# changelog

author: andreas.stieger@gmx.de
changelog:
  - Serf 1.3.7
    Serf may not provide the full value for fields contained in X.509
    certificates.  Allowing for clients to potentially improperly
    accept certificates.
    * Handle NUL bytes in fields of an X.509 certificate.
      [bnc#890510] [CVE-2014-3504]


author: andreas.stieger@gmx.de
changelog:
  - Serf 1.3.8
    This release fixes a problem with handling very large gzip-
    encoded HTTP responses and disables SSLv2 and SSLv3.
    * CRC calculation error for gzipped http reponses > 4GB.
    * SSPI CredHandle not freed when APR pool is destroyed.
    * Disable SSLv2 and SSLv3 as both or broken [boo#901968]
  - disable running tests due to memory leak in test fixture


author: andreas.stieger@gmx.de
changelog:
  - enable running test suite:
    * add libserf-1.3.x-fix-comment-style.patch to fix compile error
    * add libserf-1.3.x-fix-deflate-buckets-test.patch to fix crash


author: astieger@suse.com
changelog:
  - Apache Serf 1.3.9:
    * serf is now Apache Software Foundation project
    * fix various build issues
    * resolve a bucket (aka "memory") leak when a request bucket is
      destroyed before it is morphed into an aggregate bucket
    * reset state variables when resetting connection
    * fix types of passed, but unused batons
    * fix some usages of the openssl BIO api
    * improve handling of bad data in the response state line
    * support more overrides via SCons arguments
    * adapt to OpenSSL 1.1.x api
  - drop upstream patches:
      libserf-1.3.x-fix-comment-style.patch
      libserf-1.3.x-fix-deflate-buckets-test.patch


