# changelog

author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-43.1
changelog:
  - ALTPHP-1896: Update to 7.1.1-43
  - ALTPHP-1920: Update libwebp to 1.5.0
  - ALTPHP-1932: Fix perfomance issues


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.11.0-2
changelog:
  - don't add link to ldap in *.pc file if ldap.pc doesn't exist
  - don't add link to mit-krb5-gssapi in *.pc file if mit-krb5-gssapi.pc.pc doesn't exist


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.19.0-2
changelog:
  - ALTPHP-2119: patch to allow building alt-curlssl11 with OpenSSL 1.1
    (curl 8.19.0 dropped OpenSSL < 3.0 support upstream)
  - Fix OPENSSL_VERSION_STRING -> OPENSSL_VERSION for OpenSSL 1.1 compat
  - Fix doc file references: FAQ -> FAQ.md, TODO -> TODO.md, KNOWN_BUGS -> KNOWN_BUGS.md
  - Disable flaky tests 763, 1501, 1583


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 8.19.0-3
changelog:
  - ALTPHP-2106: pin alt-nghttp2 runtime requirement to the version we built
    against, to avoid undefined-symbol errors when an older alt-nghttp2 is
    installed alongside a freshly built alt-curlssl11


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.19.0-4
changelog:
  - Restore short "OpenSSL/1.1.1w" SSL version string (drop the duplicated
    "OpenSSL " prefix and trailing release date introduced when working
    around OPENSSL_VERSION_STRING for alt-openssl11)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.1.28-1
changelog:
  - Update to 2.1.28 to match system cyrus-sasl on EL10 (fixes
    "ldap_int_sasl_init: SASL library version mismatch: expected 2.1.28,
    got 2.1.27" when system libldap loads alt libsasl2 via php RPATH)
  - Drop cyrus-sasl-pr559-RC4-openssl.patch (merged upstream in 2.1.28)
  - Add rpath to own libdir so sbin tools find the bundled libsasl2
    without the system cyrus-sasl-lib package installed
  - Drop cyrus-sasl-2.1.23-man.patch (testsaslauthd.8 man page is shipped
    upstream in 2.1.28; applying the patch would duplicate its content)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 57.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow): not applied
    for v57 yet (see TODO.md)
  - Drop SOURCE100/101 dep filters, use alt_default_filter
  - Drop downstream ".cloudlinux.1" release suffix; align Release with
    other ICU lines


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 65.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Run %check as two top-level make calls (source/test + xcheck-local)
    to dodge ICU's broken nested-make jobserver pattern; tests now run
    strictly without "||:"


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 71.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Release bumped to align with other ICU lines


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.0.2u-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free)
  - Guard -Wno-error=incompatible-pointer-types/-implicit-function-declaration
    to gcc >= 6 (rhel >= 8) so the build no longer fails on CL7 gcc 4.8.5


author: Areg Gasparyan <agasparyan@cloudlinux.com> - 1:1.1.1w-3
changelog:
  - CVE-2025-68160: fix heap buffer overflow in BIO_f_linebuffer when next BIO
    performs short writes
  - CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes
    unauthenticated/unencrypted by advancing pointers after stream processing
  - CVE-2025-69419: fix out-of-bounds write in OPENSSL_uni2utf8 and do_buf
    by checking return code of UTF8_putc/bmp_to_utf8
  - CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
    for signing certificate attributes
  - CVE-2025-69421: fix NULL pointer dereference in PKCS12_item_decrypt_d2i
    by adding NULL check for oct parameter
  - CVE-2026-22795: fix ASN1_TYPE validation in PKCS12 parsing (p12_kiss.c)
    and s_client.c before accessing union members
  - CVE-2026-22796: fix ASN1_TYPE type confusion in PKCS7_digest_from_attributes
    by validating type before accessing as OCTET_STRING


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.2
changelog:
  - CVE-2023-5678: fix excessive time in DH check/generation with large Q
    parameter by adding bounds checks in DH_check_pub_key and DH_generate_key
  - CVE-2024-0727: fix PKCS12 decoding NULL pointer dereference by adding NULL
    checks where ContentInfo data can be NULL


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.3
changelog:
  - CVE-2026-28387: fix use-after-free in DANE client code by using X509_free()
    instead of OPENSSL_free() to properly release reference-counted X509 objects
  - CVE-2026-28388: fix NULL pointer dereference when processing a delta CRL
    that has a Delta CRL Indicator but lacks a CRL Number extension
  - CVE-2026-28389: fix NULL pointer dereference in CMS KeyAgreeRecipientInfo
    processing when KeyEncryptionAlgorithmIdentifier omits the optional
    parameter field, by using safe X509_ALGOR_get0() extraction
  - CVE-2026-28390: fix NULL pointer dereference in CMS KeyTransportRecipientInfo
    processing when RSA-OAEP SourceFunc parameters are missing, by using safe
    X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.4
changelog:
  - CVE-2026-45447: fix use-after-free in PKCS7_verify triggered by a crafted
    PKCS#7 / S-MIME message with an empty digestAlgorithms ASN.1 SET, which made
    OpenSSL free a caller-owned BIO; free the BIO chain explicitly and stop at
    the caller-supplied indata BIO


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-54
changelog:
  - ALTPHP-1582: add support cl-MariaDB1011
  - ALTPHP-1626: return mysqli.so for alt-php >= 82
  - ALTPHP-1637: rebuild with system python from BaseOS repo


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-63
changelog:
  - o not create symlinks to mysqli on plesk
  - hardcode x86_64-linux-gnu to lib path in alt-php-mysql-reconfigure
    script


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-63
changelog:
  - do not create symlinks to mysqli on plesk
  - hardcode x86_64-linux-gnu to lib path in alt-php-mysql-reconfigure
    script


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-64
changelog:
  - for plesk panel create symlinks:
      mysqli.so -> nd_mysqli.so
      pdo_mysql.so -> nd_pdo_mysql.so
  - for plesk panel do not create any symlinks for ini configs


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-65
changelog:
  - ALTPHP-2180: Fixed processing mysql.so (for PHP 5x) in Plesk environment
  - ALTPHP-2180: Call alt-php-mysql-reconfigure in Plesk environment wthout installed bindings


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.1.0-0
changelog:
  - Update package scripts for repo.alt.tuxcare.com
  - Clean install scripts for fresh installations from repo.alt.tuxcare.com


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.1.0-4
changelog:
  - Pin $releasever to the EL major version in the repo file to avoid HTTP 404
    on point-release hosts where $releasever resolves to e.g. 7.9


