Charlie Li <[email protected]> writes: > Nothing will be backported until upstream can verify that the fixes do > not break existing (correct) behaviour. Currently only the imaplib > (CVE-2025-15366) fixes are present in the latest upstream > lang/python31{3,4,5}.
Not true. The patches I posted _are_ from upstream 3.15. There is an additional commit to imaplib commit which we could include: commit d0921efb665aff26b378f495e5ff84f7e3fe649d Author: Serhiy Storchaka <[email protected]> AuthorDate: Sun Jul 5 18:25:36 2026 +0300 Commit: GitHub <[email protected]> CommitDate: Sun Jul 5 18:25:36 2026 +0300 gh-143921: Narrow the control character check in imaplib commands (GH-153067) Only NUL, CR and LF are rejected now. Other control characters are valid in quoted strings and can occur in mailbox names returned by the server, so they are now accepted and sent quoted. Co-authored-by: Claude Fable 5 <[email protected]> Upstream 3.13.15 and 3.14.7 already have both imaplib patches but not the poplib patch. DES -- Dag-Erling Smørgrav - [email protected]
