alt-python27 (2.7.18-21) stable; urgency=medium

  * SECURITY UPDATE: command injection via control characters in imaplib
    - debian/patches/CVE-2025-15366-CVE-2025-15367.patch: backport of
      cpython 6262704b (gh-143921, Seth Michael Larson).
      imaplib.IMAP4._command() concatenated each argument into the
      wire-level command without inspecting it, so user-controlled text
      (e.g. a username passed to IMAP4.login()) containing CR/LF or other
      control characters could inject a second IMAP command. Adds a
      module-level _control_chars regex to Lib/imaplib.py and a guard in
      _command() that rejects any argument containing a byte in
      [\x00-\x1F\x7F] with ValueError before concatenation. Adds a
      test_control_characters regression test to Lib/test/test_imaplib.py.
    - CVE-2025-15366
  * SECURITY UPDATE: command injection via control characters in poplib
    - debian/patches/CVE-2025-15366-CVE-2025-15367.patch: backport of
      cpython b234a2b6 (gh-143923, Seth Michael Larson).
      poplib.POP3._putcmd() sent its argument to the server without
      inspecting it, so user-controlled text passed to
      user()/pass_()/apop()/rpop()/top() could inject a second POP3
      command. Adds a guard in _putcmd() (Lib/poplib.py) that rejects any
      argument containing a byte in [\x00-\x1F\x7F] with ValueError before
      sending. Adds a test_control_characters regression test to
      Lib/test/test_poplib.py.
    - CVE-2025-15367

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 08 Jun 2026 09:00:00 +0200

alt-python27 (2.7.18-20) stable; urgency=medium

  * SECURITY UPDATE: CVE-2026-7210 + CVE-2026-41080 (paired): backport
    the libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled
    expat 2.2.8 and wire pyexpat/_elementtree to use it. Together these
    restore proper hash-flood mitigation. xml.parsers.expat and
    xml.etree.ElementTree previously used only the legacy 8-byte
    XML_SetHashSalt API; that salt is brute-forceable with modern
    hardware, allowing a crafted XML document to trigger hash
    collisions and a denial of service.
    - debian/patches/CVE-2026-7210.patch: backport of cpython
      24b8f12544 (gh-149018, Stan Ulbrych). Switches pyexpat and
      _elementtree to XML_SetHashSalt16Bytes when built/linked against
      libexpat >= 2.8.0, falling back to the legacy XML_SetHashSalt on
      older expat. Adds a hashsalt16[16] field to _Py_HashSecret_t in
      Include/object.h (seeded by _PyRandom_Init alongside prefix /
      suffix) and a NULL-able SetHashSalt16Bytes function pointer in
      the pyexpat CAPI struct so _elementtree can dispatch at runtime.
      No upstream backport to 2.7 exists; upstream backports landed
      only to 3.14 / 3.15.
    - debian/patches/CVE-2026-41080.patch: backport of libexpat
      PR #1183 into the bundled Modules/expat/ tree (libexpat 2.2.8).
      Widens m_hash_secret_salt from `unsigned long` to a 128-bit
      `struct sipkey` and adds the new public XML_SetHashSalt16Bytes()
      entry point. Since pyexpat.so / _elementtree.so are statically
      linked against this tree, the cpython half now consumes full
      16-byte entropy without requiring an external libexpat
      >= 2.8.0 at runtime.
    - CVE-2026-7210
    - CVE-2026-41080

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Fri, 22 May 2026 10:00:00 +0200

alt-python27 (2.7.18-19) stable; urgency=medium

  * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow
    the C stack when an Expat parser with a registered ElementDeclHandler
    parsed a deeply nested DTD content model, causing a denial-of-service.
    - debian/patches/CVE-2026-4224.patch: C-level backport of cpython
      eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps
      conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall
      so deep nesting raises RuntimeError instead of crashing. The
      upstream Lib/test/test_pyexpat.py test addition is skipped: it
      depends on test.support.infinite_recursion() which only exists
      in Python 3.x test.support.
    - CVE-2026-4224

  * SECURITY UPDATE: Lib/Cookie.py Morsel accepts control characters
    in reserved-attribute values, in key/value/coded_value via .set(),
    and via the inherited dict.update() / pickle restoration paths,
    allowing newline-based HTTP header injection via Set-Cookie. The
    upstream CVE description and py3 fix target Lib/http/cookies.py
    (which does not exist in py2); a runtime POC confirmed the same
    vulnerability class is reachable through py2's Cookie module via
    five distinct write paths.
    - debian/patches/CVE-2026-0672-CVE-2026-3644.patch: py2 adaptation
      of cpython 95746b3a13 (gh-143919, Seth Larson) and 57e88c1cf9
      (gh-145599, Stan Ulbrych + Victor Stinner). Adds a
      _has_control_character helper and validates at Morsel.__setitem__,
      .setdefault, .set, an explicit .update, an explicit .__setstate__,
      plus re-validates the assembled output in Morsel.js_output and
      BaseCookie.output (defence-in-depth against direct attribute
      mutation). The py3 __ior__ hunk is not ported (py2 dict has no
      `|=` operator). Doctest fixture `keebler="...fudge=\012;"` is
      updated to drop the embedded newline, mirroring the upstream
      doctest fix.
    - CVE-2026-0672, CVE-2026-3644

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 11 May 2026 10:00:00 +0200

alt-python27 (2.7.18-18) stable; urgency=medium

  * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding
    after the first padded quad, silently dropping any excess data. The
    behaviour can lead to data being accepted that other implementations
    process differently.
    - debian/patches/CVE-2026-3446.patch: backport of upstream commits
      4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats
      the pad character as non-alphabet data per RFC 4648 section 3.3:
      the loop in binascii_a2b_base64 no longer breaks out on a pad
      sequence; a `pads` counter is added so post-loop validation still
      raises "Incorrect padding" for inputs that do not satisfy
      `quad_pos + pads == 4`. The unused `binascii_find_valid` helper
      is removed.
    - CVE-2026-3446

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 04 May 2026 09:30:00 +0200

alt-python27 (2.7.18-17) stable; urgency=medium

  * SECURITY UPDATE: header injection via newline in email.Generator
    - debian/patches/CVE-2026-1299.patch: add HeaderWriteError exception
      to Lib/email/errors.py, add NEWLINE_WITHOUT_FWSP regex to
      Lib/email/generator.py and check the header *value* in all four
      branches of Generator._write_headers(), raising HeaderWriteError
      when a CR/LF without folding whitespace is found. Updates
      test_embedded_header_via_string_rejected to expect
      HeaderWriteError instead of HeaderParseError. In Python 2.7 this
      single Generator-class hardening covers both upstream
      CVE-2026-1299 (BytesGenerator) and CVE-2024-6923 because
      BytesGenerator does not exist in 2.7.
    - CVE-2026-1299
  * SECURITY UPDATE: missing header-name newline check in email.Generator
    - debian/patches/CVE-2024-6923.patch: add NEWLINE_WITHOUT_FWSP check
      on the header *name* at the top of Generator._write_headers() in
      Lib/email/generator.py, raising HeaderWriteError when a CR/LF
      without folding whitespace is found in the header name. Documents
      HeaderWriteError in Doc/library/email.errors.rst and adds a
      test_invalid_header_format regression test in
      Lib/email/test/test_email_renamed.py.
    - CVE-2024-6923
  * SECURITY UPDATE: ssl.SSLContext data race in cert_store_stats /
    get_ca_certs
    - debian/patches/CVE-2024-0397.patch: backport of upstream 3.8
      commit 29c97287d2 ("[3.8] gh-114572: Fix locking in
      cert_store_stats and get_ca_certs"). Adds a polyfill of
      OpenSSL 3.3's X509_STORE_get1_objects() (deep-copy under
      X509_STORE_lock()) and replaces the shared, unlocked
      X509_STORE_get0_objects() calls in cert_store_stats() and
      get_ca_certs() in Modules/_ssl.c, preventing a memory race
      and potential use-after-free when an SSLContext is shared
      across multiple threads.
    - CVE-2024-0397
  * SECURITY UPDATE: open redirect in BaseHTTPServer when path starts
    with //
    - debian/patches/CVE-2021-28861.patch: backport of upstream commit
      4abab6b603 ("gh-87389: Fix an open redirection vulnerability in
      http.server"). In Lib/BaseHTTPServer.py, after the request line
      is parsed, collapse any leading run of '/' characters to a
      single '/' so an attacker-controlled '//evil.example/...' path
      cannot become an absolute scheme-less URI in a 301 Location
      header. Adds a regression test in Lib/test/test_httpservers.py.
    - CVE-2021-28861

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Wed, 29 Apr 2026 12:00:00 +0200

alt-python27 (2.7.18-16) stable; urgency=medium

  * SECURITY UPDATE: use-after-free in
    BZ2Decompressor when MemoryError is raised in the C-level
    decompress() helper
    - debian/patches/CVE-2026-6100.patch: defensively null
      bzs->next_in on the error: path of BZ2Decomp_decompress in
      Modules/bz2module.c.
    - CVE-2026-6100

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Tue, 28 Apr 2026 12:00:00 +0200

alt-python27 (2.7.18-15) stable; urgency=medium

  * SECURITY UPDATE: stack buffer overflow in ctypes PyCArg_repr
    - debian/patches/CVE-2021-3177.patch: replace sprintf into fixed
      char buffer[256] with PyUnicode_FromFormat in PyCArg_repr() in
      Modules/_ctypes/callproc.c, preventing a stack buffer overflow
      when a ctypes parameter repr is computed for a very large
      c_double or c_float value (e.g. c_double.from_param(1e300)).
    - CVE-2021-3177
  * SECURITY UPDATE: ftplib trusts server host from PASV response
    - debian/patches/CVE-2021-4189.patch: by default ignore the host
      value returned by the server in response to the PASV command
      and use the already-connected host instead. Opt-out by setting
      trust_server_pasv_ipv4_address=True on the FTP instance.
    - CVE-2021-4189
  * SECURITY UPDATE: zipfile quoted-overlap zip bomb
    - debian/patches/CVE-2024-0450.patch: raise BadZipfile when an
      archive entry overlaps with another entry or the central
      directory, preventing quoted-overlap zip bombs with extreme
      compression ratios.
    - CVE-2024-0450
  * SECURITY UPDATE: eval() on HTTP content in CJK codec test helper
    - debian/patches/CVE-2020-27619.patch: replace eval() with safe
      integer/hex parsing in Lib/test/multibytecodec_support.py so
      mapping files fetched over HTTP from www.unicode.org can no
      longer trigger arbitrary code execution via MITM.
    - CVE-2020-27619

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Wed, 22 Apr 2026 12:40:00 +0200

alt-python27 (2.7.18-14) stable; urgency=medium

  * SECURITY UPDATE: command-line option injection in webbrowser.open()
    - debian/patches/CVE-2026-4519.patch: reject leading dashes in
      webbrowser.open() URLs to prevent command-line option injection
      in browser subprocesses
    - CVE-2026-4519

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Tue, 14 Apr 2026 12:30:00 +0200

alt-python27 (2.7.18-13) stable; urgency=medium

  * ALTPYTH-597: Fix debug build on arm64: disable --with-tsc for
    unsupported architectures

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Thu, 27 Mar 2026 12:00:00 +0400

alt-python27 (2.7.18-12) stable; urgency=medium

  * SECURITY UPDATE: quadratic complexity in os.path.expandvars()
    - debian/patches/CVE-2025-6075.patch: replace character-by-character loop
      with regex-based substitution to fix quadratic complexity
    - CVE-2025-6075

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Tue, 03 Mar 2026 10:44:00 +0100

alt-python27 (2.7.18-11) stable; urgency=medium

  * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and
    deadlock in parsing of maliciously crafted tar archives
    - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member
      offsets are non-negative
    - CVE-2025-8194

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 27 Feb 2026 10:38:00 +0100

alt-python27 (2.7.18-10) stable; urgency=medium

  * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache
    clearing
    - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in
      xml.minidom node ID cache clearing
    - CVE-2025-12084

 -- Juan Carlos García <jgarcia@cloudlinux.com>  Fri, 20 Feb 2026 07:51:00 +0100

alt-python27 (2.7.18-9) stable; urgency=medium

  * SECURITY UPDATE: Shell command injection in mailcap module
    - debian/patches/CVE-2015-20107.patch: sanitize the second
      argument which allowing shell commands injection
    - CVE-2015-20107

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Wed, 18 Feb 2026 12:39:00 +0100

alt-python27 (2.7.18-8) stable; urgency=medium

  * SECURITY UPDATE: Web cache poisoning vulnerability
    - debian/patches/CVE-2021-23336.patch: fix web cache poisoning
      via urllib.parse.parse_qsl and urllib.parse.parse_qs
    - CVE-2021-23336
  * SECURITY UPDATE: Regular expression denial of service
    - debian/patches/CVE-2021-3733.patch: fix flaw in urllib’s
      AbstractBasicAuthHandler that could lead to a denial of service
      by leveraging a regular expression
    - CVE-2021-3733
  * SECURITY UPDATE: Constant-time-defeating optimisations issue
    - debian/patches/CVE-2022-48566.patch: make compare_digest more
      constant-time
    - CVE-2022-48566
  * SECURITY UPDATE: Incorrect parsing of email addresses containing special
    characters
    - debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by
      adding optional 'strict' parameter to getaddresses() and parseaddr()
      functions
    - CVE-2023-27043
  * SECURITY UPDATE: TLS handshake bypass
    - debian/patches/CVE-2023-40217.patch: Check for & avoid the ssl
      pre-close flaw. Update SSL tests
    - CVE-2023-40217

 -- Koba Karaputadze <kkaraputadze@cloudlinux.com>  Mon, 06 Oct 2025 10:00:00 +0400

alt-python27 (2.7.18-7) stable; urgency=medium

  * SECURITY UPDATE: DoS in regular expression because of
    urllib.request.AbstractBasicAuthHandler catastrophic backtracking
    - debian/patches/CVE-2020-8492.patch: fix DoS in the urllib regexp
    - CVE-2020-8492
  * SECURITY UPDATE: a header injection vulnerability for http methods
    in the httplib
    - debian/patches/CVE-2020-26116.patch: prevent header injection in
    http methods in httplib
    - CVE-2020-26116

 -- Pavel Kopylov <pkopylov@cloudlinux.com>  Mon, 06 Oct 2025 12:28:01 +0100

alt-python27 (2.7.18-6) stable; urgency=medium

  * SECURITY UPDATE: DoS in case of malicious XML entity declarations
    - debian/patches/CVE-2022-48565.patch: reject XML entity declarations
      in plist files
    - CVE-2022-48565
  * SECURITY UPDATE: Bypassing blocklisting methods by supplying a URL
    that starts with blank characters
    - debian/patches/CVE-2023-24329.patch,
      debian/patches/CVE-2023-24329-2.patch: prevent urllib.parse.urlparse
      from accepting schemes that don't begin with an alphabetical ASCII
      character
    - CVE-2023-24329
  * SECURITY UPDATE: ReDoS via specifically-crafted tar archives
    - debian/patches/CVE-2024-6232.patch: remove backtracking when parsing
      tarfile
    - CVE-2024-6232
  * SECURITY UPDATE: Excessive CPU usage while parsing a cookie value
    - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in
      parsing double-quoted cookie values with backslashes
    - CVE-2024-7592
  * SECURITY UPDATE: CPU DoS by crafting inputs to the IDNA decoder
    - debian/patches/CVE-2022-45061.patch: fix quadratic time idna
      decoding
    - CVE-2022-45061
  * SECURITY UPDATE: Use-after-free via heappushpop in heapq
    - debian/patches/CVE-2022-48560.patch: fix posible crash in heapq with
      custom comparison operators
    - debian/patches/CVE-2022-48560-2.patch: add tests for CVE-2022-48560
    - CVE-2022-48560
  * SECURITY UPDATE: DoS by HTTP client infinite line reading from
    malicious server after a 100 Continue response
    - debian/patches/CVE-2021-3737.patch: stop reading a header if it's
      too long
    - CVE-2021-3737
  * SECURITY UPDATE: A flaw in the urllib.parse module
    - debian/patches/CVE-2022-0391.patch: make urlparse sanitize URLs
      containing ASCII newline and tabs
    - CVE-2022-0391

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Fri, 03 Oct 2025 09:34:21 +0100

alt-python27 (2.7.18-5) stable; urgency=medium

  * Enable internal testing

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Fri, 03 Oct 2025 09:07:16 +0100

alt-python27 (2.7.18-4) stable; urgency=medium

  * ALTPYTH-568: Build for debian 13

 -- Levon Matshkalyan <lmatshkalyan@cloudlinux.com>  Tue, 30 Sep 2025 15:30:00 +0400

alt-python27 (2.7.18-3) stable; urgency=medium

  * SECURITY UPDATE: zip bomb vulnerability in Lib/zipfile.py
    - debian/patches/CVE-2019-9674.patch: add pitfalls to zipfile module
      documentation
    - CVE-2019-9674
  * SECURITY UPDATE: Infinite loop
    - debian/patches/CVE-2019-20907.patch: avoid infinite loop in the
      tarfile module in Lib/tarfile.py, Lib/test/test_tarfile.py.
    - CVE-2019-20907

 -- Jai S <jsathyapalan@cloudlinux.com>  Mon, 29 Sep 2025 18:23:17 +0000

alt-python27 (2.7.18-2) stable; urgency=medium

  * Fix build on ubuntu16.

 -- Dmitrii Samoilov <dsamoilov@cloudlinux.com>  Mon, 08 Sep 2025 04:26:00 +0100

alt-python27 (2.7.18-1) stable; urgency=medium

  * ALTPYTH-559: initial build for deb platforms

 -- Sergey Fokin <sfokin@cloudlinux.com>  Mon, 21 Jul 2025 17:04:00 +0100
