<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="10">
<package pkgid="9555fd7525c216507bf641773a09ebb951be35a9bd622e0f4b4a6c6700e72330" name="otrs" arch="noarch">
  <version epoch="0" ver="6.0.30" rel="189.1"/>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1543665600">- Update to 6.0.14
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-14/
- fix Url
- update License: AGPL-3.0-only -&gt; GPL-3.0-or-later
- improve itsm-update.sh
- rebase otrs-perm_test.patch
- update
  * UPGRADING.SUSE
  * ZZZAuto.pm
  * otrs.README.de
  * otrs.README.en
- remove SysVinit stuff and scripts
  * otrs.init
- rework permissions handling vor @OTRS_ROOT@/var/tmp</changelog>
  <changelog author="chris@computersalat.de" date="1548763200">- Update to 6.0.16
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-16/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 6.0.15
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-15/
- fix typo in itsm.README
- fix permissions
  * add missing trailing /
- rework rpmlintrc
  * addFilter pem-certificate
  * keep permissions-unauthorized-file for other DISTS than Factory</changelog>
  <changelog author="chris@computersalat.de" date="1548936000">- update rpmlintrc
  * disable setBadness('permissions-unauthorized-file', 333)</changelog>
  <changelog author="jengelh@inai.de" date="1549108800">- Do not hide errors from useradd.
- Remove pointless groupadd/useradd in %build (this always fails,
  and the error is always ignored).
- Replace %__-type macro indirections. Replace old $RPM_*
  shell vars.
- Trim redundant metadata from description.
- Switch out strong PreReq by more lenient Requires(pre,post).</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- fix changes file (chronological order)
- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 6.0.19
  https://community.otrs.com/release-notes-otrs-6-patch-level-19/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 6.0.18
  https://community.otrs.com/release-notes-otrs-6-patch-level-18/
- fix for boo#1139406
  * (CVE-2019-10066, OSA-2019-06)
    Stored XSS
    An attacker who is logged into OTRS as an agent with appropriate
    permissions may create a carefully crafted calendar appointment
    in order to cause execution of JavaScript in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- Update to 6.0.17
  https://community.otrs.com/release-notes-otrs-6-patch-level-17/
- fix for boo#1129755
  * (CVE-2019-9751, OSA-2019-02)
    XSS
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 6.0.20
  https://community.otrs.com/release-notes-otrs-6-patch-level-20/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1567512000">- Update to 6.0.22
  https://community.otrs.com/otrs-community-edition-6-patch-level-22/</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 6.0.23
  https://community.otrs.com/otrs-community-edition-6-patch-level-23/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 6.0.24
  https://community.otrs.com/otrs-community-edition-6-patch-level-24/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 6.0.25
  https://community.otrs.com/otrs-community-edition-6-patch-level-25/
- fix for boo#1160663
  * (CVE-2020-1767, OSA-2020-03)
    Possible to send drafted messages as wrong agent
    Agent A is able to save a draft (i.e. for customer reply). Then
    Agent B can open the draft, change the text completely and send
    it in the name of Agent A. For the customer it will not be
    visible that the message was sent by another agent.
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- update itsm-update.sh
  * add Reject for *6.0.?.opm files</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 6.0.27
  https://community.otrs.com/otrs-community-edition-6-patch-level-27/
- fix for
  * boo#1168029 (CVE-2020-1773, OSA-2020-10)
    Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
  * boo#1168029 (CVE-2020-1772, OSA-2020-09)
    Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
  * boo#1168030 (CVE-2020-1771, OSA-2020-08)
    Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
  * boo#1168031 (CVE-2020-1770, OSA-2020-07)
    Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
  * boo#1168032 (CVE-2020-1769, OSA-2020-06)
    Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 6.0.26
  https://community.otrs.com/otrs-community-edition-6-patch-level-26/
  * (CVE-2019-11358, OSA-2020-05)
    Possible to send drafted messages as wrong agent
    OTRS use jquery version 3.2.1, which is vulnerable to the prototype
    pollution attack. For more information, please read following
    article https://snyk.io/test/npm/jquery/3.2.1</changelog>
  <changelog author="chris@computersalat.de" date="1596283200">- fix deps
  * add missing perl(Moo)
- add otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1596456000">- Update to 6.0.29
  https://community.otrs.com/otrs-community-edition-6-patch-level-29/
- fix for boo#1174830
  * (CVE-2020-1776, OSA-2020-13)
    Information disclosure
    When an agent user is renamed or set to invalid the session
    belonging to the user is keept active. The session can not be used
    to access ticket data in the case the agent is invalid.
- Update to 6.0.28
  https://community.otrs.com/otrs-community-edition-6-patch-level-28/
- fix for boo#1170764
  * (CVE-2020-1774, OSA-2020-11)
    Information disclosure
    When user downloads PGP or S/MIME keys/certificates, exported file
    has same name for private and public keys. Therefore it?s possible
    to mix them and to send private key to the third-party instead of
    public key.
- rebase otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1604491200">- Update to 6.0.30
  https://community.otrs.com/otrs-community-edition-6-patch-level-30/
- fix for boo#1178434
  * (CVE-2020-11022, CVE-2020-11023, OSA-2020-14)
  Vulnerability in third-party library - jquery
  OTRS uses jquery version 3.4.1, which is vulnerable to cross-site
  scripting (XSS). For more information, please read following article
  https://snyk.io/test/npm/jquery/3.4.1</changelog>
</package>
<package pkgid="33cf3a25d2f8d6d9a39159da8e7b49939aef248693f3b9b5fd9ac3e7802ddcb0" name="otrs" arch="src">
  <version epoch="0" ver="6.0.30" rel="189.1"/>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1543665600">- Update to 6.0.14
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-14/
- fix Url
- update License: AGPL-3.0-only -&gt; GPL-3.0-or-later
- improve itsm-update.sh
- rebase otrs-perm_test.patch
- update
  * UPGRADING.SUSE
  * ZZZAuto.pm
  * otrs.README.de
  * otrs.README.en
- remove SysVinit stuff and scripts
  * otrs.init
- rework permissions handling vor @OTRS_ROOT@/var/tmp</changelog>
  <changelog author="chris@computersalat.de" date="1548763200">- Update to 6.0.16
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-16/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 6.0.15
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-15/
- fix typo in itsm.README
- fix permissions
  * add missing trailing /
- rework rpmlintrc
  * addFilter pem-certificate
  * keep permissions-unauthorized-file for other DISTS than Factory</changelog>
  <changelog author="chris@computersalat.de" date="1548936000">- update rpmlintrc
  * disable setBadness('permissions-unauthorized-file', 333)</changelog>
  <changelog author="jengelh@inai.de" date="1549108800">- Do not hide errors from useradd.
- Remove pointless groupadd/useradd in %build (this always fails,
  and the error is always ignored).
- Replace %__-type macro indirections. Replace old $RPM_*
  shell vars.
- Trim redundant metadata from description.
- Switch out strong PreReq by more lenient Requires(pre,post).</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- fix changes file (chronological order)
- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 6.0.19
  https://community.otrs.com/release-notes-otrs-6-patch-level-19/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 6.0.18
  https://community.otrs.com/release-notes-otrs-6-patch-level-18/
- fix for boo#1139406
  * (CVE-2019-10066, OSA-2019-06)
    Stored XSS
    An attacker who is logged into OTRS as an agent with appropriate
    permissions may create a carefully crafted calendar appointment
    in order to cause execution of JavaScript in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- Update to 6.0.17
  https://community.otrs.com/release-notes-otrs-6-patch-level-17/
- fix for boo#1129755
  * (CVE-2019-9751, OSA-2019-02)
    XSS
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 6.0.20
  https://community.otrs.com/release-notes-otrs-6-patch-level-20/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1567512000">- Update to 6.0.22
  https://community.otrs.com/otrs-community-edition-6-patch-level-22/</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 6.0.23
  https://community.otrs.com/otrs-community-edition-6-patch-level-23/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 6.0.24
  https://community.otrs.com/otrs-community-edition-6-patch-level-24/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 6.0.25
  https://community.otrs.com/otrs-community-edition-6-patch-level-25/
- fix for boo#1160663
  * (CVE-2020-1767, OSA-2020-03)
    Possible to send drafted messages as wrong agent
    Agent A is able to save a draft (i.e. for customer reply). Then
    Agent B can open the draft, change the text completely and send
    it in the name of Agent A. For the customer it will not be
    visible that the message was sent by another agent.
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- update itsm-update.sh
  * add Reject for *6.0.?.opm files</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 6.0.27
  https://community.otrs.com/otrs-community-edition-6-patch-level-27/
- fix for
  * boo#1168029 (CVE-2020-1773, OSA-2020-10)
    Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
  * boo#1168029 (CVE-2020-1772, OSA-2020-09)
    Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
  * boo#1168030 (CVE-2020-1771, OSA-2020-08)
    Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
  * boo#1168031 (CVE-2020-1770, OSA-2020-07)
    Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
  * boo#1168032 (CVE-2020-1769, OSA-2020-06)
    Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 6.0.26
  https://community.otrs.com/otrs-community-edition-6-patch-level-26/
  * (CVE-2019-11358, OSA-2020-05)
    Possible to send drafted messages as wrong agent
    OTRS use jquery version 3.2.1, which is vulnerable to the prototype
    pollution attack. For more information, please read following
    article https://snyk.io/test/npm/jquery/3.2.1</changelog>
  <changelog author="chris@computersalat.de" date="1596283200">- fix deps
  * add missing perl(Moo)
- add otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1596456000">- Update to 6.0.29
  https://community.otrs.com/otrs-community-edition-6-patch-level-29/
- fix for boo#1174830
  * (CVE-2020-1776, OSA-2020-13)
    Information disclosure
    When an agent user is renamed or set to invalid the session
    belonging to the user is keept active. The session can not be used
    to access ticket data in the case the agent is invalid.
- Update to 6.0.28
  https://community.otrs.com/otrs-community-edition-6-patch-level-28/
- fix for boo#1170764
  * (CVE-2020-1774, OSA-2020-11)
    Information disclosure
    When user downloads PGP or S/MIME keys/certificates, exported file
    has same name for private and public keys. Therefore it?s possible
    to mix them and to send private key to the third-party instead of
    public key.
- rebase otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1604491200">- Update to 6.0.30
  https://community.otrs.com/otrs-community-edition-6-patch-level-30/
- fix for boo#1178434
  * (CVE-2020-11022, CVE-2020-11023, OSA-2020-14)
  Vulnerability in third-party library - jquery
  OTRS uses jquery version 3.4.1, which is vulnerable to cross-site
  scripting (XSS). For more information, please read following article
  https://snyk.io/test/npm/jquery/3.4.1</changelog>
</package>
<package pkgid="54156c525e687da8f802c15413f739dce48a909ae1a2d16675a54bb749aeb718" name="otrs-doc" arch="noarch">
  <version epoch="0" ver="6.0.30" rel="189.1"/>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1543665600">- Update to 6.0.14
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-14/
- fix Url
- update License: AGPL-3.0-only -&gt; GPL-3.0-or-later
- improve itsm-update.sh
- rebase otrs-perm_test.patch
- update
  * UPGRADING.SUSE
  * ZZZAuto.pm
  * otrs.README.de
  * otrs.README.en
- remove SysVinit stuff and scripts
  * otrs.init
- rework permissions handling vor @OTRS_ROOT@/var/tmp</changelog>
  <changelog author="chris@computersalat.de" date="1548763200">- Update to 6.0.16
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-16/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 6.0.15
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-15/
- fix typo in itsm.README
- fix permissions
  * add missing trailing /
- rework rpmlintrc
  * addFilter pem-certificate
  * keep permissions-unauthorized-file for other DISTS than Factory</changelog>
  <changelog author="chris@computersalat.de" date="1548936000">- update rpmlintrc
  * disable setBadness('permissions-unauthorized-file', 333)</changelog>
  <changelog author="jengelh@inai.de" date="1549108800">- Do not hide errors from useradd.
- Remove pointless groupadd/useradd in %build (this always fails,
  and the error is always ignored).
- Replace %__-type macro indirections. Replace old $RPM_*
  shell vars.
- Trim redundant metadata from description.
- Switch out strong PreReq by more lenient Requires(pre,post).</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- fix changes file (chronological order)
- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 6.0.19
  https://community.otrs.com/release-notes-otrs-6-patch-level-19/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 6.0.18
  https://community.otrs.com/release-notes-otrs-6-patch-level-18/
- fix for boo#1139406
  * (CVE-2019-10066, OSA-2019-06)
    Stored XSS
    An attacker who is logged into OTRS as an agent with appropriate
    permissions may create a carefully crafted calendar appointment
    in order to cause execution of JavaScript in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- Update to 6.0.17
  https://community.otrs.com/release-notes-otrs-6-patch-level-17/
- fix for boo#1129755
  * (CVE-2019-9751, OSA-2019-02)
    XSS
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 6.0.20
  https://community.otrs.com/release-notes-otrs-6-patch-level-20/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1567512000">- Update to 6.0.22
  https://community.otrs.com/otrs-community-edition-6-patch-level-22/</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 6.0.23
  https://community.otrs.com/otrs-community-edition-6-patch-level-23/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 6.0.24
  https://community.otrs.com/otrs-community-edition-6-patch-level-24/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 6.0.25
  https://community.otrs.com/otrs-community-edition-6-patch-level-25/
- fix for boo#1160663
  * (CVE-2020-1767, OSA-2020-03)
    Possible to send drafted messages as wrong agent
    Agent A is able to save a draft (i.e. for customer reply). Then
    Agent B can open the draft, change the text completely and send
    it in the name of Agent A. For the customer it will not be
    visible that the message was sent by another agent.
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- update itsm-update.sh
  * add Reject for *6.0.?.opm files</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 6.0.27
  https://community.otrs.com/otrs-community-edition-6-patch-level-27/
- fix for
  * boo#1168029 (CVE-2020-1773, OSA-2020-10)
    Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
  * boo#1168029 (CVE-2020-1772, OSA-2020-09)
    Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
  * boo#1168030 (CVE-2020-1771, OSA-2020-08)
    Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
  * boo#1168031 (CVE-2020-1770, OSA-2020-07)
    Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
  * boo#1168032 (CVE-2020-1769, OSA-2020-06)
    Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 6.0.26
  https://community.otrs.com/otrs-community-edition-6-patch-level-26/
  * (CVE-2019-11358, OSA-2020-05)
    Possible to send drafted messages as wrong agent
    OTRS use jquery version 3.2.1, which is vulnerable to the prototype
    pollution attack. For more information, please read following
    article https://snyk.io/test/npm/jquery/3.2.1</changelog>
  <changelog author="chris@computersalat.de" date="1596283200">- fix deps
  * add missing perl(Moo)
- add otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1596456000">- Update to 6.0.29
  https://community.otrs.com/otrs-community-edition-6-patch-level-29/
- fix for boo#1174830
  * (CVE-2020-1776, OSA-2020-13)
    Information disclosure
    When an agent user is renamed or set to invalid the session
    belonging to the user is keept active. The session can not be used
    to access ticket data in the case the agent is invalid.
- Update to 6.0.28
  https://community.otrs.com/otrs-community-edition-6-patch-level-28/
- fix for boo#1170764
  * (CVE-2020-1774, OSA-2020-11)
    Information disclosure
    When user downloads PGP or S/MIME keys/certificates, exported file
    has same name for private and public keys. Therefore it?s possible
    to mix them and to send private key to the third-party instead of
    public key.
- rebase otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1604491200">- Update to 6.0.30
  https://community.otrs.com/otrs-community-edition-6-patch-level-30/
- fix for boo#1178434
  * (CVE-2020-11022, CVE-2020-11023, OSA-2020-14)
  Vulnerability in third-party library - jquery
  OTRS uses jquery version 3.4.1, which is vulnerable to cross-site
  scripting (XSS). For more information, please read following article
  https://snyk.io/test/npm/jquery/3.4.1</changelog>
</package>
<package pkgid="ca62c95568e9449ca1845f713146dfe9e2dc6f41a7618c5b81714147632c231e" name="otrs-itsm" arch="noarch">
  <version epoch="0" ver="6.0.30" rel="189.1"/>
  <changelog author="chris@computersalat.de" date="1531310400">- Update to 5.0.28
  * Renamed 'OTRS Free' to '((OTRS)) Community Edition'.
  * https://github.com/OTRS/otrs/blob/rel-5_0_28/CHANGES.md
- improve itsm-update.sh
- fix otrs.service
  * remove otrs-scheduler.service from [Unit]After</changelog>
  <changelog author="chris@computersalat.de" date="1537963200">- Update to 5.0.30
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-30/
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-29/
- fix for boo#1109822 (CVE-2018-16586, OSA-2018-05)
  * Loading External Image or CSS Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in user opens it, the email could cause the browser to
    load external image or CSS resources.
- fix for boo#1109823 (CVE-2018-16587, OSA-2018-04)
  * Remote File Deletion
    An attacker could send a malicious email to an OTRS system. If a user
    with admin permissions opens it, it causes deletions of arbitrary
    files that the OTRS web server user has write access to.
- fix for boo#1103800 (CVE-2018-14593, OSA-2018-03)
  * Privilege Escalation
    An attacker who is logged into OTRS as a user may escalate their
    privileges by accessing a specially crafted URL.
- improve itsm-update.sh
- fix permissions file
  * @OTRS_ROOT@/var/tmp -&gt; @OTRS_ROOT@/var/tmp/</changelog>
  <changelog author="chris@computersalat.de" date="1543492800">- Update to 5.0.32
  * https://community.otrs.com/release-notes-otrs-5s-patch-level-32/
- fix for boo#1116004
  * (CVE-2018-20800, OSA-2018-10)
    Data loss during migration
    Users updating to OTRS 6.0.13 (also patchlevel updates) or 5.0.31
    (only major updates) will experience data loss in their agent
    preferences table.
- fix for boo#1115416
  * (CVE-2018-19141, OSA-2018-09)
    Privilege Escalation
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
  * (CVE-2018-19143, OSA-2018-07)
    Remote File Deletion
    An attacker who is logged into OTRS as a user may manipulate the
    submission form to cause deletion of arbitrary files that the
    OTRS web server user has write access to.</changelog>
  <changelog author="chris@computersalat.de" date="1543665600">- Update to 6.0.14
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-14/
- fix Url
- update License: AGPL-3.0-only -&gt; GPL-3.0-or-later
- improve itsm-update.sh
- rebase otrs-perm_test.patch
- update
  * UPGRADING.SUSE
  * ZZZAuto.pm
  * otrs.README.de
  * otrs.README.en
- remove SysVinit stuff and scripts
  * otrs.init
- rework permissions handling vor @OTRS_ROOT@/var/tmp</changelog>
  <changelog author="chris@computersalat.de" date="1548763200">- Update to 6.0.16
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-16/
- fix for boo#1122560
  * (CVE-2019-9752, OSA-2019-01)
    Stored XSS
    An attacker who is logged into OTRS as an agent or a customer user
    may upload a carefully crafted resource in order to cause execution
    of JavaScript in the context of OTRS.
- Update to 6.0.15
  https://community.otrs.com/release-notes-otrs-faq-6-patch-level-15/
- fix typo in itsm.README
- fix permissions
  * add missing trailing /
- rework rpmlintrc
  * addFilter pem-certificate
  * keep permissions-unauthorized-file for other DISTS than Factory</changelog>
  <changelog author="chris@computersalat.de" date="1548936000">- update rpmlintrc
  * disable setBadness('permissions-unauthorized-file', 333)</changelog>
  <changelog author="jengelh@inai.de" date="1549108800">- Do not hide errors from useradd.
- Remove pointless groupadd/useradd in %build (this always fails,
  and the error is always ignored).
- Replace %__-type macro indirections. Replace old $RPM_*
  shell vars.
- Trim redundant metadata from description.
- Switch out strong PreReq by more lenient Requires(pre,post).</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="chris@computersalat.de" date="1561204800">- fix changes file (chronological order)
- update missing CVE for OSA-2018-10, OSA-2019-01</changelog>
  <changelog author="chris@computersalat.de" date="1561809600">- Update to 6.0.19
  https://community.otrs.com/release-notes-otrs-6-patch-level-19/
- fix for boo#1137614
  * (CVE-2019-12497, OSA-2019-09)
    Information Disclosure
    In the customer or external frontend, personal information of agents
    can be disclosed like Name and mail address in external notes.
- fix for boo#1137615
  * (CVE-2019-12248, OSA-2019-08)
    Loading External Image Resources
    An attacker could send a malicious email to an OTRS system. If a
    logged in agent user quotes it, the email could cause the browser
    to load external image resources.
- Update to 6.0.18
  https://community.otrs.com/release-notes-otrs-6-patch-level-18/
- fix for boo#1139406
  * (CVE-2019-10066, OSA-2019-06)
    Stored XSS
    An attacker who is logged into OTRS as an agent with appropriate
    permissions may create a carefully crafted calendar appointment
    in order to cause execution of JavaScript in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-10067, OSA-2019-05)
    Reflected and Stored XSS
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may manipulate the URL to cause execution of JavaScript
    in the context of OTRS.
- fix for boo#1139406
  * (CVE-2019-9892, OSA-2019-04)
    XXE Processing
    An attacker who is logged into OTRS as an agent user with appropriate
    permissions may try to import carefully crafted Report Statistics XML
    that will result in reading of arbitrary files of OTRS filesystem.
- Update to 6.0.17
  https://community.otrs.com/release-notes-otrs-6-patch-level-17/
- fix for boo#1129755
  * (CVE-2019-9751, OSA-2019-02)
    XSS
    An attacker who is logged into OTRS as an admin user may manipulate
    the URL to cause execution of JavaScript in the context of OTRS.
- rebase otrs-perm_test.patch</changelog>
  <changelog author="chris@computersalat.de" date="1563624000">- Update to 6.0.20
  https://community.otrs.com/release-notes-otrs-6-patch-level-20/
- fix for boo#1141432
  * (CVE-2019-13458, OSA-2019-12)
    Information Disclosure
    An attacker who is logged into OTRS as an agent user with
    appropriate permissions can leverage OTRS tags in templates in
    order to disclose hashed user passwords.
- fix for boo#1141431
  * (CVE-2019-13457, OSA-2019-11)
    Information Disclosure
    A customer user can use the search results to disclose information
    from their ?company? tickets (with the same CustomerID), even when
    CustomerDisableCompanyTicketAccess setting is turned on.
- fix for boo#1141430
  * (CVE-2019-12746, OSA-2019-10)
    Session ID Disclosure
    A user logged into OTRS as an agent might unknowingly disclose
    their session ID by sharing the link of an embedded ticket article
    with third parties. This identifier can be then potentially abused
    in order to impersonate the agent user.</changelog>
  <changelog author="chris@computersalat.de" date="1567512000">- Update to 6.0.22
  https://community.otrs.com/otrs-community-edition-6-patch-level-22/</changelog>
  <changelog author="chris@computersalat.de" date="1573387200">- Update to 6.0.23
  https://community.otrs.com/otrs-community-edition-6-patch-level-23/
- fix for boo#1156431
  * (CVE-2019-16375, OSA-2019-13)
    Stored XXS
    An attacker who is logged into OTRS as an agent or customer user
    with appropriate permissions can create a carefully crafted
    string containing malicious JavaScript code as an article body.
    This malicious code is executed when an agent compose an answer
    to the original article.</changelog>
  <changelog author="chris@computersalat.de" date="1577534400">- Update 6.0.24
  https://community.otrs.com/otrs-community-edition-6-patch-level-24/
- fix for boo#1157001
  * (CVE-2019-18180, OSA-2019-15)
    Denial of service
    OTRS can be put into an endless loop by providing filenames with
    overly long extensions. This applies to the PostMaster
    (sending in email) and also upload
    (attaching files to mails, for example).
  * (CVE-2019-18179, OSA-2019-14)
    Information Disclosure
    An attacker who is logged into OTRS as an agent is able to list
    tickets assigned to other agents, which are in the queue where
    attacker doesn?t have permissions.</changelog>
  <changelog author="chris@computersalat.de" date="1578657600">- Update to 6.0.25
  https://community.otrs.com/otrs-community-edition-6-patch-level-25/
- fix for boo#1160663
  * (CVE-2020-1767, OSA-2020-03)
    Possible to send drafted messages as wrong agent
    Agent A is able to save a draft (i.e. for customer reply). Then
    Agent B can open the draft, change the text completely and send
    it in the name of Agent A. For the customer it will not be
    visible that the message was sent by another agent.
  * (CVE-2020-1766, OSA-2020-02)
    Improper handling of uploaded inline images
    Due to improper handling of uploaded images it is possible in very
    unlikely and rare conditions to force the agents browser to execute
    malicious javascript from a special crafted SVG file rendered as
    inline jpg file.
  * (CVE-2020-1765, OSA-2020-01)
    Spoofing of From field in several screens
    An improper control of parameters allows the spoofing of the from
    fields of the following screens:
    AgentTicketCompose, AgentTicketForward, AgentTicketBounce and
    AgentTicketEmailOutbound
  * run bin/otrs.Console.pl Maint::Config::Rebuild after the upgrade
- update itsm-update.sh
  * add Reject for *6.0.?.opm files</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="chris@computersalat.de" date="1586260800">- Update to 6.0.27
  https://community.otrs.com/otrs-community-edition-6-patch-level-27/
- fix for
  * boo#1168029 (CVE-2020-1773, OSA-2020-10)
    Session / Password / Password token leak
    An attacker with the ability to generate session IDs or password
    reset tokens, either by being able to authenticate or by exploiting
    OSA-2020-09, may be able to predict other users session IDs,
    password reset tokens and automatically generated passwords.
  * boo#1168029 (CVE-2020-1772, OSA-2020-09)
    Information Disclosure
    It?s possible to craft Lost Password requests with wildcards in
    the Token value, which allows attacker to retrieve valid Token(s),
    generated by users which already requested new passwords.
  * boo#1168030 (CVE-2020-1771, OSA-2020-08)
    Possible XSS in Customer user address book
    Attacker is able craft an article with a link to the customer
    address book with malicious content (JavaScript). When agent opens
    the link, JavaScript code is executed due to the missing parameter
    encoding.
  * boo#1168031 (CVE-2020-1770, OSA-2020-07)
    Information disclosure in support bundle files
    Support bundle generated files could contain sensitive information
    that might be unwanted to be disclosed.
  * boo#1168032 (CVE-2020-1769, OSA-2020-06)
    Autocomplete in the form login screens
    In the login screens (in agent and customer interface), Username
    and Password fields use autocomplete, which might be considered
    as security issue.
- Update to 6.0.26
  https://community.otrs.com/otrs-community-edition-6-patch-level-26/
  * (CVE-2019-11358, OSA-2020-05)
    Possible to send drafted messages as wrong agent
    OTRS use jquery version 3.2.1, which is vulnerable to the prototype
    pollution attack. For more information, please read following
    article https://snyk.io/test/npm/jquery/3.2.1</changelog>
  <changelog author="chris@computersalat.de" date="1596283200">- fix deps
  * add missing perl(Moo)
- add otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1596456000">- Update to 6.0.29
  https://community.otrs.com/otrs-community-edition-6-patch-level-29/
- fix for boo#1174830
  * (CVE-2020-1776, OSA-2020-13)
    Information disclosure
    When an agent user is renamed or set to invalid the session
    belonging to the user is keept active. The session can not be used
    to access ticket data in the case the agent is invalid.
- Update to 6.0.28
  https://community.otrs.com/otrs-community-edition-6-patch-level-28/
- fix for boo#1170764
  * (CVE-2020-1774, OSA-2020-11)
    Information disclosure
    When user downloads PGP or S/MIME keys/certificates, exported file
    has same name for private and public keys. Therefore it?s possible
    to mix them and to send private key to the third-party instead of
    public key.
- rebase otrs-CheckModules.patch</changelog>
  <changelog author="chris@computersalat.de" date="1604491200">- Update to 6.0.30
  https://community.otrs.com/otrs-community-edition-6-patch-level-30/
- fix for boo#1178434
  * (CVE-2020-11022, CVE-2020-11023, OSA-2020-14)
  Vulnerability in third-party library - jquery
  OTRS uses jquery version 3.4.1, which is vulnerable to cross-site
  scripting (XSS). For more information, please read following article
  https://snyk.io/test/npm/jquery/3.4.1</changelog>
</package>
<package pkgid="bf8ec2a94300533b586fd627f7a36359072f2c83bf87c8c6642dca9894870191" name="perl-Scalar-List-Utils" arch="src">
  <version epoch="0" ver="1.36" rel="1.11"/>
  <changelog author="lars@linux-schulserver.de" date="1253016000">- initial package build</changelog>
  <changelog author="lars@linux-schulserver.de" date="1268308800">- update to 1.23:
  + Use PERL_NO_GET_CONTEXT for efficiency (see perlguts)
  + avoid non-portable warnings
  + Fix PP::reftype in edge cases
  + RT#51484 Preserve utf8 flag of string passed to dualvar()
  + RT#51454 Check first argument to first/reduce is a code
    reference
  + RT#50528 [PATCH] p_tainted.t fix for VMS [Craig A. Berry]
  + RT#48550 fix pure perl looks_like_number not to match
    non-ascii digits</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="lars@linux-schulserver.de" date="1376913600">- update to 1.31:
  + Bugfix pairmap to return list length in scalar context
  + Added "Odd number of elements" warnings to all pair* functions
  + Added pairfirst
  + Added MULTICALL implementations to pairmap/pairgrep/pairfirst
  + Fix declaration-after-code for C99-challenged compilers
  + Documentation updates to List::Util
  + Bugfix to pairmap/pairgrep when stack moves beneath them
    during operation
  + Added pairgrep, pairmap, pairs (inspired by List::Pairwise)
  + Added pairkeys and pairvalues
  + Fix multicall refcount bug RT#80646
  + Merge patch from JDHEDDEN - Add Scalar::Util::isdual() RT#76150
  + Fix a hash order dependency bug t/tainted.t</changelog>
  <changelog author="coolo@suse.com" date="1380974400">- update to 1.32:
  * Skip pairmap()'s MULTICALL implementation 5.8.9 / 5.10.0 as it doesn't
    work (RT87857)
  * Comment on the fact that package "0" is defined but false (RT88201)
  * TODO test in t/readonly.t now passes since 5.19.3 (RT88223)</changelog>
  <changelog author="coolo@suse.com" date="1386936000">- update to 1.35:
  * Added List::Util::product()
  * Ensure that List::Util::{any,all,none,notall} return PL_sv_{yes,no}
  * Implement reduce() and first() even in the absence of MULTICALL
  * Avoid C99/C++-style comments in XS code
  * Fix dualvar tests for perl 5.6; fix skip() test counts in dualvar.t
  * Neater documentation examples of other functions that can be built using
    reduce
  * Added any, all, none, notall list reduction functions
    (inspired by List::MoreUtils)</changelog>
  <changelog author="lars@linux-schulserver.de" date="1389960000">- update to 1.36:
  * Added Scalar::Util::unweaken()
  * Various documentation changes/updates
  * Correct uses of overload operators in unit tests (RT91969)
- do not run weak test on SLE_11</changelog>
</package>
<package pkgid="f1852e2f6692bab1d8db84ce6aaaae979dabce31eea58a3240d91da5d54f7fb0" name="perl-Scalar-List-Utils" arch="x86_64">
  <version epoch="0" ver="1.36" rel="1.11"/>
  <changelog author="lars@linux-schulserver.de" date="1253016000">- initial package build</changelog>
  <changelog author="lars@linux-schulserver.de" date="1268308800">- update to 1.23:
  + Use PERL_NO_GET_CONTEXT for efficiency (see perlguts)
  + avoid non-portable warnings
  + Fix PP::reftype in edge cases
  + RT#51484 Preserve utf8 flag of string passed to dualvar()
  + RT#51454 Check first argument to first/reduce is a code
    reference
  + RT#50528 [PATCH] p_tainted.t fix for VMS [Craig A. Berry]
  + RT#48550 fix pure perl looks_like_number not to match
    non-ascii digits</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="lars@linux-schulserver.de" date="1376913600">- update to 1.31:
  + Bugfix pairmap to return list length in scalar context
  + Added "Odd number of elements" warnings to all pair* functions
  + Added pairfirst
  + Added MULTICALL implementations to pairmap/pairgrep/pairfirst
  + Fix declaration-after-code for C99-challenged compilers
  + Documentation updates to List::Util
  + Bugfix to pairmap/pairgrep when stack moves beneath them
    during operation
  + Added pairgrep, pairmap, pairs (inspired by List::Pairwise)
  + Added pairkeys and pairvalues
  + Fix multicall refcount bug RT#80646
  + Merge patch from JDHEDDEN - Add Scalar::Util::isdual() RT#76150
  + Fix a hash order dependency bug t/tainted.t</changelog>
  <changelog author="coolo@suse.com" date="1380974400">- update to 1.32:
  * Skip pairmap()'s MULTICALL implementation 5.8.9 / 5.10.0 as it doesn't
    work (RT87857)
  * Comment on the fact that package "0" is defined but false (RT88201)
  * TODO test in t/readonly.t now passes since 5.19.3 (RT88223)</changelog>
  <changelog author="coolo@suse.com" date="1386936000">- update to 1.35:
  * Added List::Util::product()
  * Ensure that List::Util::{any,all,none,notall} return PL_sv_{yes,no}
  * Implement reduce() and first() even in the absence of MULTICALL
  * Avoid C99/C++-style comments in XS code
  * Fix dualvar tests for perl 5.6; fix skip() test counts in dualvar.t
  * Neater documentation examples of other functions that can be built using
    reduce
  * Added any, all, none, notall list reduction functions
    (inspired by List::MoreUtils)</changelog>
  <changelog author="lars@linux-schulserver.de" date="1389960000">- update to 1.36:
  * Added Scalar::Util::unweaken()
  * Various documentation changes/updates
  * Correct uses of overload operators in unit tests (RT91969)
- do not run weak test on SLE_11</changelog>
</package>
<package pkgid="0cde73e3445e16adaf089edd3f59789feb1fa7a8d94d7bd7f1676c16e46bfe1f" name="perl-YAML-LibYAML" arch="src">
  <version epoch="0" ver="0.910.0" rel="2.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1560772800">- update to 0.79
  0.79 Tue 11 Jun 2019 09:35:22 PM CEST
  - Support aliasing scalars resolved as null or booleans (tinita)
  - Add YAML::XS::LibYAML::libyaml_version() (tinita)
  - Support standard !!int/!!float tags instead of dying (tinita)
  0.78 Sat 18 May 2019 06:35:21 PM CEST
  - Fix double free/core dump when Dump()ing binary data, see issue#91 (tinita)
  - Update config.h from libyaml (tinita)
  0.77 Mon 15 Apr 2019 10:55:13 PM CEST
  - Update libyaml to version 0.2.2. Most important change for users is that plain
    urls in flow style can be parsed now. Example: `[ http://yaml.org]`. (tinita)
  0.76 Sun Dec 30 20:10:16 CET 2018
  - Add $Indent - number of spaces when dumping. PR#89 @zdm++
  - Fix typo in docs. PR#87 @mr-mixas++
  - Fix links in docs. @manwar++
  0.75 Sat Nov  3 14:17:28 CET 2018
  - Implement $LoadCode (tinita)</changelog>
  <changelog author="coolo@suse.com" date="1566561600">- updated to 0.80
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.80 Thu 22 Aug 2019 01:17:13 PM CEST
  - Fix memory leak when loading invalid YAML (PR#93 tinita)</changelog>
  <changelog author="tina.mueller@suse.com" date="1567080000">- Remove perl-YAML-LibYAML-no-plan.patch (not used anymore)</changelog>
  <changelog author="timueller+perl@suse.de" date="1580212800">- updated to 0.81
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.81 Mon 27 Jan 2020 11:05:46 PM CET
  - Breaking Change: Set $YAML::XS::LoadBlessed default to false to make it
    more secure
  0.69: [bsc#1173703]
  - Security fix: Add $LoadBlessed option to turn on/off loading objects:
    Default is set to true. Note that, the behavior is unchanged.</changelog>
  <changelog author="timueller+perl@suse.de" date="1588507200">updated to 0.82
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.82 Sat 02 May 2020 08:39:03 PM CEST
  - Updated libyaml sources to 0.2.4. Changes affecting YAML::XS are
  - Output '...' at the stream end after a block scalar with trailing empty
    lines
  - Accept '%YAML 1.2' directives (they are ignored and do not change
    behaviour though)</changelog>
  <changelog author="timueller+perl@suse.de" date="1620561600">- updated to 0.83
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.83 Sat 08 May 2021 11:51:32 PM CEST
  - Recognize tied variables (PR#101 tinita)
  - Add license file from included libyaml code (PR#102 tinita)</changelog>
  <changelog author="timueller+perl@suse.de" date="1662292800">- updated to 0.84
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.84 Sat 03 Sep 2022 09:20:20 PM CEST
  - Add option ForbidDuplicateKeys (PR#105 tinita)</changelog>
  <changelog author="timueller+perl@suse.de" date="1663070400">- updated to 0.85
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.85 Mon Sep 12 08:20:19 AM EDT 2022
  - Convert doc from Swim to Markdown
  - Remove travis testing</changelog>
  <changelog author="timueller+perl@suse.de" date="1674820800">- updated to 0.86
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.86 Wed Jan 25 09:34:14 PM EST 2023
  - Fix YAML::XS pod in cpanminus</changelog>
  <changelog author="timueller+perl@suse.de" date="1683979200">- updated to 0.88
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.88 Fri May 12 05:28:05 AM PDT 2023
  - REVERT "Turn off internal POK flag for number scalars"
  0.87 Thu May  4 09:37:26 PM CEST 2023
  - Turn off internal POK flag for number scalars</changelog>
  <changelog author="timueller+perl@suse.de" date="1706356800">- updated to 0.89
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.89 Sat 27 Jan 2024 01:44:08 AM CET
  - Recognise core booleans on Perl 5.36+ at dump time (PR#114 PEVANS++)</changelog>
  <changelog author="tina.mueller@suse.com" date="1709899200">- Fix disabling of __perllib_provides</changelog>
  <changelog author="timueller+perl@suse.de" date="1726920000">- updated to 0.902.0 (v0.902.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.902.0 2024-09-20 21:39:00+02:00
  - Loaded builtin booleans are not readonly anymore for perl &gt;= v5.36
  v0.901.0 2024-09-06 23:56:41+02:00
  - Change version scheme
  - Fix missing linebreak in pod from Dist::Zilla conversion
  0.90 2024-09-06 23:44:13+02:00
  - Change from Zilla::Dist to Dist::Zilla</changelog>
  <changelog author="timueller+perl@suse.de" date="1738584000">- updated to 0.903.0 (v0.903.0) (CVE-2025-40908, [bsc#1243902])
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.903.0 2025-02-03 00:12:41+01:00
  - Security fix: Use 3-arg form of open in LoadFile (issue#120 PR#121)</changelog>
  <changelog author="timueller+perl@suse.de" date="1746792000">- updated to 0.904.0
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.904.0 2025-05-08 14:12:41+02:00
  - Experimental OOP Interface, YAML 1.2</changelog>
  <changelog author="timueller+perl@suse.de" date="1777032000">- updated to 0.905.0 (v0.905.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.905.0 2026-04-24 09:37:22+02:00
  - Fix memory leak for trailing UTF8 octets (PR#123)</changelog>
  <changelog author="timueller+perl@suse.de" date="1777291200">- updated to 0.906.0 (v0.906.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.906.0 2026-04-26 11:12:32+02:00
  - Fix detecting floats in YAML 1.2 Core Schema (issue#125)</changelog>
  <changelog author="timueller+perl@suse.de" date="1778500800">- updated to 0.907.0 (v0.907.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.907.0 2026-05-10 19:47:04+02:00
  - Turn off cyclic references by default</changelog>
  <changelog author="timueller+perl@suse.de" date="1782043200">- updated to 0.908.0 (v0.908.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes</changelog>
  <changelog author="timueller+perl@suse.de" date="1783080000">- updated to 0.910.0 (v0.910.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes</changelog>
</package>
<package pkgid="a8ab598a71a2e626c6c946a9b27024354f75942677995008459c5b7d06795d92" name="perl-YAML-LibYAML" arch="x86_64">
  <version epoch="0" ver="0.910.0" rel="2.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1560772800">- update to 0.79
  0.79 Tue 11 Jun 2019 09:35:22 PM CEST
  - Support aliasing scalars resolved as null or booleans (tinita)
  - Add YAML::XS::LibYAML::libyaml_version() (tinita)
  - Support standard !!int/!!float tags instead of dying (tinita)
  0.78 Sat 18 May 2019 06:35:21 PM CEST
  - Fix double free/core dump when Dump()ing binary data, see issue#91 (tinita)
  - Update config.h from libyaml (tinita)
  0.77 Mon 15 Apr 2019 10:55:13 PM CEST
  - Update libyaml to version 0.2.2. Most important change for users is that plain
    urls in flow style can be parsed now. Example: `[ http://yaml.org]`. (tinita)
  0.76 Sun Dec 30 20:10:16 CET 2018
  - Add $Indent - number of spaces when dumping. PR#89 @zdm++
  - Fix typo in docs. PR#87 @mr-mixas++
  - Fix links in docs. @manwar++
  0.75 Sat Nov  3 14:17:28 CET 2018
  - Implement $LoadCode (tinita)</changelog>
  <changelog author="coolo@suse.com" date="1566561600">- updated to 0.80
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.80 Thu 22 Aug 2019 01:17:13 PM CEST
  - Fix memory leak when loading invalid YAML (PR#93 tinita)</changelog>
  <changelog author="tina.mueller@suse.com" date="1567080000">- Remove perl-YAML-LibYAML-no-plan.patch (not used anymore)</changelog>
  <changelog author="timueller+perl@suse.de" date="1580212800">- updated to 0.81
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.81 Mon 27 Jan 2020 11:05:46 PM CET
  - Breaking Change: Set $YAML::XS::LoadBlessed default to false to make it
    more secure
  0.69: [bsc#1173703]
  - Security fix: Add $LoadBlessed option to turn on/off loading objects:
    Default is set to true. Note that, the behavior is unchanged.</changelog>
  <changelog author="timueller+perl@suse.de" date="1588507200">updated to 0.82
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.82 Sat 02 May 2020 08:39:03 PM CEST
  - Updated libyaml sources to 0.2.4. Changes affecting YAML::XS are
  - Output '...' at the stream end after a block scalar with trailing empty
    lines
  - Accept '%YAML 1.2' directives (they are ignored and do not change
    behaviour though)</changelog>
  <changelog author="timueller+perl@suse.de" date="1620561600">- updated to 0.83
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.83 Sat 08 May 2021 11:51:32 PM CEST
  - Recognize tied variables (PR#101 tinita)
  - Add license file from included libyaml code (PR#102 tinita)</changelog>
  <changelog author="timueller+perl@suse.de" date="1662292800">- updated to 0.84
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.84 Sat 03 Sep 2022 09:20:20 PM CEST
  - Add option ForbidDuplicateKeys (PR#105 tinita)</changelog>
  <changelog author="timueller+perl@suse.de" date="1663070400">- updated to 0.85
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.85 Mon Sep 12 08:20:19 AM EDT 2022
  - Convert doc from Swim to Markdown
  - Remove travis testing</changelog>
  <changelog author="timueller+perl@suse.de" date="1674820800">- updated to 0.86
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.86 Wed Jan 25 09:34:14 PM EST 2023
  - Fix YAML::XS pod in cpanminus</changelog>
  <changelog author="timueller+perl@suse.de" date="1683979200">- updated to 0.88
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.88 Fri May 12 05:28:05 AM PDT 2023
  - REVERT "Turn off internal POK flag for number scalars"
  0.87 Thu May  4 09:37:26 PM CEST 2023
  - Turn off internal POK flag for number scalars</changelog>
  <changelog author="timueller+perl@suse.de" date="1706356800">- updated to 0.89
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  0.89 Sat 27 Jan 2024 01:44:08 AM CET
  - Recognise core booleans on Perl 5.36+ at dump time (PR#114 PEVANS++)</changelog>
  <changelog author="tina.mueller@suse.com" date="1709899200">- Fix disabling of __perllib_provides</changelog>
  <changelog author="timueller+perl@suse.de" date="1726920000">- updated to 0.902.0 (v0.902.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.902.0 2024-09-20 21:39:00+02:00
  - Loaded builtin booleans are not readonly anymore for perl &gt;= v5.36
  v0.901.0 2024-09-06 23:56:41+02:00
  - Change version scheme
  - Fix missing linebreak in pod from Dist::Zilla conversion
  0.90 2024-09-06 23:44:13+02:00
  - Change from Zilla::Dist to Dist::Zilla</changelog>
  <changelog author="timueller+perl@suse.de" date="1738584000">- updated to 0.903.0 (v0.903.0) (CVE-2025-40908, [bsc#1243902])
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.903.0 2025-02-03 00:12:41+01:00
  - Security fix: Use 3-arg form of open in LoadFile (issue#120 PR#121)</changelog>
  <changelog author="timueller+perl@suse.de" date="1746792000">- updated to 0.904.0
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.904.0 2025-05-08 14:12:41+02:00
  - Experimental OOP Interface, YAML 1.2</changelog>
  <changelog author="timueller+perl@suse.de" date="1777032000">- updated to 0.905.0 (v0.905.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.905.0 2026-04-24 09:37:22+02:00
  - Fix memory leak for trailing UTF8 octets (PR#123)</changelog>
  <changelog author="timueller+perl@suse.de" date="1777291200">- updated to 0.906.0 (v0.906.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.906.0 2026-04-26 11:12:32+02:00
  - Fix detecting floats in YAML 1.2 Core Schema (issue#125)</changelog>
  <changelog author="timueller+perl@suse.de" date="1778500800">- updated to 0.907.0 (v0.907.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes
  v0.907.0 2026-05-10 19:47:04+02:00
  - Turn off cyclic references by default</changelog>
  <changelog author="timueller+perl@suse.de" date="1782043200">- updated to 0.908.0 (v0.908.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes</changelog>
  <changelog author="timueller+perl@suse.de" date="1783080000">- updated to 0.910.0 (v0.910.0)
  see /usr/share/doc/packages/perl-YAML-LibYAML/Changes</changelog>
</package>
<package pkgid="392294ec642d72ef66ea925305b533ce4619c2a04fe358bb0675a011892ae2a7" name="perl-common-sense" arch="noarch">
  <version epoch="0" ver="3.5" rel="1.11"/>
  <changelog author="chris@computersalat.de" date="1252065600">- initial pkg 2.0</changelog>
  <changelog author="jw@novell.com" date="1263816000">- update to 3.0, as suggested by JSON::XS</changelog>
  <changelog author="chris@computersalat.de" date="1271419200">- update to 3.2
  - removed "substr" warning - while it overall is a good category,
    "substr '', 2" is entirely sensible.
- 3.1  Sat Apr  3 04:56:36 CEST 2010
  - removed "parenthesis" warning:
    sysread $fh, my $buf, -s $fh; # ok
    sysread $fh, my $buf, $size;  # warning
    Made no sense to me, especially as $size is in scope.
  - no longer hardcode warning/struct bits, calculate them at
    installation time, for when I will no longer be alive etc.
  - tweaked documentation.
- fixed perl-macros deps</changelog>
  <changelog author="chris@computersalat.de" date="1278417600">- update tp 3.3
  - removed "exiting" category - this is too useful to create new
    control statements, and fails utterly with eval, as eval will
    catch the (fatal) warning itself. Kind of hurts, but this is
    just another warning category which is too broad and has to be
    disabled fully because of a minority of issues.
- noarch package
  o remove .packlist/perllocal.pod</changelog>
  <changelog author="coolo@novell.com" date="1291118400">- switch to perl_requires macro</changelog>
  <changelog author="chris@computersalat.de" date="1299240000">- update to 3.4
  - remove "regexp" category. this is rather painful as it's a large
    class, but unfortunately, somebody thought emitting a warning when
    you match more than 32kb of text is in some way useful, which
    spoils the whole category.
  - use META.json instead of META.yml - apparently YAML parsers don't
    actually exist.
- recreated by cpanspec 1.78.03</changelog>
  <changelog author="coolo@suse.com" date="1337774400">- updated to 3.5
  - localise $^W, as this causes warnings with 5.16 when some lost
    soul uses -w. common::sense doesn't support $^W, but tries to
    shield module authors and programs from its ill effects. If you
    enable $^W, then you normally get to keep the pieces because you
    change semantics of other people's code.</changelog>
</package>
<package pkgid="2a49273f527e8ba825a066e59c196e9bef24b903e3bbe4dc3d506b8b1ee35b19" name="perl-common-sense" arch="src">
  <version epoch="0" ver="3.5" rel="1.11"/>
  <changelog author="chris@computersalat.de" date="1252065600">- initial pkg 2.0</changelog>
  <changelog author="jw@novell.com" date="1263816000">- update to 3.0, as suggested by JSON::XS</changelog>
  <changelog author="chris@computersalat.de" date="1271419200">- update to 3.2
  - removed "substr" warning - while it overall is a good category,
    "substr '', 2" is entirely sensible.
- 3.1  Sat Apr  3 04:56:36 CEST 2010
  - removed "parenthesis" warning:
    sysread $fh, my $buf, -s $fh; # ok
    sysread $fh, my $buf, $size;  # warning
    Made no sense to me, especially as $size is in scope.
  - no longer hardcode warning/struct bits, calculate them at
    installation time, for when I will no longer be alive etc.
  - tweaked documentation.
- fixed perl-macros deps</changelog>
  <changelog author="chris@computersalat.de" date="1278417600">- update tp 3.3
  - removed "exiting" category - this is too useful to create new
    control statements, and fails utterly with eval, as eval will
    catch the (fatal) warning itself. Kind of hurts, but this is
    just another warning category which is too broad and has to be
    disabled fully because of a minority of issues.
- noarch package
  o remove .packlist/perllocal.pod</changelog>
  <changelog author="coolo@novell.com" date="1291118400">- switch to perl_requires macro</changelog>
  <changelog author="chris@computersalat.de" date="1299240000">- update to 3.4
  - remove "regexp" category. this is rather painful as it's a large
    class, but unfortunately, somebody thought emitting a warning when
    you match more than 32kb of text is in some way useful, which
    spoils the whole category.
  - use META.json instead of META.yml - apparently YAML parsers don't
    actually exist.
- recreated by cpanspec 1.78.03</changelog>
  <changelog author="coolo@suse.com" date="1337774400">- updated to 3.5
  - localise $^W, as this causes warnings with 5.16 when some lost
    soul uses -w. common::sense doesn't support $^W, but tries to
    shield module authors and programs from its ill effects. If you
    enable $^W, then you normally get to keep the pieces because you
    change semantics of other people's code.</changelog>
</package>
</otherdata>