From d0a2453060fd61f77b742d45cf1dfbed4711d9f7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Sun, 27 Jan 2019 12:54:28 +0100 Subject: [PATCH 1/8] Rebase to go1.11.5 Fix for CVE-2019-6486 --- .gitignore | 1 + golang.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d200ff1..5e10e22 100644 --- a/.gitignore +++ b/.gitignore @@ -62,3 +62,4 @@ /go1.11.1.src.tar.gz /go1.11.2.src.tar.gz /go1.11.4.src.tar.gz +/go1.11.5.src.tar.gz diff --git a/golang.spec b/golang.spec index 53b0e49..0485432 100644 --- a/golang.spec +++ b/golang.spec @@ -102,10 +102,10 @@ %endif %global go_api 1.11 -%global go_version 1.11.4 +%global go_version 1.11.5 Name: golang -Version: 1.11.4 +Version: 1.11.5 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -546,6 +546,11 @@ fi %endif %changelog +* Sun Jan 27 2019 Jakub Čajka - 1.11.5-1 +- Rebase to go1.11.5 +- Fix for CVE-2019-6486 +- Resolves: BZ#1668973 + * Wed Jan 02 2019 Jakub Čajka - 1.11.4-1 - Rebase to go1.11.4 - Fix for CVE-2018-16875, CVE-2018-16874 and CVE-2018-16873 diff --git a/sources b/sources index fd855af..06d5eb7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.11.4.src.tar.gz) = 9aa2e1800807841ec0432289b672c1607bdcb295f29c02d38adfaf1e3bf043040c9f916e4cb170875d92fe168c5ba6baef2b3d1f824a56ff9138ca2cdcc646e0 +SHA512 (go1.11.5.src.tar.gz) = 63500238e8d73e4b29279ee3eb9242960de93ccd3b52bacc4009f45cf123cb8edfe5f519d38c5b07bdf2a810925758511ff3255310a056113d0169f78be1d2f6 From 7d97257830588e67b2e586451d9bbf1a6679b39e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Mon, 1 Apr 2019 13:41:56 +0200 Subject: [PATCH 2/8] Rebase to 1.11.6 Fix CVE-2019-9741 Fix requirement for %preun (instead of %postun) scriptlet thanks to Tim Landscheidt Use weak deps for SCM deps Resolves: BZ#1688233 --- .gitignore | 1 + golang.spec | 15 +++++++++++---- sources | 2 +- 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index 5e10e22..a55c8ab 100644 --- a/.gitignore +++ b/.gitignore @@ -63,3 +63,4 @@ /go1.11.2.src.tar.gz /go1.11.4.src.tar.gz /go1.11.5.src.tar.gz +/go1.11.6.src.tar.gz diff --git a/golang.spec b/golang.spec index 0485432..d435867 100644 --- a/golang.spec +++ b/golang.spec @@ -102,10 +102,10 @@ %endif %global go_api 1.11 -%global go_version 1.11.5 +%global go_version 1.11.6 Name: golang -Version: 1.11.5 +Version: 1.11.6 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -265,13 +265,13 @@ Obsoletes: golang-vet < 0-12.1 Obsoletes: golang-cover < 0-12.1 Requires(post): %{_sbindir}/update-alternatives -Requires(postun): %{_sbindir}/update-alternatives +Requires(preun): %{_sbindir}/update-alternatives # We strip the meta dependency, but go does require glibc. # This is an odd issue, still looking for a better fix. Requires: glibc Requires: gcc -Requires: git, subversion, mercurial +Recommends: git, subversion, mercurial %description bin %{summary} @@ -546,6 +546,13 @@ fi %endif %changelog +* Fri Mar 15 2019 Jakub Čajka - 1.11.6-1 +- Rebase to 1.11.6 +- Fix CVE-2019-9741 +- Fix requirement for %preun (instead of %postun) scriptlet thanks to Tim Landscheidt +- Use weak deps for SCM deps +- Resolves: BZ#1688233 + * Sun Jan 27 2019 Jakub Čajka - 1.11.5-1 - Rebase to go1.11.5 - Fix for CVE-2019-6486 diff --git a/sources b/sources index 06d5eb7..e4381cf 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.11.5.src.tar.gz) = 63500238e8d73e4b29279ee3eb9242960de93ccd3b52bacc4009f45cf123cb8edfe5f519d38c5b07bdf2a810925758511ff3255310a056113d0169f78be1d2f6 +SHA512 (go1.11.6.src.tar.gz) = bc29df69a08a4e9e703de72b5eda5f2d63b78f18f3e7a1173eae5c6dd767f29f1b865a2fc3f692e15277df2d45e74ee17875b275eb3fc50aac2b88082e618bf5 From 0301e6483af13cbcb7a82fd800580ead15db097c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Mon, 8 Apr 2019 13:30:59 +0200 Subject: [PATCH 3/8] Rebase to 1.11.7 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a55c8ab..601c71a 100644 --- a/.gitignore +++ b/.gitignore @@ -64,3 +64,4 @@ /go1.11.4.src.tar.gz /go1.11.5.src.tar.gz /go1.11.6.src.tar.gz +/go1.11.7.src.tar.gz diff --git a/golang.spec b/golang.spec index d435867..8e5cd0f 100644 --- a/golang.spec +++ b/golang.spec @@ -102,10 +102,10 @@ %endif %global go_api 1.11 -%global go_version 1.11.6 +%global go_version 1.11.7 Name: golang -Version: 1.11.6 +Version: 1.11.7 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -546,6 +546,9 @@ fi %endif %changelog +* Mon Apr 8 2019 Jakub Čajka - 1.11.7-1 +- Rebase to 1.11.7 + * Fri Mar 15 2019 Jakub Čajka - 1.11.6-1 - Rebase to 1.11.6 - Fix CVE-2019-9741 diff --git a/sources b/sources index e4381cf..cca6ed6 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.11.6.src.tar.gz) = bc29df69a08a4e9e703de72b5eda5f2d63b78f18f3e7a1173eae5c6dd767f29f1b865a2fc3f692e15277df2d45e74ee17875b275eb3fc50aac2b88082e618bf5 +SHA512 (go1.11.7.src.tar.gz) = 26bc2a3ab51ebe1179cd83897dae6ca17f30126189bf2c0b60060a25f3f22e72bcda383055825a9151948f074a103a177ab5550f5c2d088448bdf5455448061e From 9ad1b634eab1a76cbd089ffbeff7abacb57ef0e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Thu, 16 May 2019 13:41:31 +0200 Subject: [PATCH 4/8] Rebase to go1.11.10 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 601c71a..875065d 100644 --- a/.gitignore +++ b/.gitignore @@ -65,3 +65,4 @@ /go1.11.5.src.tar.gz /go1.11.6.src.tar.gz /go1.11.7.src.tar.gz +/go1.11.10.src.tar.gz diff --git a/golang.spec b/golang.spec index 8e5cd0f..bf26666 100644 --- a/golang.spec +++ b/golang.spec @@ -102,10 +102,10 @@ %endif %global go_api 1.11 -%global go_version 1.11.7 +%global go_version 1.11.10 Name: golang -Version: 1.11.7 +Version: 1.11.10 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -546,6 +546,9 @@ fi %endif %changelog +* Thu May 16 2019 Jakub Čajka - 1.11.10-1 +- Rebase to 1.11.10 + * Mon Apr 8 2019 Jakub Čajka - 1.11.7-1 - Rebase to 1.11.7 diff --git a/sources b/sources index cca6ed6..aa17f31 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.11.7.src.tar.gz) = 26bc2a3ab51ebe1179cd83897dae6ca17f30126189bf2c0b60060a25f3f22e72bcda383055825a9151948f074a103a177ab5550f5c2d088448bdf5455448061e +SHA512 (go1.11.10.src.tar.gz) = 8fab3b96d1c47b8f75b135da9d1a104c485098f6f42041b69336216a57cfd49c0785c8cfa7b016020ded5f0aadd279d7a76feeca33038321a4930139aee28cc8 From 3b89fed2fe44e8b5529f911517d21b20e5ef9e34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Thu, 13 Jun 2019 10:37:15 +0200 Subject: [PATCH 5/8] Rebase to 1.11.11 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 875065d..70f1512 100644 --- a/.gitignore +++ b/.gitignore @@ -66,3 +66,4 @@ /go1.11.6.src.tar.gz /go1.11.7.src.tar.gz /go1.11.10.src.tar.gz +/go1.11.11.src.tar.gz diff --git a/golang.spec b/golang.spec index bf26666..61ad5c4 100644 --- a/golang.spec +++ b/golang.spec @@ -102,10 +102,10 @@ %endif %global go_api 1.11 -%global go_version 1.11.10 +%global go_version 1.11.11 Name: golang -Version: 1.11.10 +Version: 1.11.11 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -546,6 +546,9 @@ fi %endif %changelog +* Thu Jun 13 2019 Jakub Čajka - 1.11.11-1 +- Rebase to 1.11.11 + * Thu May 16 2019 Jakub Čajka - 1.11.10-1 - Rebase to 1.11.10 diff --git a/sources b/sources index aa17f31..aab6223 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.11.10.src.tar.gz) = 8fab3b96d1c47b8f75b135da9d1a104c485098f6f42041b69336216a57cfd49c0785c8cfa7b016020ded5f0aadd279d7a76feeca33038321a4930139aee28cc8 +SHA512 (go1.11.11.src.tar.gz) = ee5e5dfdca1bade6d8b5957a21d89d553089152fe35e070c0c1c4849dbb3370e2591208569ec131187a7e8ae9ab775ad302225f7c19ddabee8fd3d6dfb9763e6 From c3b72c1a47212d528cf9bea637e3efd2a8fabb0e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Wed, 10 Jul 2019 13:10:29 +0200 Subject: [PATCH 6/8] Rebase to 1.11.12 --- .gitignore | 1 + golang.spec | 7 +++++-- sources | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 70f1512..102d118 100644 --- a/.gitignore +++ b/.gitignore @@ -67,3 +67,4 @@ /go1.11.7.src.tar.gz /go1.11.10.src.tar.gz /go1.11.11.src.tar.gz +/go1.11.12.src.tar.gz diff --git a/golang.spec b/golang.spec index 61ad5c4..6525ba6 100644 --- a/golang.spec +++ b/golang.spec @@ -102,10 +102,10 @@ %endif %global go_api 1.11 -%global go_version 1.11.11 +%global go_version 1.11.12 Name: golang -Version: 1.11.11 +Version: 1.11.12 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -546,6 +546,9 @@ fi %endif %changelog +* Wed Jul 10 2019 Jakub Čajka - 1.11.12-1 +- Rebase to 1.11.12 + * Thu Jun 13 2019 Jakub Čajka - 1.11.11-1 - Rebase to 1.11.11 diff --git a/sources b/sources index aab6223..3ab14b1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.11.11.src.tar.gz) = ee5e5dfdca1bade6d8b5957a21d89d553089152fe35e070c0c1c4849dbb3370e2591208569ec131187a7e8ae9ab775ad302225f7c19ddabee8fd3d6dfb9763e6 +SHA512 (go1.11.12.src.tar.gz) = ff74678d7002be20c994702cc778d2447bbe4aad2ecf906e4cde9cf00c0c226c2f0def25146acd24f86fddf397b47602c1e5509c21b0d7b856cf933a05e19a6d From 82082d43143be73a9e30977467b5a9b6856d0cd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Mon, 26 Aug 2019 16:08:45 +0200 Subject: [PATCH 7/8] Rebase to 1.11.13 Fix for CVE-2019-14809, CVE-2019-9514 and CVE-2019-9512 Resolves: BZ#1741816, BZ#1741827 and BZ#1743131 --- .gitignore | 1 + golang.spec | 9 +++++++-- sources | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 102d118..291a5e8 100644 --- a/.gitignore +++ b/.gitignore @@ -68,3 +68,4 @@ /go1.11.10.src.tar.gz /go1.11.11.src.tar.gz /go1.11.12.src.tar.gz +/go1.11.13.src.tar.gz diff --git a/golang.spec b/golang.spec index 6525ba6..39fb4aa 100644 --- a/golang.spec +++ b/golang.spec @@ -102,10 +102,10 @@ %endif %global go_api 1.11 -%global go_version 1.11.12 +%global go_version 1.11.13 Name: golang -Version: 1.11.12 +Version: 1.11.13 Release: 1%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain @@ -546,6 +546,11 @@ fi %endif %changelog +* Mon Aug 26 2019 Jakub Čajka - 1.11.13-1 +- Rebase to 1.11.13 +- Fix for CVE-2019-14809, CVE-2019-9514 and CVE-2019-9512 +- Resolves: BZ#1741816, BZ#1741827 and BZ#1743131 + * Wed Jul 10 2019 Jakub Čajka - 1.11.12-1 - Rebase to 1.11.12 diff --git a/sources b/sources index 3ab14b1..f4417d1 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (go1.11.12.src.tar.gz) = ff74678d7002be20c994702cc778d2447bbe4aad2ecf906e4cde9cf00c0c226c2f0def25146acd24f86fddf397b47602c1e5509c21b0d7b856cf933a05e19a6d +SHA512 (go1.11.13.src.tar.gz) = a5dc8ec2bdad226e2498fdfb3560d6e7e19a84711cc1adb91675a8563a0b1fd153513397ca2a2b8cf266d718a6964ad143dfa588313dcf7fe350dd4a24efc3e9 From f9db95a6c9f5bb36ccdcbfe967f3f24362313a42 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20=C4=8Cajka?= Date: Sat, 5 Oct 2019 10:04:57 +0200 Subject: [PATCH 8/8] Fix for CVE-2019-16276 Resolves: BZ#1755970 --- CVE-2019-16276.patch | 103 +++++++++++++++++++++++++++++++++++++++++++ golang.spec | 15 +++++-- 2 files changed, 114 insertions(+), 4 deletions(-) create mode 100644 CVE-2019-16276.patch diff --git a/CVE-2019-16276.patch b/CVE-2019-16276.patch new file mode 100644 index 0000000..56cab94 --- /dev/null +++ b/CVE-2019-16276.patch @@ -0,0 +1,103 @@ +diff -up ./go/src/net/http/serve_test.go ./go/src/net/http/serve_test.go +--- ./go/src/net/http/serve_test.go 2019-08-13 18:50:13.000000000 +0200 ++++ ./go/src/net/http/serve_test.go 2019-10-05 05:35:33.018025762 +0200 +@@ -4725,6 +4725,10 @@ func TestServerValidatesHeaders(t *testi + {"foo\xffbar: foo\r\n", 400}, // binary in header + {"foo\x00bar: foo\r\n", 400}, // binary in header + {"Foo: " + strings.Repeat("x", 1<<21) + "\r\n", 431}, // header too large ++ // Spaces between the header key and colon are not allowed. ++ // See RFC 7230, Section 3.2.4. ++ {"Foo : bar\r\n", 400}, ++ {"Foo\t: bar\r\n", 400}, + + {"foo: foo foo\r\n", 200}, // LWS space is okay + {"foo: foo\tfoo\r\n", 200}, // LWS tab is okay +diff -up ./go/src/net/http/transport_test.go ./go/src/net/http/transport_test.go +--- ./go/src/net/http/transport_test.go 2019-10-05 05:35:33.019025756 +0200 ++++ ./go/src/net/http/transport_test.go 2019-10-05 05:39:12.037927288 +0200 +@@ -4838,3 +4838,30 @@ func TestClientTimeoutKillsConn_AfterHea + t.Fatal("timeout") + } + } ++ ++func TestInvalidHeaderResponse(t *testing.T) { ++ setParallel(t) ++ defer afterTest(t) ++ cst := newClientServerTest(t, h1Mode, HandlerFunc(func(w ResponseWriter, r *Request) { ++ conn, buf, _ := w.(Hijacker).Hijack() ++ buf.Write([]byte("HTTP/1.1 200 OK\r\n" + ++ "Date: Wed, 30 Aug 2017 19:09:27 GMT\r\n" + ++ "Content-Type: text/html; charset=utf-8\r\n" + ++ "Content-Length: 0\r\n" + ++ "Foo : bar\r\n\r\n")) ++ buf.Flush() ++ conn.Close() ++ })) ++ defer cst.close() ++ res, err := cst.c.Get(cst.ts.URL) ++ if err != nil { ++ t.Fatal(err) ++ } ++ defer res.Body.Close() ++ if v := res.Header.Get("Foo"); v != "" { ++ t.Errorf(`unexpected "Foo" header: %q`, v) ++ } ++ if v := res.Header.Get("Foo "); v != "bar" { ++ t.Errorf(`bad "Foo " header value: %q, want %q`, v, "bar") ++ } ++} +diff -up ./go/src/net/textproto/reader.go ./go/src/net/textproto/reader.go +--- ./go/src/net/textproto/reader.go 2019-08-13 18:50:13.000000000 +0200 ++++ ./go/src/net/textproto/reader.go 2019-10-05 05:35:33.019025756 +0200 +@@ -492,18 +492,12 @@ func (r *Reader) ReadMIMEHeader() (MIMEH + return m, err + } + +- // Key ends at first colon; should not have trailing spaces +- // but they appear in the wild, violating specs, so we remove +- // them if present. ++ // Key ends at first colon. + i := bytes.IndexByte(kv, ':') + if i < 0 { + return m, ProtocolError("malformed MIME header line: " + string(kv)) + } +- endKey := i +- for endKey > 0 && kv[endKey-1] == ' ' { +- endKey-- +- } +- key := canonicalMIMEHeaderKey(kv[:endKey]) ++ key := canonicalMIMEHeaderKey(kv[:i]) + + // As per RFC 7230 field-name is a token, tokens consist of one or more chars. + // We could return a ProtocolError here, but better to be liberal in what we +diff -up ./go/src/net/textproto/reader_test.go ./go/src/net/textproto/reader_test.go +--- ./go/src/net/textproto/reader_test.go 2019-08-13 18:50:13.000000000 +0200 ++++ ./go/src/net/textproto/reader_test.go 2019-10-05 05:43:58.156469247 +0200 +@@ -188,11 +188,10 @@ func TestLargeReadMIMEHeader(t *testing. + } + } + +-// Test that we read slightly-bogus MIME headers seen in the wild, +-// with spaces before colons, and spaces in keys. ++// TestReadMIMEHeaderNonCompliant checks that we don't normalize headers ++// with spaces before colons, and accept spaces in keys. + func TestReadMIMEHeaderNonCompliant(t *testing.T) { +- // Invalid HTTP response header as sent by an Axis security +- // camera: (this is handled by IE, Firefox, Chrome, curl, etc.) ++ // These invalid headers will be rejected by net/http according to RFC 7230. + r := reader("Foo: bar\r\n" + + "Content-Language: en\r\n" + + "SID : 0\r\n" + +@@ -202,9 +201,9 @@ func TestReadMIMEHeaderNonCompliant(t *t + want := MIMEHeader{ + "Foo": {"bar"}, + "Content-Language": {"en"}, +- "Sid": {"0"}, +- "Audio Mode": {"None"}, +- "Privilege": {"127"}, ++ "SID ": {"0"}, ++ "Audio Mode ": {"None"}, ++ "Privilege ": {"127"}, + } + if !reflect.DeepEqual(m, want) || err != nil { + t.Fatalf("ReadMIMEHeader =\n%v, %v; want:\n%v", m, err, want) diff --git a/golang.spec b/golang.spec index 39fb4aa..c270b9c 100644 --- a/golang.spec +++ b/golang.spec @@ -106,7 +106,7 @@ Name: golang Version: 1.11.13 -Release: 1%{?dist} +Release: 2%{?dist} Summary: The Go Programming Language # source tree includes several copies of Mark.Twain-Tom.Sawyer.txt under Public Domain License: BSD and Public Domain @@ -183,6 +183,8 @@ Requires: go-srpm-macros Patch1: 0001-Don-t-use-the-bundled-tzdata-at-runtime-except-for-t.patch Patch2: 0002-syscall-expose-IfInfomsg.X__ifi_pad-on-s390x.patch +# Backport of https://github.com/golang/go/commit/6e6f4aaf70c8b1cc81e65a26332aa9409de03ad8 +Patch3: CVE-2019-16276.patch # Having documentation separate was broken Obsoletes: %{name}-docs < 1.1-4 @@ -308,6 +310,7 @@ Requires: %{name} = %{version}-%{release} %patch1 -p1 %patch2 -p1 +%patch3 -p2 cp %{SOURCE1} ./src/runtime/ @@ -412,8 +415,8 @@ pushd $RPM_BUILD_ROOT%{goroot} echo "%%{golibdir}/$(basename $file)" >> $shared_list done - find pkg/*_dynlink/ -type d -printf '%%%dir %{goroot}/%p\n' >> $shared_list - find pkg/*_dynlink/ ! -type d -printf '%{goroot}/%p\n' >> $shared_list + find pkg/*_dynlink/ -type d -printf '%%%dir %{goroot}/%p\n' >> $shared_list + find pkg/*_dynlink/ ! -type d -printf '%{goroot}/%p\n' >> $shared_list %endif %if %{race} @@ -546,6 +549,10 @@ fi %endif %changelog +* Sat Oct 5 2019 Jakub Čajka - 1.11.13-2 +- Fix for CVE-2019-16276 +- Resolves: BZ#1755970 + * Mon Aug 26 2019 Jakub Čajka - 1.11.13-1 - Rebase to 1.11.13 - Fix for CVE-2019-14809, CVE-2019-9514 and CVE-2019-9512 @@ -566,7 +573,7 @@ fi * Fri Mar 15 2019 Jakub Čajka - 1.11.6-1 - Rebase to 1.11.6 - Fix CVE-2019-9741 -- Fix requirement for %preun (instead of %postun) scriptlet thanks to Tim Landscheidt +- Fix requirement for %%preun (instead of %%postun) scriptlet thanks to Tim Landscheidt - Use weak deps for SCM deps - Resolves: BZ#1688233