python3.10 (3.10.12-1~22.04.16) jammy-security; urgency=medium

  * SECURITY UPDATE: incorrect normalization in tarfile module
    - debian/patches/CVE-2025-13462.patch: Skip TarInfo DIRTYPE normalization
      during GNU long name handling in Lib/tarfile.py,
      Lib/test/test_tarfile.py.
    - CVE-2025-13462
  * SECURITY UPDATE: crash in Markdown parsing
    - debian/patches/CVE-2025-69534-1.patch: Fix comment parsing in HTMLParser
      according to the HTML5 standard in Lib/html/parser.py,
      Lib/test/test_htmlparser.py.
    - debian/patches/CVE-2025-69534-2.patch: Fix parsing start and end tags in
      HTMLParser according to the HTML5 standard in Lib/html/parser.py,
      Lib/test/support/__init__.py, Lib/test/test_htmlparser.py.
    - debian/patches/CVE-2025-69534-3.patch: Fix parsing attributes with
      whitespaces around the "=" separator in HTMLParser in Lib/html/parser.py,
      Lib/test/test_htmlparser.py.
    - debian/patches/CVE-2025-69534-4.patch: Fix support of elements "textarea"
      and "title" in HTMLParser in Lib/html/parser.py,
      Lib/test/test_htmlparser.py.
    - debian/patches/CVE-2025-69534-5.patch: Fix CDATA section parsing in
      HTMLParser in Lib/html/parser.py, Lib/test/test_htmlparser.py.
    - debian/patches/CVE-2025-69534-6.patch: Support more RAWTEXT and PLAINTEXT
      elements in HTMLParser in Doc/library/html.parser.rst, Lib/html/parser.py,
      Lib/test/test_htmlparser.py.
    - CVE-2025-69534
  * SECURITY UPDATE: incorrect newlines quoting in email module
    - debian/patches/CVE-2026-1299.patch: email: verify headers are sound in
      BytesGenerator in Lib/email/generator.py,
      Lib/test/test_email/test_generator.py, Lib/test/test_email/test_policy.py.
    - CVE-2026-1299
  * SECURITY UPDATE:HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF
    - debian/patches/CVE-2026-1502.patch: Reject CR/LF in HTTP tunnel request
      headers in Lib/http/client.py, Lib/test/test_httplib.py.
    - CVE-2026-1502
  * SECURITY UPDATE: missing audit event for legacy *.pyc files
    - debian/patches/CVE-2026-2297.patch: Ensure SourcelessFileLoader uses
      io.open_code in Lib/importlib/_bootstrap_external.py.
    - CVE-2026-2297
  * SECURITY UPDATE: unicodedata.normalize() can take excessive CPU time
    - debian/patches/CVE-2026-3276.patch: Fix O(n^2) canonical ordering in
      unicodedata.normalize() in Lib/test/test_unicodedata.py,
      Modules/unicodedata.c.
    - CVE-2026-3276
  * SECURITY UPDATE: Incomplete fix for CVE-2026-0672
    - debian/patches/CVE-2026-3644.patch: Reject control characters in
      http.cookies.Morsel.update() in Lib/http/cookies.py,
      Lib/test/test_http_cookies.py.
    - CVE-2026-3644
  * SECURITY UPDATE: Overflow in Expat parser
    - debian/patches/CVE-2026-4224.patch: Avoid unbound C recursion in
      conv_content_model in pyexpat.c in Lib/test/test_pyexpat.py,
      Modules/pyexpat.c.
    - CVE-2026-4224
  * SECURITY UPDATE: leading dashes used as options in webbrowser.open()
    - debian/patches/CVE-2026-4519-1.patch: Reject leading dashes in webbrowser
      URLs in Lib/test/test_webbrowser.py, Lib/webbrowser.py.
    - debian/patches/CVE-2026-4519-2.patch: Tweak the exception message and
      increase test coverage in Lib/test/test_webbrowser.py, Lib/webbrowser.py.
    - CVE-2026-4519
  * SECURITY UPDATE: Mitgation of CVE-2026-4519 was incomplete
    - debian/patches/CVE-2026-4786.patch: Fix webbrowser `%action` substitution
      bypass of dash-prefix check in Lib/test/test_webbrowser.py,
      Lib/webbrowser.py.
    - CVE-2026-4786
  * SECURITY UPDATE: insufficient escaping in http.cookies.Morsel.js_output()
    - debian/patches/CVE-2026-6019-1.patch: Base64-encode cookie values
      embedded in JS in Lib/http/cookies.py, Lib/test/test_http_cookies.py.
    - debian/patches/CVE-2026-6019-2.patch: Use `decodeURIComponent()` for
      UTF-8 support in `js_output()` in Lib/http/cookies.py,
      Lib/test/test_http_cookies.py.
    - CVE-2026-6019
  * SECURITY UPDATE: use-after-free in lzma, bz2, gzip decoders
    - debian/patches/CVE-2026-6100.patch: Fix a possible UAF in
      `{LZMA,BZ2,_Zlib}Decompressor` in Modules/_bz2module.c,
      Modules/_lzmamodule.c.
    - CVE-2026-6100
  * SECURITY UPDATE: Incomplete fix for CVE-2021-4189
    - debian/patches/CVE-2026-8328.patch: Apply CVE-2021-4189 PASV fix to
      ftplib.ftpcp() (GH-149648) (#149795) in Lib/ftplib.py,
      Lib/test/test_ftplib.py.
    - CVE-2026-8328
  * SECURITY UPDATE: bz2.BZ2Decompressor object reuse after decompression error
    - debian/patches/CVE-2026-9669.patch: Prevent bz2 decompressor reuse after
      errors in Lib/test/test_bz2.py, Modules/_bz2module.c.
    - CVE-2026-9669

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 22 Jun 2026 14:55:27 -0400

python3.10 (3.10.12-1~22.04.15) jammy-security; urgency=medium

  * SECURITY REGRESSION: Revert patch for CVE-2025-15366
    - debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC
      9051 IMAP conformance and introduces behavior regressions avoided
      by upstream.
    - CVE-2025-15366
  * SECURITY REGRESSION: Revert patch for CVE-2025-15367
    - debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior
      regressions, aligning with upstream backporting decisions.
    - CVE-2025-15367
  * SECURITY REGRESSION: Allow HTAB in wsgiref header values
    - debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values
      (excluding names) in Lib/wsgiref/headers.py, add test coverage.
    - CVE-2026-0865

 -- Vyom Yadav <vyom.yadav@canonical.com>  Tue, 03 Mar 2026 17:26:32 +0530

python3.10 (3.10.12-1~22.04.14) jammy-security; urgency=medium

  * SECURITY UPDATE: Header injection in email messages where addresses are not
    sanitized.
    - debian/patches/CVE-2025-11468.patch: Add escape parentheses and backslash
      in Lib/email/_header_value_parser.py. Add test in
      Lib/test/test_email/test__header_value_parser.py.
    - CVE-2025-11468
  * SECURITY UPDATE: Quadratic algorithm when building excessively nested XML
    documents.
    - debian/patches/CVE-2025-12084-*.patch: Remove _in_document and replace
      with node.ownerDocument in Lib/xml/dom/minidom.py. Set self.ownerDocument
      to None in Lib/xml/dom/minidom.py. Add test in Lib/test/test_minidom.py.
    - CVE-2025-12084
  * SECURITY UPDATE: OOM and denial of service when opening malicious plist
    file.
    - debian/patches/CVE-2025-13837.patch: Add _MIN_READ_BUF_SIZE and _read
      with checks in Lib/plistlib.py. Add test in Lib/test/test_plistlib.py.
    - CVE-2025-13837
  * SECURITY UPDATE: Header injection in user controlled data URLs in urllib.
    - debian/patches/CVE-2025-15282.patch: Add control character checks in
      Lib/urllib/request.py. Add test in Lib/test/test_urllib.py.
  * SECURITY UPDATE: Command injection through user controlled commands in
    imaplib.
    - debian/patches/CVE-2025-15366.patch: Add _control_chars and checks in
      Lib/imaplib.py. Add test in Lib/test/test_imaplib.py.
  * SECURITY UPDATE: Command injection through user controlled commands in
    poplib.
    - debian/patches/CVE-2025-15367.patch: Add control character regex check
      in Lib/poplib.py. Add test in Lib/test/test_poplib.py.
    - CVE-2025-15367
  * SECURITY UPDATE: HTTP header injection in user controlled cookie values.
    - debian/patches/CVE-2026-0672.patch: Add _control_characters_re and
      checks in Lib/http/cookies.py. Add test in Lib/test/test_http_cookies.py.
    - CVE-2026-0672
  * SECURITY UPDATE: HTTP header injection in user controlled headers and
    values with newlines.
    - debian/patches/CVE-2026-0865.patch: Add _control_chars_re and check in
      Lib/wsgiref/headers.py. Add test in Lib/test/support/__init__.py and
      Lib/test/test_wsgiref.py.
    - CVE-2026-0865

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 26 Jan 2026 11:25:28 -0330

python3.10 (3.10.12-1~22.04.13) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP Content-Length denial of service
    - debian/patches/CVE-2025-13836.patch: Read large data in chunks with
      geometric reads in Lib/http/client.py and add tests in 
      Lib/test/test_httplib.py
    - CVE-2025-13836

 -- Vyom Yadav <vyom.yadav@canonical.com>  Thu, 08 Jan 2026 12:22:19 +0530

python3.10 (3.10.12-1~22.04.12) jammy-security; urgency=medium

  * SECURITY UPDATE: Possible payload obfuscation
    - debian/patches/CVE-2025-8291.patch: check consistency of
      the zip64 end of central dir record in Lib/zipfile.py,
      Lib/test/test_zipfile.py.
    - CVE-2025-8291
  * SECURITY UPDATE: Performance degradation
    - debian/patches/CVE-2025-6075.patch: fix quadratic complexity
      in os.path.expandvars() in Lib/ntpatch.py, Lib/posixpath.py,
      Lib/test/test_genericpatch.py, Lib/test/test_npath.py.
    - CVE-2025-6075

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Tue, 04 Nov 2025 05:48:33 -0300

python3.10 (3.10.12-1~22.04.11) jammy-security; urgency=medium

  * SECURITY UPDATE: Regular expression denial of service.
    - debian/patches/CVE-2025-6069.patch: Improve regex parsing in
      Lib/html/parser.py.
    - CVE-2025-6069
  * SECURITY UPDATE: Infinite loop when parsing tar archives.
    - debian/patches/CVE-2025-8194.patch: Raise exception when count < 0 in
      Lib/tarfile.py.
    - CVE-2025-8194

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Fri, 15 Aug 2025 12:02:43 -0230

python3.10 (3.10.12-1~22.04.10) jammy-security; urgency=medium

  * SECURITY UPDATE: incorrect address list folding
    - debian/patches/CVE-2025-1795-1.patch: don't encode list separators in
      Lib/email/_header_value_parser.py,
      Lib/test/test_email/test__header_value_parser.py.
    - debian/patches/CVE-2025-1795-2.patch: fix AttributeError in the email
      module in Lib/email/_header_value_parser.py,
      Lib/test/test_email/test__header_value_parser.py.
    - CVE-2025-1795
  * SECURITY UPDATE: DoS via bytes.decode with unicode_escape
    - debian/patches/CVE-2025-4516.patch: fix use-after-free in the
      unicode-escape decoder with an error handler in
      Include/cpython/bytesobject.h, Include/cpython/unicodeobject.h,
      Lib/test/test_codeccallbacks.py, Lib/test/test_codecs.py,
      Objects/bytesobject.c, Objects/unicodeobject.c,
      Parser/string_parser.c.
    - CVE-2025-4516

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 27 May 2025 13:12:29 -0400

python3.10 (3.10.12-1~22.04.9) jammy-security; urgency=medium

  * SECURITY UPDATE: urlparse does not flag hostname with square brackets
    as incorrect
    - debian/patches/CVE-2025-0938.patch: disallow square brackets in
      domain names for parsed URLs in Lib/test/test_urlparse.py,
      Lib/urllib/parse.py.
    - CVE-2025-0938

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 04 Feb 2025 09:57:36 -0500

python3.10 (3.10.12-1~22.04.8) jammy-security; urgency=medium

  * SECURITY UPDATE: incorrect validation of bracketed hosts
    - debian/patches/CVE-2024-11168.patch: add checks to ensure that
      bracketed hosts found by urlsplit are of IPv6 or IPvFuture format in
      Lib/urllib/parse.py, Lib/test/test_urlparse.py.
    - CVE-2024-11168

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 17 Jan 2025 09:35:34 -0500

python3.10 (3.10.12-1~22.04.7) jammy-security; urgency=medium

  * SECURITY UPDATE: incorrect quoting in venv module
    - debian/patches/CVE-2024-9287.patch: quote template strings in venv
      activation scripts in Lib/test/test_venv.py, Lib/venv/__init__.py,
      Lib/venv/scripts/common/activate, Lib/venv/scripts/nt/activate.bat,
      Lib/venv/scripts/posix/activate.csh,
      Lib/venv/scripts/posix/activate.fish.
    - CVE-2024-9287

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 06 Nov 2024 15:22:13 -0500

# For older changelog entries, run 'apt-get changelog idle-python3.10'
