alt-python310 (3.10.21-3) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a custom extraction filter that skips a
    member on the hard-link fallback path
    - debian/patches/CVE-2026-87910.patch: keep the result of the first
      filter_function() call in makelink_with_filter() and return when it is
      None. When extracting a hard link falls back to extracting the target
      member under the link's own name, the CVE-2026-11940 guard re-runs the
      filter with that substituted name, but only an exception was acted
      upon. A PEP 706 custom filter signals "skip this member" by returning
      None rather than raising, so such a filter was silently ignored on this
      path and the member was extracted anyway, under the very name the
      filter had just refused. Also carries upstream's
      test_extract_filters_target_none regression test and the matching
      adjustment to test_sneaky_hardlink_fallback. The guard being repaired
      is native to the shipped upstream micro 3.10.21, not a patch of ours
    - CVE-2026-87910
  * SECURITY UPDATE: tarfile tar/data filters created directories outside the
    destination for a member name that leaves it and returns
    - debian/patches/CVE-2026-19672.patch: normalise a member name containing
      a ".." component in _get_filtered_attrs() before the containment check.
      The check looks at the resolved path, which stays inside the
      destination for a name such as "../evil/../dest/sub/file", while the
      intermediate directories are created from the name as given, so "evil"
      was created as a sibling of the destination directory. POSIX only. Also
      carries upstream's test_parent_dir_out_and_back regression test, as
      merged. Backported from upstream commit 97688346 (gh-155999, GH-156000).
      Behaviour change: the "tar" and "data" filters now rewrite such a
      member name with os.path.normpath(), which drops internal ".."
      components and so may change the meaning of a name that traverses
      symbolic links.
      Upstream carries this on 3.12 and newer only; the backport pull request
      for 3.10 is still open, so this is ahead of upstream
    - CVE-2026-19672

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 12:00:00 +0000

alt-python310 (3.10.21-2) stable; urgency=medium

  * SECURITY UPDATE: tarfile data/tar extraction filter bypassed by a hard
    link whose target is a symlink
    - debian/patches/CVE-2026-82049.patch: pass os.path.realpath() of the
      hard-link source to os.link() in makelink_with_filter(), so the
      extracted name is a hard link to the file the symlink resolves to
      instead of a second name for the symlink inode itself. link(2) does
      not follow symlinks, so without this a crafted archive could place a
      copy of an already-extracted symlink one directory shallower, where
      its relative payload re-bases outside the destination directory and
      the chmod/utime that follow change the mode and mtime of the outside
      file while exposing its contents inside the extracted tree (CWE-59).
      Also carries upstream's test_sneaky_hardlink_relocation regression
      test. This fix is effective only in combination with CVE-2026-11940,
      which is already part of upstream 3.10.21 and blocks the variant that
      never reaches os.link()
    - CVE-2026-82049

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 08:40:00 +0000

alt-python310 (3.10.21-1) stable; urgency=medium

  * ALTPYTH-616: Update to 3.10.21
  * Drop CVE backports included in upstream 3.10.21: CVE-2026-3644,
    CVE-2026-4224, CVE-2026-4519, CVE-2026-4786, CVE-2026-6100,
    CVE-2026-9669, CVE-2026-41080, CVE-2026-15308, CVE-2025-13462,
    CVE-2026-8328, CVE-2026-7774, CVE-2026-1502, CVE-2026-3276,
    CVE-2026-0864, CVE-2026-11972, CVE-2026-11940, CVE-2026-6879
  * debian/patches/CVE-2026-7210.patch: re-anchor the Include/pyexpat.h hunk
    onto the 3.10.21 PyExpat_CAPI layout, which inserted the
    SetBillionLaughsAttackProtection* members before the end-of-struct
    sentinel, so the patch applies with --fuzz=0 instead of relying on the
    builder's --fuzz=2. No functional change: the new SetHashSalt16Bytes
    member still lands last in the struct
    (the expat >= 2.4.0 runtime requirement added on the RPM side is not
    needed here -- Debian/Ubuntu builds use --without-system-expat)

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 20 Aug 2026 12:20:12 +0400

alt-python310 (3.10.20-11) stable; urgency=medium

  * SECURITY UPDATE: quadratic complexity in xml.etree XPath index
    predicates
    - debian/patches/CVE-2026-6879.patch: cache the indexed sibling lookup
      in the ElementPath predicate selector so Element.findall() and a
      fully-consumed Element.iterfind() with an XPath index predicate call
      parent.findall() once per parent/tag pair instead of once per matching
      sibling, removing the O(n^2) CPU DoS on documents with many same-tag
      siblings
    - CVE-2026-6879

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 11 Aug 2026 02:46:16 -0400

alt-python310 (3.10.20-10) stable; urgency=medium

  * SECURITY UPDATE: excess base64 data ignored after the first padded quad
    - debian/patches/CVE-2026-3446.patch: treat the pad character as
      non-alphabet data in binascii.a2b_base64() as permitted by RFC 4648
      section 3.3, so decoding continues to the end of the input instead of
      silently dropping everything that follows the first padded quad
    - CVE-2026-3446
  * SECURITY UPDATE: symlink escape via the tarfile hardlink-extraction
    fallback
    - debian/patches/CVE-2026-11940.patch: revalidate the link with the
      hardlink's own shallower name in makelink_with_filter() so a crafted
      archive whose hardlink references a symlink stored at a deeper path
      cannot recreate a relative target that escapes the destination
      directory (incomplete fix of CVE-2025-4330), and pass the extraction
      filter from extract() down to _extract_one() so the revalidation runs
      for single-member extraction as well and not only for extractall()
    - CVE-2026-11940
  * SECURITY UPDATE: script-element breakout in http.cookies
    Morsel.js_output()
    - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value
      with urllib.parse.quote() and wrap it in decodeURIComponent() in the
      generated inline <script> snippet so an attacker-controlled value
      containing </script> or other HTML parser-sensitive sequences cannot
      escape the script element, while non-latin-1 values still reach the
      browser as UTF-8
    - CVE-2026-6019

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Mon, 27 Jul 2026 10:45:27 +0000

alt-python310 (3.10.20-9) stable; urgency=medium

  * SECURITY UPDATE: quadratic-complexity CPU DoS in unicodedata.normalize()
    - debian/patches/CVE-2026-3276.patch: replace the O(n^2) adjacent-swap
      canonical ordering in nfd_nfkd() with a hybrid insertion/counting
      sort so specially crafted input with long runs of combining
      characters cannot consume excessive CPU
    - CVE-2026-3276
  * SECURITY UPDATE: key and value injection via carriage returns in
    configparser writes
    - debian/patches/CVE-2026-0864.patch: normalize CR, CRLF and LF line
      endings to '\n\t' when writing multi-line values in configparser so
      attacker-controlled '\r' cannot inject unexpected keys and values
      into the written file
    - CVE-2026-0864
  * SECURITY UPDATE: CPU DoS in tarfile streaming-mode archive parsing
    - debian/patches/CVE-2026-11972.patch: break at EOF in
      tarfile._Stream.seek() so parsing a crafted or truncated archive
      opened in streaming mode (mode="r|") cannot take exponentially longer
    - CVE-2026-11972

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 16:03:14 +0000

alt-python310 (3.10.20-8) stable; urgency=medium

  * SECURITY UPDATE: standard-alphabet characters accepted by base64
    alternative-alphabet decoding
    - debian/patches/CVE-2025-12781.patch: emit a DeprecationWarning
      (validate=True) or FutureWarning (validate=False) when b64decode()
      or urlsafe_b64decode() accept '+' or '/' characters that are not
      part of the alternative alphabet, and raise ValueError instead of
      a debug-only assert for altchars of invalid length
    - CVE-2025-12781
  * SECURITY UPDATE: CR/LF injection in HTTP proxy CONNECT tunnel
    - debian/patches/CVE-2026-1502.patch: reject control characters in the
      tunnel host and validate tunnel request header names and values in
      http.client HTTPConnection._tunnel() to prevent request smuggling
    - CVE-2026-1502

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 14:54:38 +0000

alt-python310 (3.10.20-7) stable; urgency=medium

  * SECURITY UPDATE: SSRF via server-supplied PASV address in ftplib.ftpcp()
    - debian/patches/CVE-2026-8328.patch: use the source server's peer
      address instead of its self-reported PASV address, as makepasv()
      already does since the CVE-2021-4189 fix
    - CVE-2026-8328
  * SECURITY UPDATE: tarfile data extraction filter bypass via crafted links
    - debian/patches/CVE-2026-7774.patch: validate the normalized link
      target actually written to disk, resolve symlink targets against the
      stripped member name, and reject link members that resolve to the
      destination directory itself
    - CVE-2026-7774

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 14:05:45 +0000

alt-python310 (3.10.20-6) stable; urgency=medium

  * SECURITY UPDATE: email address-list folding no longer RFC 2047-encodes the comma list separator (header spoofing)
    - debian/patches/CVE-2025-1795.patch: email address-list folding no longer RFC 2047-encodes the comma list separator (header spoofing)
    - CVE-2025-1795
  * SECURITY UPDATE: tarfile no longer normalizes AREGTYPE to DIRTYPE while parsing GNU long-name/long-link multi-block members
    - debian/patches/CVE-2025-13462.patch: tarfile no longer normalizes AREGTYPE to DIRTYPE while parsing GNU long-name/long-link multi-block members
    - CVE-2025-13462

 -- Viktor Borzov <vborzov@cloudlinux.com>  Fri, 24 Jul 2026 09:01:41 -0400

alt-python310 (3.10.20-5) stable; urgency=medium

  * SECURITY UPDATE: quadratic-complexity CPU denial of service in html.parser
    - debian/patches/CVE-2026-15308.patch: accumulate incremental feed() data
      to avoid re-scanning/concatenating unterminated constructs quadratically
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 22 Jul 2026 09:00:00 +0000

alt-python310 (3.10.20-4) stable; urgency=medium

  * SECURITY UPDATE: webbrowser argument injection via action-token substitution
    - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519)
    - CVE-2026-4786
  * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError
    - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path
    - CVE-2026-6100
  * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection
    - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy
    - CVE-2026-7210
  * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection
    - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds
    - CVE-2026-41080
  * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error
    - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:11 +0000

alt-python310 (3.10.20-3) stable; urgency=medium

  * SECURITY UPDATE: reject control characters in imaplib IMAP4 commands
    - debian/patches/CVE-2025-15366.patch: guard IMAP4._command()
    - CVE-2025-15366
  * SECURITY UPDATE: reject control characters in poplib POP3 commands
    - debian/patches/CVE-2025-15367.patch: guard POP3._putcmd()
    - CVE-2025-15367
  * SECURITY UPDATE: control-character injection via http.cookies paths
    - debian/patches/CVE-2026-3644.patch: guard Morsel.update()/|=/unpickle/js_output
    - CVE-2026-3644
  * SECURITY UPDATE: uncontrolled recursion in pyexpat content model
    - debian/patches/CVE-2026-4224.patch: recursion guard in conv_content_model()
    - CVE-2026-4224
  * SECURITY UPDATE: webbrowser argument injection via leading-dash URL
    - debian/patches/CVE-2026-4519.patch: reject URLs starting with '-'
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:11 +0000

alt-python310 (3.10.20-2) stable; urgency=medium

  * ELS-2239: Build alt-python310 packages on Ubuntu 18.04/22.04 arm64

 -- Juan-Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 15 Jul 2026 00:00:00 +0000

alt-python310 (3.10.20-1) stable; urgency=medium

  * ALTPYTH-592: Update to 3.10.20 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 07 Apr 2026 00:00:00 +0000

alt-python310 (3.10.19-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python310 (3.10.19-1) stable; urgency=medium

  * ALTPTYH-584: Update to 3.10.19 version

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Tue, 09 Dec 2025 18:41:00 +0000

alt-python310 (3.10.18-1) stable; urgency=medium

  * ALTPYTH-557: Update to 3.10.18 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:23:18 +0000

alt-python310 (3.10.17-1) stable; urgency=medium

  * ALTPYTH-552: Update to 3.10.17 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:51 +0000

alt-python310 (3.10.16-1) stable; urgency=medium

  * ALTPYTH-542: Update to 3.10.16 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:23:48 +0000

alt-python310 (3.10.15-1) stable; urgency=medium

  * Update to 3.10.15 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 06:23:35 +0000

alt-python310 (3.10.14-3) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200   

alt-python310 (3.10.14-2) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200 

alt-python310 (3.10.14-1) stable; urgency=medium

  * ALTPYTH-512: Update to 3.10.14 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 20 Mar 2024 00:23:09 +0000

alt-python310 (3.10.13-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * ALTPYTH-486: update to 3.10.12
  * ALTPYTH-481: Updated to 3.10.13

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python310 (3.10.9-1) stable; urgency=medium

  * update to 3.10.9

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Jan 2023 17:00:00 +0200

alt-python310 (3.10.8-1) stable; urgency=medium

  * update to 3.10.8
  * ALTPYTH-443: CL9 compatibility

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 21 Oct 2022 17:08:00 +0200

alt-python310 (3.10.4-1) stable; urgency=medium

  * ALTPYTH-422: fix for ensurepip
  * update to 3.10.4

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 06 Apr 2022 10:08:00 +0200

alt-python310 (3.10.2-1) stable; urgency=medium

  * update to 3.10.2

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 28 Jan 2022 16:22:00 +0300

alt-python310 (3.10.1-1) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 14 Dec 2021 11:28:00 +0300
