python2.7 (2.7.18-13ubuntu1.5) jammy-security; urgency=medium

  * SECURITY UPDATE: User-after-free
    - debian/patches/CVE-2022-48560.patch: Fix posible crash in heapq with
      custom comparison operators in  Modules/_heapqmodule.c,
      Lib/test/test_heapq.py.
    - CVE-2022-48560
  * SECURITY UPDATE: xml external entity processing
    - debian/patches/CVE-2022-48565.patch: rejects XML entity declarations in
      plist files.
    - CVE-2022-48565
  * SECURITY UPDATE: breaking of constant-time guarantee for crypto operations
    - debian/patches/CVE-2022-48566.patch: adds ``volatile`` to the accumulator
      variable result in ``hmac.compare_digest``, making
      constant-time-defeating optimizations less likely.
    - CVE-2022-48566
  * SECURITY UPDATE: Possible Bypass Blocklisting
    - debian/patches/CVE-2023-24329.patch: enforce
      that a scheme must begin with an alphabetical ASCII character
      in Lib/urlparse.py, Lib/test/test_urlparse.py.
    - debian/patches/CVE-2023-24329-2.patch: adds a complementary patch/fix
      for CVE-2023-24329 that was partially fixed before. This patch starts
      stripping C0 control and space chars in 'urlsplit' in Lib/urlparse.py,
      Lib/test/test_urlparse.py.
    - CVE-2023-24329
  * SECURITY UPDATE: TLS handshake bypass
    - debian/patches/CVE-2023-40217.diff: avoid ssl pre-close flaw in ssl.py.
    - CVE-2023-40217

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 09 Dec 2024 15:47:23 -0300

python2.7 (2.7.18-13ubuntu1.4) jammy-security; urgency=medium

  * SECURITY REGRESSION: regression for CVE-2024-6232
    - d/p/fix-regression-lp2089071.patch: fix incomplete update for
      CVE-2024-6232 (LP: #2089071)

 -- Nishit Majithia <nishit.majithia@canonical.com>  Thu, 21 Nov 2024 15:31:26 +0530

python2.7 (2.7.18-13ubuntu1.3) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2024-6232.patch: Remove backtracking when parsing
      tarfile headers
    - CVE-2024-6232
  * SECURITY UPDATE: header injection issue
    - debian/patches/CVE-2024-6923.patch: Encode newlines in headers
    - CVE-2024-6923

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 13 Nov 2024 10:22:30 +0530

python2.7 (2.7.18-13ubuntu1.2) jammy; urgency=medium

  * Add d/p/add-optimization-flags-to-cflags.diff: Add optimization flags to
    cflags when compiling C modules. (LP: #2002043)

 -- Mitchell Dzurick <mitchell.dzurick@canonical.com>  Sun, 15 Oct 2023 12:43:11 -0400

python2.7 (2.7.18-13ubuntu1.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Injection Attack
    - debian/patches/CVE-2015-20107.patch: Make mailcap refuse to match unsafe
      filenames/types/param in Lib/mailcap.py.
    - CVE-2015-20107

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Fri, 01 Jul 2022 07:30:50 -0300

python2.7 (2.7.18-13ubuntu1) jammy; urgency=medium

  * Hard-code dependency on libssl3 instead of libssl1.1.

 -- Matthias Klose <doko@ubuntu.com>  Sat, 12 Mar 2022 07:24:29 +0100

python2.7 (2.7.18-13) unstable; urgency=medium

  * Skip tests requiring TLS 1.2 under OpenSSL 3.
  * Test suite adjustments for Expat >=2.4.5.

 -- Matthias Klose <doko@debian.org>  Tue, 22 Feb 2022 12:45:08 +0100

python2.7 (2.7.18-12) unstable; urgency=medium

  * Apply patches for a binary-indep only build.

 -- Matthias Klose <doko@debian.org>  Sun, 23 Jan 2022 18:03:09 +0100

python2.7 (2.7.18-11) unstable; urgency=medium

  [ Stefano Rivera ]
  * Preliminary OpenSSL 3 support.
  * Support building docs with Sphinx 4.

  [ Matthias Klose ]
  * (Build-)Depend on media-types. Closes: #991565.
  * Bump standards version.
  * Bump debhelper version.

 -- Matthias Klose <doko@debian.org>  Fri, 21 Jan 2022 15:07:38 +0100

python2.7 (2.7.18-9) unstable; urgency=medium

  * Bump standards version.

 -- Matthias Klose <doko@debian.org>  Fri, 24 Sep 2021 11:39:51 +0200

# For older changelog entries, run 'apt-get changelog python2.7-doc'
