alt-python27-pip (20.2.4-7) stable; urgency=medium

  * SECURITY UPDATE: option injection via Mercurial revision passed as a bare argument
    - debian/patches/CVE-2023-5752.patch: pass the revision as --rev=<rev> so it
      cannot be interpreted as an hg option
    - CVE-2023-5752
  * SECURITY UPDATE: arbitrary file write via unchecked symlink targets in tar extraction
    - debian/patches/CVE-2025-8869.patch: reject symlink members whose target is
      absent from the archive or resolves outside the destination directory
    - CVE-2025-8869
  * SECURITY UPDATE: path traversal via sibling-prefix directory containment check
    - debian/patches/CVE-2026-1703.patch: compare whole path components instead of
      using os.path.commonprefix
    - CVE-2026-1703
  * SECURITY UPDATE: archive format confusion for files matching both zip and tar signatures
    - debian/patches/CVE-2026-3219.patch: order format detection by confidence and
      refuse archives with an ambiguous signature
    - CVE-2026-3219
  * SECURITY UPDATE: arbitrary file write via entry point name escaping the scripts directory
    - debian/patches/CVE-2026-8643.patch: reject console script names that do not
      resolve inside the scripts directory
    - CVE-2026-8643
  * SECURITY UPDATE: directory escape via Link.filename decoding the URL path twice
    - debian/patches/CVE-2026-13346.patch: decode the URL path once and reduce the
      file name to a single path component
    - CVE-2026-13346
  * SECURITY UPDATE: revision hijacking via unicode separators in git references
    - debian/patches/CVE-2021-3572.patch: split git show-ref output on plain
      newlines/ASCII spaces instead of all unicode separators
    - CVE-2021-3572

 -- Davit Sargsyan <dsargsyan@cloudlinux.com>  Mon, 24 Aug 2026 15:30:00 -0400

alt-python27-pip (20.2.4-6) stable; urgency=medium

  * ALTPYTH-597: Rebuild for arm64 support

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Mon, 31 Mar 2026 12:00:00 +0400

alt-python27-pip (20.2.4-1) stable; urgency=medium

  * Initial build for deb platform

 --  Sergey Fokin <sfokin@cloudlinux.com>  Fri, 08 Aug 2025 16:53:00 +0100
