alt-python310 (3.10.20-10) stable; urgency=medium

  * SECURITY UPDATE: excess base64 data ignored after the first padded quad
    - debian/patches/CVE-2026-3446.patch: treat the pad character as
      non-alphabet data in binascii.a2b_base64() as permitted by RFC 4648
      section 3.3, so decoding continues to the end of the input instead of
      silently dropping everything that follows the first padded quad
    - CVE-2026-3446
  * SECURITY UPDATE: symlink escape via the tarfile hardlink-extraction
    fallback
    - debian/patches/CVE-2026-11940.patch: revalidate the link with the
      hardlink's own shallower name in makelink_with_filter() so a crafted
      archive whose hardlink references a symlink stored at a deeper path
      cannot recreate a relative target that escapes the destination
      directory (incomplete fix of CVE-2025-4330), and pass the extraction
      filter from extract() down to _extract_one() so the revalidation runs
      for single-member extraction as well and not only for extractall()
    - CVE-2026-11940
  * SECURITY UPDATE: script-element breakout in http.cookies
    Morsel.js_output()
    - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value
      with urllib.parse.quote() and wrap it in decodeURIComponent() in the
      generated inline <script> snippet so an attacker-controlled value
      containing </script> or other HTML parser-sensitive sequences cannot
      escape the script element, while non-latin-1 values still reach the
      browser as UTF-8
    - CVE-2026-6019

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Mon, 27 Jul 2026 10:45:27 +0000

alt-python310 (3.10.20-9) stable; urgency=medium

  * SECURITY UPDATE: quadratic-complexity CPU DoS in unicodedata.normalize()
    - debian/patches/CVE-2026-3276.patch: replace the O(n^2) adjacent-swap
      canonical ordering in nfd_nfkd() with a hybrid insertion/counting
      sort so specially crafted input with long runs of combining
      characters cannot consume excessive CPU
    - CVE-2026-3276
  * SECURITY UPDATE: key and value injection via carriage returns in
    configparser writes
    - debian/patches/CVE-2026-0864.patch: normalize CR, CRLF and LF line
      endings to '\n\t' when writing multi-line values in configparser so
      attacker-controlled '\r' cannot inject unexpected keys and values
      into the written file
    - CVE-2026-0864
  * SECURITY UPDATE: CPU DoS in tarfile streaming-mode archive parsing
    - debian/patches/CVE-2026-11972.patch: break at EOF in
      tarfile._Stream.seek() so parsing a crafted or truncated archive
      opened in streaming mode (mode="r|") cannot take exponentially longer
    - CVE-2026-11972

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 16:03:14 +0000

alt-python310 (3.10.20-8) stable; urgency=medium

  * SECURITY UPDATE: standard-alphabet characters accepted by base64
    alternative-alphabet decoding
    - debian/patches/CVE-2025-12781.patch: emit a DeprecationWarning
      (validate=True) or FutureWarning (validate=False) when b64decode()
      or urlsafe_b64decode() accept '+' or '/' characters that are not
      part of the alternative alphabet, and raise ValueError instead of
      a debug-only assert for altchars of invalid length
    - CVE-2025-12781
  * SECURITY UPDATE: CR/LF injection in HTTP proxy CONNECT tunnel
    - debian/patches/CVE-2026-1502.patch: reject control characters in the
      tunnel host and validate tunnel request header names and values in
      http.client HTTPConnection._tunnel() to prevent request smuggling
    - CVE-2026-1502

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 14:54:38 +0000

alt-python310 (3.10.20-7) stable; urgency=medium

  * SECURITY UPDATE: SSRF via server-supplied PASV address in ftplib.ftpcp()
    - debian/patches/CVE-2026-8328.patch: use the source server's peer
      address instead of its self-reported PASV address, as makepasv()
      already does since the CVE-2021-4189 fix
    - CVE-2026-8328
  * SECURITY UPDATE: tarfile data extraction filter bypass via crafted links
    - debian/patches/CVE-2026-7774.patch: validate the normalized link
      target actually written to disk, resolve symlink targets against the
      stripped member name, and reject link members that resolve to the
      destination directory itself
    - CVE-2026-7774

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 14:05:45 +0000

alt-python310 (3.10.20-6) stable; urgency=medium

  * SECURITY UPDATE: email address-list folding no longer RFC 2047-encodes the comma list separator (header spoofing)
    - debian/patches/CVE-2025-1795.patch: email address-list folding no longer RFC 2047-encodes the comma list separator (header spoofing)
    - CVE-2025-1795
  * SECURITY UPDATE: tarfile no longer normalizes AREGTYPE to DIRTYPE while parsing GNU long-name/long-link multi-block members
    - debian/patches/CVE-2025-13462.patch: tarfile no longer normalizes AREGTYPE to DIRTYPE while parsing GNU long-name/long-link multi-block members
    - CVE-2025-13462

 -- Viktor Borzov <vborzov@cloudlinux.com>  Fri, 24 Jul 2026 09:01:41 -0400

alt-python310 (3.10.20-5) stable; urgency=medium

  * SECURITY UPDATE: quadratic-complexity CPU denial of service in html.parser
    - debian/patches/CVE-2026-15308.patch: accumulate incremental feed() data
      to avoid re-scanning/concatenating unterminated constructs quadratically
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 22 Jul 2026 09:00:00 +0000

alt-python310 (3.10.20-4) stable; urgency=medium

  * SECURITY UPDATE: webbrowser argument injection via action-token substitution
    - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519)
    - CVE-2026-4786
  * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError
    - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path
    - CVE-2026-6100
  * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection
    - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy
    - CVE-2026-7210
  * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection
    - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds
    - CVE-2026-41080
  * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error
    - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:11 +0000

alt-python310 (3.10.20-3) stable; urgency=medium

  * SECURITY UPDATE: reject control characters in imaplib IMAP4 commands
    - debian/patches/CVE-2025-15366.patch: guard IMAP4._command()
    - CVE-2025-15366
  * SECURITY UPDATE: reject control characters in poplib POP3 commands
    - debian/patches/CVE-2025-15367.patch: guard POP3._putcmd()
    - CVE-2025-15367
  * SECURITY UPDATE: control-character injection via http.cookies paths
    - debian/patches/CVE-2026-3644.patch: guard Morsel.update()/|=/unpickle/js_output
    - CVE-2026-3644
  * SECURITY UPDATE: uncontrolled recursion in pyexpat content model
    - debian/patches/CVE-2026-4224.patch: recursion guard in conv_content_model()
    - CVE-2026-4224
  * SECURITY UPDATE: webbrowser argument injection via leading-dash URL
    - debian/patches/CVE-2026-4519.patch: reject URLs starting with '-'
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:11 +0000

alt-python310 (3.10.20-2) stable; urgency=medium

  * ELS-2239: Build alt-python310 packages on Ubuntu 18.04/22.04 arm64

 -- Juan-Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 15 Jul 2026 00:00:00 +0000

alt-python310 (3.10.20-1) stable; urgency=medium

  * ALTPYTH-592: Update to 3.10.20 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 07 Apr 2026 00:00:00 +0000

alt-python310 (3.10.19-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python310 (3.10.19-1) stable; urgency=medium

  * ALTPTYH-584: Update to 3.10.19 version

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Tue, 09 Dec 2025 18:41:00 +0000

alt-python310 (3.10.18-1) stable; urgency=medium

  * ALTPYTH-557: Update to 3.10.18 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:23:18 +0000

alt-python310 (3.10.17-1) stable; urgency=medium

  * ALTPYTH-552: Update to 3.10.17 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:51 +0000

alt-python310 (3.10.16-1) stable; urgency=medium

  * ALTPYTH-542: Update to 3.10.16 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:23:48 +0000

alt-python310 (3.10.15-1) stable; urgency=medium

  * Update to 3.10.15 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 06:23:35 +0000

alt-python310 (3.10.14-3) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200   

alt-python310 (3.10.14-2) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200 

alt-python310 (3.10.14-1) stable; urgency=medium

  * ALTPYTH-512: Update to 3.10.14 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 20 Mar 2024 00:23:09 +0000

alt-python310 (3.10.13-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * ALTPYTH-486: update to 3.10.12
  * ALTPYTH-481: Updated to 3.10.13

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python310 (3.10.9-1) stable; urgency=medium

  * update to 3.10.9

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Jan 2023 17:00:00 +0200

alt-python310 (3.10.8-1) stable; urgency=medium

  * update to 3.10.8
  * ALTPYTH-443: CL9 compatibility

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 21 Oct 2022 17:08:00 +0200

alt-python310 (3.10.4-1) stable; urgency=medium

  * ALTPYTH-422: fix for ensurepip
  * update to 3.10.4

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 06 Apr 2022 10:08:00 +0200

alt-python310 (3.10.2-1) stable; urgency=medium

  * update to 3.10.2

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 28 Jan 2022 16:22:00 +0300

alt-python310 (3.10.1-1) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 14 Dec 2021 11:28:00 +0300
