2.4.1-2

Use low-level AES operations to prevent session leak (#2487009 )
2026-06-23 15:39:27 +02:00 · 2026-06-23 15:38:34 +02:00
6 changed files with 342 additions and 164 deletions
--- a/.gitignore
+++ b/.gitignore
@ -25,19 +25,3 @@
 /yubihsm-shell-2.4.0.tar.gz.sig
 /yubihsm-shell-2.4.1.tar.gz
 /yubihsm-shell-2.4.1.tar.gz.sig
-/yubihsm-shell-2.4.2.tar.gz
-/yubihsm-shell-2.4.2.tar.gz.sig
-/yubihsm-shell-2.5.0.tar.gz
-/yubihsm-shell-2.5.0.tar.gz.sig
-/yubihsm-shell-2.6.0.tar.gz
-/yubihsm-shell-2.6.0.tar.gz.sig
-/yubihsm-shell-2.7.0.tar.gz
-/yubihsm-shell-2.7.0.tar.gz.sig
-/yubihsm-shell-2.7.1.tar.gz
-/yubihsm-shell-2.7.1.tar.gz.sig
-/yubihsm-shell-2.7.2.tar.gz
-/yubihsm-shell-2.7.2.tar.gz.sig
-/yubihsm-shell-2.7.3.tar.gz
-/yubihsm-shell-2.7.3.tar.gz.sig
-/yubihsm-shell-2.8.0.tar.gz
-/yubihsm-shell-2.8.0.tar.gz.sig
--- a/93
+++ b/93
@ -1,93 +0,0 @@
-* Tue Apr 28 2026 Simo Sorce <ssorce@redhat.com> - 2.7.3-2
- OpenSSL 4.0 build fixes
-
-* Thu Apr 16 2026 Jakub Jelen <jjelen@redhat.com> - 2.7.3-1
- New upstream release (#2458149)
-
-* Fri Mar 13 2026 Jakub Jelen <jjelen@redhat.com> - 2.7.2-1
- New upstream release (#2447224)
-
-* Tue Jan 20 2026 Jakub Jelen <jjelen@redhat.com> - 2.7.1-1
- New upstream release (#2431274)
-
-* Tue Jun 17 2025 Jakub Jelen <jjelen@redhat.com> - 2.7.0-1
- New upstream release (#2372452)
-
-* Wed Feb 05 2025 Jakub Jelen <jjelen@redhat.com> - 2.6.0-3
- Fix gcc15 warnings (#2341598)
-
-* Wed Sep 11 2024 Jakub Jelen <jjelen@redhat.com> - 2.6.0-1
- New upstream release (#2311424)
-
-* Tue Jul 30 2024 Jakub Jelen <jjelen@redhat.com> - 2.5.0-4
- Fix build against pcsc-lite >= 2.2 (#2301379)
-
-* Wed Jul 24 2024 Miroslav Suchý <msuchy@redhat.com> - 2.5.0-3
- convert license to SPDX
-
-* Tue Apr 02 2024 Jakub Jelen <jjelen@redhat.com> - 2.5.0-1
- New upstream release (#2272123)
-
-* Wed Nov 08 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.2-1
- New upstream release (#2248609)
-
-* Thu Aug 17 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.1-1
- New upstream release (#2232340)
-
-* Mon Jan 30 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.0-1
- New upstream release (#2165239)
-
-* Mon Jun 27 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.2-1
- New upstream release (#2100542)
-
-* Tue Feb 22 2022 Veronika Hanulikova <vhanulik@redhat.com> - 2.3.1-1
- New upstream release (#2050104)
-
-* Mon Jan 03 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.0b-1
- New upstream release (#2035159)
-
-* Mon Dec 13 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.0-1
- New upstream release (#2030694)
-
-* Thu Nov 18 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.0-5
- Rebuild with deprecated OpenSSL 3.0 functions (#2021878)
-
-* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.2.0-4
- Rebuilt with OpenSSL 3.0.0
-
-* Tue Aug 03 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.0-3
- Disable rpath to allow build in Fedora 35 (#1988058)
-
-* Fri Apr 16 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.0-1
- New upstream release (#1950207)
-
-* Thu Mar 18 2021 Jakub Jelen <jjelen@redhat.com> - 2.1.0-1
- New upstream release (#1936041)
-
-* Wed Oct 21 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.3-1
- New upstream release (#1889941)
-
-* Thu Aug 06 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-7
- Workaround FTBFS on s390x (#1865658)
-
-* Thu Aug 06 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-6
- Rebuild after libz3 soname bump (#1865658)
-
-* Mon Mar 16 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-3
- Avoid warnings/errors with new gcc on s390x (#1800289)
-
-* Tue Jan 07 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-1
- New upstream release (#1772013)
-
-* Tue Apr 02 2019 Jakub Jelen <jjelen@redhat.com> - 2.0.1-1
- New upstream release (#1692935)
-
-* Wed Feb 13 2019 Jakub Jelen <jjelen@redhat.com> - 2.0.0-4
- Workaround unreasonagle error from GCC9 (#1676257)
-
-* Mon Dec 03 2018 Jakub Jelen <jjelen@redhat.com> - 2.0.0-2
- Pull the latest signed tarballs
- Address review comments (#1654689)
-
-* Thu Nov 29 2018 Jakub Jelen <jjelen@redhat.com> - 2.0.0-1
- Initial release
--- a/4
+++ b/4
@ -1,3 +1,3 @@
-SHA512 (yubihsm-shell-2.8.0.tar.gz) = 9d3153444b3ae71fee344ed81f7b7229d62c5d9b40ebd31e38026c69d36f5a6f92ef411d029861cf2cd33fc1a8689c1ec3576cc076f91e81312795b344da8a58
-SHA512 (yubihsm-shell-2.8.0.tar.gz.sig) = 77ee4399c7e05d1daed4fd1164f8bacde8e69d69e4bbb6f35fc58a15e212f9455207c529b4f144814ee972e6dd8eb7f3804e7ad15a9d4a853ea187876f5a2630
+SHA512 (yubihsm-shell-2.4.1.tar.gz) = e302d645ebbfc7425794a16e9301fdd4ce96d8dd9e8aca72458a3832e27e9b0d303ce0cfbbfb84aab94f3c1042b6a053cb42526879f77592b64377345b67fd58
+SHA512 (yubihsm-shell-2.4.1.tar.gz.sig) = 3a5792bf303707cff23929aeee8eed4796bd4d3ad15fdc07234cd7ee8e67371f98e466263ac60c1a5edd43d56d0d25c5011c54770833b5650f37b34897aaa66e
 SHA512 (gpgkey-9588EA0F.gpg) = ff3fb773cf95c8d28fb9630c8525539c7ba497a046292a9eda816dd77c4a8b199b74467c7639bbbb0236e439b4db4d0a8b1694a40b33e074072d3ecac46acd87
--- a/yubihsm-shell-2.5.0-pcsc-lite.patch
+++ b/yubihsm-shell-2.5.0-pcsc-lite.patch
@ -1,38 +0,0 @@
-From 440ba3ad140732ab51bc2df56ae0c82684d02922 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 30 Jul 2024 10:18:02 +0200
-Subject: [PATCH] cmake: Fix build against pcsc-lite >= 2.2
-
-The pcsc-lite 2.2.0 switched from autotools to meson and reworked the
-pkgconfig files. The new pkg config provides CFLAGS that work ok, but
-the yubihsm-shell ignores them and hopes that all included files are in
-the default include directory (with the PCSC prefix).
-
-Note, the value ${LIBPCSC_CFLAGS} is a semicolon separated list which
-we need to split to separate items here.
-
-This solution works with both old and new versions.
-
-Fixes: #404
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
---
- CMakeLists.txt | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index acbb392..ecf3df8 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -194,6 +194,8 @@ if(NOT BUILD_ONLY_LIB)
-   set(LIBPCSC_REQ "Linux" "FreeBSD")
-   if(${CMAKE_SYSTEM_NAME} IN_LIST LIBPCSC_REQ)
-     pkg_search_module (LIBPCSC REQUIRED libpcsclite)
-+    string (REPLACE ";" " " MY_LIBPCSC_CFLAGS "${LIBPCSC_CFLAGS}")
-+    string (APPEND CMAKE_C_FLAGS " ${MY_LIBPCSC_CFLAGS}")
-   elseif(${CMAKE_SYSTEM_NAME} MATCHES "Windows")
-     set (LIBPCSC_LDFLAGS "winscard.lib")
-   elseif(${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
-- 
-2.45.2
-
--- a/yubihsm-shell-2.7.0-session-leak.patch
+++ b/yubihsm-shell-2.7.0-session-leak.patch
@ -0,0 +1,228 @@
+diff --git a/aes_cmac/aes.c b/aes_cmac/aes.c
+index 5b5f45f..696a289 100644
+--- a/aes_cmac/aes.c
+++ b/aes_cmac/aes.c
+@@ -170,77 +170,15 @@ cleanup:
+ 
+ #else
+ 
+-static const EVP_CIPHER *aes_ecb(uint16_t key_len) {
+-  switch (key_len) {
+-    case 16:
+-      return EVP_aes_128_ecb();
+-    case 24:
+-      return EVP_aes_192_ecb();
+-    case 32:
+-      return EVP_aes_256_ecb();
+-    default:
+-      return NULL;
+-  }
+-}
+-
+-static const EVP_CIPHER *aes_cbc(uint16_t key_len) {
+-  switch (key_len) {
+-    case 16:
+-      return EVP_aes_128_cbc();
+-    case 24:
+-      return EVP_aes_192_cbc();
+-    case 32:
+-      return EVP_aes_256_cbc();
+-    default:
+-      return NULL;
+-  }
+-}
+-
+-static int aes_encrypt_ex(const EVP_CIPHER *cipher, const uint8_t *in,
+-                          uint8_t *out, uint16_t len, const uint8_t *iv,
+-                          aes_context *ctx) {
+-  if (EVP_EncryptInit_ex(ctx->ctx, cipher, NULL, ctx->key, iv) != 1) {
+-    return -1;
+-  }
+-  if (EVP_CIPHER_CTX_set_padding(ctx->ctx, 0) != 1) {
+-    return -2;
+-  }
+-  int update_len = len;
+-  if (EVP_EncryptUpdate(ctx->ctx, out, &update_len, in, len) != 1) {
+-    return -3;
+-  }
+-  int final_len = len - update_len;
+-  if (EVP_EncryptFinal_ex(ctx->ctx, out + update_len, &final_len) != 1) {
+-    return -4;
+-  }
+-  if (update_len + final_len != len) {
+-    return -5;
+-  }
+-  return 0;
+-}
+-
+-static int aes_decrypt_ex(const EVP_CIPHER *cipher, const uint8_t *in,
+-                          uint8_t *out, uint16_t len, const uint8_t *iv,
+-                          aes_context *ctx) {
+-  if (EVP_DecryptInit_ex(ctx->ctx, cipher, NULL, ctx->key, iv) != 1) {
+-    return -1;
+-  }
+-  if (EVP_CIPHER_CTX_set_padding(ctx->ctx, 0) != 1) {
+-    return -2;
+-  }
+-  int update_len = len;
+-  if (EVP_DecryptUpdate(ctx->ctx, out, &update_len, in, len) != 1) {
+-    return -3;
+-  }
+-  int final_len = len - update_len;
+-  if (EVP_DecryptFinal_ex(ctx->ctx, out + update_len, &final_len) != 1) {
+-    return -4;
+-  }
+-  if (update_len + final_len != len) {
+-    return -5;
+-  }
+-  return 0;
+-}
+/*
+ * Use the low-level AES API (AES_set_encrypt_key / AES_ecb_encrypt /
+ * AES_cbc_encrypt) instead of the EVP API.  The low-level functions
+ * operate directly on an AES_KEY struct with pre-computed round keys
+ * and do not depend on OpenSSL's global library context.  This means
+ * they continue to work after OPENSSL_cleanup() has been called,
+ * which is critical for SCP03 session close during application
+ * teardown.
+ */
+ 
+ #endif
+ 
+@@ -266,17 +204,15 @@ int aes_set_key(const uint8_t *key, uint16_t key_len, aes_context *ctx) {
+ 
+ #else
+ 
+-  if (key == NULL || aes_ecb(key_len) == NULL) {
+  if (key == NULL || (key_len != 16 && key_len != 24 && key_len != 32)) {
+     return -1;
+   }
+-  if (!ctx->ctx) {
+-    ctx->ctx = EVP_CIPHER_CTX_new();
+-    if (!ctx->ctx) {
+-      return -2;
+-    }
+  if (AES_set_encrypt_key(key, key_len * 8, &ctx->enc_key) != 0) {
+    return -2;
+  }
+  if (AES_set_decrypt_key(key, key_len * 8, &ctx->dec_key) != 0) {
+    return -3;
+   }
+-  ctx->key_len = key_len;
+-  memcpy(ctx->key, key, key_len);
+ 
+ #endif
+ 
+@@ -295,23 +231,18 @@ int aes_load_key(const char *key, aes_context *ctx) {
+   const uint8_t default_mac[] = {0x59, 0x2f, 0xd4, 0x83, 0xf7, 0x59,
+                                  0xe2, 0x99, 0x09, 0xa0, 0x4c, 0x45,
+                                  0x05, 0xd2, 0xce, 0x0a};
+-  ctx->key_len = sizeof(default_enc);
+-  if (key == NULL || aes_ecb(ctx->key_len) == NULL) {
+  const uint8_t *k;
+
+  if (key == NULL)
+     return -1;
+-  }
+-  if (!ctx->ctx) {
+-    ctx->ctx = EVP_CIPHER_CTX_new();
+-    if (!ctx->ctx) {
+-      return -2;
+-    }
+-  }
+   if (!strcmp(key, "default_enc"))
+-    memcpy(ctx->key, default_enc, ctx->key_len);
+    k = default_enc;
+   else if (!strcmp(key, "default_mac"))
+-    memcpy(ctx->key, default_mac, ctx->key_len);
+    k = default_mac;
+   else
+-    memset(ctx->key, 0, ctx->key_len);
+-  return 0;
+    return -1;
+
+  return aes_set_key(k, sizeof(default_enc), ctx);
+ #endif
+ }
+ 
+@@ -334,8 +265,8 @@ int aes_encrypt(const uint8_t *in, uint8_t *out, aes_context *ctx) {
+ 
+ #else
+ 
+-  return aes_encrypt_ex(aes_ecb(ctx->key_len), in, out, AES_BLOCK_SIZE, NULL,
+-                        ctx);
+  AES_ecb_encrypt(in, out, &ctx->enc_key, AES_ENCRYPT);
+  return 0;
+ 
+ #endif
+ }
+@@ -359,8 +290,8 @@ int aes_decrypt(const uint8_t *in, uint8_t *out, aes_context *ctx) {
+ 
+ #else
+ 
+-  return aes_decrypt_ex(aes_ecb(ctx->key_len), in, out, AES_BLOCK_SIZE, NULL,
+-                        ctx);
+  AES_ecb_encrypt(in, out, &ctx->dec_key, AES_DECRYPT);
+  return 0;
+ 
+ #endif
+ }
+@@ -388,7 +319,10 @@ int aes_cbc_encrypt(const uint8_t *in, uint8_t *out, uint16_t len,
+ 
+ #else
+ 
+-  return aes_encrypt_ex(aes_cbc(ctx->key_len), in, out, len, iv, ctx);
+  uint8_t _iv[AES_BLOCK_SIZE];
+  memcpy(_iv, iv, AES_BLOCK_SIZE);
+  AES_cbc_encrypt(in, out, len, &ctx->enc_key, _iv, AES_ENCRYPT);
+  return 0;
+ 
+ #endif
+ }
+@@ -416,7 +350,10 @@ int aes_cbc_decrypt(const uint8_t *in, uint8_t *out, uint16_t len,
+ 
+ #else
+ 
+-  return aes_decrypt_ex(aes_cbc(ctx->key_len), in, out, len, iv, ctx);
+  uint8_t _iv[AES_BLOCK_SIZE];
+  memcpy(_iv, iv, AES_BLOCK_SIZE);
+  AES_cbc_encrypt(in, out, len, &ctx->dec_key, _iv, AES_DECRYPT);
+  return 0;
+ 
+ #endif
+ }
+@@ -484,7 +421,7 @@ void aes_destroy(aes_context *ctx) {
+ 
+ #else
+ 
+-  EVP_CIPHER_CTX_free(ctx->ctx);
+  /* AES_KEY has no resources to free, just zero the key material */
+ 
+ #endif
+ 
+diff --git a/aes_cmac/aes.h b/aes_cmac/aes.h
+index 798cb15..ba0ef97 100644
+--- a/aes_cmac/aes.h
+++ b/aes_cmac/aes.h
+@@ -30,7 +30,7 @@
+ #include <bcrypt.h>
+ #include <ntstatus.h>
+ #else
+-#include <openssl/evp.h>
+#include <openssl/aes.h>
+ #endif
+ 
+ #ifndef AES_BLOCK_SIZE // Defined in openssl/aes.h
+@@ -51,9 +51,8 @@ typedef struct {
+   PBYTE pbKeyECBObj;
+   size_t cbKeyObj;
+ #else
+-  EVP_CIPHER_CTX *ctx;
+-  uint16_t key_len;
+-  uint8_t key[32];
+  AES_KEY enc_key;
+  AES_KEY dec_key;
+ #endif
+ } aes_context;
+ 
+
--- a/yubihsm-shell.spec
+++ b/yubihsm-shell.spec
@ -1,18 +1,17 @@
 %undefine __cmake_in_source_build

 Name:		yubihsm-shell
-Version:	2.8.0
-Release:	%autorelease
+Version:	2.4.1
+Release:	2%{?dist}
 Summary:	Tools to interact with YubiHSM 2

-# Automatically converted from old format: ASL 2.0 - review is highly recommended.
-License:	Apache-2.0 
+License:	ASL 2.0 
 URL:		https://github.com/Yubico/%{name}/
 Source0:	https://developers.yubico.com/%{name}/Releases/%{name}-%{version}.tar.gz
 Source1:	https://developers.yubico.com/%{name}/Releases/%{name}-%{version}.tar.gz.sig
 Source2:	gpgkey-9588EA0F.gpg
-# https://github.com/Yubico/yubihsm-shell/pull/411
-Patch2:	yubihsm-shell-2.5.0-pcsc-lite.patch
+# https://github.com/Yubico/yubihsm-shell/pull/528
+Patch3:	yubihsm-shell-2.7.0-session-leak.patch

 BuildRequires:	cmake
 BuildRequires:	cppcheck
@ -28,7 +27,11 @@ BuildRequires:	libedit-devel
 BuildRequires:	pcsc-lite-devel
 BuildRequires:	clang
 BuildRequires:	pkg-config
-BuildRequires:	libusb-compat-0.1-devel
+%if 0%{?fedora} > 36
+BuildRequires: libusb-compat-0.1-devel
+%else
+BuildRequires:	libusb-devel
+%endif
 BuildRequires:	chrpath
 BuildRequires:	gnupg2

@ -58,11 +61,7 @@ export CFLAGS="$CFLAGS -Wno-error=format-overflow"
 %endif
 # OpenSSL 3.0 deprecates a lot of functions still widely used here
 export CFLAGS="$CFLAGS -Wno-error=deprecated-declarations"
-%cmake -DCMAKE_SKIP_INSTALL_RPATH=ON \
-   %if "%{?_lib}" == "lib64"
-     %{?_cmake_lib_suffix64}
-   %endif
-   %{nil}
+%cmake -DCMAKE_SKIP_INSTALL_RPATH=ON
 %cmake_build


@ -103,10 +102,108 @@ chrpath --delete $RPM_BUILD_ROOT%{_libdir}/pkcs11/yubihsm_pkcs11.so
 %dir %{_includedir}/pkcs11
 %{_includedir}/pkcs11/pkcs11.h
 %{_includedir}/pkcs11/pkcs11y.h
-%{_includedir}/pkcs11/pkcs11f.h
-%{_includedir}/pkcs11/pkcs11t.h
 %{_datadir}/pkgconfig/yubihsm.pc
 %{_datadir}/pkgconfig/ykhsmauth.pc

+
+
 %changelog
-%autochangelog
+* Tue Jun 23 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.1-2
+- Use low-level AES operations to prevent session leak (#2487009)
+
+* Thu Aug 17 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.1-1
+- New upstream release (#2232340)
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Mon Jan 30 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.0-1
+- New upstream release (#2165239)
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Jun 27 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.2-1
+- New upstream release (#2100542)
+
+* Tue Feb 22 2022 Veronika Hanulikova <vhanulik@redhat.com> - 2.3.1-1
+- New upstream release (#2050104)
+
+* Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.0b-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Mon Jan 03 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.0b-1
+- New upstream release (#2035159)
+
+* Mon Dec 13 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.0-1
+- New upstream release (#2030694)
+
+* Thu Nov 18 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.0-5
+- Rebuild with deprecated OpenSSL 3.0 functions (#2021878)
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.2.0-4
+- Rebuilt with OpenSSL 3.0.0
+
+* Tue Aug 03 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.0-3
+- Disable rpath to allow build in Fedora 35 (#1988058)
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Fri Apr 16 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.0-1
+- New upstream release (#1950207)
+
+* Thu Mar 18 2021 Jakub Jelen <jjelen@redhat.com> - 2.1.0-1
+- New upstream release (#1936041)
+
+* Thu Jan 28 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Wed Oct 21 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.3-1
+- New upstream release (#1889941)
+
+* Thu Aug 06 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-7
+- Workaround FTBFS on s390x (#1865658)
+
+* Thu Aug 06 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-6
+- Rebuild after libz3 soname bump (#1865658)
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.2-5
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.2-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Mar 16 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-3
+- Avoid warnings/errors with new gcc on s390x (#1800289)
+
+* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Tue Jan 07 2020 Jakub Jelen <jjelen@redhat.com> - 2.0.2-1
+- New upstream release (#1772013)
+
+* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Tue Apr 02 2019 Jakub Jelen <jjelen@redhat.com> - 2.0.1-1
+- New upstream release (#1692935)
+
+* Wed Feb 13 2019 Jakub Jelen <jjelen@redhat.com> - 2.0.0-4
+- Workaround unreasonagle error from GCC9 (#1676257)
+
+* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Mon Dec 03 2018 Jakub Jelen <jjelen@redhat.com> - 2.0.0-2
+- Pull the latest signed tarballs
+- Address review comments (#1654689)
+
+* Thu Nov 29 2018 Jakub Jelen <jjelen@redhat.com> - 2.0.0-1
+- Initial release
+
+
Author	SHA1	Message	Date
Jakub Jelen	94c9ef1ef8	2.4.1-2	2026-06-23 15:39:27 +02:00
Jakub Jelen	a54c3d0373	Use low-level AES operations to prevent session leak (#2487009 )	2026-06-23 15:38:34 +02:00