alt-python310 (3.10.22-1) stable; urgency=medium

  * ALTPYTH-624: Update to 3.10.22
  * Drop CVE backports included upstream

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Fri, 02 Oct 2026 14:00:00 +0400

alt-python310 (3.10.21-4) stable; urgency=medium

  * SECURITY UPDATE: urllib handed out HTTPS credentials for plain-HTTP URLs
    - debian/patches/CVE-2026-15806.patch: scope HTTPPasswordMgr credentials
      by URL scheme. reduce_uri() drops the scheme, so credentials registered
      for "https://host/" were also returned for "http://host/", and an
      attacker able to force an HTTPS to HTTP downgrade or redirect received
      them in cleartext. Adds _reduce_uri_with_scheme() and
      _is_suburi_with_scheme() and uses them in HTTPPasswordMgr and
      HTTPPasswordMgrWithPriorAuth. A URI registered without a scheme still
      matches any scheme, so proxy authentication is unchanged. Carries
      upstream's regression tests (gh-155694)
    - CVE-2026-15806
  * SECURITY UPDATE: stringprep case-folded characters that Unicode 3.2.0
    leaves alone
    - debian/patches/CVE-2026-17084.patch: map_table_b3() fell back to
      str.lower(), which uses the interpreter's own Unicode 13.0.0 data
      instead of the Unicode 3.2.0 data RFC 3454 mandates, so the idna codec
      folded e.g. Cherokee, Georgian Mtavruli and Cyrillic Palochka and could
      derive a different A-label for the same domain name. Regenerates
      Lib/stringprep.py so b3_exceptions pins every such codepoint to itself,
      and updates Tools/unicode/mkstringprep.py accordingly. The table was
      regenerated with this version's own interpreter (UCD 13.0.0), because
      the upstream table is specific to the Unicode version it was built
      with. Carries upstream's idna regression test (gh-155292)
    - CVE-2026-17084

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 24 Sep 2026 12:00:00 +0000

alt-python310 (3.10.21-3) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a custom extraction filter that skips a
    member on the hard-link fallback path
    - debian/patches/CVE-2026-87910.patch: keep the result of the first
      filter_function() call in makelink_with_filter() and return when it is
      None. When extracting a hard link falls back to extracting the target
      member under the link's own name, the CVE-2026-11940 guard re-runs the
      filter with that substituted name, but only an exception was acted
      upon. A PEP 706 custom filter signals "skip this member" by returning
      None rather than raising, so such a filter was silently ignored on this
      path and the member was extracted anyway, under the very name the
      filter had just refused. Also carries upstream's
      test_extract_filters_target_none regression test and the matching
      adjustment to test_sneaky_hardlink_fallback. The guard being repaired
      is native to the shipped upstream micro 3.10.21, not a patch of ours
    - CVE-2026-87910
  * SECURITY UPDATE: tarfile tar/data filters created directories outside the
    destination for a member name that leaves it and returns
    - debian/patches/CVE-2026-19672.patch: normalise a member name containing
      a ".." component in _get_filtered_attrs() before the containment check.
      The check looks at the resolved path, which stays inside the
      destination for a name such as "../evil/../dest/sub/file", while the
      intermediate directories are created from the name as given, so "evil"
      was created as a sibling of the destination directory. POSIX only. Also
      carries upstream's test_parent_dir_out_and_back regression test, as
      merged. Backported from upstream commit 97688346 (gh-155999, GH-156000).
      Behaviour change: the "tar" and "data" filters now rewrite such a
      member name with os.path.normpath(), which drops internal ".."
      components and so may change the meaning of a name that traverses
      symbolic links.
      Upstream carries this on 3.12 and newer only; the backport pull request
      for 3.10 is still open, so this is ahead of upstream
    - CVE-2026-19672

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 12:00:00 +0000

alt-python310 (3.10.21-2) stable; urgency=medium

  * SECURITY UPDATE: tarfile data/tar extraction filter bypassed by a hard
    link whose target is a symlink
    - debian/patches/CVE-2026-82049.patch: pass os.path.realpath() of the
      hard-link source to os.link() in makelink_with_filter(), so the
      extracted name is a hard link to the file the symlink resolves to
      instead of a second name for the symlink inode itself. link(2) does
      not follow symlinks, so without this a crafted archive could place a
      copy of an already-extracted symlink one directory shallower, where
      its relative payload re-bases outside the destination directory and
      the chmod/utime that follow change the mode and mtime of the outside
      file while exposing its contents inside the extracted tree (CWE-59).
      Also carries upstream's test_sneaky_hardlink_relocation regression
      test. This fix is effective only in combination with CVE-2026-11940,
      which is already part of upstream 3.10.21 and blocks the variant that
      never reaches os.link()
    - CVE-2026-82049

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 08:40:00 +0000

alt-python310 (3.10.21-1) stable; urgency=medium

  * ALTPYTH-616: Update to 3.10.21
  * Drop CVE backports included in upstream 3.10.21: CVE-2026-3644,
    CVE-2026-4224, CVE-2026-4519, CVE-2026-4786, CVE-2026-6100,
    CVE-2026-9669, CVE-2026-41080, CVE-2026-15308, CVE-2025-13462,
    CVE-2026-8328, CVE-2026-7774, CVE-2026-1502, CVE-2026-3276,
    CVE-2026-0864, CVE-2026-11972, CVE-2026-11940, CVE-2026-6879
  * debian/patches/CVE-2026-7210.patch: re-anchor the Include/pyexpat.h hunk
    onto the 3.10.21 PyExpat_CAPI layout, which inserted the
    SetBillionLaughsAttackProtection* members before the end-of-struct
    sentinel, so the patch applies with --fuzz=0 instead of relying on the
    builder's --fuzz=2. No functional change: the new SetHashSalt16Bytes
    member still lands last in the struct
    (the expat >= 2.4.0 runtime requirement added on the RPM side is not
    needed here -- Debian/Ubuntu builds use --without-system-expat)

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 20 Aug 2026 12:20:12 +0400

alt-python310 (3.10.20-11) stable; urgency=medium

  * SECURITY UPDATE: quadratic complexity in xml.etree XPath index
    predicates
    - debian/patches/CVE-2026-6879.patch: cache the indexed sibling lookup
      in the ElementPath predicate selector so Element.findall() and a
      fully-consumed Element.iterfind() with an XPath index predicate call
      parent.findall() once per parent/tag pair instead of once per matching
      sibling, removing the O(n^2) CPU DoS on documents with many same-tag
      siblings
    - CVE-2026-6879

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 11 Aug 2026 02:46:16 -0400

alt-python310 (3.10.20-10) stable; urgency=medium

  * SECURITY UPDATE: excess base64 data ignored after the first padded quad
    - debian/patches/CVE-2026-3446.patch: treat the pad character as
      non-alphabet data in binascii.a2b_base64() as permitted by RFC 4648
      section 3.3, so decoding continues to the end of the input instead of
      silently dropping everything that follows the first padded quad
    - CVE-2026-3446
  * SECURITY UPDATE: symlink escape via the tarfile hardlink-extraction
    fallback
    - debian/patches/CVE-2026-11940.patch: revalidate the link with the
      hardlink's own shallower name in makelink_with_filter() so a crafted
      archive whose hardlink references a symlink stored at a deeper path
      cannot recreate a relative target that escapes the destination
      directory (incomplete fix of CVE-2025-4330), and pass the extraction
      filter from extract() down to _extract_one() so the revalidation runs
      for single-member extraction as well and not only for extractall()
    - CVE-2026-11940
  * SECURITY UPDATE: script-element breakout in http.cookies
    Morsel.js_output()
    - debian/patches/CVE-2026-6019.patch: percent-encode the cookie value
      with urllib.parse.quote() and wrap it in decodeURIComponent() in the
      generated inline <script> snippet so an attacker-controlled value
      containing </script> or other HTML parser-sensitive sequences cannot
      escape the script element, while non-latin-1 values still reach the
      browser as UTF-8
    - CVE-2026-6019

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Mon, 27 Jul 2026 10:45:27 +0000

alt-python310 (3.10.20-9) stable; urgency=medium

  * SECURITY UPDATE: quadratic-complexity CPU DoS in unicodedata.normalize()
    - debian/patches/CVE-2026-3276.patch: replace the O(n^2) adjacent-swap
      canonical ordering in nfd_nfkd() with a hybrid insertion/counting
      sort so specially crafted input with long runs of combining
      characters cannot consume excessive CPU
    - CVE-2026-3276
  * SECURITY UPDATE: key and value injection via carriage returns in
    configparser writes
    - debian/patches/CVE-2026-0864.patch: normalize CR, CRLF and LF line
      endings to '\n\t' when writing multi-line values in configparser so
      attacker-controlled '\r' cannot inject unexpected keys and values
      into the written file
    - CVE-2026-0864
  * SECURITY UPDATE: CPU DoS in tarfile streaming-mode archive parsing
    - debian/patches/CVE-2026-11972.patch: break at EOF in
      tarfile._Stream.seek() so parsing a crafted or truncated archive
      opened in streaming mode (mode="r|") cannot take exponentially longer
    - CVE-2026-11972

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 16:03:14 +0000

alt-python310 (3.10.20-8) stable; urgency=medium

  * SECURITY UPDATE: standard-alphabet characters accepted by base64
    alternative-alphabet decoding
    - debian/patches/CVE-2025-12781.patch: emit a DeprecationWarning
      (validate=True) or FutureWarning (validate=False) when b64decode()
      or urlsafe_b64decode() accept '+' or '/' characters that are not
      part of the alternative alphabet, and raise ValueError instead of
      a debug-only assert for altchars of invalid length
    - CVE-2025-12781
  * SECURITY UPDATE: CR/LF injection in HTTP proxy CONNECT tunnel
    - debian/patches/CVE-2026-1502.patch: reject control characters in the
      tunnel host and validate tunnel request header names and values in
      http.client HTTPConnection._tunnel() to prevent request smuggling
    - CVE-2026-1502

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 14:54:38 +0000

alt-python310 (3.10.20-7) stable; urgency=medium

  * SECURITY UPDATE: SSRF via server-supplied PASV address in ftplib.ftpcp()
    - debian/patches/CVE-2026-8328.patch: use the source server's peer
      address instead of its self-reported PASV address, as makepasv()
      already does since the CVE-2021-4189 fix
    - CVE-2026-8328
  * SECURITY UPDATE: tarfile data extraction filter bypass via crafted links
    - debian/patches/CVE-2026-7774.patch: validate the normalized link
      target actually written to disk, resolve symlink targets against the
      stripped member name, and reject link members that resolve to the
      destination directory itself
    - CVE-2026-7774

 -- Arseniy Zolotarev <azolotarev@cloudlinux.com>  Fri, 24 Jul 2026 14:05:45 +0000

alt-python310 (3.10.20-6) stable; urgency=medium

  * SECURITY UPDATE: email address-list folding no longer RFC 2047-encodes the comma list separator (header spoofing)
    - debian/patches/CVE-2025-1795.patch: email address-list folding no longer RFC 2047-encodes the comma list separator (header spoofing)
    - CVE-2025-1795
  * SECURITY UPDATE: tarfile no longer normalizes AREGTYPE to DIRTYPE while parsing GNU long-name/long-link multi-block members
    - debian/patches/CVE-2025-13462.patch: tarfile no longer normalizes AREGTYPE to DIRTYPE while parsing GNU long-name/long-link multi-block members
    - CVE-2025-13462

 -- Viktor Borzov <vborzov@cloudlinux.com>  Fri, 24 Jul 2026 09:01:41 -0400

alt-python310 (3.10.20-5) stable; urgency=medium

  * SECURITY UPDATE: quadratic-complexity CPU denial of service in html.parser
    - debian/patches/CVE-2026-15308.patch: accumulate incremental feed() data
      to avoid re-scanning/concatenating unterminated constructs quadratically
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 22 Jul 2026 09:00:00 +0000

alt-python310 (3.10.20-4) stable; urgency=medium

  * SECURITY UPDATE: webbrowser argument injection via action-token substitution
    - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519)
    - CVE-2026-4786
  * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError
    - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path
    - CVE-2026-6100
  * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection
    - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy
    - CVE-2026-7210
  * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection
    - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds
    - CVE-2026-41080
  * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error
    - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:11 +0000

alt-python310 (3.10.20-3) stable; urgency=medium

  * SECURITY UPDATE: reject control characters in imaplib IMAP4 commands
    - debian/patches/CVE-2025-15366.patch: guard IMAP4._command()
    - CVE-2025-15366
  * SECURITY UPDATE: reject control characters in poplib POP3 commands
    - debian/patches/CVE-2025-15367.patch: guard POP3._putcmd()
    - CVE-2025-15367
  * SECURITY UPDATE: control-character injection via http.cookies paths
    - debian/patches/CVE-2026-3644.patch: guard Morsel.update()/|=/unpickle/js_output
    - CVE-2026-3644
  * SECURITY UPDATE: uncontrolled recursion in pyexpat content model
    - debian/patches/CVE-2026-4224.patch: recursion guard in conv_content_model()
    - CVE-2026-4224
  * SECURITY UPDATE: webbrowser argument injection via leading-dash URL
    - debian/patches/CVE-2026-4519.patch: reject URLs starting with '-'
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:11 +0000

alt-python310 (3.10.20-2) stable; urgency=medium

  * ELS-2239: Build alt-python310 packages on Ubuntu 18.04/22.04 arm64

 -- Juan-Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 15 Jul 2026 00:00:00 +0000

alt-python310 (3.10.20-1) stable; urgency=medium

  * ALTPYTH-592: Update to 3.10.20 version

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 07 Apr 2026 00:00:00 +0000

alt-python310 (3.10.19-2) stable; urgency=medium

  * ALTPYTH-595: Build alt-python packages for Debian 12 and 13 on ARM

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Fri, 27 Mar 2026 00:00:00 +0000

alt-python310 (3.10.19-1) stable; urgency=medium

  * ALTPTYH-584: Update to 3.10.19 version

 -- Huseyn Hajizada <hhajizada@cloudlinux.com>  Tue, 09 Dec 2025 18:41:00 +0000

alt-python310 (3.10.18-1) stable; urgency=medium

  * ALTPYTH-557: Update to 3.10.18 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:23:18 +0000

alt-python310 (3.10.17-1) stable; urgency=medium

  * ALTPYTH-552: Update to 3.10.17 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:23:51 +0000

alt-python310 (3.10.16-1) stable; urgency=medium

  * ALTPYTH-542: Update to 3.10.16 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:23:48 +0000

alt-python310 (3.10.15-1) stable; urgency=medium

  * Update to 3.10.15 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 06:23:35 +0000

alt-python310 (3.10.14-3) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200   

alt-python310 (3.10.14-2) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200 

alt-python310 (3.10.14-1) stable; urgency=medium

  * ALTPYTH-512: Update to 3.10.14 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 20 Mar 2024 00:23:09 +0000

alt-python310 (3.10.13-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * ALTPYTH-486: update to 3.10.12
  * ALTPYTH-481: Updated to 3.10.13

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python310 (3.10.9-1) stable; urgency=medium

  * update to 3.10.9

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Jan 2023 17:00:00 +0200

alt-python310 (3.10.8-1) stable; urgency=medium

  * update to 3.10.8
  * ALTPYTH-443: CL9 compatibility

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 21 Oct 2022 17:08:00 +0200

alt-python310 (3.10.4-1) stable; urgency=medium

  * ALTPYTH-422: fix for ensurepip
  * update to 3.10.4

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 06 Apr 2022 10:08:00 +0200

alt-python310 (3.10.2-1) stable; urgency=medium

  * update to 3.10.2

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 28 Jan 2022 16:22:00 +0300

alt-python310 (3.10.1-1) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 14 Dec 2021 11:28:00 +0300
