alt-python36 (3.6.15-48) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a "skip this member" answer from a
    custom extraction filter on the hard-link fallback. The CVE-2026-11940
    hardening re-validates a link's target under the link's own name before
    extracting it as a copy, but makelink_with_filter() threw that call's
    return value away and the next line overwrote it with the result of the
    ordinary filter call. A filter that returns None - the documented PEP 706
    way to say "skip" - was therefore ignored for the re-rooted member, and
    the member was extracted anyway at the link's shallower name, exactly the
    placement the filter had declined. The bundled "data" and "tar" filters
    raise instead of returning None, so only custom filter callables are
    affected.
    - debian/patches/CVE-2026-87910.patch: backport of cpython
      9c17bace90f88dfba6d0e2fe23c8e7ae35f83955 (gh-157265, GH-157266,
      GH-157308), the 3.13-branch form of the fix, together with its test
      follow-up d9565e54b1fc6d63c5be9afd58114499128fa57b. The two added lines
      are upstream's verbatim; only the hunk anchor differs. The upstream test
      test_extract_filters_target_none is carried too, minus the @symlink_test
      decorator and with os_helper.can_symlink() spelled
      support.can_symlink(), neither of which exists in 3.6.
    - Applied strictly after CVE-2026-11940.patch in all three packaging
      paths: that patch is carried by this package rather than native to
      3.6, and it supplies the re-rooted filter call this fix repairs.
      Reordering the two would leave this patch nothing to apply against.
    - CVE-2026-87910
  * SECURITY UPDATE: the tarfile "tar" and "data" extraction filters created
    directories outside the destination for a member whose name leaves the
    destination and comes back, such as "../evil/../dest/sub/file".
    _get_filtered_attrs() decided containment on the resolved path, which for
    such a name lands back inside and passes the check, but tarfile creates
    the intermediate directories from the name as given and so walked out of
    the destination on the way, leaving an attacker-named directory beside it.
    Normalizing the name before the check, and writing the normalized form
    back into the member attributes, makes the directories that get created
    match the path that was validated.
    - Behaviour change: the "tar" and "data" filters now rewrite any member
      name containing ".." components with os.path.normpath(), which removes
      internal ".." components and so may change the meaning of a name that
      traverses symbolic links.
    - debian/patches/CVE-2026-19672.patch: backport of cpython
      97688346ada2df3e5b9c279348862c3d64ab0823 (gh-155999, GH-156000). The
      seven added lines and all of their context are upstream's verbatim; the
      hunk applies to this tree unchanged. The upstream regression test
      test_parent_dir_out_and_back is carried as merged, only re-anchored,
      because this tree's test_parent_symlink has no @symlink_test decorator
      for the hunk to end on.
    - This CVE reaches this package only because the PEP 706 extraction
      filters are backported here by CVE-2007-4559.patch and the
      realpath(strict=ALLOW_MISSING) containment check by CVE-2026-7774.patch;
      upstream 3.6 has no filter machinery at all. The patch is
      therefore ordered after every other tarfile-touching patch in all three
      packaging paths.
    - CVE-2026-19672
  * The Misc/NEWS.d fragments of both upstream commits are omitted; this
    version ships a single Misc/NEWS file.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 12:00:00 +0000

alt-python36 (3.6.15-47) stable; urgency=medium

  * SECURITY UPDATE: tarfile PEP 706 "data"/"tar" extraction filter bypass
    via a hard link to a symlink. A crafted archive whose hard link names a
    symlink stored deeper in the archive made makelink_with_filter() call
    os.link() on the unresolved source; link(2) does not follow symlinks, so
    the extracted member became the same symlink inode under the hard link's
    own, shallower name, where its relative payload re-bases outside the
    destination. The chmod()/utime() that tarfile applies next then hit the
    outside file, changing its mode and mtime, and its contents became
    readable from inside the extracted tree (CWE-59).
    - debian/patches/CVE-2026-82049.patch: backport of cpython
      b8f23e307097552eaea2604383a12ab280520d0d (gh-157190, GH-157191,
      GH-157192), the 3.13-branch form of the fix; the changed line and its
      comment are upstream's verbatim, only re-anchored because this tree
      has no "unlink an existing targetpath" step before os.link(). The
      upstream regression test test_sneaky_hardlink_relocation is carried
      too, minus the @symlink_test / @os_helper.skip_unless_hardlink
      decorators and with os_helper.can_symlink() spelled
      support.can_symlink(), neither of which exists in 3.6.
    - The one-line fix closes only the variant where the archive carries a
      decoy file at the outer name, so os.path.exists(tarinfo._link_target)
      is true and extraction goes through os.link(). The decoy-less variant
      never reaches os.link() at all; under the "data" filter it is rejected
      by CVE-2026-11940.patch, already in this package, so the two must not
      be separated.
    - CVE-2026-82049
  * The Misc/NEWS.d fragment of the upstream commit is omitted; this version
    ships a single Misc/NEWS file.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 12:00:00 +0000

alt-python36 (3.6.15-46) stable; urgency=medium

  * SECURITY UPDATE: CPU denial-of-service in csv.Sniffer. Two independent
    regexes in Sniffer._guess_quote_and_delimiter() ran in super-linear time
    on samples reachable from the public csv.Sniffer.sniff() API (CWE-1176,
    algorithmic complexity). The quoted-field probe matched a field body with
    a lazy ".*?" under re.DOTALL, so a closing quote not followed by a
    delimiter was retried against every later quote in the sample: quadratic.
    The doubled-quote probe dq_regexp was unanchored, rescanned leading
    whitespace and ran even when no delimiter had been found, which is
    exponential on a sample carrying a run of quote characters.
    - debian/patches/CVE-2026-18503.patch: backport of cpython 19e5024518
      (gh-109638, GH-154868) and fd78b565 (gh-98820, GH-154867), both in
      their upstream 3.10-branch form. Both commits are part of Python
      3.10.21, the release the CVE record names as fixing the "0 to <
      3.10.21" range, and gh-98820 alone leaves the doubled-quote probe
      exponential: with it applied on its own, sniff() on
      '"",'*100 + '"'*100 + '0' + '"'*100 + '0', on '"a"\n' + ' '*100000
      with delimiters=',;', and on '"a" "b"\n' + ' '*100000 each still runs
      unbounded inside a single C-level re call. Field bodies are now matched
      by unrolled, unambiguous loops that cannot backtrack, the doubled-quote
      probe is anchored on whole fields and skipped when no delimiter was
      found, and sniff() normalises CRLF and CR to LF first so the probe's
      "$" means end of record. The 3.10 commits are used rather than the
      3.11+ ones, which express the same fix with a possessive quantifier
      that Python 3.6's re module does not support.
    - CVE-2026-18503
  * The Misc/NEWS.d fragments of both commits are omitted; this version
    ships a single Misc/NEWS file.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 31 Aug 2026 12:15:00 +0000

alt-python36 (3.6.15-45) stable; urgency=medium

  * ALTPYTH-615: rebuild against renamed alt-openssl11 (deb OpenSSL 1.1.1
    package renamed alt-openssl -> alt-openssl11, install prefix
    /opt/alt/openssl -> /opt/alt/openssl11)

 -- Nikolai Mardanov <nmardanov@cloudlinux.com>  Wed, 19 Aug 2026 14:35:00 +0400

alt-python36 (3.6.15-44) stable; urgency=medium

  * SECURITY UPDATE: xml.etree.ElementTree's find(), findall() and iterfind()
    had quadratic complexity when an XPath index predicate ([1], [last()],
    [last()-N]) was evaluated against a document with many same-tag siblings.
    The [index] selector called parent.findall(tag) once per candidate
    element, and each such call is itself linear in the number of siblings,
    allowing a CPU denial-of-service on untrusted XML or untrusted XPath
    (CWE-407, algorithmic complexity).
    - debian/patches/CVE-2026-6879.patch: backport of cpython 2ffab083
      (gh-152674, Petr Viktorin) taken via the upstream 3.12 backport
      96510a37. The [index] selector now caches the resolved element per
      (parent, tag), so parent.findall() runs once per parent instead of once
      per candidate. The code change is verbatim: the pre-fix select() body in
      3.6.15 is identical to the one upstream changed, so only line offsets
      differ. The regression test is added to test_xml_etree.py unchanged
      (it uses f-strings, available since 3.6); the Misc/NEWS.d/next/Security
      fragment is omitted as 3.6.15 ships a single Misc/NEWS.
    - CVE-2026-6879

 -- Viktor Borzov <vborzov@cloudlinux.com>  Wed, 12 Aug 2026 06:04:07 -0400

alt-python36 (3.6.15-43) stable; urgency=medium

  * SECURITY UPDATE: tarfile.data_filter could be bypassed using crafted
    link entries, including symlinks with empty or directory-like names,
    to redirect later archive members outside the intended extraction
    directory, so tarfile.extractall() could write files outside the
    destination directory.
    - debian/patches/CVE-2026-7774.patch: backport of cpython c063191c
      ([3.10] branch variant of 57841198, gh-149486).  data_filter now
      validates the normalised link target that is actually written to
      disk, resolves a symlink's target relative to its member name with
      trailing separators stripped, and rejects link members that would
      replace the destination directory itself.
    - CVE-2026-7774
  * SECURITY UPDATE: ftplib.ftpcp() still called parse227() directly and
    passed the source server's self-reported PASV IPv4 address to the
    target server's PORT command, so a malicious source FTP server could
    redirect the target's data connection to an arbitrary host:port
    (SSRF); the CVE-2021-4189 fix only covered FTP.makepasv().
    - debian/patches/CVE-2026-8328.patch: backport of cpython eac4fe3b
      (gh-87451).  ftpcp() now uses the source server's actual peer
      address unless trust_server_pasv_ipv4_address is set, the same
      rule FTP.makepasv() already applies.
    - CVE-2026-8328

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Mon, 10 Aug 2026 02:45:25 -0400

alt-python36 (3.6.15-42) stable; urgency=medium

  * SECURITY UPDATE: unicodedata.normalize() used an O(n^2) insertion
    sort for canonical ordering of combining characters, so a crafted
    Unicode string with many combining characters in alternating
    canonical-combining-class order caused a CPU denial of service.
    - debian/patches/CVE-2026-3276.patch: backport of cpython
      991224b1 + 90748760 (gh-149079).  Canonical ordering now sorts
      each combining-character run in the Py_UCS4 output buffer with a
      hybrid insertion/counting sort (insertion sort below 20
      characters, counting sort from 20 up), reducing the worst case
      to O(n).
    - CVE-2026-3276

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 07 Aug 2026 04:33:40 -0400

alt-python36 (3.6.15-41) stable; urgency=medium

  * SECURITY UPDATE: tarfile.extractall() with the 'data' or 'tar'
    extraction filter could be bypassed by a crafted archive where a
    hardlink references a symlink stored at a deeper name than the
    hardlink itself. The extraction fallback validated the symlink at its
    archived location but recreated it at the hardlink's shallower path,
    letting a relative target the filter judged contained escape the
    destination directory (out-of-destination read/write; incomplete fix
    of CVE-2025-4330).
    - debian/patches/CVE-2026-11940.patch: backport of cpython be13e86f
      (gh-151558, GH-151559 3.11 backport, Stan Ulbrych).
      makelink_with_filter() now re-runs the filter on the member
      re-rooted at the link's own path before using the fallback. Adapted
      to 3.6: fix hunk identical to upstream (the package already carries
      the PEP 706 filters and the CVE-2025-4330 fix); the regression test
      test_sneaky_hardlink_fallback_deep is added to TestExtractionFilters
      unchanged.
    - CVE-2026-11940

  * SECURITY UPDATE: the configparser module wrote multi-line values
    escaping only bare '\n', so a carriage return ('\r' or '\r\n') in an
    attacker-controlled value acted as a line terminator when the file was
    read back, injecting unexpected keys and values.
    - debian/patches/CVE-2026-0864.patch: backport of cpython 5858e42c
      (gh-143927, Seth Larson). RawConfigParser.write() now normalizes all
      line endings (CR, CRLF, LF) to '\n\t'. Adapted to 3.6: fix hunk
      identical to upstream; the regression test test_crlf_normalization
      is added with the existing io import.
    - CVE-2026-0864

  * SECURITY UPDATE: in tarfile streaming mode (mode="r|") the module did
    not properly handle EOF; a member header declaring a huge size made
    _Stream.seek() loop once per declared block against an already
    exhausted stream, making archive parsing take exponentially longer
    (CPU denial-of-service).
    - debian/patches/CVE-2026-11972.patch: backport of cpython f50bf135
      (gh-151981, Petr Viktorin). The seek() block loop now breaks when
      read() returns no data. Adapted to 3.6: fix hunk identical to
      upstream; the regression test test_getmembers_big_size uses a
      self.subTest loop (no 3.13+ support.subTests) so it runs on 3.6.
    - CVE-2026-11972

  * SECURITY UPDATE: TarFile.extract() did not pass the extraction filter
    down to _extract_one(), so on the single-member extract() path the
    hardlink/symlink extraction fallback recreated the link target without
    applying the filter: attacker-controlled mode, uid and gid were applied
    verbatim even with filter='data', and the CVE-2025-4330/CVE-2026-11940
    fallback checks never ran there.
    - debian/patches/CVE-2026-4360.patch: backport of cpython 7ccdbaba
      (gh-151987, Petr Viktorin). extract() now forwards filter_function
      to _extract_one(). Adapted to 3.6: fix hunk identical to upstream;
      the regression tests' parenthesized multi-item "with" blocks are
      rewritten as backslash-continued statements (3.6 syntax).
    - CVE-2026-4360

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Tue, 04 Aug 2026 10:01:11 +0000

alt-python36 (3.6.15-40) stable; urgency=medium

  * SECURITY UPDATE: html.parser.HTMLParser had quadratic complexity in
    incremental parsing. An unterminated construct (e.g. a tag or comment)
    fed across many feed() calls made the parser rescan the growing buffer
    and reconcatenate new data onto it on every call, both quadratic in the
    input size, allowing a CPU denial-of-service on uncontrolled data
    (CWE-407, algorithmic complexity).
    - debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddb
      (gh-153030, Serhiy Storchaka). feed() now accumulates new data in a
      list and only joins and parses it once enough has piled up, and
      close() flushes any pending buffer. Adapted to 3.6: feed()/close()/
      reset() logic identical to upstream (3.6 already has list.clear());
      the regression test is added with "from test import support"; the
      NEWS.d fragment is omitted as 3.6.15 ships a single Misc/NEWS.
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 09:34:30 +0000

alt-python36 (3.6.15-39) stable; urgency=medium

  * SECURITY UPDATE: a bz2.BZ2Decompressor could be reused after a libbz2
    decompression error. Re-entering BZ2_bzDecompress() once libbz2 had
    reported an error could write past the end of a stack buffer
    (CWE-121, possible stack buffer overflow).
    - debian/patches/CVE-2026-9669.patch: backport of cpython
      5755d0f0 (gh-150599, Stan Ulbrych). Records the libbz2 error in a
      new bzerror field, clears needs_input on the error path, and makes
      decompress() raise ValueError ("Decompressor is unusable after a
      previous error") on any subsequent call. Adapted to 3.6: plain
      needs_input reset (no free-threading atomics) and the existing
      ACQUIRE_LOCK/RELEASE_LOCK wrappers; NEWS.d fragment omitted as
      3.6.15 ships a single Misc/NEWS.
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 23 Jun 2026 05:38:56 +0000

alt-python36 (3.6.15-38) stable; urgency=medium

  * SECURITY UPDATE: imaplib.IMAP4._command() concatenated each command
    argument into the wire-level command without inspecting it, so a
    caller passing user-controlled text could inject additional IMAP
    commands using CR/LF or other control characters.
    - debian/patches/CVE-2025-15366.patch: backport of cpython
      6262704b (gh-143921, Seth Larson). Adds a module-level
      _control_chars regex and rejects any byte in [\x00-\x1F\x7F] with
      ValueError before concatenating each argument. Upstream-main-only
      fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464).
    - CVE-2025-15366

  * SECURITY UPDATE: poplib.POP3._putcmd() encoded its argument and sent
    it to the server without inspecting it, allowing the same command
    injection via user() / pass_() / apop() / rpop() / top().
    - debian/patches/CVE-2025-15367.patch: backport of cpython
      b234a2b6 (gh-143923, Seth Larson). Rejects any byte in
      [\x00-\x1F\x7F] with ValueError before sending. Upstream-main-only
      fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464).
    - CVE-2025-15367

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 08 Jun 2026 09:00:00 +0200

alt-python36 (3.6.15-37) stable; urgency=medium

  * SECURITY UPDATE: tarfile applied AREGTYPE -> DIRTYPE normalization
    even during multi-block GNU long members (GNUTYPE_LONGNAME /
    GNUTYPE_LONGLINK), enabling a parsing differential vs. other tar
    implementations.
    - debian/patches/CVE-2025-13462.patch: backport of cpython
      42d754e3 (gh-143934, Seth Larson + Eashwar Ranganathan).
      Threads a dircheck flag through frombuf / fromtarfile so
      normalization is skipped on the inner header during GNU long
      name / link handling.
    - CVE-2025-13462

  * SECURITY UPDATE: wsgiref.headers.Headers did not reject control
    characters in header names / values, allowing HTTP header
    injection from WSGI applications.
    - debian/patches/CVE-2026-0865.patch: combined backport of
      cpython f7fceed7 (gh-143917) which adds the control-char regex
      check, 66da7bf6 (gh-143916 HTAB follow-up) which splits the
      check so HTAB is allowed in header values (RFC 9110 Section
      5.5) but still rejected in header names, plus d931725b
      (gh-144370) which disallows control characters in status in
      wsgiref.handlers.start_response.
    - CVE-2026-0865

  * SECURITY UPDATE: http.client did not reject CR/LF in HTTPConnection
    CONNECT tunnel host / per-tunnel-header values, enabling request
    injection through a proxy tunnel.
    - debian/patches/CVE-2026-1502.patch: backport of cpython
      05ed7ce7 + b1cf9016 (gh-146212, Seth Larson). Adapted to 3.6's
      per-line self.send() form (no headers=[] list in _tunnel until
      3.9+). Validates _tunnel_host and per-header name / value in
      _tunnel().
    - CVE-2026-1502

  * SECURITY UPDATE: http.cookies.Morsel.js_output() emitted an inline
    <script> snippet that only escaped " and left </script> intact,
    enabling HTML injection when a cookie value contains </script>.
    - debian/patches/CVE-2026-6019.patch: backport of cpython
      76b3923d (gh-148848, Seth Larson). Base64-encodes the cookie
      value and emits document.cookie = atob("...") instead of
      pasting the raw cookie string into the JavaScript snippet.
      Composes on top of CVE-2026-3644's js_output() control-character
      recheck (preserved).
    - CVE-2026-6019

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 16:00:00 +0200

alt-python36 (3.6.15-36) stable; urgency=medium

  * SECURITY UPDATE: bytes.decode("unicode_escape", errors="ignore" or
    "replace") could trigger a use-after-free when the error handler
    reallocated the input buffer; the decoder retained a pointer into
    the freed old buffer.
    - debian/patches/CVE-2025-4516.patch: backport of cpython
      9f69a586 (gh-129648, Serhiy Storchaka). Captures the initial
      starts pointer in _PyUnicode_DecodeUnicodeEscape and only stores
      *first_invalid_escape when starts == initial_starts, so the
      pointer cannot dangle after reallocation.
    - CVE-2025-4516

  * SECURITY UPDATE: html.parser.HTMLParser had worst-case quadratic
    complexity on crafted malformed input, enabling amplified DoS.
    - debian/patches/CVE-2025-6069.patch: backport of cpython
      6eb6c5db (gh-135464, Serhiy Storchaka). Adds the endtagopen
      regex and rewrites goahead()'s EOF handling per the HTML5 spec
      so comments and declarations are auto-closed and tags are
      ignored at EOF.
    - CVE-2025-6069

  * SECURITY UPDATE: zipfile did not validate the ZIP64 EOCD locator
    offset, enabling ZIP parsing-differential / archive-smuggling
    attacks.
    - debian/patches/CVE-2025-8291.patch: backport of cpython
      162997bb + 333d4a6f (gh-139702). Adds the reloff > offset guard
      in _EndRecData64 and supports zip64 extensible data when there
      are no bytes prepended to the ZIP file.
    - CVE-2025-8291

  * SECURITY UPDATE: folding a long email header comment of only
    unfoldable characters dropped the enclosing parentheses, enabling
    header injection in serialized email messages.
    - debian/patches/CVE-2025-11468.patch: backport of cpython
      17d1490a (gh-143936, Seth Larson). Adds make_parenthesis_pairs
      and a comment-escaping branch in _refold_parse_tree, and fixes
      WhiteSpaceTerminal.startswith_fws.
    - CVE-2025-11468

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 15:30:00 +0200

alt-python36 (3.6.15-35) stable; urgency=medium

  * SECURITY UPDATE: rework the CVE-2026-7210 fix so the system-libexpat
    code path is no longer inert when the system libexpat does not bump
    XML_COMBINED_VERSION to 2.8.0.  alt-python36's bundled libexpat 2.4.1
    (patched by CVE-2026-41080.patch) and any distro libexpat that
    backports the XML_SetHashSalt16Bytes entropy fix into an older
    branch are now detected at load time, not at compile time.
    - debian/patches/CVE-2026-7210.patch: rewritten.  Drops the
      compile-time "XML_COMBINED_VERSION >= 20800 || defined
      (XML_HAS_HASHSALT16BYTES_BACKPORT)" conditional and instead
      declares XML_SetHashSalt16Bytes as __attribute__((weak)) at
      the top of Modules/pyexpat.c.  The pyexpat parser init code,
      the pyexpat C-API capsule initialization, and _elementtree.c
      now all do a single runtime "if (... != NULL)" check on the
      symbol's address.  Result:
        - RPM / Debian builds: bundled libexpat 2.4.1 with the
          matching CVE-2026-41080 backport exposes the symbol, weak
          resolution finds it, 16-byte salt path is taken -- same
          mitigation as before, no regression.
        - Alpine builds: --with-system-expat links the system
          libexpat at load time.  If the system libexpat has the
          entropy fix (upstream 2.8.0+, or a distro backport into
          2.7.x), the weak symbol resolves to the real function and
          the 16-byte path activates without needing to rebuild
          alt-python36.  If not, the legacy 8-byte XML_SetHashSalt
          path is used, exactly as before this patch -- no behavior
          regression and the package becomes self-healing the moment
          Alpine ships a libexpat with the fix.
    - debian/patches/CVE-2026-41080.patch: unchanged.  The
      XML_HAS_HASHSALT16BYTES_BACKPORT feature-test macro it defines
      is no longer consumed by CVE-2026-7210.patch (the weak symbol
      replaces it), but the macro is kept as a stable signal.
    - CVE-2026-7210

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse accepted bracketed
    hosts that were not valid IPv6 / IPvFuture, enabling SSRF and
    parser-differential attacks.
    - debian/patches/CVE-2024-11168.patch: backport of cpython
      29f348e2 (gh-103848). Adds _check_bracketed_host and wires it
      into urlsplit(). Also backports cpython 5a88d50 (bpo-43882) to
      remove the 3.6-only urlsplit() "http" fast-path so http:// URLs
      flow through the validated code path; without it the bracketed-
      host check is bypassed for http://, which is the scheme targeted
      by both CVE-2024-11168 and CVE-2025-0938.
    - CVE-2024-11168

  * SECURITY UPDATE: bundled libexpat 2.4.1 crashes in XML_ResumeParser
    when XML_StopParser is called on an unstarted parser (NULL deref).
    - debian/patches/CVE-2024-50602.patch: backport of the libexpat
      2.6.4 fix.  Adds XML_ERROR_NOT_STARTED and refuses to
      stop/suspend a parser in XML_INITIALIZED state in
      XML_StopParser, eliminating the precondition for the
      XML_ResumeParser NULL deref. Alpine builds use system expat
      (--with-system-expat + rm -r Modules/expat) so this hardening
      affects only the bundled-expat path used by RPM/Debian builds.
    - CVE-2024-50602

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse continued to accept
    domain names containing square brackets after the CVE-2024-11168 fix;
    follow-up that completes the validation.
    - debian/patches/CVE-2025-0938.patch: backport of cpython
      d89a5f6a (gh-105704). Disallows square brackets in domain names
      not delimiting an IPv6 / IPvFuture host.
    - CVE-2025-0938

  * SECURITY UPDATE: email address-list folding could unicode-encode the
    comma separator together with a folded line, causing the address
    header to be misinterpreted by some mail servers.
    - debian/patches/CVE-2025-1795.patch: backport of cpython gh-100884
      (Thomas Weißschuh). Marks ListSeparator with
      as_ew_allowed = False so the comma is never encoded-word-wrapped.
    - CVE-2025-1795

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 15:00:00 +0200

alt-python36 (3.6.15-34) stable; urgency=medium

  * SECURITY UPDATE: CVE-2026-7210 + CVE-2026-41080 (paired) — backport
    the libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled
    expat 2.4.1 and wire pyexpat/_elementtree to use it. Together these
    restore proper hash-flood mitigation for xml.parsers.expat and
    xml.etree.ElementTree.
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). Adds a new 16-byte
      _Py_HashSecret.expat.hashsalt16 slot in Include/pyhash.h
      (overlapping the existing padding), extends the PyExpat CAPI in
      Include/pyexpat.h with SetHashSalt16Bytes, and prefers the new
      API in Modules/pyexpat.c and Modules/_elementtree.c when built
      against libexpat exposing it; falls back to the legacy
      XML_SetHashSalt path otherwise. The two XML_COMBINED_VERSION
      gates are extended with `|| defined(XML_HAS_HASHSALT16BYTES_BACKPORT)`
      so the new code path activates against the bundled patched
      libexpat without bumping its advertised version, while
      --with-system-expat builds (Alpine) keep the upstream
      `>= 20800` semantics.
    - debian/patches/CVE-2026-41080.patch: backport of libexpat
      PR #1183. Widens the parser's internal hash salt from
      `unsigned long m_hash_secret_salt` to a full
      `struct sipkey m_hash_secret_salt_128` (+ an
      m_hash_secret_salt_set flag), adds the new
      XML_SetHashSalt16Bytes API and the matching
      XML_HAS_HASHSALT16BYTES_BACKPORT marker in expat.h, and namespaces
      the new symbol via pyexpatns.h. Applied to bundled
      Modules/expat/; on Alpine `prepare()` deletes Modules/expat
      after the patch, so the libexpat backport is a no-op there and
      the system libexpat decides whether the new API is available.
    - CVE-2026-7210
    - CVE-2026-41080

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 22 May 2026 10:00:00 +0200

alt-python36 (3.6.15-33) stable; urgency=medium

  * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose
    mediatype contained control characters, allowing newline-based HTTP
    header injection downstream.
    - debian/patches/CVE-2025-15282.patch: backport of cpython
      f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F]
      regex check in data_open() and a matching test_invalid_mediatype.
    - CVE-2025-15282

  * SECURITY UPDATE: http.cookies.Morsel did not reject control characters
    in keys / values / coded_value, allowing cookie injection via
    __setitem__, setdefault, set, and BaseCookie.output.
    - debian/patches/CVE-2026-0672.patch: backport of cpython
      95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character
      helper and inserts validation in __setitem__, setdefault, set,
      plus a wrap of BaseCookie.OutputString / output.
    - CVE-2026-0672

  * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control
    characters could still bypass via Morsel.update(), |=, __setstate__
    (pickle), and BaseCookie.js_output().
    - debian/patches/CVE-2026-3644.patch: backport of cpython
      57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds
      validation to Morsel.update(), defines explicit Morsel.__ior__
      (was inherited from dict and bypassed validation), validates
      __setstate__ before assigning attributes, and re-validates the
      assembled output string in js_output().
    - CVE-2026-3644

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RecursionError instead of crashing.
    - CVE-2026-4224

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 10:00:00 +0200

alt-python36 (3.6.15-32) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64_impl no longer breaks out on a pad
      sequence; a `pads` counter is added so post-loop validation still
      raises "Incorrect padding" for inputs that do not satisfy
      `quad_pos + pads == 4`. The unused `binascii_find_valid` helper
      is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python36 (3.6.15-31) stable; urgency=medium

  * SECURITY UPDATE: email BytesGenerator header injection
    - debian/patches/CVE-2026-1299.patch: verify generated headers in
      email.generator.BytesGenerator and Generator. Adds the
      HeaderWriteError exception, NEWLINE_WITHOUT_FWSP /
      NEWLINE_WITHOUT_FWSP_BYTES regexes, and the
      Policy.verify_generated_headers attribute, then raises
      HeaderWriteError when the folded header does not end with the
      policy linesep or contains a stray newline. Includes the
      CVE-2024-6923 prerequisite hardening of the string Generator.
    - CVE-2026-1299
  * SECURITY UPDATE: ssl.SSLContext memory race in cert_store_stats /
    get_ca_certs
    - debian/patches/CVE-2024-0397.patch: backport the upstream
      X509_STORE_get1_objects shim and the x509_object_dup helper
      from cpython 29c97287d205bf2f410f4895ebce3f43b5160524, then
      switch _ssl__SSLContext_cert_store_stats_impl and
      _ssl__SSLContext_get_ca_certs_impl to take a deep-copy snapshot
      of the X509_STORE under lock, freeing the snapshot before
      returning. Closes a use-after-free triggered by loading
      certificates concurrently from another thread.
    - CVE-2024-0397
  * SECURITY UPDATE: ipaddress is_private / is_global misclassification
    - debian/patches/CVE-2024-4032.patch: backport upstream
      gh-113171 / gh-65056. Update Lib/ipaddress.py to align the
      _private_networks lists with the IANA special-purpose registries
      and add _private_networks_exceptions so that
      is_private / is_global no longer misclassify addresses in
      192.0.0.0/24 (with 192.0.0.9 and 192.0.0.10 exceptions),
      64:ff9b:1::/48, 2002::/16, and the 2001::/23 sub-range
      exceptions (2001:1::1, 2001:1::2, 2001:3::/32, 2001:4:112::/48,
      2001:20::/28, 2001:30::/28). Includes the matching docs and
      test updates.
    - CVE-2024-4032

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:36:00 +0200

alt-python36 (3.6.15-30) stable; urgency=medium

  * SECURITY UPDATE: zipfile quoted-overlap zip bomb
    - debian/patches/CVE-2024-0450.patch: raise BadZipFile when an
      archive entry overlaps with another entry or the central
      directory, preventing quoted-overlap zip bombs with extreme
      compression ratios.
    - CVE-2024-0450
  * SECURITY UPDATE: use-after-free in lzma/bz2 decompressors
    - debian/patches/CVE-2026-6100.patch: null next_in at the error:
      label of decompress() in Modules/_bz2module.c and
      Modules/_lzmamodule.c so the decompressor cannot be re-used
      with a stale buffer pointer after a MemoryError.
    - CVE-2026-6100

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 12:00:00 +0200

alt-python36 (3.6.15-29) stable; urgency=medium

  * SECURITY UPDATE: command-line option injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject leading dashes in
      webbrowser.open() URLs to prevent command-line option injection
      in browser subprocesses
    - CVE-2026-4519

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 12:30:00 +0200

alt-python36 (3.6.15-28) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python36 (3.6.15-27) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in
      os.path.expandvars() by replacing the character-by-character loop
      with regex-based substitution in both posixpath and ntpath modules.
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 07:45:00 +0100

alt-python36 (3.6.15-26) stable; urgency=medium

  * ALTPYTH-586: Initial build for arm64

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Thu, 26 Feb 2026 17:00:00 +0400

alt-python36 (3.6.15-25) stable; urgency=medium

  * SECURITY UPDATE: Shell command injection in the mailcap module
    - debian/patches/CVE-2015-20107.patch: sanitize the second
      argument which allowing shell command injection
    - CVE-2015-20107

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Wed, 18 Feb 2026 17:10:11 +0100

alt-python36 (3.6.15-24) stable; urgency=medium

  * Exclude flaky timing-dependent tests on Debian 12/13
    (test_generators, test_pdb, test_regrtest)

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Wed, 18 Feb 2026 15:00:00 +0400

alt-python36 (3.6.15-23) stable; urgency=medium

  * SECURITY UPDATE: Memory denial of service in plistlib
    - debian/patches/CVE-2025-13837.patch: read large data by chunks,
      therefore the upper limit of consumed memory is proportional to the
      size of the input file.
    - CVE-2025-13837

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 12 Feb 2026 08:04:42 +0100

alt-python36 (3.6.15-22) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Mon, 09 Feb 2026 19:00:00 +0400

alt-python36 (3.6.15-21) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 08 Jan 2026 11:51:00 +0100

alt-python36 (3.6.15-20) stable; urgency=medium

  * SECURITY UPDATE: Ability to modify permissions with privileged programs
    - debian/patches/CVE-2023-6597: prevent tempfile.TemporaryDirectory
      class dereference symlinks
    - CVE-2023-6597

 -- Azat Nurgaliev <anurgaliev@cloudlinux.com>  Wed, 10 Dec 2025 15:54:02 +0200

alt-python36 (3.6.15-19) stable; urgency=medium

  * SECURITY UPDATE: Traversing outside chmod directory
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filters directory members
      before chmod/chown
    - CVE-2024-12718
  * SECURITY UPDATE: Symlink exfiltration
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: properly handles different link
      semantics
    - CVE-2025-4138
  * SECURITY UPDATE: Hardlink Fallback Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink
      extraction falls back to copying
    - CVE-2025-4330
  * SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: account errorlevel
    - CVE-2025-4435
  * SECURITY UPDATE: PATH_MAX Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow
      attacks
    - CVE-2025-4517
  * TEST UPDATE: Incorrect encoding leading to an unexpected
    exception in test_tarfile.py
    - debian/patch/fix_test_tarfile-enconding.patch: fix encoding

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Fri, 17 Oct 2025 18:20:02 +0100

alt-python36 (3.6.15-18) stable; urgency=medium

  * TESTS UPDATE: Rename bisect.by to bisect_cmd.py in tests to
    avoid conflicts with bisect module
    - debian/patches/bpo-35519.patch: rename test.bisect module to
      test.bisect_cmd to avoid conflict with bisect module when running
      directly a test like "./python Lib/test/test_xmlrpc.py"
  * TESTS UPDATE: Enabled build tests for debian 10, 11, 12, and 13

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Thu, 16 Oct 2025 18:20:02 +0100

alt-python36 (3.6.15-17) stable; urgency=medium

  * SECURITY UPDATE: Overwriting of arbitrary files by remote attackers
    - debian/patches/CVE-2007-4559.patch: implement PEP 706 - a filter in
      the tarfile module to prevent directory traversal vulnerability
    - CVE-2007-4559
  * SECURITY UPDATE: Bypass of domain e-mail-based protection mechanism by
    incorrect parsing of e-mail addresses that contain a special character
    - debian/patches/CVE-2023-27043.patch: reject malformed addresses in
      email.parseaddr()
    - CVE-2023-27043
  * SECURITY UPDATE: Bypass of the TLS handshake and included protections
    - debian/patches/CVE-2023-40217.patch: check for & avoid the ssl
      pre-close flaw
    - CVE-2023-40217

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Thu, 09 Oct 2025 11:09:00 +0100

alt-python36 (3.6.15-16) stable; urgency=medium

  * disable failing internal tests on ubuntu24

 -- Jai S <jsathyapalan@cloudlinux.com>  Tue, 07 Oct 2025 09:32:00 +0000

alt-python36 (3.6.15-15) stable; urgency=medium

  * Enable internal testing

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Fri, 26 Sep 2025 11:04:00 +0100

alt-python36 (3.6.15-14) stable; urgency=medium

  * SECURITY UPDATE: DOS, buffer overflow in SHA3, Possible Bypass Blocklisting
    Redirection vulnerability in http.server, regex DOS, Quadratic complexity,
    pathname quoting for venv
    - debian/patches/CVE-2022-37454.patch: fix a buffer overflow in
      Modules/_sha3/kcp/KeccakSponge.inc, Lib/test/test_hashlib.py
      (LP: #1995197).
    - debian/patches/CVE-2022-45061.patch: fix quadratic time idna decoding
      in Lib/encodings/idna.py, Lib/test/test_codecs.py.
    - debian/patches/CVE-2023-24329.patch: enforce
      that a scheme must begin with an alphabetical ASCII character
      in Lib/urllib/parse.py, Lib/test/test_urlparse.py.
      start stripping C0 control and space chars in `urlsplit`
    - debian/patches/CVE-2021-28861.patch: Fix an open
      redirection vulnerability in the `http.server` module
      when an URI path starts with `//`
    - debian/patches/CVE-2024-6232.patch: Fix header parsing vulnerability that
      could lead to ReDoS
    - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in parsing
      "-quoted cookie values with backslashes
    - debian/patches/CVE-2024-9287.patch: Quote template strings in `venv` activation
    - CVE-2022-37454
    - CVE-2022-45061
    - CVE-2023-24329
    - CVE-2021-28861
    - CVE-2024-6232
    - CVE-2024-7592
    - CVE-2024-9287

 -- Jai S <jsathyapalan@cloudlinux.com>  Thu, 18 Sep 2025 13:57:38 +0000

alt-python36 (3.6.15-13) stable; urgency=medium

  * SECURITY UPDATE: Misleading information
    - debian/patches/CVE-2019-17514.patch: explain that the orderness of the
      of the result is system-dependant in Doc/library/glob.rst.
    - CVE-2019-17514

 -- Jai S <jsathyapalan@cloudlinux.com>  Tue, 26 Aug 2025 05:52:43 +0000

alt-python36 (3.6.15-12) stable; urgency=medium

  * Bootstrap for Debian 13

 -- Vladimir D. Seleznev <vseleznev@cloudlinux.com>  Mon, 08 Sep 2025 20:00:00 +0300

alt-python36 (3.6.15-11) stable; urgency=medium

  * SECURITY UPDATE: Denial of service via a ZIP bomb
    - debian/patches/CVE-2019-9674.patch: add pitfalls to zipfile module
      documentation
    - CVE-2019-9674

 -- Koba Karaputadze <kkaraputadze@cloudlinux.com>  Fri, 22 Aug 2025 20:49:00 +0100

alt-python36 (3.6.15-10) stable; urgency=medium

  * ALTPYTH-560: initial build.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 23 Jul 2025 13:20:00 +0300

