python3.7 (3.7.5-2ubuntu1~18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Regular Expression Denial of Service
    - debian/patches/CVE-2020-8492.patch: updates a regular expression in the 
      urllib.request.AbsatrctBasicAuthHandler class which allows for 
      catastrophic backtracking and could result in a Denial of Service 
      condition.
    - CVE-2020-8492 
  * SECURITY UPDATE: Regular Expression Denial of Service
    - debian/patches/CVE-2021-3733.patch: updates a regular expression in the 
      urllib.request.AbstractBasicAuthHandler class which has a quadratic
      worst-case time complexity and could be abused by a malicious HTTP
      server to cause a Denial of Service condition for a client.
    - CVE-2021-3733 
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2021-3737.patch: addresses the potential for the
      urllib http client to enter into an infinite loop and hang on a 100
      Continue response from a malicious server.
    - debian/patches/CVE-2021-3737_test-fix.patch: improves the regression
      test in Lib/test/test_httplib.py
    - CVE-2021-3737

 -- Ian Constantin <ian.constantin@canonical.com>  Thu, 09 Dec 2021 12:04:37 -0500

python3.7 (3.7.5-2~18.04.4) bionic-security; urgency=medium

  * SECURITY UPDATE: Code execution from content received via HTTP
    - debian/patches/CVE-2020-27619.patch: no longer call eval() on
      content received via HTTP in Lib/test/multibytecodec_support.py.
    - CVE-2020-27619
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2021-3177.patch: replace snprintf with Python unicode
      formatting in ctypes param reprs in Lib/ctypes/test/test_parameters.py,
      Modules/_ctypes/callproc.c.
    - CVE-2021-3177
  * debian/rules: Disable test_ttk_guionly for armhf, arm6, i386 and s390x.

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Tue, 23 Feb 2021 13:22:40 +0000

python3.7 (3.7.5-2~18.04) bionic-proposed; urgency=medium

  * SRU: LP: #1835738, backport 3.7.5 to 18.04.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Nov 2019 11:50:52 +0100

python3.7 (3.7.5-2) unstable; urgency=medium

  * python3.7-dev: Depend on zlib1g-dev, needed to link as an
    embedded interpreter.

 -- Matthias Klose <doko@debian.org>  Sun, 27 Oct 2019 17:43:29 +0200

python3.7 (3.7.5-1) unstable; urgency=medium

  * Python 3.7.5 release.

 -- Matthias Klose <doko@debian.org>  Tue, 15 Oct 2019 17:24:06 +0200

python3.7 (3.7.5~rc1-2) unstable; urgency=medium

  * Apply proposed patch for issue 38368. LP: #1847036. Closes: #941650.

 -- Matthias Klose <doko@debian.org>  Tue, 08 Oct 2019 18:47:45 +0200

python3.7 (3.7.5~rc1-1) unstable; urgency=medium

  * Python 3.7.5 release candidate 1.
  * Bump standards version.

 -- Matthias Klose <doko@debian.org>  Wed, 02 Oct 2019 06:19:31 +0200

python3.7 (3.7.4-4) unstable; urgency=medium

  * Update to 20190904 from the 3.7 branch.

 -- Matthias Klose <doko@debian.org>  Wed, 04 Sep 2019 10:03:05 +0200

python3.7 (3.7.4-3) unstable; urgency=medium

  * Enable pgo/lto builds on arm64. Closes: #934812.
  * Don't propagate lto flags to the _sysconfigdata module. Closes: #934771.
  * d/patches/issue35998.diff: Disable TLS1.3 in the client on all platforms
    rather than just reducing the payload size (Michael Hudson-Doyle).
  * Annote build dependencies used for tests. Closes: #928513.

 -- Matthias Klose <doko@debian.org>  Wed, 21 Aug 2019 18:01:23 +0200

python3.7 (3.7.4-2) unstable; urgency=medium

  * Bump the platform name for KFreeBSD.

 -- Matthias Klose <doko@debian.org>  Thu, 11 Jul 2019 12:43:21 +0200

# For older changelog entries, run 'apt-get changelog libpython3.7-minimal'
