-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 25 Jan 2026 14:37:52 +0100 Source: python3.9 Architecture: source Version: 3.9.2-1+deb11u5 Distribution: bullseye Urgency: medium Maintainer: Matthias Klose <[email protected]> Changed-By: Andrej Shadura <[email protected]> Changes: python3.9 (3.9.2-1+deb11u5) bullseye; urgency=medium . * Apply upstream patch to fix regression after CVE-2025-12084 fix (see #1122875 for more details) * Apply upstream patched for the following CVEs: - CVE-2025-11468: Folding email comments of unfoldable characters didn't preserve parenthesis which could be abused. - CVE-2025-15282: User-controlled data URLs parsed by urllib allowed injecting headers through newlines in the data URL mediatype. - CVE-2025-15366: User-controlled command could have additional commands injected using newlines. - CVE-2025-15367: User-controlled command could have additional commands injected using newlines. - CVE-2026-0672: User-controlled cookie values and parameters could be used to inject HTTP headers into messages. - CVE-2026-0865: User-controlled header names and values containing newlines could be used to inject HTTP headers. - CVE-2026-1299: email module allowed header injection in the BytesGenerator class. Checksums-Sha1: a5f784eb5118dff7caced84c961a73aa5b131939 3007 python3.9_3.9.2-1+deb11u5.dsc 4a6fc7b84a9305036872638e6a53b08549ea183a 302112 python3.9_3.9.2-1+deb11u5.debian.tar.xz 28eb2e79e38f7781e4ccfdc091b6549878541d8c 10378 python3.9_3.9.2-1+deb11u5_source.buildinfo Checksums-Sha256: e1484a80600e726c3e6d0790c2f07a3fdc984c16f8464124f8fdacd587bd5fb8 3007 python3.9_3.9.2-1+deb11u5.dsc b6731f8cb7800ee81512086b36dcffd1a8358a98bdb02f1c31677f0812df526a 302112 python3.9_3.9.2-1+deb11u5.debian.tar.xz ad26080ce3f1d80adb83e58948388f4748efbe91d1924337b9f7a6f639ef7c76 10378 python3.9_3.9.2-1+deb11u5_source.buildinfo Files: 9419beae396853accf2df34036fd98cb 3007 python optional python3.9_3.9.2-1+deb11u5.dsc af86db3a57e14b0733aab859d6251b9d 302112 python optional python3.9_3.9.2-1+deb11u5.debian.tar.xz a301c044dab5117bf38ad3caeeaaa8e4 10378 python optional python3.9_3.9.2-1+deb11u5_source.buildinfo
-----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCaXZ1HgAKCRDoRGtKyMdy YU2AAQDjTkYrcpKtyda30vWqpK30AmPlkfQCuLfP/hJVzrE4pQEAk0VlV+rociPY iKyEEyStqip32XkLgKSNCWFuIBC1cAk= =c1Og -----END PGP SIGNATURE-----
pgpnoIkxPl5Az.pgp
Description: PGP signature
