column aliases)
  - Fix CVE-2026-1312 (Django: SQL injection via crafted column aliases in QuerySet.order_by())


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.5-1
changelog:
  - Update to 3.1.5
  - Fix CVE-2024-56326 (Jinja has a sandbox breakout through indirect reference to format method)
  - Fix CVE-2024-56201 (Jinja has a sandbox breakout through malicious filenames)


author: Satoe Imaishi <simaishi@redhat.com> - 3.1.6-1
changelog:
  - Update to 3.1.6
  - Fix CVE-2025-27516 (Jinja sandbox breakout through attr filter selecting format method)


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 23.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Charalampos Stratakis <cstratak@redhat.com>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jeroen van Meeuwen (Kolab Systems) <vanmeeuwen@kolabsys.com>
        Karolina Surma <ksurma@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Satoe Imaishi <simaishi@redhat.com> - 6.0.0-2
changelog:
  - Update to 6.0.0
  - Remove obsoletes and add python version as suffix for files in /usr/bin
  - Rebuild for python 3.11


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 68.2.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Haikel Guemar <hguemar@fedoraproject.org>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Jesse Keating <jkeating@fedoraproject.org>
        Karolina Surma <ksurma@redhat.com>
        Kevin Fenzi <kevin@scrye.com>
        Konstantin Ryabitsev <icon@fedoraproject.org>
        Lumir Balhar <lbalhar@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <mcyprian@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@cora.nwra.com>
        Petr Viktorin <pviktori@redhat.com>
        Pierre-Yves Chibon <pingou@pingoured.fr>
        Ralph Bean <rbean@redhat.com>
        Randy Barlow <randy@electronsweatshop.com>
        Robert Kuska <rkuska@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Troy Dawson <tdawson@redhat.com>
        Ville Skyttä <scop@fedoraproject.org>


author: Satoe Imaishi <simaishi@redhat.com> - 1.26.20-1
changelog:
  - Update to 1.26.20
  - Fix CVE-2024-37891 (proxy-authorization request header is not stripped during
    cross-origin redirects)


author: Satoe Imaishi <simaishi@redhat.com> - 2.6.3-1
changelog:
  - Update to 2.6.3
  - Fix CVE-2025-66471 (urllib3 Streaming API improperly handles highly compressed data)


author: Satoe Imaishi <simaishi@redhat.com> - 1.5.7-2
changelog:
  - Update to 1.5.7
  - Fix CVE-2025-22871 (Request smuggling due to acceptance of invalid chunked data in net/http)


author: Nickolos Monk <nmonk@redhat.com> - 1.6.3-1
changelog:
  - Update to 1.6.3
  - Fix CVE-2025-61729 (Excessive resource consumption when printing error string for host certificate
    validation in crypto/x509)


author: Satoe Imaishi <simaishi@redhat.com> - 1.6.5-1
changelog:
  - Update to 1.6.5
  - Fix CVE-2026-32283 (Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages)
  - Fix CVE-2026-32282 (Root.Chmod can follow symlinks out of the root)
  - Fix CVE-2026-32280 (Go: Denial of Service vulnerability in certificate chain building)


