alt-python39 (3.9.23-19) stable; urgency=medium

  * SECURITY UPDATE: bz2.BZ2Decompressor could be reused after a
    decompression error. libbz2 leaves the bz_stream in an inconsistent
    state after reporting an error, so re-entering BZ2_bzDecompress() on
    that stream could write past the output buffer, a stack buffer
    overflow (CWE-121).
    - debian/patches/CVE-2026-9669.patch: backport of cpython 5755d0f083
      (gh-150599). Record the libbz2 error code in a new BZ2Decompressor
      bzerror field, clear needs_input on error, and raise
      ValueError("Decompressor is unusable after a previous error") on any
      subsequent decompress() call.
    - CVE-2026-9669

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 23 Jun 2026 12:00:00 +0200

alt-python39 (3.9.23-18) stable; urgency=medium

  * SECURITY UPDATE: imaplib.IMAP4._command() concatenated command
    arguments without rejecting control characters, allowing IMAP command
    injection via CR/LF in a user-controlled argument.
    - debian/patches/CVE-2025-15366.patch: backport of cpython 6262704b13
      (gh-143921). Add the _control_chars guard and raise ValueError on any
      argument byte in [\x00-\x1F\x7F].
    - CVE-2025-15366
  * SECURITY UPDATE: poplib.POP3._putcmd() wrote command lines without
    rejecting control characters, allowing POP3 command injection via CR/LF
    in a user-controlled argument.
    - debian/patches/CVE-2025-15367.patch: backport of cpython b234a2b675
      (gh-143923). Reject any line byte in [\x00-\x1F\x7F] with ValueError.
    - CVE-2025-15367

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Sun, 08 Jun 2026 12:00:00 +0200

alt-python39 (3.9.23-17) stable; urgency=medium

  * SECURITY UPDATE: tarfile normalized AREGTYPE blocks to DIRTYPE while
    processing GNU long name/link follow-up headers, allowing a crafted tar
    archive to be misinterpreted.
    - debian/patches/CVE-2025-13462.patch: backport of cpython 42d754e34c
      (gh-141707). Skip DIRTYPE normalization on follow-up headers via a
      dircheck flag.
    - CVE-2025-13462
  * SECURITY UPDATE: wsgiref.headers.Headers accepted C0 control characters
    in header names, values and parameters, enabling response splitting.
    - debian/patches/CVE-2026-0865.patch: backport of cpython f7fceed79c
      (gh-143916) plus the HTAB follow-up. Reject control characters; HTAB
      remains allowed in values but not names.
    - CVE-2026-0865
  * SECURITY UPDATE: http.client did not reject CR/LF in HTTP tunnel
    (CONNECT) request headers set via HTTPConnection.set_tunnel().
    - debian/patches/CVE-2026-1502.patch: backport of cpython 05ed7ce7ae
      (gh-146211). Validate the tunnel host and per-header name/value.
    - CVE-2026-1502
  * SECURITY UPDATE: http.cookies Morsel.js_output() emitted cookie values
    into a document.cookie assignment using only quote-escaping, allowing
    a </script> breakout / JavaScript injection.
    - debian/patches/CVE-2026-6019.patch: backport of cpython 76b3923d68
      (gh-90309). Base64-encode the value and wrap it in atob().
    - CVE-2026-6019

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 11:15:00 +0200

alt-python39 (3.9.23-16) stable; urgency=medium

  * SECURITY UPDATE: email address-list folding encoded the separating
    comma when it ended up on a folded, unicode-encoded line, letting some
    mail servers misinterpret the address header.
    - debian/patches/CVE-2025-1795.patch: backport of cpython 09fab93c3d
      (gh-100884). Mark the shared ListSeparator terminal as_ew_allowed=False
      and reuse it in get_address_list().
    - CVE-2025-1795
  * SECURITY UPDATE: quadratic complexity in html.parser.HTMLParser allowed
    a denial of service via specially crafted incomplete markup.
    - debian/patches/CVE-2025-6069.patch: backport of cpython 6eb6c5dbfb
      (gh-135462). Rewrite goahead() EOF handling for tags, comments,
      declarations and processing instructions.
    - CVE-2025-6069
  * SECURITY UPDATE: zipfile did not validate the ZIP64 end-of-central-
    directory record and locator, so a crafted archive could be
    misinterpreted.
    - debian/patches/CVE-2025-8291.patch: backport of cpython 162997bb70
      (gh-139700). Validate the zip64 EOCD record/locator consistency.
    - CVE-2025-8291
  * SECURITY UPDATE: header injection via folded comments in the email
    module.
    - debian/patches/CVE-2025-11468.patch: backport of cpython 17d1490aa9
      (gh-143935). Escape parentheses/backslashes in folded comments and
      fix WhiteSpaceTerminal.startswith_fws().
    - CVE-2025-11468

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 11:05:00 +0200

alt-python39 (3.9.23-15) stable; urgency=medium

  * SECURITY UPDATE: xml.parsers.expat / xml.etree.ElementTree used
    insufficient entropy for libexpat hash-flooding protection, allowing a
    crafted XML document to trigger hash collisions. Mitigation requires
    both libexpat 2.8.0+ (or a distro-backported equivalent that exports
    XML_SetHashSalt16Bytes) and a Python-side patch to seed the parser
    with the new 16-byte salt API.
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). pyexpat and _elementtree call
      XML_SetHashSalt16Bytes with _Py_HashSecret.expat.hashsalt16 (16
      bytes of entropy); legacy XML_SetHashSalt remains as the fallback
      when the loaded libexpat does not export the new symbol. The
      symbol is declared __attribute__((weak)) in Modules/pyexpat.c so
      the same source path works whether the build links against bundled
      libexpat 2.8.0+ or a distro libexpat 2.5/2.7 that backports the
      entropy fix without bumping XML_COMBINED_VERSION (Debian, Ubuntu,
      RHEL/CL, Alpine). Extends the PyExpat CAPI with a nullable
      SetHashSalt16Bytes slot populated from the weak reference.
    - CVE-2026-7210

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 28 May 2026 10:36:38 +0200

alt-python39 (3.9.23-14) stable; urgency=medium

  * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose
    mediatype contained control characters, allowing newline-based HTTP
    header injection downstream.
    - debian/patches/CVE-2025-15282.patch: backport of cpython
      f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F]
      regex check in data_open() and a matching test_invalid_mediatype.
    - CVE-2025-15282

  * SECURITY UPDATE: http.cookies.Morsel did not reject control characters
    in keys / values / coded_value, allowing cookie injection via
    __setitem__, setdefault, set, and BaseCookie.output.
    - debian/patches/CVE-2026-0672.patch: backport of cpython
      95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character
      helper and inserts validation in __setitem__, setdefault, set,
      plus a wrap of BaseCookie.OutputString / output.
    - CVE-2026-0672

  * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control
    characters could still bypass via Morsel.update(), |=, __setstate__
    (pickle), and BaseCookie.js_output().
    - debian/patches/CVE-2026-3644.patch: backport of cpython
      57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds
      validation to Morsel.update(), defines explicit Morsel.__ior__
      (was inherited from dict and bypassed validation), validates
      __setstate__ before assigning attributes, and re-validates the
      assembled output string in js_output().
    - CVE-2026-3644

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RecursionError instead of crashing.
    - CVE-2026-4224

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 08:22:00 +0200

alt-python39 (3.9.23-13) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64_impl no longer breaks out on a pad
      sequence; a `pads` counter tracks them so post-loop validation
      still raises "Incorrect padding" / "Invalid base64-encoded string"
      for inputs that do not satisfy `quad_pos + pads == 4`. The unused
      `done:` label is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python39 (3.9.23-12) stable; urgency=medium

  * SECURITY UPDATE: email.BytesGenerator did not quote newlines in
    serialized headers, allowing header injection when a custom header
    class (e.g. LiteralHeader) bypasses the email folding rules. This is
    a bypass of CVE-2024-6923, which only added the validation to the
    text Generator class.
    - debian/patches/CVE-2026-1299.patch: mirror the
      verify_generated_headers / NEWLINE_WITHOUT_FWSP check from
      Generator._write_headers into BytesGenerator._write_headers in
      Lib/email/generator.py, raising HeaderWriteError on unsafely
      folded or delimited headers; extend test_email tests to cover
      message.as_bytes().
    - CVE-2026-1299

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 09:30:00 +0200

alt-python39 (3.9.23-11) stable; urgency=medium

  * SECURITY UPDATE: use-after-free in lzma/bz2/gzip decompressors
    - debian/patches/CVE-2026-6100.patch: null next_in at the error:
      label of decompress() in Modules/_bz2module.c and
      Modules/_lzmamodule.c so the decompressor cannot be re-used
      with a stale buffer pointer after a MemoryError.
    - CVE-2026-6100

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 27 Apr 2026 12:00:00 +0200

alt-python39 (3.9.23-10) stable; urgency=medium

  * SECURITY UPDATE: webbrowser.open() accepts leading dashes in URLs which
    could be interpreted as command-line options by web browsers
    - debian/patches/CVE-2026-4519.patch: reject URLs starting with dashes
      in BaseBrowser._check_url() before passing to subprocess
    - CVE-2026-4519

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 11:30:00 +0200

alt-python39 (3.9.23-9) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python39 (3.9.23-8) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in
      os.path.expandvars() by replacing the character-by-character loop
      with regex-based substitution in both posixpath and ntpath modules.
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Mon, 23 Feb 2026 10:33:00 +0100

alt-python39 (3.9.23-7) stable; urgency=medium

  * Fix arm64 build: use multiarch SOABI suffix on all architectures
  * Fix hardcoded x86_64 in debug package config filename for arm64
  * Fix rm -rf __pycache__ failure under fakeroot on Debian 12
  * Use dh_missing --fail-missing instead of manual unpackaged files check

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Sun, 15 Feb 2026 15:00:00 +0400

alt-python39 (3.9.23-6) stable; urgency=medium

  * SECURITY UPDATE: Memory denial of service in plistlib
    - debian/patches/CVE-2025-13837.patch: read large data by chunks,
      therefore the upper limit of consumed memory is proportional to the
      size of the input file.
    - CVE-2025-13837

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Thu, 12 Feb 2026 08:04:42 +0100

alt-python39 (3.9.23-5) stable; urgency=medium

  * ALTPYTH-586: Add libnsl-dev runtime dependency for libs on Debian 13+

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 11 Feb 2026 15:00:00 +0400

alt-python39 (3.9.23-4) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 09 Jan 2026 11:35:00 +0100

alt-python39 (3.9.23-3) stable; urgency=medium

  * ALTPYTH-581: Build for Debian 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 01 Dec 2025 14:20:00 +0200

alt-python39 (3.9.23-1) stable; urgency=medium

  * ALTPYTH-558: Update to 3.9.23 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Jun 2025 00:23:28 +0000

alt-python39 (3.9.22-1) stable; urgency=medium

  * ALTPYTH-553: Update to 3.9.22 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 09 Apr 2025 00:24:05 +0000

alt-python39 (3.9.21-1) stable; urgency=medium

  * ALTPYTH-543: Update to 3.9.21 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Wed, 04 Dec 2024 00:24:04 +0000

alt-python39 (3.9.20-1) stable; urgency=medium

  * Update to 3.9.20 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Sat, 07 Sep 2024 00:22:57 +0000

alt-python39 (3.9.19-3) stable; urgency=medium

  * ALTPYTH-518: Resolve conflicts with idle3.appdata.xml with other alt-pythonXX-idle packages

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Thu, 25 Jul 2024 17:03:00 +0200   
 
alt-python39 (3.9.19-2) stable; urgency=medium

  * ALTPYTH-509: Always use alt-sqlite

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 10 Apr 2024 15:05:00 +0200  
 
alt-python39 (3.9.19-1) stable; urgency=medium

  * ALTPYTH-510: Update to 3.9.19 version

 -- CloudLinux Packaging Team <packager@cloudlinux.com>  Tue, 19 Mar 2024 18:23:03 +0000

alt-python39 (3.9.18-1) stable; urgency=medium

  * ALTPYTH-476: Build missing alt-python packages for CL ubuntu.
  * update to 3.9.18

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Mon, 21 Aug 2023 14:20:00 +0200

alt-python39 (3.9.16-1) stable; urgency=medium

  * update to 3.9.16

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 30 Jan 2023 17:00:00 +0200

alt-python39 (3.9.15-1) stable; urgency=medium

  * update to 3.9.15
  * ALTPYTH-443: CL9 compatibility
  * Stripped debug symbols

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Fri, 21 Oct 2022 17:08:00 +0200

alt-python39 (3.9.12-1) stable; urgency=medium

  * update to 3.9.12
  * ALTPYTH-417: fix python-wheels path

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Wed, 06 Apr 2022 10:08:00 +0200

alt-python39 (3.9.10-1) stable; urgency=medium

  * update to 3.9.10

 -- Sergey Fokin <sfokin@cloudlinux.com>  Tue, 01 Feb 2022 10:46:00 +0300

alt-python39 (3.9.9-1) stable; urgency=medium

  * ALTPYTH-397: Fix the path of _WHEEL_DIR in alt-python 3.9
  * ALTPYTH-402: update to 3.9.9

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 17 Jan 2022 16:43:00 +0300

alt-python39 (3.9.7-1) stable; urgency=medium

  * initial build

 -- Sergey Fokin <sfokin@cloudlinux.com>  Fri, 27 Oct 2021 11:27:00 +0300
