alt-python37 (3.7.17-35) stable; urgency=medium

  * SECURITY UPDATE: use-after-free of a server-side ssl.SSLContext when an
    sni_callback switches SSLSocket.context. _servername_callback() in
    Modules/_ssl.c reached the Python SSLContext through the borrowed pointer
    registered with SSL_CTX_set_tlsext_servername_arg(); once the callback
    switched the socket to another context and nothing else referenced the
    original one, PyErr_WriteUnraisable() after a raising callback, and a
    second ClientHello (e.g. after a TLS 1.3 HelloRetryRequest) dispatched
    through the surviving session_ctx, used freed memory. The callback now
    takes the socket's current context and holds strong references to it
    and to its callback, and context_dealloc() unregisters the callback.
    - debian/patches/CVE-2026-19445.patch: backport of cpython
      ec44b5a3258cbda947d5e07242ee562ed05ef24b (3.10 branch, gh-156293,
      GH-158504), adapted to the 3.7 C API (Py_INCREF/Py_XINCREF instead of
      Py_NewRef/Py_XNewRef, no get_state_ctx()). Both upstream regression
      tests are carried; the unraisable-exception check reads sys.stderr,
      as 3.7 has no support.catch_unraisable_exception().
    - CVE-2026-19445
  * SECURITY UPDATE: ssl.SSLContext.wrap_bio() did not require
    server_hostname when check_hostname was enabled, so an SSLObject
    (memory-BIO) client, and asyncio's start_tls()/create_connection(
    server_hostname=''), verified the certificate chain but silently never
    the peer's hostname. Lib/ssl.py now validates the wrap_bio() parameters
    with the same _check_sslobject_params() helper as wrap_socket() and
    raises ValueError("check_hostname requires server_hostname").
    - debian/patches/CVE-2026-19553.patch: backport of cpython PR 158516
      (3.11 branch, commits 5de40fab6050 and b8e971fc1615, gh-156793,
      GH-158503). Lib/ssl.py is upstream's; the asyncio tests were adapted
      because 3.7 calls wrap_bio() lazily from connection_made().
    - CVE-2026-19553

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 05 Oct 2026 12:00:00 +0000

alt-python37 (3.7.17-34) stable; urgency=medium

  * SECURITY UPDATE: urllib.request handed out credentials registered for an
    https:// URI to the matching http:// URI. HTTPPasswordMgr.reduce_uri()
    drops the scheme, and add_password()/find_user_password() compared only
    the reduced (authority, path) pair, so an attacker able to force an
    HTTPS-to-HTTP downgrade or redirect received the Basic-auth credentials
    in cleartext. HTTPPasswordMgrWithPriorAuth had the same flaw in
    update_authenticated()/is_authenticated(). Credentials are now scoped by
    scheme; a URI registered without a scheme still matches any scheme, which
    keeps proxy authentication working.
    - debian/patches/CVE-2026-15806.patch: backport of cpython
      a2773a34183b7d94a243bb98fd658926cc5348ce (gh-155694, GH-155696), the
      3.13-branch form of the fix. The code change and the three new tests in
      Lib/test/test_urllib2.py are upstream's verbatim; only hunk offsets
      were re-cut.
    - CVE-2026-15806
  * SECURITY UPDATE: the stringprep module, used by the "idna" codec
    (IDNA 2003), applied post-Unicode-3.2.0 case mappings that RFC 3454
    forbids. map_table_b3() falls back to str.lower(), which uses the
    interpreter's own Unicode 11.0.0 data, for every codepoint missing from
    the generated b3_exceptions table, so characters that gained a lowercase
    mapping after 3.2.0 (Cherokee, Cyrillic Palochka, Georgian Mtavruli,
    Adlam, ...) were case-folded, and different Python versions derived
    different A-labels for the same domain name.
    - debian/patches/CVE-2026-17084.patch: backport of cpython
      1e54caa096678a38afcabecabb1ff72400dd6bae (gh-155292, GH-155293), the
      3.14-branch form of the fix, covering Lib/stringprep.py,
      Tools/unicode/mkstringprep.py and the new idna test in
      Lib/test/test_codecs.py.
    - The b3_exceptions table is generated from the running interpreter's
      Unicode database, so upstream's Unicode 16.0.0 table does not apply.
      Lib/stringprep.py was regenerated with the patched mkstringprep.py
      under this version's own interpreter (Unicode 11.0.0), adding 634
      identity entries. The new unidata_version assertion makes a future
      Unicode database bump fail loudly instead of leaving the table stale.
    - CVE-2026-17084
  * The Misc/NEWS.d fragments and documentation changes of both upstream
    commits are omitted, as is the Tools/unicode/makeunicodedata.py hook,
    which only matters when the bundled Unicode database is rebuilt.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 24 Sep 2026 12:00:00 +0000

alt-python37 (3.7.17-33) stable; urgency=medium

  * SECURITY UPDATE: tarfile ignored a "skip this member" answer from a
    custom extraction filter on the hard-link fallback. The CVE-2026-11940
    hardening re-validates a link's target under the link's own name before
    extracting it as a copy, but makelink_with_filter() threw that call's
    return value away and the next line overwrote it with the result of the
    ordinary filter call. A filter that returns None - the documented PEP 706
    way to say "skip" - was therefore ignored for the re-rooted member, and
    the member was extracted anyway at the link's shallower name, exactly the
    placement the filter had declined. The bundled "data" and "tar" filters
    raise instead of returning None, so only custom filter callables are
    affected.
    - debian/patches/CVE-2026-87910.patch: backport of cpython
      9c17bace90f88dfba6d0e2fe23c8e7ae35f83955 (gh-157265, GH-157266,
      GH-157308), the 3.13-branch form of the fix, together with its test
      follow-up d9565e54b1fc6d63c5be9afd58114499128fa57b. The two added lines
      are upstream's verbatim; only the hunk anchor differs. The upstream test
      test_extract_filters_target_none is carried too, minus the @symlink_test
      decorator and with os_helper.can_symlink() spelled
      support.can_symlink(), neither of which exists in 3.7.
    - Applied strictly after CVE-2026-11940.patch in all three packaging
      paths: that patch is carried by this package rather than native to
      3.7, and it supplies the re-rooted filter call this fix repairs.
      Reordering the two would leave this patch nothing to apply against.
    - CVE-2026-87910
  * SECURITY UPDATE: the tarfile "tar" and "data" extraction filters created
    directories outside the destination for a member whose name leaves the
    destination and comes back, such as "../evil/../dest/sub/file".
    _get_filtered_attrs() decided containment on the resolved path, which for
    such a name lands back inside and passes the check, but tarfile creates
    the intermediate directories from the name as given and so walked out of
    the destination on the way, leaving an attacker-named directory beside it.
    Normalizing the name before the check, and writing the normalized form
    back into the member attributes, makes the directories that get created
    match the path that was validated.
    - debian/patches/CVE-2026-19672.patch: backport of cpython
      97688346ada2df3e5b9c279348862c3d64ab0823 (gh-155999, GH-156000). The
      seven added lines and all of their context are upstream's verbatim; the
      hunk applies to this tree unchanged. The upstream regression test
      test_parent_dir_out_and_back is carried as merged, only re-anchored,
      because this tree's test_parent_symlink has no @symlink_test decorator
      for the hunk to end on.
    - Behaviour change: the "tar" and "data" filters now normalize member
      names containing ".." with os.path.normpath(), which removes internal
      ".." components and may change the meaning of a name that traverses
      symbolic links.
    - This CVE reaches this package only because the PEP 706 extraction
      filters are backported here by CVE-2007-4559.patch and the
      realpath(strict=ALLOW_MISSING) containment check by CVE-2026-7774.patch;
      upstream 3.7 has no filter machinery at all. The patch is
      therefore ordered after every other tarfile-touching patch in all three
      packaging paths.
    - CVE-2026-19672
  * The Misc/NEWS.d fragments of both upstream commits are omitted; this
    version ships a single Misc/NEWS file.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 22 Sep 2026 12:00:00 +0000

alt-python37 (3.7.17-32) stable; urgency=medium

  * SECURITY UPDATE: tarfile PEP 706 "data"/"tar" extraction filter bypass
    via a hard link to a symlink. A crafted archive whose hard link names a
    symlink stored deeper in the archive made makelink_with_filter() call
    os.link() on the unresolved source; link(2) does not follow symlinks, so
    the extracted member became the same symlink inode under the hard link's
    own, shallower name, where its relative payload re-bases outside the
    destination. The chmod()/utime() that tarfile applies next then hit the
    outside file, changing its mode and mtime, and its contents became
    readable from inside the extracted tree (CWE-59).
    - debian/patches/CVE-2026-82049.patch: backport of cpython
      b8f23e307097552eaea2604383a12ab280520d0d (gh-157190, GH-157191,
      GH-157192), the 3.13-branch form of the fix; the changed line and its
      comment are upstream's verbatim, only re-anchored because this tree
      has no "unlink an existing targetpath" step before os.link(). The
      upstream regression test test_sneaky_hardlink_relocation is carried
      too, minus the @symlink_test / @os_helper.skip_unless_hardlink
      decorators and with os_helper.can_symlink() spelled
      support.can_symlink(), neither of which exists in 3.7.
    - The one-line fix closes only the variant where the archive carries a
      decoy file at the outer name, so os.path.exists(tarinfo._link_target)
      is true and extraction goes through os.link(). The decoy-less variant
      never reaches os.link() at all; under the "data" filter it is rejected
      by CVE-2026-11940.patch, already in this package, so the two must not
      be separated.
    - CVE-2026-82049
  * The Misc/NEWS.d fragment of the upstream commit is omitted; this version
    ships a single Misc/NEWS file.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 18 Sep 2026 12:00:00 +0000

alt-python37 (3.7.17-31) stable; urgency=medium

  * SECURITY UPDATE: CPU denial-of-service in csv.Sniffer. Two independent
    regexes in Sniffer._guess_quote_and_delimiter() ran in super-linear time
    on samples reachable from the public csv.Sniffer.sniff() API (CWE-1176,
    algorithmic complexity). The quoted-field probe matched a field body with
    a lazy ".*?" under re.DOTALL, so a closing quote not followed by a
    delimiter was retried against every later quote in the sample: quadratic.
    The doubled-quote probe dq_regexp was unanchored, rescanned leading
    whitespace and ran even when no delimiter had been found, which is
    exponential on a sample carrying a run of quote characters.
    - debian/patches/CVE-2026-18503.patch: backport of cpython 19e5024518
      (gh-109638, GH-154868) and fd78b565 (gh-98820, GH-154867), both in
      their upstream 3.10-branch form. Both commits are part of Python
      3.10.21, the release the CVE record names as fixing the "0 to <
      3.10.21" range, and gh-98820 alone leaves the doubled-quote probe
      exponential: with it applied on its own, sniff() on
      '"",'*100 + '"'*100 + '0' + '"'*100 + '0', on '"a"\n' + ' '*100000
      with delimiters=',;', and on '"a" "b"\n' + ' '*100000 each still runs
      unbounded inside a single C-level re call. Field bodies are now matched
      by unrolled, unambiguous loops that cannot backtrack, the doubled-quote
      probe is anchored on whole fields and skipped when no delimiter was
      found, and sniff() normalises CRLF and CR to LF first so the probe's
      "$" means end of record. The 3.10 commits are used rather than the
      3.11+ ones, which express the same fix with a possessive quantifier
      that Python 3.7's re module does not support.
    - CVE-2026-18503
  * The Misc/NEWS.d fragments of both commits are omitted; this version
    ships a single Misc/NEWS file.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 31 Aug 2026 12:15:00 +0000

alt-python37 (3.7.17-30) stable; urgency=medium

  * SECURITY UPDATE: xml.etree.ElementTree Element.findall(), iterfind()
    and find() were vulnerable to a quadratic-complexity CPU denial of
    service.  Evaluating an XPath index predicate ([1], [last()],
    [last()-N]) against a document with many same-tag siblings re-ran
    parent.findall(elem.tag) once per candidate element, which is
    quadratic in the number of siblings.
    - debian/patches/CVE-2026-6879.patch: backport of cpython
      2ffab083 (gh-152674).  Caches the element selected by the index
      predicate per (parent, tag) pair, so each sibling group is
      scanned only once.
    - CVE-2026-6879

 -- Viktor Borzov <vborzov@cloudlinux.com>  Tue, 11 Aug 2026 12:00:00 +0000

alt-python37 (3.7.17-29) stable; urgency=medium

  * SECURITY UPDATE: tarfile.data_filter could be bypassed using crafted
    link entries, including symlinks with empty or directory-like names,
    to redirect later archive members outside the intended extraction
    directory, so tarfile.extractall() could write files outside the
    destination directory.
    - debian/patches/CVE-2026-7774.patch: backport of cpython c063191c
      (gh-149486, 3.10 branch).  The 'data' filter now validates the
      normalized linkname that is actually written to disk, strips
      trailing separators from the member name when resolving the
      directory a symlink target is relative to, and rejects link
      members whose name resolves to the destination directory itself.
    - CVE-2026-7774
  * debian/patches/CVE-2026-8328.patch: register the TestFtpcpSecurity
    test class in test_ftplib's test_main so regrtest actually runs it
    (fixes an omission in the original backport; no functional change
    to the CVE fix itself).

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Mon, 10 Aug 2026 02:45:25 -0400

alt-python37 (3.7.17-28) stable; urgency=medium

  * SECURITY UPDATE: unicodedata.normalize() used an O(n^2) insertion
    sort for canonical ordering of combining characters, so a crafted
    Unicode string with many combining characters in alternating
    canonical-combining-class order caused a CPU denial of service.
    - debian/patches/CVE-2026-3276.patch: backport of cpython
      991224b1 + 90748760 (gh-149079).  Canonical ordering now sorts
      each combining-character run in the Py_UCS4 output buffer with a
      hybrid insertion/counting sort (insertion sort below 20
      characters, counting sort from 20 up), reducing the worst case
      to O(n).
    - CVE-2026-3276

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Fri, 07 Aug 2026 04:33:40 -0400

alt-python37 (3.7.17-27) stable; urgency=medium

  * SECURITY UPDATE: the tarfile extraction filters ('data' and 'tar')
    could be bypassed by a crafted archive whose hardlink references a
    symlink stored at a deeper name than the hardlink itself.  The
    hardlink-extraction fallback validated the symlink at its archived
    location but recreated it at the hardlink's shallower path, so a
    relative target could escape the destination directory.  Incomplete
    fix of CVE-2025-4330.
    - debian/patches/CVE-2026-11940.patch: backport of cpython
      be13e86f (gh-151558, 3.11 branch).  makelink_with_filter now
      re-runs the filter on the member re-rooted at the link's own path
      before using the fallback, so an escaping target is rejected with
      LinkFallbackError.
    - CVE-2026-11940
  * SECURITY UPDATE: configparser wrote multi-line values containing
    carriage return characters without escaping them, so a value under
    attacker control could inject unexpected keys, values and sections
    into the written configuration file.
    - debian/patches/CVE-2026-0864.patch: backport of cpython
      5858e42c (gh-143927).  RawConfigParser.write() now normalizes all
      line endings (CR, CRLF and LF) to "\n\t".
    - CVE-2026-0864
  * SECURITY UPDATE: tarfile did not handle EOF in _Stream.seek() for
    files opened in streaming mode ("r|"), so a small forged archive
    whose member header declares a huge size made archive parsing loop
    once per declared block against an already-exhausted stream,
    causing a CPU denial of service.
    - debian/patches/CVE-2026-11972.patch: backport of cpython
      f50bf135 (gh-151981).  The block loop in _Stream.seek() now
      breaks when read() returns no data.
    - CVE-2026-11972

  * SECURITY UPDATE: TarFile.extract() did not pass the extraction filter
    down to _extract_one(), so on the single-member extract() path the
    hardlink/symlink extraction fallback recreated the link target without
    applying the filter: attacker-controlled mode, uid and gid were
    applied verbatim even with filter='data', and the
    CVE-2025-4330/CVE-2026-11940 fallback checks never ran there.
    - debian/patches/CVE-2026-4360.patch: backport of cpython 7ccdbaba
      (gh-151987, Petr Viktorin).  extract() now forwards filter_function
      to _extract_one().  Adapted to 3.7: fix hunk identical to upstream;
      the regression tests' parenthesized multi-item "with" blocks are
      rewritten as backslash-continued statements (3.7 syntax).
    - CVE-2026-4360

 -- Tamar Zerekidze <tzerekidze@cloudlinux.com>  Tue, 04 Aug 2026 10:14:06 -0400

alt-python37 (3.7.17-26) stable; urgency=medium

  * SECURITY UPDATE: html.parser.HTMLParser was vulnerable to a
    quadratic-complexity CPU denial of service.  Feeding an unterminated
    markup construct (e.g. a tag or comment) in many small chunks made
    feed() re-scan and re-concatenate the growing unparsed buffer on
    every call, which is quadratic in the input size.
    - debian/patches/CVE-2026-15308.patch: backport of cpython
      bcf98ddb (gh-153030).  Accumulates incoming data in a list and
      only joins/parses it once enough has piled up, flushing any
      pending data in close().
    - CVE-2026-15308

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 20 Jul 2026 12:00:00 +0200

alt-python37 (3.7.17-25) stable; urgency=medium

  * SECURITY UPDATE: reusing a bz2.BZ2Decompressor after libbz2 reported
    a decompression error could re-enter BZ2_bzDecompress() with
    inconsistent internal state, leading to a stack buffer overflow.
    - debian/patches/CVE-2026-9669.patch: backport of cpython
      5755d0f0 (gh-150599).  Records the libbz2 error code on the
      decompressor and clears needs_input, then refuses further
      decompress() calls with ValueError so libbz2 is never re-entered
      after an error.
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 23 Jun 2026 12:00:00 +0200

alt-python37 (3.7.17-24) stable; urgency=medium

  * SECURITY UPDATE: imaplib.IMAP4._command() did not reject control
    characters in command arguments, so a CR/LF embedded in an argument
    could inject a second IMAP command.
    - debian/patches/CVE-2025-15366.patch: backport of cpython
      6262704b (gh-143921).  Adds the _control_chars regex and rejects
      arguments containing bytes in [\x00-\x1F\x7F] in _command() with
      ValueError.
    - CVE-2025-15366

  * SECURITY UPDATE: poplib.POP3._putcmd() did not reject control
    characters, allowing the same CR/LF command injection on the POP3
    socket.
    - debian/patches/CVE-2025-15367.patch: backport of cpython
      b234a2b6 (gh-143923).  Rejects lines containing bytes in
      [\x00-\x1F\x7F] in _putcmd() with ValueError.
    - CVE-2025-15367

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 08 Jun 2026 12:00:00 +0200

alt-python37 (3.7.17-23) stable; urgency=medium

  * SECURITY UPDATE: base64.b64decode / urlsafe_b64decode silently
    accepted the '+/' alphabet regardless of altchars.
    - debian/patches/CVE-2025-12781.patch: backport of cpython 3.x
      9060b4ab (gh-125346) - deprecation-only fix that emits a
      DeprecationWarning / FutureWarning when '+' / '/' appear in
      input outside the configured alphabet.  Behavior is unchanged,
      matching upstream's deprecation intent.
    - CVE-2025-12781

  * SECURITY UPDATE: wsgiref.headers.Headers did not reject control
    characters in header names / values.
    - debian/patches/CVE-2026-0865.patch: combined backport of cpython
      22e4d552 (gh-143916, the initial fix that adds a control-char
      regex check in _convert_string_type) and follow-up 83ecd187
      (gh-144762, "Allow HTAB in wsgiref header values" per RFC 9110
      Section 5.5).  Splits the regex into _name_disallowed_re and
      _value_disallowed_re, threads a keyword-only `name` parameter
      through _convert_string_type, and updates every caller to pass
      name=True or name=False.  HTAB is now allowed in header values
      but still rejected in header names; LF / CR / DEL remain
      rejected in both.
    - CVE-2026-0865

  * SECURITY UPDATE: http.client did not reject CR/LF in HTTPConnection
    CONNECT tunnel host / headers, enabling request injection.
    - debian/patches/CVE-2026-1502.patch: backport of cpython
      05ed7ce7 (gh-146211).  Validates the tunnel host and each
      tunnel header name / value via _is_legal_header_name /
      _is_illegal_header_value before sending.
    - CVE-2026-1502

  * SECURITY UPDATE: http.cookies.Morsel.js_output() emitted an inline
    <script> snippet that only escaped " and left </script> intact.
    - debian/patches/CVE-2026-6019.patch: backport of cpython
      f795e042 (gh-90309).  Base64-encodes the cookie value and emits
      a self-decoding JavaScript stub instead of an unescaped string
      literal.  Builds on top of the CVE-2026-3644 control-character
      validation that the repo already carries.
    - CVE-2026-6019

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 18:00:00 +0200

alt-python37 (3.7.17-22) stable; urgency=medium

  * SECURITY UPDATE: email address-list folding could unicode-encode the
    comma separator together with a folded line.
    - debian/patches/CVE-2025-1795.patch: combined backport of cpython
      9148b77e (gh-100884, the original fix that marks ListSeparator
      with as_ew_allowed = False) and the upstream regression fix
      4762b36540 (gh-118643).  The original fix introduced two issues
      in _refold_parse_tree(): (a) when want_encoding=True met a
      ListSeparator, the `part.syntactic_break` branch called
      `part.fold()` on a Terminal which has no fold() method ->
      AttributeError; (b) even after the fall-through, the inner
      else-branch still called _fold_as_ew() on the Terminal,
      re-encoding the comma -- the very behaviour gh-100884 set out
      to suppress.  gh-118643 closes both: adds
      ListSeparator.syntactic_break = False, and restructures the
      inner if/else into `elif part.as_ew_allowed` (do encode) vs
      `else` (keep non-encoded, fall through).
    - CVE-2025-1795

  * SECURITY UPDATE: html.parser.HTMLParser had worst-case quadratic
    complexity on crafted malformed input, enabling amplified DoS.
    - debian/patches/CVE-2025-6069.patch: backport of cpython 3.9
      6eb6c5db (gh-135462).  Adds endtagopen regex and rewrites the
      EOF handling in goahead() per HTML5 spec.
    - CVE-2025-6069

  * SECURITY UPDATE: zipfile did not validate the ZIP64 EOCD locator
    offset, blindly seeking to the previous record.
    - debian/patches/CVE-2025-8291.patch: backport of cpython 3.9
      76437ac (gh-139700).  Adds reloff > offset guard in
      _EndRecData64.
    - CVE-2025-8291

  * SECURITY UPDATE: folding a long email header comment of only
    unfoldable characters dropped the enclosing parentheses.
    - debian/patches/CVE-2025-11468.patch: backport of cpython 3.11
      e9970f07 (gh-143935).  Adds make_parenthesis_pairs helper and
      teaches _refold_parse_tree to escape comment tokens.
    - CVE-2025-11468

  * SECURITY UPDATE: tarfile applied AREGTYPE -> DIRTYPE normalization
    even during multi-block GNU long members (LONGNAME / LONGLINK).
    - debian/patches/CVE-2025-13462.patch: backport of cpython 3.13
      ae99fe3 (gh-141707).  Threads a dircheck flag through
      frombuf / fromtarfile so normalization is skipped on follow-up
      headers.
    - CVE-2025-13462

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 17:30:00 +0200

alt-python37 (3.7.17-21) stable; urgency=medium

  * SECURITY UPDATE: rework the CVE-2026-7210 fix so the
    XML_SetHashSalt16Bytes code path is no longer inert when the linked
    libexpat does not bump XML_COMBINED_VERSION to 2.8.0 (Alpine system
    libexpat).
    - debian/patches/CVE-2026-7210.patch: rewritten.  Declares
      XML_SetHashSalt16Bytes as __attribute__((weak)) at the top of
      Modules/pyexpat.c and replaces the compile-time
      XML_COMBINED_VERSION / XML_HAS_SET_HASH_SALT_16_BYTES gate with a
      single runtime "if (... != NULL)" check at every call site
      (newxmlparseobject in pyexpat.c, the pyexpat C-API capsule init,
      and _elementtree.c).  RPM / Debian builds keep 16-byte mitigation
      via bundled libexpat 2.5.0 + CVE-2026-41080; Alpine activates
      the 16-byte path automatically the moment the system libexpat
      ships the entropy fix; libexpat without the symbol falls back
      to the legacy 8-byte XML_SetHashSalt path (no regression).
    - CVE-2026-41080.patch is unchanged.
    - CVE-2026-7210

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse accepted bracketed
    hosts that were not valid IPv6 / IPvFuture, enabling SSRF and
    parser-differential attacks.
    - debian/patches/CVE-2024-11168.patch: backport of cpython 3.11
      b2171a2 (gh-103848, Seth Larson).
    - CVE-2024-11168

  * SECURITY UPDATE: bundled libexpat 2.5.0 crashes in XML_ResumeParser
    when XML_StopParser is called on an unstarted parser (NULL deref).
    - debian/patches/CVE-2024-50602.patch: backport of libexpat
      51c70190 (PR #915).  Alpine builds use system expat
      (--with-system-expat) so this hardening affects only the
      bundled-expat path used by RPM/Debian builds.
    - CVE-2024-50602

  * SECURITY UPDATE: urllib.parse.urlsplit / urlparse continued to accept
    domain names containing square brackets after the CVE-2024-11168
    fix; follow-up that completes the validation.
    - debian/patches/CVE-2025-0938.patch: backport of cpython 3.10
      b8b4b71 (gh-105704).
    - CVE-2025-0938

  * SECURITY UPDATE: bytes.decode("unicode_escape", errors="ignore" or
    "replace") could trigger a use-after-free when the error handler
    reallocated the input buffer.
    - debian/patches/CVE-2025-4516.patch: backport of cpython 3.9
      8d35fd1b (gh-129648, Serhiy Storchaka).  Captures the initial
      starts pointer and only stores *first_invalid_escape when
      starts == initial_starts.
    - CVE-2025-4516

  * SECURITY UPDATE: ftplib.ftpcp() was not updated when CVE-2021-4189
    was fixed; still passed raw server-supplied PASV host / port to
    target.sendport().
    - debian/patches/CVE-2026-8328.patch: backport of cpython
      eac4fe3b (gh-87451, PR #149648).  Applies the CVE-2021-4189
      hardening to ftpcp() using source.sock.getpeername()[0]
      unless trust_server_pasv_ipv4_address is set.
    - CVE-2026-8328

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 17:00:00 +0200

alt-python37 (3.7.17-20) stable; urgency=medium

  * SECURITY UPDATE: xml.parsers.expat and xml.etree.ElementTree used
    insufficient entropy (a single Py_hash_t) to seed Expat's
    hash-flooding protection, allowing a crafted XML document to
    trigger hash flooding (CWE-331). The CPython side and the
    libexpat side of the fix are paired -- the new XML_SetHashSalt16Bytes
    call sites are inert unless the linked libexpat exposes the
    16-byte salt API. Because alt-python37 statically links the
    bundled Modules/expat/ tree (libexpat 2.5.0), we backport both
    halves here.
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). Adds the
      XML_SetHashSalt16Bytes function pointer to the pyexpat CAPI and
      uses it with 16 bytes of entropy in pyexpat.c and
      _elementtree.c when the 16-byte salt API is available; falls
      back to legacy XML_SetHashSalt otherwise. The original upstream
      conditional only checks XML_COMBINED_VERSION >= 20800; we widen
      it to also activate when the feature-test macro
      XML_HAS_SET_HASH_SALT_16_BYTES is defined, which our bundled
      expat patch exposes (see CVE-2026-41080.patch). On builds that
      use system libexpat (--with-system-expat, e.g. Alpine), the
      macro is absent and the version check still applies normally.
    - debian/patches/CVE-2026-41080.patch: backport of libexpat
      PR #1183 (https://github.com/libexpat/libexpat/pull/1183),
      restricted to the C sources needed for the bundled static
      link (Modules/expat/expat.h, internal.h, xmlparse.c). Widens
      the per-parser salt storage to a full struct sipkey (128 bits)
      and adds XML_SetHashSalt16Bytes. Also defines the alt-python-
      specific feature-test macro XML_HAS_SET_HASH_SALT_16_BYTES so
      the CPython side can detect the backported API without bumping
      XML_COMBINED_VERSION (the bundled tree still reports 2.5.0).
      Together with CVE-2026-7210 this activates the 16-byte salt
      path inside pyexpat / xml.etree against the bundled expat,
      restoring proper hash-flood mitigation.
    - CVE-2026-7210
    - CVE-2026-41080

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 22 May 2026 10:00:00 +0200

alt-python37 (3.7.17-19) stable; urgency=medium

  * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose
    mediatype contained control characters, allowing newline-based HTTP
    header injection downstream.
    - debian/patches/CVE-2025-15282.patch: backport of cpython
      f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F]
      regex check in data_open() and a matching test_invalid_mediatype.
    - CVE-2025-15282

  * SECURITY UPDATE: http.cookies.Morsel did not reject control characters
    in keys / values / coded_value, allowing cookie injection via
    __setitem__, setdefault, set, and BaseCookie.output.
    - debian/patches/CVE-2026-0672.patch: backport of cpython
      95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character
      helper and inserts validation in __setitem__, setdefault, set,
      plus a wrap of BaseCookie.OutputString / output.
    - CVE-2026-0672

  * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control
    characters could still bypass via Morsel.update(), |=, __setstate__
    (pickle), and BaseCookie.js_output().
    - debian/patches/CVE-2026-3644.patch: backport of cpython
      57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds
      validation to Morsel.update(), defines explicit Morsel.__ior__
      (was inherited from dict and bypassed validation), validates
      __setstate__ before assigning attributes, and re-validates the
      assembled output string in js_output().
    - CVE-2026-3644

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RecursionError instead of crashing.
    - CVE-2026-4224

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 10:00:00 +0200

alt-python37 (3.7.17-18) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64_impl no longer breaks out on a pad
      sequence; a `pads` counter is added so post-loop validation still
      raises "Incorrect padding" / "Invalid base64-encoded string" for
      inputs that do not satisfy `quad_pos + pads == 4`. The unused
      `binascii_find_valid` helper is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python37 (3.7.17-17) stable; urgency=medium

  * SECURITY UPDATE: email BytesGenerator header injection
    - debian/patches/CVE-2026-1299.patch: combined backport of
      gh-121650 (CVE-2024-6923) and gh-144125 (CVE-2026-1299) that
      adds email.errors.HeaderWriteError, the
      policy.verify_generated_headers attribute, and the
      verify-on-write check for both Generator and BytesGenerator,
      preventing CRLF/LF header injection through custom fold().
    - CVE-2026-1299
  * SECURITY UPDATE: ssl.SSLContext memory race in cert_store_stats /
    get_ca_certs
    - debian/patches/CVE-2024-0397.patch: backport the
      X509_STORE_get1_objects shim and the x509_object_dup helper from
      cpython 3.8.20 (29c97287d2). The two affected impl functions in
      Modules/_ssl.c (cert_store_stats / get_ca_certs) now take a
      deep-copy snapshot of the X509_STORE under X509_STORE_lock(),
      preventing the use-after-free that occurred when certificates
      were loaded concurrently from another thread.
    - CVE-2024-0397
  * SECURITY UPDATE: ipaddress is_private/is_global misclassification
    - debian/patches/CVE-2024-4032.patch: backport cpython 3.8.20 fix
      895f7e2ac2 (gh-113171). Adds the
      _IPv4Constants._private_networks_exceptions list (192.0.0.9/32,
      192.0.0.10/32) and the IPv6 equivalents (2001:1::1/128,
      2001:1::2/128, 2001:3::/32, 2001:4:112::/48, 2001:20::/28,
      2001:30::/28). Expands 192.0.0.0/29 to /24, adds 64:ff9b:1::/48
      and 2002::/16 to the IPv6 _private_networks list, and updates
      is_private to filter against the exceptions list and use
      ipv4_mapped semantics on IPv6.
    - CVE-2024-4032

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 12:00:00 +0200

alt-python37 (3.7.17-16) stable; urgency=medium

  * SECURITY UPDATE: zipfile quoted-overlap zip bomb
    - debian/patches/CVE-2024-0450.patch: raise BadZipFile when an
      archive entry overlaps with another entry or the central
      directory, preventing quoted-overlap zip bombs with extreme
      compression ratios.
    - CVE-2024-0450
  * SECURITY UPDATE: use-after-free in lzma/bz2 decompressors
    - debian/patches/CVE-2026-6100.patch: null next_in at the error:
      label of decompress() in Modules/_bz2module.c and
      Modules/_lzmamodule.c so the decompressor cannot be re-used
      with a stale buffer pointer after a MemoryError.
    - CVE-2026-6100

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 12:05:00 +0200

alt-python37 (3.7.17-15) stable; urgency=medium

  * SECURITY UPDATE: Command-line option injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject leading dashes in
      webbrowser.open() URLs to prevent command-line option injection
      in browser subprocesses
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 12:20:00 +0200

alt-python37 (3.7.17-14) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python37 (3.7.17-13) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in
      os.path.expandvars() by replacing the character-by-character loop
      with regex-based substitution in both posixpath and ntpath modules.
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Mon, 23 Feb 2026 10:33:00 +0100

alt-python37 (3.7.17-12) stable; urgency=medium

  * ALTPYTH-586: Initial build for arm64

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Thu, 26 Feb 2026 17:00:00 +0400

alt-python37 (3.7.17-11) stable; urgency=medium

  * SECURITY UPDATE: Traversing outside chmod directory
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filters directory members
      before chmod/chown
    - CVE-2024-12718
  * SECURITY UPDATE: Symlink exfiltration
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: properly handles different link
      semantics
    - CVE-2025-4138
  * SECURITY UPDATE: Hardlink Fallback Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink
      extraction falls back to copying
    - CVE-2025-4330
  * SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: account errorlevel
    - CVE-2025-4435
  * SECURITY UPDATE: PATH_MAX Attack
    - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE
      -2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow
      attacks
    - CVE-2025-4517

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Wed, 18 Feb 2026 08:11:00 +0100

alt-python37 (3.7.17-10) stable; urgency=medium

  * SECURITY UPDATE: Memory denial of service in plistlib
    - debian/patches/CVE-2025-13837.patch: read large data by chunks,
      therefore the upper limit of consumed memory is proportional to the
      size of the input file.
    - CVE-2025-13837

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 12 Feb 2026 08:04:42 +0100

alt-python37 (3.7.17-9) stable; urgency=medium

  * ALTNJS-243: Add ARM64 build support for Debian 12 and Debian 13

 -- Levon Matshkalyan <lmatshkalyan@corp.cloudlinux.com>  Mon, 09 Feb 2026 19:00:00 +0400

alt-python37 (3.7.17-8) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084
  * SECURITY UPDATE: Overwriting of arbitrary files by remote attackers
    - debian/patches/CVE-2007-4559.patch: implement PEP 706 - a filter in
      the tarfile module to prevent directory traversal vulnerability
    - CVE-2007-4559

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 09 Jan 2026 11:35:00 +0100

alt-python37 (3.7.17-7) stable; urgency=medium

  * SECURITY UPDATE: Bypass of domain e-mail-based protection mechanism by
    incorrect parsing of e-mail addresses that contain a special character
    - debian/patches/CVE-2023-27043.patch: reject malformed addresses in
      email.parseaddr()
    - CVE-2023-27043
  * SECURITY UPDATE: Bypass of the TLS handshake and included protections
    - debian/patches/CVE-2023-40217.patch: check for & avoid the ssl
      pre-close flaw
    - CVE-2023-40217

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 15 Dec 2025 11:23:00 +0100

alt-python37 (3.7.17-6) stable; urgency=medium

  * SECURITY UPDATE: Ability to modify permissions with privileged programs
    - debian/patches/CVE-2023-6597.patch: prevent tempfile.TemporaryDirectory
      class dereference symlinks
    - CVE-2023-6597

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 15 Dec 2025 10:40:00 +0100

alt-python37 (3.7.17-5) stable; urgency=medium

  * SECURITY UPDATE: ReDoS in tarfile module when parsing specially
    crafted tar archive headers
    - debian/patches/CVE-2024-6232.patch: Remove backtracking from
      tarfile header parsing
  * SECURITY UPDATE: DoS due to quadratic time complexity in http.cookies
    module when parsing quoted cookie values with backslashes
    - debian/patches/CVE-2024-7592.patch: Replace iterative regex search
      with single-pass substitution to eliminate quadratic complexity
  * SECURITY UPDATE: Command injection vulnerability in venv module activation
    scripts when virtual environment paths contain special shell characters
    - debian/patches/CVE-2024-9287.patch: Properly quote template
      strings in venv activation scripts

 -- Azat Nurgaliev <anurgaliev@cloudlinux.com>  Mon, 17 Nov 2025 19:08:00 +0200

alt-python37 (3.7.17-4) stable; urgency=medium

  * ALTPYTH-574: Build alt-python37 for Debian12/13

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Fri, 14 Nov 2025 14:20:00 +0200

alt-python37 (3.7.17-3) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200

alt-python37 (3.7.17-2) stable; urgency=medium

  * ALTPYTH-504: Switched to use_rpm_wheels patch

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 26 Jan 2024 12:00:00 +0100

alt-python37 (3.7.17-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * Updated to 3.8.17

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python37 (3.7.16-1) stable; urgency=medium

  * update to 3.7.16

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Jan 2023 12:00:00 +0200

alt-python37 (3.7.15-1) stable; urgency=medium

  * update to 3.7.15

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 24 Oct 2022 12:00:00 +0200

alt-python37 (3.7.13-1) stable; urgency=medium

  * update to 3.7.13

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 01 Aug 2022 17:46:00 +0200

alt-python37 (3.7.12-2) stable; urgency=medium

  * ALTPYTH-407: call lve-stats/accelerate-wp scripts

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 06 May 2022 18:00:00 +0200

alt-python37 (3.7.12-1) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 01 Oct 2021 13:07:43 +0300

