alt-python37 (3.7.17-26) stable; urgency=medium

  * SECURITY UPDATE: html.parser.HTMLParser was vulnerable to a
    quadratic-complexity CPU denial of service.  Feeding an unterminated
    markup construct (e.g. a tag or comment) in many small chunks made
    feed() re-scan and re-concatenate the growing unparsed buffer on
    every call, which is quadratic in the input size.
    - debian/patches/CVE-2026-15308.patch: backport of cpython
      bcf98ddb (gh-153030).  Accumulates incoming data in a list and
      only joins/parses it once enough has piled up, flushing any
      pending data in close().
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 12:00:00 +0200

alt-python37 (3.7.17-25) stable; urgency=medium

  * SECURITY UPDATE: reusing a bz2.BZ2Decompressor after libbz2 reported
    a decompression error could re-enter BZ2_bzDecompress() with
    inconsistent internal state, leading to a stack buffer overflow.
    - debian/patches/CVE-2026-9669.patch: backport of cpython
      5755d0f0 (gh-150599).  Records the libbz2 error code on the
      decompressor and clears needs_input, then refuses further
      decompress() calls with ValueError so libbz2 is never re-entered
      after an error.
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 23 Jun 2026 12:00:00 +0200

alt-python37 (3.7.17-24) stable; urgency=medium

  * SECURITY UPDATE: imaplib.IMAP4._command() did not reject control
    characters in command arguments, so a CR/LF embedded in an argument
    could inject a second IMAP command.
    - debian/patches/CVE-2025-15366.patch: backport of cpython
      6262704b (gh-143921).  Adds the _control_chars regex and rejects
      arguments containing bytes in [\x00-\x1F\x7F] in _command() with
      ValueError.
    - CVE-2025-15366

  * SECURITY UPDATE: poplib.POP3._putcmd() did not reject control
    characters, allowing the same CR/LF command injection on the POP3
    socket.
    - debian/patches/CVE-2025-15367.patch: backport of cpython
      b234a2b6 (gh-143923).  Rejects lines containing bytes in
      [\x00-\x1F\x7F] in _putcmd() with ValueError.
    - CVE-2025-15367

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 08 Jun 2026 12:00:00 +0200

alt-python37 (3.7.17-23) stable; urgency=medium

  * SECURITY UPDATE: base64.b64decode / urlsafe_b64decode silently
    accepted the '+/' alphabet regardless of altchars.
    - debian/patches/CVE-2025-12781.patch: backport of cpython 3.x
      9060b4ab (gh-125346) - deprecation-only fix that emits a
      DeprecationWarning / FutureWarning when '+' / '/' appear in
      input outside the configured alphabet.  Behavior is unchanged,
      matching upstream's deprecation intent.
    - CVE-2025-12781

  * SECURITY UPDATE: wsgiref.headers.Headers did not reject control
    characters in header names / values.
    - debian/patches/CVE-2026-0865.patch: combined backport of cpython
      22e4d552 (gh-143916, the initial fix that adds a control-char
      regex check in _convert_string_type) and follow-up 83ecd187
      (gh-144762, "Allow HTAB in wsgiref header values" per RFC 9110
      Section 5.5).  Splits the regex into _name_disallowed_re and
      _value_disallowed_re, threads a keyword-only `name` parameter
      through _convert_string_type, and updates every caller to pass
      name=True or name=False.  HTAB is now allowed in header values
      but still rejected in header names; LF / CR / DEL remain
      rejected in both.
    - CVE-2026-0865

  * SECURITY UPDATE: http.client did not reject CR/LF in HTTPConnection
    CONNECT tunnel host / headers, enabling request injection.
    - debian/patches/CVE-2026-1502.patch: backport of cpython
      05ed7ce7 (gh-146211).  Validates the tunnel host and each
      tunnel header name / value via _is_legal_header_name /
      _is_illegal_header_value before sending.
    - CVE-2026-1502

  * SECURITY UPDATE: http.cookies.Morsel.js_output() emitted an inline
    <script> snippet that only escaped " and left </script> intact.
    - debian/patches/CVE-2026-6019.patch: backport of cpython
      f795e042 (gh-90309).  Base64-encodes the cookie value and emits
      a self-decoding JavaScript stub instead of an unescaped string
      literal.  Builds on top of the CVE-2026-3644 control-character
      validation that the repo already carries.
    - CVE-2026-6019

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 18:00:00 +0200

alt-python37 (3.7.17-22) stable; urgency=medium

  * SECURITY UPDATE: email address-list folding could unicode-encode the
    comma separator together with a folded line.
    - debian/patches/CVE-2025-1795.patch: combined backport of cpython
      9148b77e (gh-100884, the original fix that marks ListSeparator
      with as_ew_allowed = False) and the upstream regression fix
      4762b36540 (gh-118643).  The original fix introduced two issues
      in _refold_parse_tree(): (a) when want_encoding=True met a
      ListSeparator, the `part.syntactic_break` branch called
      `part.fold()` on a Terminal which has no fold() method ->
      AttributeError; (b) even after the fall-through, the inner
      else-branch still called _fold_as_ew() on the Terminal,
      re-encoding the comma -- the very behaviour gh-100884 set out
      to suppress.  gh-118643 closes both: adds
      ListSeparator.syntactic_break = False, and restructures the
      inner if/else into `elif part.as_ew_allowed` (do encode) vs
      `else` (keep non-encoded, fall through).
    - CVE-2025-1795

  * SECURITY UPDATE: html.parser.HTMLParser had worst-case quadratic
    complexity on crafted malformed input, enabling amplified DoS.
    - debian/patches/CVE-2025-6069.patch: backport of cpython 3.9
      6eb6c5db (gh-135462).  Adds endtagopen regex and rewrites the
      EOF handling in goahead() per HTML5 spec.
    - CVE-2025-6069

  * SECURITY UPDATE: zipfile did not validate the ZIP64 EOCD locator
    offset, blindly seeking to the previous record.
    - debian/patches/CVE-2025-8291.patch: backport of cpython 3.9
      76437ac (gh-139700).  Adds reloff > offset guard in
      _EndRecData64.
    - CVE-2025-8291

  * SECURITY UPDATE: folding a long email header comment of only
    unfoldable characters dropped the enclosing parentheses.
    - debian/patches/CVE-2025-11468.patch: backport of cpython 3.11
      e9970f07 (gh-143935).  Adds make_parenthesis_pairs helper and
      teaches _refold_parse_tree to escape comment tokens.
    - CVE-2025-11468

  * SECURITY UPDATE: tarfile applied AREGTYPE -> DIRTYPE normalization
    even during multi-block GNU long members (LONGNAME / LONGLINK).
    - debian/patches/CVE-2025-13462.patch: backport of cpython 3.13
      ae99fe3 (gh-141707).  Threads a dircheck flag through
      frombuf / fromtarfile so normalization is skipped on follow-up
      headers.
    - CVE-2025-13462

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 17:30:00 +0200

alt-python37 (3.7.17-21) stable; urgency=medium

  * SECURITY UPDATE: rework the CVE-2026-7210 fix so the
    XML_SetHashSalt16Bytes code path is no longer inert when the linked
    libexpat does not bump XML_COMBINED_VERSION to 2.8.0 (Alpine system
    libexpat).
    - debian/patches/CVE-2026-7210.patch: rewritten.  Declares
      XML_SetHashSalt16Bytes as __attribute__((weak)) at the top of
      Modules/pyexpat.c and replaces the compile-time
      XML_COMBINED_VERSION / XML_HAS_SET_HASH_SALT_16_BYTES gate with a
      single runtime "if (... != NULL)" check at every call site
      (newxmlparseobject in pyexpat.c, the pyexpat C-API capsule init,
      and _elementtree.c).  RPM / Debian builds keep 16-byte mitigation
      via bundled libexpat 2.5.0 + CVE-2026-41080; Alpine activates
      the 16-byte path automatically the moment the system libexpat
      ships the entropy fix; libexpat without the symbol falls back
      to the legacy 8-byte XML_SetHashSalt path (no regression).
    - CVE-2026-41080.patch is unchanged.
    - CVE-2026-7210

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse accepted bracketed
    hosts that were not valid IPv6 / IPvFuture, enabling SSRF and
    parser-differential attacks.
    - debian/patches/CVE-2024-11168.patch: backport of cpython 3.11
      b2171a2 (gh-103848, Seth Larson).
    - CVE-2024-11168

  * SECURITY UPDATE: bundled libexpat 2.5.0 crashes in XML_ResumeParser
    when XML_StopParser is called on an unstarted parser (NULL deref).
    - debian/patches/CVE-2024-50602.patch: backport of libexpat
      51c70190 (PR #915).  Alpine builds use system expat
      (--with-system-expat) so this hardening affects only the
      bundled-expat path used by RPM/Debian builds.
    - CVE-2024-50602

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse continued to accept
    domain names containing square brackets after the CVE-2024-11168
    fix; follow-up that completes the validation.
    - debian/patches/CVE-2025-0938.patch: backport of cpython 3.10
      b8b4b71 (gh-105704).
    - CVE-2025-0938

  * SECURITY UPDATE: bytes.decode("unicode_escape", errors="ignore" or
    "replace") could trigger a use-after-free when the error handler
    reallocated the input buffer.
    - debian/patches/CVE-2025-4516.patch: backport of cpython 3.9
      8d35fd1b (gh-129648, Serhiy Storchaka).  Captures the initial
      starts pointer and only stores *first_invalid_escape when
      starts == initial_starts.
    - CVE-2025-4516

  * SECURITY UPDATE: ftplib.ftpcp() was not updated when CVE-2021-4189
    was fixed; still passed raw server-supplied PASV host / port to
    target.sendport().
    - debian/patches/CVE-2026-8328.patch: backport of cpython
      eac4fe3b (gh-87451, PR #149648).  Applies the CVE-2021-4189
      hardening to ftpcp() using source.sock.getpeername()[0]
      unless trust_server_pasv_ipv4_address is set.
    - CVE-2026-8328

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 17:00:00 +0200

alt-python37 (3.7.17-20) stable; urgency=medium

  * SECURITY UPDATE: xml.parsers.expat and xml.etree.ElementTree used
    insufficient entropy (a single Py_hash_t) to seed Expat's
    hash-flooding protection, allowing a crafted XML document to
    trigger hash flooding (CWE-331). The CPython side and the
    libexpat side of the fix are paired -- the new XML_SetHashSalt16Bytes
    call sites are inert unless the linked libexpat exposes the
    16-byte salt API. Because alt-python37 statically links the
    bundled Modules/expat/ tree (libexpat 2.5.0), we backport both
    halves here.
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). Adds the
      XML_SetHashSalt16Bytes function pointer to the pyexpat CAPI and
      uses it with 16 bytes of entropy in pyexpat.c and
      _elementtree.c when the 16-byte salt API is available; falls
      back to legacy XML_SetHashSalt otherwise. The original upstream
      conditional only checks XML_COMBINED_VERSION >= 20800; we widen
      it to also activate when the feature-test macro
      XML_HAS_SET_HASH_SALT_16_BYTES is defined, which our bundled
      expat patch exposes (see CVE-2026-41080.patch). On builds that
      use system libexpat (--with-system-expat, e.g. Alpine), the
      macro is absent and the version check still applies normally.
    - debian/patches/CVE-2026-41080.patch: backport of libexpat
      PR #1183 (https://github.com/libexpat/libexpat/pull/1183),
      restricted to the C sources needed for the bundled static
      link (Modules/expat/expat.h, internal.h, xmlparse.c). Widens
      the per-parser salt storage to a full struct sipkey (128 bits)
      and adds XML_SetHashSalt16Bytes. Also defines the alt-python-
      specific feature-test macro XML_HAS_SET_HASH_SALT_16_BYTES so
      the CPython side can detect the backported API without bumping
      XML_COMBINED_VERSION (the bundled tree still reports 2.5.0).
      Together with CVE-2026-7210 this activates the 16-byte salt
      path inside pyexpat / xml.etree against the bundled expat,
      restoring proper hash-flood mitigation.
    - CVE-2026-7210
    - CVE-2026-41080

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 22 May 2026 10:00:00 +0200

alt-python37 (3.7.17-19) stable; urgency=medium

  * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose
    mediatype contained control characters, allowing newline-based HTTP
    header injection downstream.
    - debian/patches/CVE-2025-15282.patch: backport of cpython
      f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F]
      regex check in data_open() and a matching test_invalid_mediatype.
    - CVE-2025-15282

  * SECURITY UPDATE: http.cookies.Morsel did not reject control characters
    in keys / values / coded_value, allowing cookie injection via
    __setitem__, setdefault, set, and BaseCookie.output.
    - debian/patches/CVE-2026-0672.patch: backport of cpython
      95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character
      helper and inserts validation in __setitem__, setdefault, set,
      plus a wrap of BaseCookie.OutputString / output.
    - CVE-2026-0672

  * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control
    characters could still bypass via Morsel.update(), |=, __setstate__
    (pickle), and BaseCookie.js_output().
    - debian/patches/CVE-2026-3644.patch: backport of cpython
      57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds
      validation to Morsel.update(), defines explicit Morsel.__ior__
      (was inherited from dict and bypassed validation), validates
      __setstate__ before assigning attributes, and re-validates the
      assembled output string in js_output().
    - CVE-2026-3644

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RecursionError instead of crashing.
    - CVE-2026-4224

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 10:00:00 +0200

alt-python37 (3.7.17-18) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64_impl no longer breaks out on a pad
      sequence; a `pads` counter is added so post-loop validation still
      raises "Incorrect padding" / "Invalid base64-encoded string" for
      inputs that do not satisfy `quad_pos + pads == 4`. The unused
      `binascii_find_valid` helper is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python37 (3.7.17-17) stable; urgency=medium

  * SECURITY UPDATE: email BytesGenerator header injection
    - debian/patches/CVE-2026-1299.patch: combined backport of
      gh-121650 (CVE-2024-6923) and gh-144125 (CVE-2026-1299) that
      adds email.errors.HeaderWriteError, the
      policy.verify_generated_headers attribute, and the
      verify-on-write check for both Generator and BytesGenerator,
      preventing CRLF/LF header injection through custom fold().
    - CVE-2026-1299
  * SECURITY UPDATE: ssl.SSLContext memory race in cert_store_stats /
    get_ca_certs
    - debian/patches/CVE-2024-0397.patch: backport the
      X509_STORE_get1_objects shim and the x509_object_dup helper from
      cpython 3.8.20 (29c97287d2). The two affected impl functions in
      Modules/_ssl.c (cert_store_stats / get_ca_certs) now take a
      deep-copy snapshot of the X509_STORE under X509_STORE_lock(),
      preventing the use-after-free that occurred when certificates
      were loaded concurrently from another thread.
    - CVE-2024-0397
  * SECURITY UPDATE: ipaddress is_private/is_global misclassification
    - debian/patches/CVE-2024-4032.patch: backport cpython 3.8.20 fix
      895f7e2ac2 (gh-113171). Adds the
      _IPv4Constants._private_networks_exceptions list (192.0.0.9/32,
      192.0.0.10/32) and the IPv6 equivalents (2001:1::1/128,
      2001:1::2/128, 2001:3::/32, 2001:4:112::/48, 2001:20::/28,
      2001:30::/28). Expands 192.0.0.0/29 to /24, adds 64:ff9b:1::/48
      and 2002::/16 to the IPv6 _private_networks list, and updates
      is_private to filter against the exceptions list and use
      ipv4_mapped semantics on IPv6.
    - CVE-2024-4032

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 12:00:00 +0200

alt-python37 (3.7.17-16) stable; urgency=medium

  * SECURITY UPDATE: zipfile quoted-overlap zip bomb
    - debian/patches/CVE-2024-0450.patch: raise BadZipFile when an
      archive entry overlaps with another entry or the central
      directory, preventing quoted-overlap zip bombs with extreme
      compression ratios.
    - CVE-2024-0450
  * SECURITY UPDATE: use-after-free in lzma/bz2 decompressors
    - debian/patches/CVE-2026-6100.patch: null next_in at the error:
      label of decompress() in Modules/_bz2module.c and
      Modules/_lzmamodule.c so the decompressor cannot be re-used
      with a stale buffer pointer after a MemoryError.
    - CVE-2026-6100

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 12:05:00 +0200

alt-python37 (3.7.17-15) stable; urgency=medium

  * SECURITY UPDATE: Command-line option injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject leading dashes in
      webbrowser.open() URLs to prevent command-line option injection
      in browser subprocesses
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 12:20:00 +0200

alt-python37 (3.7.17-14) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python37 (3.7.17-13) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in
      os.path.expandvars() by replacing the character-by-character loop
      with regex-based substitution in both posixpath and ntpath modules.
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Mon, 23 Feb 2026 10:33:00 +0100

alt-python37 (3.7.17-12) stable; urgency=medium

  * ALTPYTH-586: Initial build for arm64

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Thu, 26 Feb 2026 17:00:00 +0400

alt-python37 (3.7.17-11) stable; urgency=medium

  * SECURITY UPDATE: Traversing outside chmod directory
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filters directory members
      before chmod/chown
    - CVE-2024-12718
  * SECURITY UPDATE: Symlink exfiltration
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: properly handles different link
      semantics
    - CVE-2025-4138
  * SECURITY UPDATE: Hardlink Fallback Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink
      extraction falls back to copying
    - CVE-2025-4330
  * SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: account errorlevel
    - CVE-2025-4435
  * SECURITY UPDATE: PATH_MAX Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow
      attacks
    - CVE-2025-4517

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Wed, 18 Feb 2026 08:11:00 +0100

alt-python37 (3.7.17-10) stable; urgency=medium

  * SECURITY UPDATE: Memory denial of service in plistlib
    - debian/patches/CVE-2025-13837.patch: read large data by chunks,
      therefore the upper limit of consumed memory is proportional to the
      size of the input file.
    - CVE-2025-13837

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 12 Feb 2026 08:04:42 +0100

alt-python37 (3.7.17-9) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Mon, 09 Feb 2026 19:00:00 +0400

alt-python37 (3.7.17-8) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084
  * SECURITY UPDATE: Overwriting of arbitrary files by remote attackers
    - debian/patches/CVE-2007-4559.patch: implement PEP 706 - a filter in
      the tarfile module to prevent directory traversal vulnerability
    - CVE-2007-4559

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 09 Jan 2026 11:35:00 +0100

alt-python37 (3.7.17-7) stable; urgency=medium

  * SECURITY UPDATE: Bypass of domain e-mail-based protection mechanism by
    incorrect parsing of e-mail addresses that contain a special character
    - debian/patches/CVE-2023-27043.patch: reject malformed addresses in
      email.parseaddr()
    - CVE-2023-27043
  * SECURITY UPDATE: Bypass of the TLS handshake and included protections
    - debian/patches/CVE-2023-40217.patch: check for & avoid the ssl
      pre-close flaw
    - CVE-2023-40217

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 15 Dec 2025 11:23:00 +0100

alt-python37 (3.7.17-6) stable; urgency=medium

  * SECURITY UPDATE: Ability to modify permissions with privileged programs
    - debian/patches/CVE-2023-6597.patch: prevent tempfile.TemporaryDirectory
      class dereference symlinks
    - CVE-2023-6597

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 15 Dec 2025 10:40:00 +0100

alt-python37 (3.7.17-5) stable; urgency=medium

  * SECURITY UPDATE: ReDoS in tarfile module when parsing specially
    crafted tar archive headers
    - debian/patches/CVE-2024-6232.patch: Remove backtracking from
      tarfile header parsing
  * SECURITY UPDATE: DoS due to quadratic time complexity in http.cookies
    module when parsing quoted cookie values with backslashes
    - debian/patches/CVE-2024-7592.patch: Replace iterative regex search
      with single-pass substitution to eliminate quadratic complexity
  * SECURITY UPDATE: Command injection vulnerability in venv module activation
    scripts when virtual environment paths contain special shell characters
    - debian/patches/CVE-2024-9287.patch: Properly quote template
      strings in venv activation scripts

 -- Azat Nurgaliev <anurgaliev@cloudlinux.com>  Mon, 17 Nov 2025 19:08:00 +0200

alt-python37 (3.7.17-4) stable; urgency=medium

  * ALTPYTH-574: Build alt-python37 for Debian12/13

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 14 Nov 2025 14:20:00 +0200

alt-python37 (3.7.17-3) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200

alt-python37 (3.7.17-2) stable; urgency=medium

  * ALTPYTH-504: Switched to use_rpm_wheels patch

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 26 Jan 2024 12:00:00 +0100

alt-python37 (3.7.17-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * Updated to 3.8.17

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python37 (3.7.16-1) stable; urgency=medium

  * update to 3.7.16

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Jan 2023 12:00:00 +0200

alt-python37 (3.7.15-1) stable; urgency=medium

  * update to 3.7.15

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 24 Oct 2022 12:00:00 +0200

alt-python37 (3.7.13-1) stable; urgency=medium

  * update to 3.7.13

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 01 Aug 2022 17:46:00 +0200

alt-python37 (3.7.12-2) stable; urgency=medium

  * ALTPYTH-407: call lve-stats/accelerate-wp scripts

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 06 May 2022 18:00:00 +0200

alt-python37 (3.7.12-1) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 01 Oct 2021 13:07:43 +0300

