alt-python38 (3.8.20-20) stable; urgency=medium

  * SECURITY UPDATE: imaplib.IMAP4._command() concatenated each argument
    into the wire command without validation, so an argument embedding
    CR/LF (or any other C0 control / DEL byte) could inject a second IMAP
    command.
    - debian/patches/CVE-2025-15366.patch: backport of cpython
      6262704b13 (gh-143921). Adds the _control_chars [\x00-\x1F\x7F]
      regex and raises ValueError in _command() before appending an
      offending argument.
    - CVE-2025-15366

  * SECURITY UPDATE: poplib.POP3._putcmd() wrote its argument to the POP3
    socket without validation, allowing the same CR/LF command-injection
    via the POP3 command API.
    - debian/patches/CVE-2025-15367.patch: backport of cpython
      b234a2b675 (gh-143923). Rejects lines matching [\x00-\x1F\x7F] with
      ValueError in _putcmd() before they are written.
    - CVE-2025-15367

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 08 Jun 2026 12:00:00 +0200

alt-python38 (3.8.20-19) stable; urgency=medium

  * SECURITY UPDATE: zipfile did not validate the ZIP64 End-of-Central-
    Directory Locator relative-offset, assuming the EOCD64 record sat
    immediately before the locator, allowing ambiguous-parsing ZIP
    archives (parser confusion vs. other ZIP tools).
    - debian/patches/CVE-2025-8291.patch: backport of cpython
      d11e69d620 (gh-139700, PSF-2025-12). Validates the locator offset
      and raises BadZipFile when it disagrees.
    - CVE-2025-8291

  * SECURITY UPDATE: tarfile applied the V7 AREGTYPE -> DIRTYPE
    normalization in frombuf() even when the header was a sub-block of
    a multi-block GNUTYPE_LONGNAME/LONGLINK member, causing parser
    confusion.
    - debian/patches/CVE-2025-13462.patch: backport of cpython
      42d754e34c (gh-141707). Skips the normalization on continuation
      blocks (dircheck=False on follow-up headers in _proc_gnulong and
      _proc_pax).
    - CVE-2025-13462

  * SECURITY UPDATE: wsgiref.headers.Headers did not reject control
    characters in header names/values, allowing HTTP header injection.
    - debian/patches/CVE-2026-0865.patch: backport of cpython
      22e4d55285 (gh-143916, initial reject of [\x00-\x1F\x7F] in
      _convert_string_type) plus follow-up 83ecd18779 (gh-144762,
      relax to allow HTAB \x09 in header values per RFC 9110). The
      merged patch splits the regex into _name_disallowed_re and
      _value_disallowed_re and threads a `name` keyword through
      _convert_string_type call sites.
    - CVE-2026-0865

  * SECURITY UPDATE: http.client.HTTPConnection did not sanitize CR/LF
    in the proxy CONNECT tunnel host or in set_tunnel() headers,
    enabling request/header splitting.
    - debian/patches/CVE-2026-1502.patch: backport of cpython
      b1cf901633 (gh-146211). Applies _is_legal_header_name/
      _is_illegal_header_value and control-char checks in
      _tunnel()/set_tunnel().
    - CVE-2026-1502

  * SECURITY UPDATE: http.cookies.Morsel.js_output() emitted the cookie
    value inside <script> ... </script> only escaping `"`, so a value
    containing </script> could break out of the script element (XSS).
    - debian/patches/CVE-2026-6019.patch: backport of cpython
      76b3923d68 (gh-90309). Base64-encodes the embedded cookie value;
      composes with the existing CVE-2026-3644 patch on the same
      function.
    - CVE-2026-6019

  * SECURITY UPDATE: ftplib.ftpcp() called parse227() directly and
    passed the attacker-controllable PASV host/port to target.sendport()
    (SSRF). The CVE-2021-4189 PASV fix had been applied to makepasv()
    but not ftpcp().
    - debian/patches/CVE-2026-8328.patch: backport of cpython
      eac4fe3b2c (gh-87451). Mirrors the getpeername() /
      trust_server_pasv_ipv4_address logic in ftpcp().
    - CVE-2026-8328

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 16:00:00 +0200

alt-python38 (3.8.20-18) stable; urgency=medium

  * SECURITY UPDATE: urllib.parse.urlsplit()/urlparse() did not validate
    that bracketed [...] hosts were valid IPv6 or IPvFuture, enabling
    SSRF-relevant differential parsing.
    - debian/patches/CVE-2024-11168.patch: backport of cpython
      29f348e232 (gh-103848, John James Utley). Adds _check_bracketed_host()
      and calls it from urlsplit(); also backports ipaddress.IPv6Address
      scope-id support (_split_scope_id) needed by the new check.
    - CVE-2024-11168

  * SECURITY UPDATE: follow-up to CVE-2024-11168; urlsplit()/urlparse()
    still accepted square brackets in non-IPv6 hostnames, enabling
    differential parsing across URL parsers.
    - debian/patches/CVE-2025-0938.patch: backport of cpython
      d89a5f6a6e (gh-105704, Seth Larson). Adds _check_bracketed_netloc()
      to reject brackets that don't enclose a valid IPv6/IPvFuture host.
    - CVE-2025-0938

  * SECURITY UPDATE: email._header_value_parser folded address-list
    separator commas through encoded-word, so the separating comma could
    be unicode-encoded and misinterpreted by mail servers.
    - debian/patches/CVE-2025-1795.patch: backport of cpython
      09fab93c3d (gh-100884) plus the bundled regression follow-up
      858b9e85fc (gh-118643) which fixes the AttributeError that
      gh-100884 introduced when re-folding long address lists. Sets
      ListSeparator.as_ew_allowed to False and routes the list-
      separator token through the named constant.
    - CVE-2025-1795

  * SECURITY UPDATE: when folding a long email-header comment composed
    of unfoldable characters, email._header_value_parser dropped the
    enclosing parenthesis (and could omit the required leading space),
    enabling header injection.
    - debian/patches/CVE-2025-11468.patch: backport of cpython
      61614a5e50 (gh-143935). Adds make_parenthesis_pairs() and a
      comment-folding branch in _refold_parse_tree() that re-emits
      parentheses around comment subparts.
    - CVE-2025-11468

  * SECURITY UPDATE: use-after-free in the unicode-escape decoder when
    an error handler ('ignore'/'replace') was used.
    - debian/patches/CVE-2025-4516.patch: backport of cpython
      0d5d68f707 (gh-133767, Serhiy Storchaka). Replaces the buffer
      pointer with an integer (first_invalid_escape_char) plus a
      starts==initial_starts guard; adds binary-compat wrappers
      _PyBytes_DecodeEscape2 and _PyUnicode_DecodeUnicodeEscapeInternal2.
    - CVE-2025-4516

  * SECURITY UPDATE: html.parser.HTMLParser had worst-case quadratic
    complexity on crafted malformed input (e.g. unterminated tags or
    comments at EOF), enabling amplified DoS.
    - debian/patches/CVE-2025-6069.patch: backport of cpython
      8d1b3dfa09 (gh-135462). Replaces the EOF-handling branch with
      starttagopen.match/endtagopen.match/bogus-comment handling.
    - CVE-2025-6069

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 14:00:00 +0200

alt-python38 (3.8.20-17) stable; urgency=medium

  * SECURITY UPDATE: xml.parsers.expat and xml.etree.ElementTree used
    insufficient entropy for the Expat hash-flooding salt (only the
    8-byte Py_hash_t field _Py_HashSecret.expat.hashsalt was passed
    to XML_SetHashSalt), allowing a crafted XML document to trigger
    hash flooding in Expat's internal hash tables. Full mitigation
    requires libexpat 2.8.0+ at runtime (or a distro-backported
    equivalent that exports XML_SetHashSalt16Bytes).
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). Adds a 16-byte
      hashsalt16 field to _Py_HashSecret.expat and prefers the new
      XML_SetHashSalt16Bytes API in both Modules/pyexpat.c
      (newxmlparseobject + capi export) and Modules/_elementtree.c
      (XMLParser.__init__); the legacy XML_SetHashSalt path is kept
      as fallback when the loaded libexpat does not export the new
      symbol. The symbol is declared __attribute__((weak)) in
      Modules/pyexpat.c so the same source path works whether the
      build links against bundled libexpat 2.8.0+ or a distro
      libexpat 2.5/2.7 that backports the entropy fix without
      bumping XML_COMBINED_VERSION (Debian, Ubuntu, RHEL/CL,
      Alpine).
    - CVE-2026-7210

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 11:18:00 +0200

alt-python38 (3.8.20-16) stable; urgency=medium

  * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose
    mediatype contained control characters, allowing newline-based HTTP
    header injection downstream.
    - debian/patches/CVE-2025-15282.patch: backport of cpython
      f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F]
      regex check in data_open() and a matching test_invalid_mediatype.
    - CVE-2025-15282

  * SECURITY UPDATE: http.cookies.Morsel did not reject control characters
    in keys / values / coded_value, allowing cookie injection via
    __setitem__, setdefault, set, and BaseCookie.output.
    - debian/patches/CVE-2026-0672.patch: backport of cpython
      95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character
      helper and inserts validation in __setitem__, setdefault, set,
      plus a wrap of BaseCookie.OutputString / output.
    - CVE-2026-0672

  * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control
    characters could still bypass via Morsel.update(), |=, __setstate__
    (pickle), and BaseCookie.js_output().
    - debian/patches/CVE-2026-3644.patch: backport of cpython
      57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds
      validation to Morsel.update(), defines explicit Morsel.__ior__
      (was inherited from dict and bypassed validation), validates
      __setstate__ before assigning attributes, and re-validates the
      assembled output string in js_output().
    - CVE-2026-3644

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RecursionError instead of crashing.
    - CVE-2026-4224

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 10:00:00 +0200

alt-python38 (3.8.20-15) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64_impl no longer breaks out on a pad
      sequence; a `pads` counter is added so post-loop validation still
      raises "Incorrect padding" / "Invalid base64-encoded string" for
      inputs that do not satisfy `quad_pos + pads == 4`. The unused
      `binascii_find_valid` helper is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python38 (3.8.20-14) stable; urgency=medium

  * SECURITY UPDATE: email.generator.BytesGenerator does not validate folded
    headers, allowing header injection via crafted Header subclasses
    - debian/patches/CVE-2026-1299.patch: extend verify_generated_headers
      check to BytesGenerator._write_headers() in Lib/email/generator.py
      so unsafely folded or delimited headers raise HeaderWriteError on
      as_bytes() too. Adds matching test coverage in
      Lib/test/test_email/test_generator.py and test_policy.py.
    - CVE-2026-1299

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:30:00 +0200

alt-python38 (3.8.20-13) stable; urgency=medium

  * SECURITY UPDATE: use-after-free in lzma/bz2/gzip decompressors
    - debian/patches/CVE-2026-6100.patch: null next_in at the error:
      label of decompress() in Modules/_bz2module.c and
      Modules/_lzmamodule.c so the decompressor cannot be re-used
      with a stale buffer pointer after a MemoryError.
    - CVE-2026-6100

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 12:00:00 +0200

alt-python38 (3.8.20-12) stable; urgency=medium

  * SECURITY UPDATE: webbrowser.open() allows command-line option injection
    via URLs with leading dashes
    - debian/patches/CVE-2026-4519.patch: reject leading dashes in
      webbrowser.open() URLs to prevent command-line option injection in
      browser subprocesses
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 12:20:00 +0200

alt-python38 (3.8.20-11) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python38 (3.8.20-10) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in
      os.path.expandvars() by replacing the character-by-character loop
      with regex-based substitution in both posixpath and ntpath modules.
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 26 Feb 2026 14:51:00 +0100

alt-python38 (3.8.20-9) stable; urgency=medium

  * ALTPYTH-586: Initial build for arm64

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Thu, 26 Feb 2026 17:00:00 +0400

alt-python38 (3.8.20-8) stable; urgency=medium

  * SECURITY UPDATE: Traversing outside chmod directory
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filters directory members
      before chmod/chown
    - CVE-2024-12718
  * SECURITY UPDATE: Symlink exfiltration
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: properly handles different link
      semantics
    - CVE-2025-4138
  * SECURITY UPDATE: Hardlink Fallback Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink
      extraction falls back to copying
    - CVE-2025-4330
  * SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: account errorlevel
    - CVE-2025-4435
  * SECURITY UPDATE: PATH_MAX Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow
      attacks
    - CVE-2025-4517

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Tue, 17 Feb 2026 11:21:00 +0100

alt-python38 (3.8.20-7) stable; urgency=medium

  * SECURITY UPDATE: Memory denial of service in plistlib
    - debian/patches/CVE-2025-13837.patch: read large data by chunks,
      therefore the upper limit of consumed memory is proportional to the
      size of the input file.
    - CVE-2025-13837

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 12 Feb 2026 08:04:42 +0100

alt-python38 (3.8.20-6) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Mon, 09 Feb 2026 19:00:00 +0400

alt-python38 (3.8.20-5) stable; urgency=medium

  * SECURITY UPDATE: Potential denial of service in http.client
    - debian/patches/CVE-2025-13836.patch: Read large data by
      chunks instead of allocating memory based on Content-Length
    - CVE-2025-13836
  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: Remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Mon, 12 Jan 2026 12:54:00 +0100

alt-python38 (3.8.20-4) stable; urgency=medium

  * SECURITY UPDATE: Command injection vulnerability in venv module activation
    scripts when virtual environment paths contain special shell characters
    - debian/patches/CVE-2024-9287.patch: Properly quote template
      strings in venv activation scripts

 -- Azat Nurgaliev <anurgaliev@cloudlinux.com>  Thu, 18 Nov 2025 10:22:00 +0200

alt-python38 (3.8.20-3) stable; urgency=medium

  * ALTPYTH-575: Build alt-python38 for Debian12/13

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Thu, 13 Nov 2025 14:20:00 +0200

alt-python38 (3.8.20-1) stable; urgency=medium

  * Update to 3.8.20 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 00:23:25 +0000

alt-python38 (3.8.19-3) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200  

alt-python38 (3.8.19-2) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200  

alt-python38 (3.8.19-1) stable; urgency=medium

  * ALTPYTH-511: Update to 3.8.19 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 19 Mar 2024 18:23:21 +0000

alt-python38 (3.8.18-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * ALTPYTH-485: Updated to 3.8.17
  * ALTPYTH-483: Updated to 3.8.18

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python38 (3.8.16-1) stable; urgency=medium

  * Updated to 3.8.16

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Jan 2023 11:48:00 +0200

alt-python38 (3.8.15-1) stable; urgency=medium

  * Updated to 3.8.15

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 24 Oct 2022 11:48:00 +0200

alt-python38 (3.8.13-1) stable; urgency=medium

  * ALTPYTH-438: Updated to 3.8.13, build fixes for bootstrap variant

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 15 Apr 2022 18:48:00 +0200

alt-python38 (3.8.12-2) stable; urgency=medium

  * ALTPYTH-413: move -fno-semantic-interposition to CFLAGS_NODIST

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 15 Apr 2022 18:48:00 +0200

alt-python38 (3.8.12-1) stable; urgency=medium

  * ALTPYTH-401: update to 3.8.12

 -- Sergey Fokin <sfokin@cloudlinux.com>  Wed, 02 Feb 2022 10:57:00 +0300

alt-python38 (3.8.6-9) stable; urgency=medium

  * ALTPYTH-358: Enable -fno-semantic-interposition flag

 -- Eduard Abdullin <eabdullin@cloudlinux.com>  Fri, 03 Sep 2021 13:55:56 +0300

alt-python38 (3.8.6-5) stable; urgency=medium

  * Fix site-packages and dist-packages

 -- Ivan Danilov <idanilov@cloudlinux.com>  Tue, 02 Feb 2021 22:22:22 +0300

alt-python38 (3.8.6-4) stable; urgency=medium

  * Fix permissions for base64.py

 -- Ivan Danilov <idanilov@cloudlinux.com>  Tue, 02 Feb 2021 22:22:22 +0300

alt-python38 (3.8.6-3) stable; urgency=medium

  * ALTPYTH-295: Build against alt-sqlite

 -- Ivan Danilov <idanilov@cloudlinux.com>  Tue, 26 Jan 2021 22:22:22 +0300

alt-python38 (3.8.6-2) stable; urgency=medium

  * ALTPYTH-321: Fix installation path

 -- Ivan Danilov <idanilov@cloudlinux.com>  Fri, 11 Dec 2020 22:22:22 +0300

alt-python38 (3.8.6-1) stable; urgency=medium

  * ALTPYTH-293: Update python to 3.8.6 version

 -- Eduard Abdullin <eabdullin@cloudlinux.com>  Fri, 20 Nov 2020 11:18:32 +0300

alt-python38 (3.8.1-5) stable; urgency=medium

  * Change wheel default directory for ensurepip

 -- Ivan Danilov <idanilov@cloudlinux.com>  Tue, 17 Nov 2020 22:22:22 +0300

alt-python38 (3.8.1-3) stable; urgency=medium

  * fix pyconfig.h
  * fix path to dist-packages

 -- Anatholy Scryabin <ascryabin@cloudlinux.com>  Mon, 07 Sep 2020 17:57:34 +0300

alt-python38 (3.8.1-2) stable; urgency=medium

  * initial build

 -- Anatholy Scryabin <ascryabin@cloudlinux.com>  Thu, 23 Jun 2020 19:01:21 +0300
