alt-python36 (3.6.15-37) stable; urgency=medium

  * SECURITY UPDATE: tarfile applied AREGTYPE -> DIRTYPE normalization
    even during multi-block GNU long members (GNUTYPE_LONGNAME /
    GNUTYPE_LONGLINK), enabling a parsing differential vs. other tar
    implementations.
    - debian/patches/CVE-2025-13462.patch: backport of cpython
      42d754e3 (gh-143934, Seth Larson + Eashwar Ranganathan).
      Threads a dircheck flag through frombuf / fromtarfile so
      normalization is skipped on the inner header during GNU long
      name / link handling.
    - CVE-2025-13462

  * SECURITY UPDATE: wsgiref.headers.Headers did not reject control
    characters in header names / values, allowing HTTP header
    injection from WSGI applications.
    - debian/patches/CVE-2026-0865.patch: combined backport of
      cpython f7fceed7 (gh-143917) which adds the control-char regex
      check, 66da7bf6 (gh-143916 HTAB follow-up) which splits the
      check so HTAB is allowed in header values (RFC 9110 Section
      5.5) but still rejected in header names, plus d931725b
      (gh-144370) which disallows control characters in status in
      wsgiref.handlers.start_response.
    - CVE-2026-0865

  * SECURITY UPDATE: http.client did not reject CR/LF in HTTPConnection
    CONNECT tunnel host / per-tunnel-header values, enabling request
    injection through a proxy tunnel.
    - debian/patches/CVE-2026-1502.patch: backport of cpython
      05ed7ce7 + b1cf9016 (gh-146212, Seth Larson). Adapted to 3.6's
      per-line self.send() form (no headers=[] list in _tunnel until
      3.9+). Validates _tunnel_host and per-header name / value in
      _tunnel().
    - CVE-2026-1502

  * SECURITY UPDATE: http.cookies.Morsel.js_output() emitted an inline
    <script> snippet that only escaped " and left </script> intact,
    enabling HTML injection when a cookie value contains </script>.
    - debian/patches/CVE-2026-6019.patch: backport of cpython
      76b3923d (gh-148848, Seth Larson). Base64-encodes the cookie
      value and emits document.cookie = atob("...") instead of
      pasting the raw cookie string into the JavaScript snippet.
      Composes on top of CVE-2026-3644's js_output() control-character
      recheck (preserved).
    - CVE-2026-6019

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 16:00:00 +0200

alt-python36 (3.6.15-36) stable; urgency=medium

  * SECURITY UPDATE: bytes.decode("unicode_escape", errors="ignore" or
    "replace") could trigger a use-after-free when the error handler
    reallocated the input buffer; the decoder retained a pointer into
    the freed old buffer.
    - debian/patches/CVE-2025-4516.patch: backport of cpython
      9f69a586 (gh-129648, Serhiy Storchaka). Captures the initial
      starts pointer in _PyUnicode_DecodeUnicodeEscape and only stores
      *first_invalid_escape when starts == initial_starts, so the
      pointer cannot dangle after reallocation.
    - CVE-2025-4516

  * SECURITY UPDATE: html.parser.HTMLParser had worst-case quadratic
    complexity on crafted malformed input, enabling amplified DoS.
    - debian/patches/CVE-2025-6069.patch: backport of cpython
      6eb6c5db (gh-135464, Serhiy Storchaka). Adds the endtagopen
      regex and rewrites goahead()'s EOF handling per the HTML5 spec
      so comments and declarations are auto-closed and tags are
      ignored at EOF.
    - CVE-2025-6069

  * SECURITY UPDATE: zipfile did not validate the ZIP64 EOCD locator
    offset, enabling ZIP parsing-differential / archive-smuggling
    attacks.
    - debian/patches/CVE-2025-8291.patch: backport of cpython
      162997bb + 333d4a6f (gh-139702). Adds the reloff > offset guard
      in _EndRecData64 and supports zip64 extensible data when there
      are no bytes prepended to the ZIP file.
    - CVE-2025-8291

  * SECURITY UPDATE: folding a long email header comment of only
    unfoldable characters dropped the enclosing parentheses, enabling
    header injection in serialized email messages.
    - debian/patches/CVE-2025-11468.patch: backport of cpython
      17d1490a (gh-143936, Seth Larson). Adds make_parenthesis_pairs
      and a comment-escaping branch in _refold_parse_tree, and fixes
      WhiteSpaceTerminal.startswith_fws.
    - CVE-2025-11468

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 15:30:00 +0200

alt-python36 (3.6.15-35) stable; urgency=medium

  * SECURITY UPDATE: rework the CVE-2026-7210 fix so the system-libexpat
    code path is no longer inert when the system libexpat does not bump
    XML_COMBINED_VERSION to 2.8.0.  alt-python36's bundled libexpat 2.4.1
    (patched by CVE-2026-41080.patch) and any distro libexpat that
    backports the XML_SetHashSalt16Bytes entropy fix into an older
    branch are now detected at load time, not at compile time.
    - debian/patches/CVE-2026-7210.patch: rewritten.  Drops the
      compile-time "XML_COMBINED_VERSION >= 20800 || defined
      (XML_HAS_HASHSALT16BYTES_BACKPORT)" conditional and instead
      declares XML_SetHashSalt16Bytes as __attribute__((weak)) at
      the top of Modules/pyexpat.c.  The pyexpat parser init code,
      the pyexpat C-API capsule initialization, and _elementtree.c
      now all do a single runtime "if (... != NULL)" check on the
      symbol's address.  Result:
        - RPM / Debian builds: bundled libexpat 2.4.1 with the
          matching CVE-2026-41080 backport exposes the symbol, weak
          resolution finds it, 16-byte salt path is taken -- same
          mitigation as before, no regression.
        - Alpine builds: --with-system-expat links the system
          libexpat at load time.  If the system libexpat has the
          entropy fix (upstream 2.8.0+, or a distro backport into
          2.7.x), the weak symbol resolves to the real function and
          the 16-byte path activates without needing to rebuild
          alt-python36.  If not, the legacy 8-byte XML_SetHashSalt
          path is used, exactly as before this patch -- no behavior
          regression and the package becomes self-healing the moment
          Alpine ships a libexpat with the fix.
    - debian/patches/CVE-2026-41080.patch: unchanged.  The
      XML_HAS_HASHSALT16BYTES_BACKPORT feature-test macro it defines
      is no longer consumed by CVE-2026-7210.patch (the weak symbol
      replaces it), but the macro is kept as a stable signal.
    - CVE-2026-7210

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse accepted bracketed
    hosts that were not valid IPv6 / IPvFuture, enabling SSRF and
    parser-differential attacks.
    - debian/patches/CVE-2024-11168.patch: backport of cpython
      29f348e2 (gh-103848). Adds _check_bracketed_host and wires it
      into urlsplit(). Also backports cpython 5a88d50 (bpo-43882) to
      remove the 3.6-only urlsplit() "http" fast-path so http:// URLs
      flow through the validated code path; without it the bracketed-
      host check is bypassed for http://, which is the scheme targeted
      by both CVE-2024-11168 and CVE-2025-0938.
    - CVE-2024-11168

  * SECURITY UPDATE: bundled libexpat 2.4.1 crashes in XML_ResumeParser
    when XML_StopParser is called on an unstarted parser (NULL deref).
    - debian/patches/CVE-2024-50602.patch: backport of the libexpat
      2.6.4 fix.  Adds XML_ERROR_NOT_STARTED and refuses to
      stop/suspend a parser in XML_INITIALIZED state in
      XML_StopParser, eliminating the precondition for the
      XML_ResumeParser NULL deref. Alpine builds use system expat
      (--with-system-expat + rm -r Modules/expat) so this hardening
      affects only the bundled-expat path used by RPM/Debian builds.
    - CVE-2024-50602

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse continued to accept
    domain names containing square brackets after the CVE-2024-11168 fix;
    follow-up that completes the validation.
    - debian/patches/CVE-2025-0938.patch: backport of cpython
      d89a5f6a (gh-105704). Disallows square brackets in domain names
      not delimiting an IPv6 / IPvFuture host.
    - CVE-2025-0938

  * SECURITY UPDATE: email address-list folding could unicode-encode the
    comma separator together with a folded line, causing the address
    header to be misinterpreted by some mail servers.
    - debian/patches/CVE-2025-1795.patch: backport of cpython gh-100884
      (Thomas Weißschuh). Marks ListSeparator with
      as_ew_allowed = False so the comma is never encoded-word-wrapped.
    - CVE-2025-1795

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 15:00:00 +0200

alt-python36 (3.6.15-34) stable; urgency=medium

  * SECURITY UPDATE: CVE-2026-7210 + CVE-2026-41080 (paired) — backport
    the libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled
    expat 2.4.1 and wire pyexpat/_elementtree to use it. Together these
    restore proper hash-flood mitigation for xml.parsers.expat and
    xml.etree.ElementTree.
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). Adds a new 16-byte
      _Py_HashSecret.expat.hashsalt16 slot in Include/pyhash.h
      (overlapping the existing padding), extends the PyExpat CAPI in
      Include/pyexpat.h with SetHashSalt16Bytes, and prefers the new
      API in Modules/pyexpat.c and Modules/_elementtree.c when built
      against libexpat exposing it; falls back to the legacy
      XML_SetHashSalt path otherwise. The two XML_COMBINED_VERSION
      gates are extended with `|| defined(XML_HAS_HASHSALT16BYTES_BACKPORT)`
      so the new code path activates against the bundled patched
      libexpat without bumping its advertised version, while
      --with-system-expat builds (Alpine) keep the upstream
      `>= 20800` semantics.
    - debian/patches/CVE-2026-41080.patch: backport of libexpat
      PR #1183. Widens the parser's internal hash salt from
      `unsigned long m_hash_secret_salt` to a full
      `struct sipkey m_hash_secret_salt_128` (+ an
      m_hash_secret_salt_set flag), adds the new
      XML_SetHashSalt16Bytes API and the matching
      XML_HAS_HASHSALT16BYTES_BACKPORT marker in expat.h, and namespaces
      the new symbol via pyexpatns.h. Applied to bundled
      Modules/expat/; on Alpine `prepare()` deletes Modules/expat
      after the patch, so the libexpat backport is a no-op there and
      the system libexpat decides whether the new API is available.
    - CVE-2026-7210
    - CVE-2026-41080

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 22 May 2026 10:00:00 +0200

alt-python36 (3.6.15-33) stable; urgency=medium

  * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose
    mediatype contained control characters, allowing newline-based HTTP
    header injection downstream.
    - debian/patches/CVE-2025-15282.patch: backport of cpython
      f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F]
      regex check in data_open() and a matching test_invalid_mediatype.
    - CVE-2025-15282

  * SECURITY UPDATE: http.cookies.Morsel did not reject control characters
    in keys / values / coded_value, allowing cookie injection via
    __setitem__, setdefault, set, and BaseCookie.output.
    - debian/patches/CVE-2026-0672.patch: backport of cpython
      95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character
      helper and inserts validation in __setitem__, setdefault, set,
      plus a wrap of BaseCookie.OutputString / output.
    - CVE-2026-0672

  * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control
    characters could still bypass via Morsel.update(), |=, __setstate__
    (pickle), and BaseCookie.js_output().
    - debian/patches/CVE-2026-3644.patch: backport of cpython
      57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds
      validation to Morsel.update(), defines explicit Morsel.__ior__
      (was inherited from dict and bypassed validation), validates
      __setstate__ before assigning attributes, and re-validates the
      assembled output string in js_output().
    - CVE-2026-3644

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RecursionError instead of crashing.
    - CVE-2026-4224

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 10:00:00 +0200

alt-python36 (3.6.15-32) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64_impl no longer breaks out on a pad
      sequence; a `pads` counter is added so post-loop validation still
      raises "Incorrect padding" for inputs that do not satisfy
      `quad_pos + pads == 4`. The unused `binascii_find_valid` helper
      is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python36 (3.6.15-31) stable; urgency=medium

  * SECURITY UPDATE: email BytesGenerator header injection
    - debian/patches/CVE-2026-1299.patch: verify generated headers in
      email.generator.BytesGenerator and Generator. Adds the
      HeaderWriteError exception, NEWLINE_WITHOUT_FWSP /
      NEWLINE_WITHOUT_FWSP_BYTES regexes, and the
      Policy.verify_generated_headers attribute, then raises
      HeaderWriteError when the folded header does not end with the
      policy linesep or contains a stray newline. Includes the
      CVE-2024-6923 prerequisite hardening of the string Generator.
    - CVE-2026-1299
  * SECURITY UPDATE: ssl.SSLContext memory race in cert_store_stats /
    get_ca_certs
    - debian/patches/CVE-2024-0397.patch: backport the upstream
      X509_STORE_get1_objects shim and the x509_object_dup helper
      from cpython 29c97287d205bf2f410f4895ebce3f43b5160524, then
      switch _ssl__SSLContext_cert_store_stats_impl and
      _ssl__SSLContext_get_ca_certs_impl to take a deep-copy snapshot
      of the X509_STORE under lock, freeing the snapshot before
      returning. Closes a use-after-free triggered by loading
      certificates concurrently from another thread.
    - CVE-2024-0397
  * SECURITY UPDATE: ipaddress is_private / is_global misclassification
    - debian/patches/CVE-2024-4032.patch: backport upstream
      gh-113171 / gh-65056. Update Lib/ipaddress.py to align the
      _private_networks lists with the IANA special-purpose registries
      and add _private_networks_exceptions so that
      is_private / is_global no longer misclassify addresses in
      192.0.0.0/24 (with 192.0.0.9 and 192.0.0.10 exceptions),
      64:ff9b:1::/48, 2002::/16, and the 2001::/23 sub-range
      exceptions (2001:1::1, 2001:1::2, 2001:3::/32, 2001:4:112::/48,
      2001:20::/28, 2001:30::/28). Includes the matching docs and
      test updates.
    - CVE-2024-4032

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:36:00 +0200

alt-python36 (3.6.15-30) stable; urgency=medium

  * SECURITY UPDATE: zipfile quoted-overlap zip bomb
    - debian/patches/CVE-2024-0450.patch: raise BadZipFile when an
      archive entry overlaps with another entry or the central
      directory, preventing quoted-overlap zip bombs with extreme
      compression ratios.
    - CVE-2024-0450
  * SECURITY UPDATE: use-after-free in lzma/bz2 decompressors
    - debian/patches/CVE-2026-6100.patch: null next_in at the error:
      label of decompress() in Modules/_bz2module.c and
      Modules/_lzmamodule.c so the decompressor cannot be re-used
      with a stale buffer pointer after a MemoryError.
    - CVE-2026-6100

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 12:00:00 +0200

alt-python36 (3.6.15-29) stable; urgency=medium

  * SECURITY UPDATE: command-line option injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject leading dashes in
      webbrowser.open() URLs to prevent command-line option injection
      in browser subprocesses
    - CVE-2026-4519

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 12:30:00 +0200

alt-python36 (3.6.15-28) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python36 (3.6.15-27) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in
      os.path.expandvars() by replacing the character-by-character loop
      with regex-based substitution in both posixpath and ntpath modules.
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 07:45:00 +0100

alt-python36 (3.6.15-26) stable; urgency=medium

  * ALTPYTH-586: Initial build for arm64

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Thu, 26 Feb 2026 17:00:00 +0400

alt-python36 (3.6.15-25) stable; urgency=medium

  * SECURITY UPDATE: Shell command injection in the mailcap module
    - debian/patches/CVE-2015-20107.patch: sanitize the second
      argument which allowing shell command injection
    - CVE-2015-20107

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Wed, 18 Feb 2026 17:10:11 +0100

alt-python36 (3.6.15-24) stable; urgency=medium

  * Exclude flaky timing-dependent tests on Debian 12/13
    (test_generators, test_pdb, test_regrtest)

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Wed, 18 Feb 2026 15:00:00 +0400

alt-python36 (3.6.15-23) stable; urgency=medium

  * SECURITY UPDATE: Memory denial of service in plistlib
    - debian/patches/CVE-2025-13837.patch: read large data by chunks,
      therefore the upper limit of consumed memory is proportional to the
      size of the input file.
    - CVE-2025-13837

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 12 Feb 2026 08:04:42 +0100

alt-python36 (3.6.15-22) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Mon, 09 Feb 2026 19:00:00 +0400

alt-python36 (3.6.15-21) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 08 Jan 2026 11:51:00 +0100

alt-python36 (3.6.15-20) stable; urgency=medium

  * SECURITY UPDATE: Ability to modify permissions with privileged programs
    - debian/patches/CVE-2023-6597: prevent tempfile.TemporaryDirectory
      class dereference symlinks
    - CVE-2023-6597

 -- Azat Nurgaliev <anurgaliev@cloudlinux.com>  Wed, 10 Dec 2025 15:54:02 +0200

alt-python36 (3.6.15-19) stable; urgency=medium

  * SECURITY UPDATE: Traversing outside chmod directory
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filters directory members
      before chmod/chown
    - CVE-2024-12718
  * SECURITY UPDATE: Symlink exfiltration
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: properly handles different link
      semantics
    - CVE-2025-4138
  * SECURITY UPDATE: Hardlink Fallback Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink
      extraction falls back to copying
    - CVE-2025-4330
  * SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: account errorlevel
    - CVE-2025-4435
  * SECURITY UPDATE: PATH_MAX Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow
      attacks
    - CVE-2025-4517
  * TEST UPDATE: Incorrect encoding leading to an unexpected
    exception in test_tarfile.py
    - debian/patch/fix_test_tarfile-enconding.patch: fix encoding

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Fri, 17 Oct 2025 18:20:02 +0100

alt-python36 (3.6.15-18) stable; urgency=medium

  * TESTS UPDATE: Rename bisect.by to bisect_cmd.py in tests to
    avoid conflicts with bisect module
    - debian/patches/bpo-35519.patch: rename test.bisect module to
      test.bisect_cmd to avoid conflict with bisect module when running
      directly a test like "./python Lib/test/test_xmlrpc.py"
  * TESTS UPDATE: Enabled build tests for debian 10, 11, 12, and 13

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Thu, 16 Oct 2025 18:20:02 +0100

alt-python36 (3.6.15-17) stable; urgency=medium

  * SECURITY UPDATE: Overwriting of arbitrary files by remote attackers
    - debian/patches/CVE-2007-4559.patch: implement PEP 706 - a filter in
      the tarfile module to prevent directory traversal vulnerability
    - CVE-2007-4559
  * SECURITY UPDATE: Bypass of domain e-mail-based protection mechanism by
    incorrect parsing of e-mail addresses that contain a special character
    - debian/patches/CVE-2023-27043.patch: reject malformed addresses in
      email.parseaddr()
    - CVE-2023-27043
  * SECURITY UPDATE: Bypass of the TLS handshake and included protections
    - debian/patches/CVE-2023-40217.patch: check for & avoid the ssl
      pre-close flaw
    - CVE-2023-40217

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Thu, 09 Oct 2025 11:09:00 +0100

alt-python36 (3.6.15-16) stable; urgency=medium

  * disable failing internal tests on ubuntu24

 -- Jai S <jsathyapalan@cloudlinux.com>  Tue, 07 Oct 2025 09:32:00 +0000

alt-python36 (3.6.15-15) stable; urgency=medium

  * Enable internal testing

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Fri, 26 Sep 2025 11:04:00 +0100

alt-python36 (3.6.15-14) stable; urgency=medium

  * SECURITY UPDATE: DOS, buffer overflow in SHA3, Possible Bypass Blocklisting
    Redirection vulnerability in http.server, regex DOS, Quadratic complexity,
    pathname quoting for venv
    - debian/patches/CVE-2022-37454.patch: fix a buffer overflow in
      Modules/_sha3/kcp/KeccakSponge.inc, Lib/test/test_hashlib.py
      (LP: #1995197).
    - debian/patches/CVE-2022-45061.patch: fix quadratic time idna decoding
      in Lib/encodings/idna.py, Lib/test/test_codecs.py.
    - debian/patches/CVE-2023-24329.patch: enforce
      that a scheme must begin with an alphabetical ASCII character
      in Lib/urllib/parse.py, Lib/test/test_urlparse.py.
      start stripping C0 control and space chars in `urlsplit`
    - debian/patches/CVE-2021-28861.patch: Fix an open
      redirection vulnerability in the `http.server` module
      when an URI path starts with `//`
    - debian/patches/CVE-2024-6232.patch: Fix header parsing vulnerability that
      could lead to ReDoS
    - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in parsing
      "-quoted cookie values with backslashes
    - debian/patches/CVE-2024-9287.patch: Quote template strings in `venv` activation
    - CVE-2022-37454
    - CVE-2022-45061
    - CVE-2023-24329
    - CVE-2021-28861
    - CVE-2024-6232
    - CVE-2024-7592
    - CVE-2024-9287

 -- Jai S <jsathyapalan@cloudlinux.com>  Thu, 18 Sep 2025 13:57:38 +0000

alt-python36 (3.6.15-13) stable; urgency=medium

  * SECURITY UPDATE: Misleading information
    - debian/patches/CVE-2019-17514.patch: explain that the orderness of the
      of the result is system-dependant in Doc/library/glob.rst.
    - CVE-2019-17514

 -- Jai S <jsathyapalan@cloudlinux.com>  Tue, 26 Aug 2025 05:52:43 +0000

alt-python36 (3.6.15-12) stable; urgency=medium

  * Bootstrap for Debian 13

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Mon, 08 Sep 2025 20:00:00 +0300

alt-python36 (3.6.15-11) stable; urgency=medium

  * SECURITY UPDATE: Denial of service via a ZIP bomb
    - debian/patches/CVE-2019-9674.patch: add pitfalls to zipfile module
      documentation
    - CVE-2019-9674

 -- Koba Karaputadze <kkaraputadze@cloudlinux.com>  Fri, 22 Aug 2025 20:49:00 +0100

alt-python36 (3.6.15-10) stable; urgency=medium

  * ALTPYTH-560: initial build.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 23 Jul 2025 13:20:00 +0300

