Tuxcare Errata System 0.0.1 5.10 2026-07-24T13:49:46 Debian 11 * SECURITY UPDATE: DOS, buffer overflow in SHA3, Possible Bypass Blocklisting Redirection vulnerability in http.server, regex DOS, Quadratic complexity, pathname quoting for venv - debian/patches/CVE-2022-37454.patch: fix a buffer overflow in Modules/_sha3/kcp/KeccakSponge.inc, Lib/test/test_hashlib.py (LP: #1995197). - debian/patches/CVE-2022-45061.patch: fix quadratic time idna decoding in Lib/encodings/idna.py, Lib/test/test_codecs.py. - debian/patches/CVE-2023-24329.patch: enforce that a scheme must begin with an alphabetical ASCII character in Lib/urllib/parse.py, Lib/test/test_urlparse.py. start stripping C0 control and space chars in `urlsplit` - debian/patches/CVE-2021-28861.patch: Fix an open redirection vulnerability in the `http.server` module when an URI path starts with `//` - debian/patches/CVE-2024-6232.patch: Fix header parsing vulnerability that could lead to ReDoS - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in parsing "-quoted cookie values with backslashes - debian/patches/CVE-2024-9287.patch: Quote template strings in `venv` activation - CVE-2022-37454 - CVE-2022-45061 - CVE-2023-24329 - CVE-2021-28861 - CVE-2024-6232 - CVE-2024-7592 - CVE-2024-9287 Critical TuxCare License Agreement CVE-2019-17514 CVE-2024-6232 CVE-2021-28861 CVE-2022-37454 CVE-2022-45061 CVE-2024-9287 CVE-2023-24329 CVE-2024-7592 Debian 11 * SECURITY UPDATE: zip bomb vulnerability in Lib/zipfile.py - debian/patches/CVE-2019-9674.patch: add pitfalls to zipfile module documentation - CVE-2019-9674 * SECURITY UPDATE: Infinite loop - debian/patches/CVE-2019-20907.patch: avoid infinite loop in the tarfile module in Lib/tarfile.py, Lib/test/test_tarfile.py. - CVE-2019-20907 Important TuxCare License Agreement CVE-2019-9674 Debian 11 * SECURITY UPDATE: DoS in case of malicious XML entity declarations - debian/patches/CVE-2022-48565.patch: reject XML entity declarations in plist files - CVE-2022-48565 * SECURITY UPDATE: Bypassing blocklisting methods by supplying a URL that starts with blank characters - debian/patches/CVE-2023-24329.patch, debian/patches/CVE-2023-24329-2.patch: prevent urllib.parse.urlparse from accepting schemes that don't begin with an alphabetical ASCII character - CVE-2023-24329 * SECURITY UPDATE: ReDoS via specifically-crafted tar archives - debian/patches/CVE-2024-6232.patch: remove backtracking when parsing tarfile - CVE-2024-6232 * SECURITY UPDATE: Excessive CPU usage while parsing a cookie value - debian/patches/CVE-2024-7592.patch: fix quadratic complexity in parsing double-quoted cookie values with backslashes - CVE-2024-7592 * SECURITY UPDATE: CPU DoS by crafting inputs to the IDNA decoder - debian/patches/CVE-2022-45061.patch: fix quadratic time idna decoding - CVE-2022-45061 * SECURITY UPDATE: Use-after-free via heappushpop in heapq - debian/patches/CVE-2022-48560.patch: fix posible crash in heapq with custom comparison operators - debian/patches/CVE-2022-48560-2.patch: add tests for CVE-2022-48560 - CVE-2022-48560 * SECURITY UPDATE: DoS by HTTP client infinite line reading from malicious server after a 100 Continue response - debian/patches/CVE-2021-3737.patch: stop reading a header if it's too long - CVE-2021-3737 * SECURITY UPDATE: A flaw in the urllib.parse module - debian/patches/CVE-2022-0391.patch: make urlparse sanitize URLs containing ASCII newline and tabs - CVE-2022-0391 Critical TuxCare License Agreement CVE-2019-20907 CVE-2021-3737 CVE-2022-48565 CVE-2022-0391 CVE-2024-7592 CVE-2022-48560 CVE-2024-6232 CVE-2022-45061 CVE-2023-24329 Debian 11 * SECURITY UPDATE: DoS in regular expression because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking - debian/patches/CVE-2020-8492.patch: fix DoS in the urllib regexp - CVE-2020-8492 * SECURITY UPDATE: a header injection vulnerability for http methods in the httplib - debian/patches/CVE-2020-26116.patch: prevent header injection in http methods in httplib - CVE-2020-26116 Important TuxCare License Agreement CVE-2020-26116 CVE-2020-8492 Debian 11 * SECURITY UPDATE: Web cache poisoning vulnerability - debian/patches/CVE-2021-23336.patch: fix web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs - CVE-2021-23336 * SECURITY UPDATE: Regular expression denial of service - debian/patches/CVE-2021-3733.patch: fix flaw in urllib’s AbstractBasicAuthHandler that could lead to a denial of service by leveraging a regular expression - CVE-2021-3733 * SECURITY UPDATE: Constant-time-defeating optimisations issue - debian/patches/CVE-2022-48566.patch: make compare_digest more constant-time - CVE-2022-48566 * SECURITY UPDATE: Incorrect parsing of email addresses containing special characters - debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses() and parseaddr() functions - CVE-2023-27043 * SECURITY UPDATE: TLS handshake bypass - debian/patches/CVE-2023-40217.patch: Check for & avoid the ssl pre-close flaw. Update SSL tests - CVE-2023-40217 Moderate TuxCare License Agreement CVE-2021-3733 CVE-2023-40217 CVE-2022-48566 CVE-2021-23336 CVE-2023-27043 Debian 11 * SECURITY UPDATE: Traversing outside chmod directory - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE -2025-4435-CVE-2025-4517.patch: re-filters directory members before chmod/chown - CVE-2024-12718 * SECURITY UPDATE: Symlink exfiltration - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE -2025-4435-CVE-2025-4517.patch: properly handles different link semantics - CVE-2025-4138 * SECURITY UPDATE: Hardlink Fallback Attack - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE -2025-4435-CVE-2025-4517.patch: re-filter the source if hardlink extraction falls back to copying - CVE-2025-4330 * SECURITY UPDATE: Errorlevel=0 Extracts Rejected Members - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE -2025-4435-CVE-2025-4517.patch: account errorlevel - CVE-2025-4435 * SECURITY UPDATE: PATH_MAX Attack - debian/patches/CVE-2024-12718-CVE-2025-4138-CVE-2025-4330-CVE -2025-4435-CVE-2025-4517.patch: prevents PATH_MAX overflow attacks - CVE-2025-4517 * TEST UPDATE: Incorrect encoding leading to an unexpected exception in test_tarfile.py - debian/patch/fix_test_tarfile-enconding.patch: fix encoding Important TuxCare License Agreement CVE-2024-12718 CVE-2025-4330 CVE-2025-4138 CVE-2025-4517 CVE-2025-4435 Debian 11 * SECURITY UPDATE: Ability to modify permissions with privileged programs - debian/patches/CVE-2023-6597: prevent tempfile.TemporaryDirectory class dereference symlinks - CVE-2023-6597 Important TuxCare License Agreement CVE-2023-6597 Debian 11 * SECURITY UPDATE: Memory denial of service in plistlib - debian/patches/CVE-2025-13837.patch: read large data by chunks, therefore the upper limit of consumed memory is proportional to the size of the input file. - CVE-2025-13837 Moderate TuxCare License Agreement CVE-2025-13837 Debian 11 * SECURITY UPDATE: Shell command injection in mailcap module - debian/patches/CVE-2015-20107.patch: sanitize the second argument which allowing shell commands injection - CVE-2015-20107 Important TuxCare License Agreement CVE-2015-20107 Debian 11 * SECURITY UPDATE: Shell command injection in the mailcap module - debian/patches/CVE-2015-20107.patch: sanitize the second argument which allowing shell command injection - CVE-2015-20107 Important TuxCare License Agreement CVE-2015-20107 Debian 11 * SECURITY UPDATE: Quadratic complexity in xml.minidom node ID cache clearing - debian/patches/CVE-2025-12084.patch: remove quadratic behavior in xml.minidom node ID cache clearing - CVE-2025-12084 Moderate TuxCare License Agreement CVE-2025-12084 Debian 11 * SECURITY UPDATE: Quadratic complexity in os.path.expandvars() - debian/patches/CVE-2025-6075.patch: fix quadratic complexity in os.path.expandvars() by replacing the character-by-character loop with regex-based substitution in both posixpath and ntpath modules. - CVE-2025-6075 Moderate TuxCare License Agreement CVE-2025-6075 Debian 11 * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and deadlock in parsing of maliciously crafted tar archives - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member offsets are non-negative - CVE-2025-8194 Important TuxCare License Agreement CVE-2025-8194 Debian 11 * SECURITY UPDATE: defect in 'tarfile' module leads to infinite loop and deadlock in parsing of maliciously crafted tar archives - debian/patches/CVE-2025-8194.patch: Validate archives to ensure member offsets are non-negative - CVE-2025-8194 Important TuxCare License Agreement CVE-2025-8194 Debian 11 * SECURITY UPDATE: quadratic complexity in os.path.expandvars() - debian/patches/CVE-2025-6075.patch: replace character-by-character loop with regex-based substitution to fix quadratic complexity - CVE-2025-6075 Moderate TuxCare License Agreement CVE-2025-6075 Debian 11 * SECURITY UPDATE: command-line option injection in webbrowser.open() - debian/patches/CVE-2026-4519.patch: reject leading dashes in webbrowser.open() URLs to prevent command-line option injection in browser subprocesses - CVE-2026-4519 Low TuxCare License Agreement CVE-2026-4519 Debian 11 * SECURITY UPDATE: command-line option injection in webbrowser.open() - debian/patches/CVE-2026-4519.patch: reject leading dashes in webbrowser.open() URLs to prevent command-line option injection in browser subprocesses - CVE-2026-4519 Low TuxCare License Agreement CVE-2026-4519 Debian 11 * SECURITY UPDATE: zipfile quoted-overlap zip bomb - debian/patches/CVE-2024-0450.patch: raise BadZipFile when an archive entry overlaps with another entry or the central directory, preventing quoted-overlap zip bombs with extreme compression ratios. - CVE-2024-0450 * SECURITY UPDATE: use-after-free in lzma/bz2 decompressors - debian/patches/CVE-2026-6100.patch: null next_in at the error: label of decompress() in Modules/_bz2module.c and Modules/_lzmamodule.c so the decompressor cannot be re-used with a stale buffer pointer after a MemoryError. - CVE-2026-6100 Critical TuxCare License Agreement CVE-2026-6100 CVE-2024-0450 Debian 11 * SECURITY UPDATE: use-after-free in BZ2Decompressor when MemoryError is raised in the C-level decompress() helper - debian/patches/CVE-2026-6100.patch: defensively null bzs->next_in on the error: path of BZ2Decomp_decompress in Modules/bz2module.c. - CVE-2026-6100 Critical TuxCare License Agreement CVE-2026-6100 CVE-2020-27619 CVE-2024-0450 CVE-2021-3177 CVE-2021-4189 Debian 11 * SECURITY UPDATE: header injection via newline in email.Generator - debian/patches/CVE-2026-1299.patch: add HeaderWriteError exception to Lib/email/errors.py, add NEWLINE_WITHOUT_FWSP regex to Lib/email/generator.py and check the header *value* in all four branches of Generator._write_headers(), raising HeaderWriteError when a CR/LF without folding whitespace is found. Updates test_embedded_header_via_string_rejected to expect HeaderWriteError instead of HeaderParseError. In Python 2.7 this single Generator-class hardening covers both upstream CVE-2026-1299 (BytesGenerator) and CVE-2024-6923 because BytesGenerator does not exist in 2.7. - CVE-2026-1299 * SECURITY UPDATE: missing header-name newline check in email.Generator - debian/patches/CVE-2024-6923.patch: add NEWLINE_WITHOUT_FWSP check on the header *name* at the top of Generator._write_headers() in Lib/email/generator.py, raising HeaderWriteError when a CR/LF without folding whitespace is found in the header name. Documents HeaderWriteError in Doc/library/email.errors.rst and adds a test_invalid_header_format regression test in Lib/email/test/test_email_renamed.py. - CVE-2024-6923 * SECURITY UPDATE: ssl.SSLContext data race in cert_store_stats / get_ca_certs - debian/patches/CVE-2024-0397.patch: backport of upstream 3.8 commit 29c97287d2 ("[3.8] gh-114572: Fix locking in cert_store_stats and get_ca_certs"). Adds a polyfill of OpenSSL 3.3's X509_STORE_get1_objects() (deep-copy under X509_STORE_lock()) and replaces the shared, unlocked X509_STORE_get0_objects() calls in cert_store_stats() and get_ca_certs() in Modules/_ssl.c, preventing a memory race and potential use-after-free when an SSLContext is shared across multiple threads. - CVE-2024-0397 * SECURITY UPDATE: open redirect in BaseHTTPServer when path starts with // - debian/patches/CVE-2021-28861.patch: backport of upstream commit 4abab6b603 ("gh-87389: Fix an open redirection vulnerability in http.server"). In Lib/BaseHTTPServer.py, after the request line is parsed, collapse any leading run of '/' characters to a single '/' so an attacker-controlled '//evil.example/...' path cannot become an absolute scheme-less URI in a 301 Location header. Adds a regression test in Lib/test/test_httpservers.py. - CVE-2021-28861 Important TuxCare License Agreement CVE-2024-6923 CVE-2021-28861 CVE-2024-0397 CVE-2026-1299 Debian 11 * SECURITY UPDATE: email BytesGenerator header injection - debian/patches/CVE-2026-1299.patch: verify generated headers in email.generator.BytesGenerator and Generator. Adds the HeaderWriteError exception, NEWLINE_WITHOUT_FWSP / NEWLINE_WITHOUT_FWSP_BYTES regexes, and the Policy.verify_generated_headers attribute, then raises HeaderWriteError when the folded header does not end with the policy linesep or contains a stray newline. Includes the CVE-2024-6923 prerequisite hardening of the string Generator. - CVE-2026-1299 * SECURITY UPDATE: ssl.SSLContext memory race in cert_store_stats / get_ca_certs - debian/patches/CVE-2024-0397.patch: backport the upstream X509_STORE_get1_objects shim and the x509_object_dup helper from cpython 29c97287d205bf2f410f4895ebce3f43b5160524, then switch _ssl__SSLContext_cert_store_stats_impl and _ssl__SSLContext_get_ca_certs_impl to take a deep-copy snapshot of the X509_STORE under lock, freeing the snapshot before returning. Closes a use-after-free triggered by loading certificates concurrently from another thread. - CVE-2024-0397 * SECURITY UPDATE: ipaddress is_private / is_global misclassification - debian/patches/CVE-2024-4032.patch: backport upstream gh-113171 / gh-65056. Update Lib/ipaddress.py to align the _private_networks lists with the IANA special-purpose registries and add _private_networks_exceptions so that is_private / is_global no longer misclassify addresses in 192.0.0.0/24 (with 192.0.0.9 and 192.0.0.10 exceptions), 64:ff9b:1::/48, 2002::/16, and the 2001::/23 sub-range exceptions (2001:1::1, 2001:1::2, 2001:3::/32, 2001:4:112::/48, 2001:20::/28, 2001:30::/28). Includes the matching docs and test updates. - CVE-2024-4032 Important TuxCare License Agreement CVE-2024-4032 CVE-2024-0397 CVE-2026-1299 Debian 11 * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding after the first padded quad, silently dropping any excess data. The behaviour can lead to data being accepted that other implementations process differently. - debian/patches/CVE-2026-3446.patch: backport of upstream commits 4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats the pad character as non-alphabet data per RFC 4648 section 3.3: the loop in binascii_a2b_base64_impl no longer breaks out on a pad sequence; a `pads` counter is added so post-loop validation still raises "Incorrect padding" for inputs that do not satisfy `quad_pos + pads == 4`. The unused `binascii_find_valid` helper is removed. - CVE-2026-3446 Moderate TuxCare License Agreement CVE-2026-3446 Debian 11 * SECURITY UPDATE: binascii.a2b_base64 / base64.b64decode stop decoding after the first padded quad, silently dropping any excess data. The behaviour can lead to data being accepted that other implementations process differently. - debian/patches/CVE-2026-3446.patch: backport of upstream commits 4561f6418a (main), e31c55121620 (3.14), 1f9958f909c1 (3.13). Treats the pad character as non-alphabet data per RFC 4648 section 3.3: the loop in binascii_a2b_base64 no longer breaks out on a pad sequence; a `pads` counter is added so post-loop validation still raises "Incorrect padding" for inputs that do not satisfy `quad_pos + pads == 4`. The unused `binascii_find_valid` helper is removed. - CVE-2026-3446 Moderate TuxCare License Agreement CVE-2026-3446 Debian 11 * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow the C stack when an Expat parser with a registered ElementDeclHandler parsed a deeply nested DTD content model, causing a denial-of-service. - debian/patches/CVE-2026-4224.patch: C-level backport of cpython eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall so deep nesting raises RuntimeError instead of crashing. The upstream Lib/test/test_pyexpat.py test addition is skipped: it depends on test.support.infinite_recursion() which only exists in Python 3.x test.support. - CVE-2026-4224 * SECURITY UPDATE: Lib/Cookie.py Morsel accepts control characters in reserved-attribute values, in key/value/coded_value via .set(), and via the inherited dict.update() / pickle restoration paths, allowing newline-based HTTP header injection via Set-Cookie. The upstream CVE description and py3 fix target Lib/http/cookies.py (which does not exist in py2); a runtime POC confirmed the same vulnerability class is reachable through py2's Cookie module via five distinct write paths. - debian/patches/CVE-2026-0672-CVE-2026-3644.patch: py2 adaptation of cpython 95746b3a13 (gh-143919, Seth Larson) and 57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds a _has_control_character helper and validates at Morsel.__setitem__, .setdefault, .set, an explicit .update, an explicit .__setstate__, plus re-validates the assembled output in Morsel.js_output and BaseCookie.output (defence-in-depth against direct attribute mutation). The py3 __ior__ hunk is not ported (py2 dict has no `|=` operator). Doctest fixture `keebler="...fudge=\012;"` is updated to drop the embedded newline, mirroring the upstream doctest fix. - CVE-2026-0672, CVE-2026-3644 Moderate TuxCare License Agreement CVE-2026-3644 CVE-2026-4224 CVE-2026-0672 Debian 11 * SECURITY UPDATE: urllib.request.DataHandler accepted data: URLs whose mediatype contained control characters, allowing newline-based HTTP header injection downstream. - debian/patches/CVE-2025-15282.patch: backport of cpython f25509e78e (gh-143925, Seth Larson). Adds a [\\x00-\\x1F\\x7F] regex check in data_open() and a matching test_invalid_mediatype. - CVE-2025-15282 * SECURITY UPDATE: http.cookies.Morsel did not reject control characters in keys / values / coded_value, allowing cookie injection via __setitem__, setdefault, set, and BaseCookie.output. - debian/patches/CVE-2026-0672.patch: backport of cpython 95746b3a13 (gh-143919, Seth Larson). Adds _has_control_character helper and inserts validation in __setitem__, setdefault, set, plus a wrap of BaseCookie.OutputString / output. - CVE-2026-0672 * SECURITY UPDATE: the CVE-2026-0672 fix was incomplete; control characters could still bypass via Morsel.update(), |=, __setstate__ (pickle), and BaseCookie.js_output(). - debian/patches/CVE-2026-3644.patch: backport of cpython 57e88c1cf9 (gh-145599, Stan Ulbrych + Victor Stinner). Adds validation to Morsel.update(), defines explicit Morsel.__ior__ (was inherited from dict and bypassed validation), validates __setstate__ before assigning attributes, and re-validates the assembled output string in js_output(). - CVE-2026-3644 * SECURITY UPDATE: Modules/pyexpat.c conv_content_model could overflow the C stack when an Expat parser with a registered ElementDeclHandler parsed a deeply nested DTD content model, causing a denial-of-service. - debian/patches/CVE-2026-4224.patch: backport of cpython eb0e8be3a7 (gh-145986, Stan Ulbrych + Bénédikt Tran). Wraps conv_content_model with Py_EnterRecursiveCall / Py_LeaveRecursiveCall so deep nesting raises RecursionError instead of crashing. - CVE-2026-4224 Moderate TuxCare License Agreement CVE-2025-15282 CVE-2026-3644 CVE-2026-4224 CVE-2026-0672 Debian 11 * SECURITY UPDATE: CVE-2026-7210 + CVE-2026-41080 (paired) — backport the libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled expat 2.4.1 and wire pyexpat/_elementtree to use it. Together these restore proper hash-flood mitigation for xml.parsers.expat and xml.etree.ElementTree. - debian/patches/CVE-2026-7210.patch: backport of cpython 24b8f12544 (gh-149018, Stan Ulbrych). Adds a new 16-byte _Py_HashSecret.expat.hashsalt16 slot in Include/pyhash.h (overlapping the existing padding), extends the PyExpat CAPI in Include/pyexpat.h with SetHashSalt16Bytes, and prefers the new API in Modules/pyexpat.c and Modules/_elementtree.c when built against libexpat exposing it; falls back to the legacy XML_SetHashSalt path otherwise. The two XML_COMBINED_VERSION gates are extended with `|| defined(XML_HAS_HASHSALT16BYTES_BACKPORT)` so the new code path activates against the bundled patched libexpat without bumping its advertised version, while --with-system-expat builds (Alpine) keep the upstream `>= 20800` semantics. - debian/patches/CVE-2026-41080.patch: backport of libexpat PR #1183. Widens the parser's internal hash salt from `unsigned long m_hash_secret_salt` to a full `struct sipkey m_hash_secret_salt_128` (+ an m_hash_secret_salt_set flag), adds the new XML_SetHashSalt16Bytes API and the matching XML_HAS_HASHSALT16BYTES_BACKPORT marker in expat.h, and namespaces the new symbol via pyexpatns.h. Applied to bundled Modules/expat/; on Alpine `prepare()` deletes Modules/expat after the patch, so the libexpat backport is a no-op there and the system libexpat decides whether the new API is available. - CVE-2026-7210 - CVE-2026-41080 Critical TuxCare License Agreement CVE-2026-7210 Debian 11 * SECURITY UPDATE: CVE-2026-7210 + CVE-2026-41080 (paired): backport the libexpat 16-byte salt API (XML_SetHashSalt16Bytes) into bundled expat 2.2.8 and wire pyexpat/_elementtree to use it. Together these restore proper hash-flood mitigation. xml.parsers.expat and xml.etree.ElementTree previously used only the legacy 8-byte XML_SetHashSalt API; that salt is brute-forceable with modern hardware, allowing a crafted XML document to trigger hash collisions and a denial of service. - debian/patches/CVE-2026-7210.patch: backport of cpython 24b8f12544 (gh-149018, Stan Ulbrych). Switches pyexpat and _elementtree to XML_SetHashSalt16Bytes when built/linked against libexpat >= 2.8.0, falling back to the legacy XML_SetHashSalt on older expat. Adds a hashsalt16[16] field to _Py_HashSecret_t in Include/object.h (seeded by _PyRandom_Init alongside prefix / suffix) and a NULL-able SetHashSalt16Bytes function pointer in the pyexpat CAPI struct so _elementtree can dispatch at runtime. No upstream backport to 2.7 exists; upstream backports landed only to 3.14 / 3.15. - debian/patches/CVE-2026-41080.patch: backport of libexpat PR #1183 into the bundled Modules/expat/ tree (libexpat 2.2.8). Widens m_hash_secret_salt from `unsigned long` to a 128-bit `struct sipkey` and adds the new public XML_SetHashSalt16Bytes() entry point. Since pyexpat.so / _elementtree.so are statically linked against this tree, the cpython half now consumes full 16-byte entropy without requiring an external libexpat >= 2.8.0 at runtime. - CVE-2026-7210 - CVE-2026-41080 Critical TuxCare License Agreement CVE-2026-7210 Debian 11 * SECURITY UPDATE: tarfile applied AREGTYPE -> DIRTYPE normalization even during multi-block GNU long members (GNUTYPE_LONGNAME / GNUTYPE_LONGLINK), enabling a parsing differential vs. other tar implementations. - debian/patches/CVE-2025-13462.patch: backport of cpython 42d754e3 (gh-143934, Seth Larson + Eashwar Ranganathan). Threads a dircheck flag through frombuf / fromtarfile so normalization is skipped on the inner header during GNU long name / link handling. - CVE-2025-13462 * SECURITY UPDATE: wsgiref.headers.Headers did not reject control characters in header names / values, allowing HTTP header injection from WSGI applications. - debian/patches/CVE-2026-0865.patch: combined backport of cpython f7fceed7 (gh-143917) which adds the control-char regex check, 66da7bf6 (gh-143916 HTAB follow-up) which splits the check so HTAB is allowed in header values (RFC 9110 Section 5.5) but still rejected in header names, plus d931725b (gh-144370) which disallows control characters in status in wsgiref.handlers.start_response. - CVE-2026-0865 * SECURITY UPDATE: http.client did not reject CR/LF in HTTPConnection CONNECT tunnel host / per-tunnel-header values, enabling request injection through a proxy tunnel. - debian/patches/CVE-2026-1502.patch: backport of cpython 05ed7ce7 + b1cf9016 (gh-146212, Seth Larson). Adapted to 3.6's per-line self.send() form (no headers=[] list in _tunnel until 3.9+). Validates _tunnel_host and per-header name / value in _tunnel(). - CVE-2026-1502 * SECURITY UPDATE: http.cookies.Morsel.js_output() emitted an inline <script> snippet that only escaped " and left </script> intact, enabling HTML injection when a cookie value contains </script>. - debian/patches/CVE-2026-6019.patch: backport of cpython 76b3923d (gh-148848, Seth Larson). Base64-encodes the cookie value and emits document.cookie = atob("...") instead of pasting the raw cookie string into the JavaScript snippet. Composes on top of CVE-2026-3644's js_output() control-character recheck (preserved). - CVE-2026-6019 Moderate TuxCare License Agreement CVE-2025-4516 CVE-2025-13462 CVE-2026-1502 CVE-2024-50602 CVE-2024-11168 CVE-2026-0865 CVE-2025-8291 CVE-2025-6069 CVE-2025-1795 CVE-2025-0938 CVE-2026-6019 CVE-2025-11468 Debian 11 * SECURITY UPDATE: command injection via control characters in imaplib - debian/patches/CVE-2025-15366-CVE-2025-15367.patch: backport of cpython 6262704b (gh-143921, Seth Michael Larson). imaplib.IMAP4._command() concatenated each argument into the wire-level command without inspecting it, so user-controlled text (e.g. a username passed to IMAP4.login()) containing CR/LF or other control characters could inject a second IMAP command. Adds a module-level _control_chars regex to Lib/imaplib.py and a guard in _command() that rejects any argument containing a byte in [\x00-\x1F\x7F] with ValueError before concatenation. Adds a test_control_characters regression test to Lib/test/test_imaplib.py. - CVE-2025-15366 * SECURITY UPDATE: command injection via control characters in poplib - debian/patches/CVE-2025-15366-CVE-2025-15367.patch: backport of cpython b234a2b6 (gh-143923, Seth Michael Larson). poplib.POP3._putcmd() sent its argument to the server without inspecting it, so user-controlled text passed to user()/pass_()/apop()/rpop()/top() could inject a second POP3 command. Adds a guard in _putcmd() (Lib/poplib.py) that rejects any argument containing a byte in [\x00-\x1F\x7F] with ValueError before sending. Adds a test_control_characters regression test to Lib/test/test_poplib.py. - CVE-2025-15367 Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 Debian 11 * SECURITY UPDATE: imaplib.IMAP4._command() concatenated each command argument into the wire-level command without inspecting it, so a caller passing user-controlled text could inject additional IMAP commands using CR/LF or other control characters. - debian/patches/CVE-2025-15366.patch: backport of cpython 6262704b (gh-143921, Seth Larson). Adds a module-level _control_chars regex and rejects any byte in [\x00-\x1F\x7F] with ValueError before concatenating each argument. Upstream-main-only fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464). - CVE-2025-15366 * SECURITY UPDATE: poplib.POP3._putcmd() encoded its argument and sent it to the server without inspecting it, allowing the same command injection via user() / pass_() / apop() / rpop() / top(). - debian/patches/CVE-2025-15367.patch: backport of cpython b234a2b6 (gh-143923, Seth Larson). Rejects any byte in [\x00-\x1F\x7F] with ValueError before sending. Upstream-main-only fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464). - CVE-2025-15367 Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 Debian 11 * SECURITY UPDATE: a bz2.BZ2Decompressor could be reused after a libbz2 decompression error. Re-entering BZ2_bzDecompress() once libbz2 had reported an error could write past the end of a stack buffer (CWE-121, possible stack buffer overflow). - debian/patches/CVE-2026-9669.patch: backport of cpython 5755d0f0 (gh-150599, Stan Ulbrych). Records the libbz2 error in a new bzerror field, clears needs_input on the error path, and makes decompress() raise ValueError ("Decompressor is unusable after a previous error") on any subsequent call. Adapted to 3.6: plain needs_input reset (no free-threading atomics) and the existing ACQUIRE_LOCK/RELEASE_LOCK wrappers; NEWS.d fragment omitted as 3.6.15 ships a single Misc/NEWS. - CVE-2026-9669 Important TuxCare License Agreement CVE-2026-9669 Debian 11 * SECURITY UPDATE: improper validation of bracketed hosts in urlparse - debian/patches/CVE-2024-11168.patch: backport of cpython b2171a2fd4 (gh-103848). urlparse.urlsplit() accepted bracketed hosts that are neither valid IPv6 nor IPvFuture literals. Adds _check_bracketed_host() to Lib/urlparse.py, called from both the "http" fast-path and the generic branch. Python 2.7 has no ipaddress module, so the bracket content is validated with socket.inet_pton() (IPv4 in brackets rejected; otherwise must parse as IPv6). - CVE-2024-11168 * SECURITY UPDATE: NULL deref in bundled libexpat XML_StopParser - debian/patches/CVE-2024-50602.patch: backport of libexpat PR #915 (51c7019069b8) into the bundled Modules/expat/ (2.2.8). XML_StopParser() on a parser in the XML_INITIALIZED state left it in a state where XML_ResumeParser() crashed via a NULL dereference. XML_StopParser() now refuses to stop/suspend an unstarted parser, returning the new XML_ERROR_NOT_STARTED. - CVE-2024-50602 * SECURITY UPDATE: square brackets allowed in parsed URL domain names - debian/patches/CVE-2025-0938.patch: backport of cpython b8b4b713c5 (gh-105704). Completes CVE-2024-11168 by rejecting square brackets in plain domain names. Adds _check_bracketed_netloc() to Lib/urlparse.py (mirroring NetlocResultMixins._hostinfo()) and uses it in both branches of urlsplit() in place of the inline bracket extraction. - CVE-2025-0938 Moderate TuxCare License Agreement CVE-2024-50602 CVE-2024-11168 CVE-2025-0938 Debian 11 * SECURITY UPDATE: expat billion-laughs / entity-expansion amplification DoS - debian/patches/CVE-2013-0340.patch: backport libexpat's billion-laughs attack protection (libexpat PR #466 / 2.4.0) into the bundled expat 2.2.8 tree (Modules/expat/xmlparse.c, expat.h, internal.h). Adds the accounting machinery, XML_ERROR_AMPLIFICATION_LIMIT_BREACH and the XML_SetBillionLaughsAttackProtection{MaximumAmplification, ActivationThreshold} setters (default 100x after 8 MiB). The fix is applied to the bundled copy (not system expat) so it coexists with the CloudLinux XML_SetHashSalt16Bytes extension; new public symbols are namespaced in pyexpatns.h. - CVE-2013-0340 * SECURITY UPDATE: control characters accepted in wsgiref response headers - debian/patches/CVE-2026-0865.patch: backport of cpython gh-143916 (GH-143917) and the HTAB follow-up (GH-144762). wsgiref.headers.Headers (Lib/wsgiref/headers.py) now rejects C0/DEL control characters in header names and values; HTAB remains legal in values, not names. Adapted to 2.7 (positional _convert_string_type flag, no keyword-only argument). - CVE-2026-0865 * SECURITY UPDATE: CR/LF injection in HTTP CONNECT tunnel headers - debian/patches/CVE-2026-1502.patch: backport of cpython gh-146211 (GH-146212). HTTPConnection._tunnel() (Lib/httplib.py) validates the tunnel host and each tunnel request header with the existing _contains_disallowed_url_pchar_re / _is_legal_header_name / _is_illegal_header_value helpers, rejecting control characters. - CVE-2026-1502 * SECURITY UPDATE: template injection via cookie values in js_output() - debian/patches/CVE-2026-6019.patch: backport of cpython gh-90309 (GH-148889), on top of CVE-2026-3644. Cookie.Morsel.js_output() (Lib/Cookie.py) base64-encodes the cookie value and emits it via atob() so it cannot break out of the JS string literal. - CVE-2026-6019 * SECURITY UPDATE: bz2 decompressor reuse-after-error stack overflow - debian/patches/CVE-2026-9669.patch: port of cpython gh-150599 (GH-150600) to the 2.7 bz2 wrapper (Modules/bz2module.c). After libbz2 reports a decompression error the stream is inconsistent and reusing it can write past the output buffer; the decompressor now records the error and raises ValueError on any further decompress() call. - CVE-2026-9669 Important TuxCare License Agreement CVE-2025-13462 CVE-2026-1502 CVE-2026-9669 CVE-2026-0865 CVE-2025-8291 CVE-2013-0340 CVE-2025-6069 CVE-2026-6019 Debian 11 * ALTPYTH-591: Update to 3.11.15 version Moderate TuxCare License Agreement CVE-2024-6923 Debian 11 * ALTPYTH-592: Update to 3.10.20 version Moderate TuxCare License Agreement CVE-2024-6923 Debian 11 * SECURITY UPDATE: reject control characters in imaplib IMAP4 commands - debian/patches/CVE-2025-15366.patch: guard IMAP4._command() - CVE-2025-15366 * SECURITY UPDATE: reject control characters in poplib POP3 commands - debian/patches/CVE-2025-15367.patch: guard POP3._putcmd() - CVE-2025-15367 * SECURITY UPDATE: control-character injection via http.cookies paths - debian/patches/CVE-2026-3644.patch: guard Morsel.update()/|=/unpickle/js_output - CVE-2026-3644 * SECURITY UPDATE: uncontrolled recursion in pyexpat content model - debian/patches/CVE-2026-4224.patch: recursion guard in conv_content_model() - CVE-2026-4224 * SECURITY UPDATE: webbrowser argument injection via leading-dash URL - debian/patches/CVE-2026-4519.patch: reject URLs starting with '-' - CVE-2026-4519 Important TuxCare License Agreement CVE-2025-15366 CVE-2025-15367 CVE-2026-3644 CVE-2026-4519 CVE-2026-4224 Debian 11 * SECURITY UPDATE: quadratic-complexity CPU DoS in incremental HTML parsing - debian/patches/CVE-2026-15308.patch: port of cpython gh-153030 (GH-153031). HTMLParser.feed() (Lib/HTMLParser.py) previously concatenated new data onto the unparsed buffer and re-scanned it from the start on every call, so feeding an unterminated construct in many small chunks was quadratic. New data is now accumulated in a list and only joined and parsed once enough has piled up; close() flushes the pending buffer. - CVE-2026-15308 Important TuxCare License Agreement CVE-2026-15308 Debian 11 * SECURITY UPDATE: webbrowser.open() dash-prefix check bypass via the action token - debian/patches/CVE-2026-4786.patch: validate the action-expanded URL and reorder the action/URL substitution so a URL containing the action token cannot expand into a dash-prefixed browser flag (CVE-2026-4519 bypass). - CVE-2026-4786 * SECURITY UPDATE: dangling input pointer (UAF) in bz2/lzma decompressors - debian/patches/CVE-2026-6100.patch: clear next_in on the MemoryError error path in _bz2/_lzma decompress() so a reused decompressor cannot read or write through a stale pointer to the released input buffer. - CVE-2026-6100 * SECURITY UPDATE: insufficient Expat hash-flooding entropy - debian/patches/CVE-2026-7210.patch: seed Expat with 16 bytes of entropy via XML_SetHashSalt16Bytes when libexpat exposes it (weak symbol), falling back to the legacy 8-byte salt otherwise. - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the BUNDLED expat (applied on ubuntu16.04 only; el7 on the RPM side) so the 16-byte salt path above is not inert; other platforms link system expat. - CVE-2026-7210 * SECURITY UPDATE: bz2.BZ2Decompressor reuse after error (stack overflow) - debian/patches/CVE-2026-9669.patch: record the libbz2 error and raise ValueError on any subsequent decompress() call instead of re-entering libbz2 on an inconsistent stream (CWE-121). - CVE-2026-9669 Critical TuxCare License Agreement CVE-2026-6100 CVE-2025-15366 CVE-2025-15367 CVE-2026-3644 CVE-2026-4519 CVE-2026-9669 CVE-2026-4786 CVE-2026-4224 CVE-2026-7210 Debian 11 * SECURITY UPDATE: html.parser.HTMLParser had quadratic complexity in incremental parsing. An unterminated construct (e.g. a tag or comment) fed across many feed() calls made the parser rescan the growing buffer and reconcatenate new data onto it on every call, both quadratic in the input size, allowing a CPU denial-of-service on uncontrolled data (CWE-407, algorithmic complexity). - debian/patches/CVE-2026-15308.patch: backport of cpython bcf98ddb (gh-153030, Serhiy Storchaka). feed() now accumulates new data in a list and only joins and parses it once enough has piled up, and close() flushes any pending buffer. Adapted to 3.6: feed()/close()/ reset() logic identical to upstream (3.6 already has list.clear()); the regression test is added with "from test import support"; the NEWS.d fragment is omitted as 3.6.15 ships a single Misc/NEWS. - CVE-2026-15308 Important TuxCare License Agreement CVE-2026-15308 Debian 11 * SECURITY UPDATE: webbrowser argument injection via action-token substitution - debian/patches/CVE-2026-4786.patch: validate expanded command (bypass of CVE-2026-4519) - CVE-2026-4786 * SECURITY UPDATE: use-after-free in bz2/lzma decompressor reuse after MemoryError - debian/patches/CVE-2026-6100.patch: clear next_in on the decompress error path - CVE-2026-6100 * SECURITY UPDATE: insufficient entropy for Expat hash-flooding protection - debian/patches/CVE-2026-7210.patch: use XML_SetHashSalt16Bytes 16-byte entropy - CVE-2026-7210 * SECURITY UPDATE: insufficient entropy in bundled Expat (libexpat) hash-flooding protection - debian/patches/CVE-2026-41080.patch: backport XML_SetHashSalt16Bytes into the bundled expat so the CVE-2026-7210 16-byte salt path is not inert on bundled-expat builds - CVE-2026-41080 * SECURITY UPDATE: stack buffer overflow via bz2 decompressor reuse after error - debian/patches/CVE-2026-9669.patch: refuse reuse after a previous error - CVE-2026-9669 Critical TuxCare License Agreement CVE-2026-6100 CVE-2026-9669 CVE-2026-4786 CVE-2026-7210 Debian 11 * SECURITY UPDATE: quadratic-complexity CPU denial of service in html.parser - debian/patches/CVE-2026-15308.patch: accumulate incremental feed() data to avoid re-scanning/concatenating unterminated constructs quadratically - CVE-2026-15308 Important TuxCare License Agreement CVE-2026-15308 alt-python36 alt-python36-debug alt-python36-devel alt-python36-libs alt-python36-test alt-python36-tkinter alt-python36-tools alt-python27 alt-python27-debug alt-python27-devel alt-python27-idle alt-python27-libs alt-python27-test alt-python27-tkinter alt-python27-tools alt-python311 alt-python311-debug alt-python311-devel alt-python311-idle alt-python311-libs alt-python311-test alt-python311-tkinter alt-python310 alt-python310-debug alt-python310-devel alt-python310-idle alt-python310-libs alt-python310-test alt-python310-tkinter amd64 0:3.6.15-14 amd64 0:2.7.18-3 amd64 0:2.7.18-6 amd64 0:2.7.18-7 amd64 0:2.7.18-8 amd64 0:3.6.15-19 amd64 0:3.6.15-20 amd64 0:3.6.15-23 amd64 0:2.7.18-9 amd64 0:3.6.15-25 amd64 0:2.7.18-10 amd64 0:3.6.15-27 amd64 0:3.6.15-28 amd64 0:2.7.18-11 amd64 0:2.7.18-12 amd64 0:2.7.18-14 amd64 0:3.6.15-29 amd64 0:3.6.15-30 amd64 0:2.7.18-16 amd64 0:2.7.18-17 amd64 0:3.6.15-31 amd64 0:3.6.15-32 amd64 0:2.7.18-18 amd64 0:2.7.18-19 amd64 0:3.6.15-33 amd64 0:3.6.15-34 amd64 0:2.7.18-20 amd64 0:3.6.15-37 amd64 0:2.7.18-21 amd64 0:3.6.15-38 amd64 0:3.6.15-39 amd64 0:2.7.18-22 amd64 0:2.7.18-24 amd64 0:3.11.15-1 amd64 0:3.10.20-1 amd64 0:3.10.20-3 amd64 0:2.7.18-25 amd64 0:3.11.15-3 amd64 0:3.6.15-40 amd64 0:3.10.20-4 amd64 0:3.10.20-5