alt-python36 (3.6.15-40) stable; urgency=medium

  * SECURITY UPDATE: html.parser.HTMLParser had quadratic complexity in
    incremental parsing. An unterminated construct (e.g. a tag or comment)
    fed across many feed() calls made the parser rescan the growing buffer
    and reconcatenate new data onto it on every call, both quadratic in the
    input size, allowing a CPU denial-of-service on uncontrolled data
    (CWE-407, algorithmic complexity).
    - debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddb
      (gh-153030, Serhiy Storchaka). feed() now accumulates new data in a
      list and only joins and parses it once enough has piled up, and
      close() flushes any pending buffer. Adapted to 3.6: feed()/close()/
      reset() logic identical to upstream (3.6 already has list.clear());
      the regression test is added with "from test import support"; the
      NEWS.d fragment is omitted as 3.6.15 ships a single Misc/NEWS.
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:30 +0000

alt-python36 (3.6.15-39) stable; urgency=medium

  * SECURITY UPDATE: a bz2.BZ2Decompressor could be reused after a libbz2
    decompression error. Re-entering BZ2_bzDecompress() once libbz2 had
    reported an error could write past the end of a stack buffer
    (CWE-121, possible stack buffer overflow).
    - debian/patches/CVE-2026-9669.patch: backport of cpython
      5755d0f0 (gh-150599, Stan Ulbrych). Records the libbz2 error in a
      new bzerror field, clears needs_input on the error path, and makes
      decompress() raise ValueError ("Decompressor is unusable after a
      previous error") on any subsequent call. Adapted to 3.6: plain
      needs_input reset (no free-threading atomics) and the existing
      ACQUIRE_LOCK/RELEASE_LOCK wrappers; NEWS.d fragment omitted as
      3.6.15 ships a single Misc/NEWS.
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 23 Jun 2026 05:38:56 +0000

alt-python36 (3.6.15-38) stable; urgency=medium

  * SECURITY UPDATE: imaplib.IMAP4._command() concatenated each command
    argument into the wire-level command without inspecting it, so a
    caller passing user-controlled text could inject additional IMAP
    commands using CR/LF or other control characters.
    - debian/patches/CVE-2025-15366.patch: backport of cpython
      6262704b (gh-143921, Seth Larson). Adds a module-level
      _control_chars regex and rejects any byte in [\x00-\x1F\x7F] with
      ValueError before concatenating each argument. Upstream-main-only
      fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464).
    - CVE-2025-15366

  * SECURITY UPDATE: poplib.POP3._putcmd() encoded its argument and sent
    it to the server without inspecting it, allowing the same command
    injection via user() / pass_() / apop() / rpop() / top().
    - debian/patches/CVE-2025-15367.patch: backport of cpython
      b234a2b6 (gh-143923, Seth Larson). Rejects any byte in
      [\x00-\x1F\x7F] with ValueError before sending. Upstream-main-only
      fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464).
    - CVE-2025-15367

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 08 Jun 2026 09:00:00 +0200

alt-python36 (3.6.15-37) stable; urgency=medium

  * SECURITY UPDATE: tarfile applied AREGTYPE -> DIRTYPE normalization
    even during multi-block GNU long members (GNUTYPE_LONGNAME /
    GNUTYPE_LONGLINK), enabling a parsing differential vs. other tar
    implementations.
    - debian/patches/CVE-2025-13462.patch: backport of cpython
      42d754e3 (gh-143934, Seth Larson + Eashwar Ranganathan).
      Threads a dircheck flag through frombuf / fromtarfile so
      normalization is skipped on the inner header during GNU long
      name / link handling.
    - CVE-2025-13462

  * SECURITY UPDATE: wsgiref.headers.Headers did not reject control
    characters in header names / values, allowing HTTP header
    injection from WSGI applications.
    - debian/patches/CVE-2026-0865.patch: combined backport of
      cpython f7fceed7 (gh-143917) which adds the control-char regex
      check, 66da7bf6 (gh-143916 HTAB follow-up) which splits the
      check so HTAB is allowed in header values (RFC 9110 Section
      5.5) but still rejected in header names, plus d931725b
      (gh-144370) which disallows control characters in status in
      wsgiref.handlers.start_response.
    - CVE-2026-0865

  * SECURITY UPDATE: http.client did not reject CR/LF in HTTPConnection
    CONNECT tunnel host / per-tunnel-header values, enabling request
    injection through a proxy tunnel.
    - debian/patches/CVE-2026-1502.patch: backport of cpython
      05ed7ce7 + b1cf9016 (gh-146212, Seth Larson). Adapted to 3.6's
      per-line self.send() form (no headers=[] list in _tunnel until
      3.9+). Validates _tunnel_host and per-header name / value in
      _tunnel().
    - CVE-2026-1502

  * SECURITY UPDATE: http.cookies.Morsel.js_output() emitted an inline
    <script> snippet that only escaped " and left </script> intact,
    enabling HTML injection when a cookie value contains </script>.
    - debian/patches/CVE-2026-6019.patch: backport of cpython
      76b3923d (gh-148848, Seth Larson). Base64-encodes the cookie
      value and emits document.cookie = atob("...") instead of
      pasting the raw cookie string into the JavaScript snippet.
      Composes on top of CVE-2026-3644's js_output() control-character
      recheck (preserved).
    - CVE-2026-6019

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 16:00:00 +0200

alt-python36 (3.6.15-36) stable; urgency=medium

  * SECURITY UPDATE: bytes.decode("unicode_escape", errors="ignore" or
    "replace") could trigger a use-after-free when the error handler
    reallocated the input buffer; the decoder retained a pointer into
    the freed old buffer.
    - debian/patches/CVE-2025-4516.patch: backport of cpython
      9f69a586 (gh-129648, Serhiy Storchaka). Captures the initial
      starts pointer in _PyUnicode_DecodeUnicodeEscape and only stores
      *first_invalid_escape when starts == initial_starts, so the
      pointer cannot dangle after reallocation.
    - CVE-2025-4516

  * SECURITY UPDATE: html.parser.HTMLParser had worst-case quadratic
    complexity on crafted malformed input, enabling amplified DoS.
    - debian/patches/CVE-2025-6069.patch: backport of cpython
      6eb6c5db (gh-135464, Serhiy Storchaka). Adds the endtagopen
      regex and rewrites goahead()'s EOF handling per the HTML5 spec
      so comments and declarations are auto-closed and tags are
      ignored at EOF.
    - CVE-2025-6069

  * SECURITY UPDATE: zipfile did not validate the ZIP64 EOCD locator
    offset, enabling ZIP parsing-differential / archive-smuggling
    attacks.
    - debian/patches/CVE-2025-8291.patch: backport of cpython
      162997bb + 333d4a6f (gh-139702). Adds the reloff > offset guard
      in _EndRecData64 and supports zip64 extensible data when there
      are no bytes prepended to the ZIP file.
    - CVE-2025-8291

  * SECURITY UPDATE: folding a long email header comment of only
    unfoldable characters dropped the enclosing parentheses, enabling
    header injection in serialized email messages.
    - debian/patches/CVE-2025-11468.patch: backport of cpython
      17d1490a (gh-143936, Seth Larson). Adds make_parenthesis_pairs
      and a comment-escaping branch in _refold_parse_tree, and fixes
      WhiteSpaceTerminal.startswith_fws.
    - CVE-2025-11468

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 15:30:00 +0200

alt-python36 (3.6.15-35) stable; urgency=medium

  * SECURITY UPDATE: rework the CVE-2026-7210 fix so the system-libexpat
    code path is no longer inert when the system libexpat does not bump
    XML_COMBINED_VERSION to 2.8.0.  alt-python36's bundled libexpat 2.4.1
    (patched by CVE-2026-41080.patch) and any distro libexpat that
    backports the XML_SetHashSalt16Bytes entropy fix into an older
    branch are now detected at load time, not at compile time.
    - debian/patches/CVE-2026-7210.patch: rewritten.  Drops the
      compile-time "XML_COMBINED_VERSION >= 20800 || defined
      (XML_HAS_HASHSALT16BYTES_BACKPORT)" conditional and instead
      declares XML_SetHashSalt16Bytes as __attribute__((weak)) at
      the top of Modules/pyexpat.c.  The pyexpat parser init code,
      the pyexpat C-API capsule initialization, and _elementtree.c
      now all do a single runtime "if (... != NULL)" check on the
      symbol's address.  Result:
        - RPM / Debian builds: bundled libexpat 2.4.1 with the
          matching CVE-2026-41080 backport exposes the symbol, weak
          resolution finds it, 16-byte salt path is taken -- same
          mitigation as before, no regression.
        - Alpine builds: --with-system-expat links the system
          libexpat at load time.  If the system libexpat has the
          entropy fix (upstream 2.8.0+, or a distro backport into
          2.7.x), the weak symbol resolves to the real function and
          the 16-byte path activates without needing to rebuild
          alt-python36.  If not, the legacy 8-byte XML_SetHashSalt
          path is used, exactly as before this patch -- no behavior
          regression and the package becomes self-healing the moment
          Alpine ships a libexpat with the fix.
    - debian/patches/CVE-2026-41080.patch: unchanged.  The
      XML_HAS_HASHSALT16BYTES_BACKPORT feature-test macro it defines
      is no longer consumed by CVE-2026-7210.patch (the weak symbol
      replaces it), but the macro is kept as a stable signal.
    - CVE-2026-7210

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse accepted bracketed
    hosts that were not valid IPv6 / IPvFuture, enabling SSRF and
    parser-differential attacks.
    - debian/patches/CVE-2024-11168.patch: backport of cpython
      29f348e2 (gh-103848). Adds _check_bracketed_host and wires it
      into urlsplit(). Also backports cpython 5a88d50 (bpo-43882) to
      remove the 3.6-only urlsplit() "http" fast-path so http:// URLs
      flow through the validated code path; without it the bracketed-
      host check is bypassed for http://, which is the scheme targeted
      by both CVE-2024-11168 and CVE-2025-0938.
    - CVE-2024-11168

  * SECURITY UPDATE: bundled libexpat 2.4.1 crashes in XML_ResumeParser
    when XML_StopParser is called on an unstarted parser (NULL deref).
    - debian/patches/CVE-2024-50602.patch: backport of the libexpat
      2.6.4 fix.  Adds XML_ERROR_NOT_STARTED and refuses to
      stop/suspend a parser in XML_INITIALIZED state in
      XML_StopParser, eliminating the precondition for the
      XML_ResumeParser NULL deref. Alpine builds use system expat
      (--with-system-expat + rm -r Modules/expat) so this hardening
      affects only the bundled-expat path used by RPM/Debian builds.
    - CVE-2024-50602

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse continued to accept
    domain names containing square brackets after the CVE-2024-11168 fix;
    follow-up that completes the validation.
    - debian/patches/CVE-2025-0938.patch: backport of cpython
      d89a5f6a (gh-105704). Disallows square brackets in domain names
      not delimiting an IPv6 / IPvFuture host.
    - CVE-2025-0938

  * SECURITY UPDATE: email address-list folding could unicode-encode the
    comma separator together with a folded line, causing the address
    header to be misinterpreted by some mail servers.
    - debian/patches/CVE-2025-1795.patch: backport of cpython gh-100884
      (Thomas Weißschuh). Marks ListSeparator with
      as_ew_allowed = False so the comma is never encoded-word-wrapped.
    - CVE-2025-1795

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 15:00:00 +0200

alt-python36 (3.6.15-34) stable; urgency=medium

  * SECURITY UPDATE: CVE-2026-7210 + CVE-2026-41080 (paired) — backport
    the libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled
    expat 2.4.1 and wire pyexpat/_elementtree to use it. Together these
    restore proper hash-flood mitigation for xml.parsers.expat and
    xml.etree.ElementTree.
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). Adds a new 16-byte
      _Py_HashSecret.expat.hashsalt16 slot in Include/pyhash.h
      (overlapping the existing padding), extends the PyExpat CAPI in
      Include/pyexpat.h with SetHashSalt16Bytes, and prefers the new
      API in Modules/pyexpat.c and Modules/_elementtree.c when built
      against libexpat exposing it; falls back to the legacy
      XML_SetHashSalt path otherwise. The two XML_COMBINED_VERSION
      gates are extended with `|| defined(XML_HAS_HASHSALT16BYTES_BACKPORT)`
      so the new code path activates against the bundled patched
      libexpat without bumping its advertised version, while
      --with-system-expat builds (Alpine) keep the upstream
      `>= 20800` semantics.
    - debian/patches/CVE-2026-41080.patch: backport of libexpat
      PR #1183. Widens the parser's internal hash salt from
      `unsigned long m_hash_secret_salt` to a full
      `struct sipkey m_hash_secret_salt_128` (+ an
      m_hash_secret_salt_set flag), adds the new
      XML_SetHashSalt16Bytes API and the matching
      XML_HAS_HASHSALT16BYTES_BACKPORT marker in expat.h, and namespaces
      the new symbol via pyexpatns.h. Applied to bundled
      Modules/expat/; on Alpine `prepare()` deletes Modules/expat
      after the patch, so the libexpat backport is a no-op there and
      the system libexpat decides whether the new API is available.
    - CVE-2026-7210
    - CVE-2026-41080

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 22 May 2026 10:00:00 +0200

alt-python36 (3.6.15-33) stable; urgency=medium

  * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose
    mediatype contained control characters, allowing newline-based HTTP
    header injection downstream.
    - debian/patches/CVE-2025-15282.patch: backport of cpython
      f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F]
      regex check in data_open() and a matching test_invalid_mediatype.
    - CVE-2025-15282

  * SECURITY UPDATE: http.cookies.Morsel did not reject control characters
    in keys / values / coded_value, allowing cookie injection via
    __setitem__, setdefault, set, and BaseCookie.output.
    - debian/patches/CVE-2026-0672.patch: backport of cpython
      95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character
      helper and inserts validation in __setitem__, setdefault, set,
      plus a wrap of BaseCookie.OutputString / output.
    - CVE-2026-0672

  * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control
    characters could still bypass via Morsel.update(), |=, __setstate__
    (pickle), and BaseCookie.js_output().
    - debian/patches/CVE-2026-3644.patch: backport of cpython
      57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds
      validation to Morsel.update(), defines explicit Morsel.__ior__
      (was inherited from dict and bypassed validation), validates
      __setstate__ before assigning attributes, and re-validates the
      assembled output string in js_output().
    - CVE-2026-3644

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RecursionError instead of crashing.
    - CVE-2026-4224

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 10:00:00 +0200

alt-python36 (3.6.15-32) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64_impl no longer breaks out on a pad
      sequence; a `pads` counter is added so post-loop validation still
      raises "Incorrect padding" for inputs that do not satisfy
      `quad_pos + pads == 4`. The unused `binascii_find_valid` helper
      is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python36 (3.6.15-31) stable; urgency=medium

  * SECURITY UPDATE: email BytesGenerator header injection
    - debian/patches/CVE-2026-1299.patch: verify generated headers in
      email.generator.BytesGenerator and Generator. Adds the
      HeaderWriteError exception, NEWLINE_WITHOUT_FWSP /
      NEWLINE_WITHOUT_FWSP_BYTES regexes, and the
      Policy.verify_generated_headers attribute, then raises
      HeaderWriteError when the folded header does not end with the
      policy linesep or contains a stray newline. Includes the
      CVE-2024-6923 prerequisite hardening of the string Generator.
    - CVE-2026-1299
  * SECURITY UPDATE: ssl.SSLContext memory race in cert_store_stats /
    get_ca_certs
    - debian/patches/CVE-2024-0397.patch: backport the upstream
      X509_STORE_get1_objects shim and the x509_object_dup helper
      from cpython 29c97287d205bf2f410f4895ebce3f43b5160524, then
      switch _ssl__SSLContext_cert_store_stats_impl and
      _ssl__SSLContext_get_ca_certs_impl to take a deep-copy snapshot
      of the X509_STORE under lock, freeing the snapshot before
      returning. Closes a use-after-free triggered by loading
      certificates concurrently from another thread.
    - CVE-2024-0397
  * SECURITY UPDATE: ipaddress is_private / is_global misclassification
    - debian/patches/CVE-2024-4032.patch: backport upstream
      gh-113171 / gh-65056. Update Lib/ipaddress.py to align the
      _private_networks lists with the IANA special-purpose registries
      and add _private_networks_exceptions so that
      is_private / is_global no longer misclassify addresses in
      192.0.0.0/24 (with 192.0.0.9 and 192.0.0.10 exceptions),
      64:ff9b:1::/48, 2002::/16, and the 2001::/23 sub-range
      exceptions (2001:1::1, 2001:1::2, 2001:3::/32, 2001:4:112::/48,
      2001:20::/28, 2001:30::/28). Includes the matching docs and
      test updates.
    - CVE-2024-4032

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:36:00 +0200

alt-python36 (3.6.15-30) stable; urgency=medium

  * SECURITY UPDATE: zipfile quoted-overlap zip bomb
    - debian/patches/CVE-2024-0450.patch: raise BadZipFile when an
      archive entry overlaps with another entry or the central
      directory, preventing quoted-overlap zip bombs with extreme
      compression ratios.
    - CVE-2024-0450
  * SECURITY UPDATE: use-after-free in lzma/bz2 decompressors
    - debian/patches/CVE-2026-6100.patch: null next_in at the error:
      label of decompress() in Modules/_bz2module.c and
      Modules/_lzmamodule.c so the decompressor cannot be re-used
      with a stale buffer pointer after a MemoryError.
    - CVE-2026-6100

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 12:00:00 +0200

alt-python36 (3.6.15-29) stable; urgency=medium

  * SECURITY UPDATE: command-line option injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject leading dashes in
      webbrowser.open() URLs to prevent command-line option injection
      in browser subprocesses
    - CVE-2026-4519

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 12:30:00 +0200

alt-python36 (3.6.15-28) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python36 (3.6.15-27) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in
      os.path.expandvars() by replacing the character-by-character loop
      with regex-based substitution in both posixpath and ntpath modules.
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 07:45:00 +0100

alt-python36 (3.6.15-26) stable; urgency=medium

  * ALTPYTH-586: Initial build for arm64

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Thu, 26 Feb 2026 17:00:00 +0400

alt-python36 (3.6.15-25) stable; urgency=medium

  * SECURITY UPDATE: Shell command injection in the mailcap module
    - debian/patches/CVE-2015-20107.patch: sanitize the second
      argument which allowing shell command injection
    - CVE-2015-20107

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Wed, 18 Feb 2026 17:10:11 +0100

alt-python36 (3.6.15-24) stable; urgency=medium

  * Exclude flaky timing-dependent tests on Debian 12/13
    (test_generators, test_pdb, test_regrtest)

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Wed, 18 Feb 2026 15:00:00 +0400

alt-python36 (3.6.15-23) stable; urgency=medium

  * SECURITY UPDATE: Memory denial of service in plistlib
    - debian/patches/CVE-2025-13837.patch: read large data by chunks,
      therefore the upper limit of consumed memory is proportional to the
      size of the input file.
    - CVE-2025-13837

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 12 Feb 2026 08:04:42 +0100

alt-python36 (3.6.15-22) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Mon, 09 Feb 2026 19:00:00 +0400

alt-python36 (3.6.15-21) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 08 Jan 2026 11:51:00 +0100

alt-python36 (3.6.15-20) stable; urgency=medium

  * SECURITY UPDATE: Ability to modify permissions with privileged programs
    - debian/patches/CVE-2023-6597: prevent tempfile.TemporaryDirectory
      class dereference symlinks
    - CVE-2023-6597

 -- Azat Nurgaliev <anurgaliev@cloudlinux.com>  Wed, 10 Dec 2025 15:54:02 +0200

alt-python36 (3.6.15-19) stable; urgency=medium

  * SECURITY UPDATE: Traversing outside chmod directory
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filters directory members
      before chmod/chown
    - CVE-2024-12718
  * SECURITY UPDATE: Symlink exfiltration
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: properly handles different link
      semantics
    - CVE-2025-4138
  * SECURITY UPDATE: Hardlink Fallback Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink
      extraction falls back to copying
    - CVE-2025-4330
  * SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: account errorlevel
    - CVE-2025-4435
  * SECURITY UPDATE: PATH_MAX Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow
      attacks
    - CVE-2025-4517
  * TEST UPDATE: Incorrect encoding leading to an unexpected
    exception in test_tarfile.py
    - debian/patch/fix_test_tarfile-enconding.patch: fix encoding

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Fri, 17 Oct 2025 18:20:02 +0100

alt-python36 (3.6.15-18) stable; urgency=medium

  * TESTS UPDATE: Rename bisect.by to bisect_cmd.py in tests to
    avoid conflicts with bisect module
    - debian/patches/bpo-35519.patch: rename test.bisect module to
      test.bisect_cmd to avoid conflict with bisect module when running
      directly a test like "./python Lib/test/test_xmlrpc.py"
  * TESTS UPDATE: Enabled build tests for debian 10, 11, 12, and 13

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Thu, 16 Oct 2025 18:20:02 +0100

alt-python36 (3.6.15-17) stable; urgency=medium

  * SECURITY UPDATE: Overwriting of arbitrary files by remote attackers
    - debian/patches/CVE-2007-4559.patch: implement PEP 706 - a filter in
      the tarfile module to prevent directory traversal vulnerability
    - CVE-2007-4559
  * SECURITY UPDATE: Bypass of domain e-mail-based protection mechanism by
    incorrect parsing of e-mail addresses that contain a special character
    - debian/patches/CVE-2023-27043.patch: reject malformed addresses in
      email.parseaddr()
    - CVE-2023-27043
  * SECURITY UPDATE: Bypass of the TLS handshake and included protections
    - debian/patches/CVE-2023-40217.patch: check for & avoid the ssl
      pre-close flaw
    - CVE-2023-40217

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Thu, 09 Oct 2025 11:09:00 +0100

alt-python36 (3.6.15-16) stable; urgency=medium

  * disable failing internal tests on ubuntu24

 -- Jai S <jsathyapalan@cloudlinux.com>  Tue, 07 Oct 2025 09:32:00 +0000

alt-python36 (3.6.15-15) stable; urgency=medium

  * Enable internal testing

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Fri, 26 Sep 2025 11:04:00 +0100

alt-python36 (3.6.15-14) stable; urgency=medium

  * SECURITY UPDATE: DOS, buffer overflow in SHA3, Possible Bypass Blocklisting
    Redirection vulnerability in http.server, regex DOS, Quadratic complexity,
    pathname quoting for venv
    - debian/patches/CVE-2022-37454.patch: fix a buffer overflow in
      Modules/_sha3/kcp/KeccakSponge.inc, Lib/test/test_hashlib.py
      (LP: #1995197).
    - debian/patches/CVE-2022-45061.patch: fix quadratic time idna decoding
      in Lib/encodings/idna.py, Lib/test/test_codecs.py.
    - debian/patches/CVE-2023-24329.patch: enforce
      that a scheme must begin with an alphabetical ASCII character
      in Lib/urllib/parse.py, Lib/test/test_urlparse.py.
      start stripping C0 control and space chars in `urlsplit`
    - debian/patches/CVE-2021-28861.patch: Fix an open
      redirection vulnerability in the `http.server` module
      when an URI path starts with `//`
    - debian/patches/CVE-2024-6232.patch: Fix header parsing vulnerability that
      could lead to ReDoS
    - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in parsing
      "-quoted cookie values with backslashes
    - debian/patches/CVE-2024-9287.patch: Quote template strings in `venv` activation
    - CVE-2022-37454
    - CVE-2022-45061
    - CVE-2023-24329
    - CVE-2021-28861
    - CVE-2024-6232
    - CVE-2024-7592
    - CVE-2024-9287

 -- Jai S <jsathyapalan@cloudlinux.com>  Thu, 18 Sep 2025 13:57:38 +0000

alt-python36 (3.6.15-13) stable; urgency=medium

  * SECURITY UPDATE: Misleading information
    - debian/patches/CVE-2019-17514.patch: explain that the orderness of the
      of the result is system-dependant in Doc/library/glob.rst.
    - CVE-2019-17514

 -- Jai S <jsathyapalan@cloudlinux.com>  Tue, 26 Aug 2025 05:52:43 +0000

alt-python36 (3.6.15-12) stable; urgency=medium

  * Bootstrap for Debian 13

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Mon, 08 Sep 2025 20:00:00 +0300

alt-python36 (3.6.15-11) stable; urgency=medium

  * SECURITY UPDATE: Denial of service via a ZIP bomb
    - debian/patches/CVE-2019-9674.patch: add pitfalls to zipfile module
      documentation
    - CVE-2019-9674

 -- Koba Karaputadze <kkaraputadze@cloudlinux.com>  Fri, 22 Aug 2025 20:49:00 +0100

alt-python36 (3.6.15-10) stable; urgency=medium

  * ALTPYTH-560: initial build.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 23 Jul 2025 13:20:00 +0300

