Bug#1135877: trixie-pu: package python3.13/3.13.5-2+deb13u2
On 08/05/2026 01:53, Moritz Mühlenhoff wrote: CVE-2026-4786 is only an issue if for CVE-2026-4519 is incompletely fixed, but my patches for for CVE-2026-4519 contain the full fix compromised of three upstream patches, so 3.13 was never affected by CVE-2026-4786 in trixie. I'd suggest to simply do the same for 3.11. Ack, thanks for the explanation. I did the same for 3.11, and I just filed the upload request at: https://bugs.debian.org/1136382 -- Arnaud
Bug#1135877: trixie-pu: package python3.13/3.13.5-2+deb13u2
On Thu, May 07, 2026 at 08:15:56PM +0100, Adam D. Barratt wrote: > Control: tags -1 + confirmed > > On Wed, 2026-05-06 at 22:50 +0200, Moritz Muehlenhoff wrote: > > This is a followup update to the +deb13u1 update already > > accepeted to trixie-proposed-updates a few weeks ago, > > which fixes a more low severity security issues, which > > have since then been backported to the upstream 3.13 > > branch. > > Please go ahead. Uploaded, thanks! Cheers, Moritz
Bug#1135877: trixie-pu: package python3.13/3.13.5-2+deb13u2
Control: tags -1 + confirmed On Wed, 2026-05-06 at 22:50 +0200, Moritz Muehlenhoff wrote: > This is a followup update to the +deb13u1 update already > accepeted to trixie-proposed-updates a few weeks ago, > which fixes a more low severity security issues, which > have since then been backported to the upstream 3.13 > branch. Please go ahead. Regards, Adam
Bug#1135877: trixie-pu: package python3.13/3.13.5-2+deb13u2
Am Thu, May 07, 2026 at 04:22:40PM +0700 schrieb Arnaud Rebillout: > Hello Moritz, > > I intend to propose a similar upload for bookworm, so I was looking at your > debdiff first. Nice! > May I ask: why not fixing CVE-2026-4786 as well? It is marked as fixed in > the tracker, but it's only because it is introduced by the fix > for CVE-2026-4519, which is not yet in trixie (it's in your debdiff here). CVE-2026-4786 is only an issue if for CVE-2026-4519 is incompletely fixed, but my patches for for CVE-2026-4519 contain the full fix compromised of three upstream patches, so 3.13 was never affected by CVE-2026-4786 in trixie. I'd suggest to simply do the same for 3.11. Cheers, Moritz
Bug#1135877: trixie-pu: package python3.13/3.13.5-2+deb13u2
Hello Moritz, I intend to propose a similar upload for bookworm, so I was looking at your debdiff first. May I ask: why not fixing CVE-2026-4786 as well? It is marked as fixed in the tracker, but it's only because it is introduced by the fix for CVE-2026-4519, which is not yet in trixie (it's in your debdiff here). Best, Arnaud On 07/05/2026 03:50, Moritz Muehlenhoff wrote: Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:python3.13 User: [email protected] Usertags: pu This is a followup update to the +deb13u1 update already accepeted to trixie-proposed-updates a few weeks ago, which fixes a more low severity security issues, which have since then been backported to the upstream 3.13 branch. Tests were fine and everything looks in order in the tests triggered in debusine as well. The debdiff below is relative to the version already on trixie-p-u. Cheers, Moritz diff -Nru python3.13-3.13.5/debian/changelog python3.13-3.13.5/debian/changelog --- python3.13-3.13.5/debian/changelog 2026-04-06 14:24:14.0 +0200 +++ python3.13-3.13.5/debian/changelog 2026-05-05 23:05:52.0 +0200 @@ -1,3 +1,14 @@ +python3.13 (3.13.5-2+deb13u2) trixie; urgency=medium + + * CVE-2026-3446 + * CVE-2026-4224 + * CVE-2026-3644 + * CVE-2026-4519 + * CVE-2026-6019 (Closes: #1135116) + * CVE-2026-6100 + + -- Moritz Mühlenhoff Tue, 05 May 2026 23:05:52 +0200 + python3.13 (3.13.5-2+deb13u1) trixie; urgency=medium * CVE-2025-11468 (Closes: #1126787) diff -Nru python3.13-3.13.5/debian/patches/CVE-2026-3446.patch python3.13-3.13.5/debian/patches/CVE-2026-3446.patch --- python3.13-3.13.5/debian/patches/CVE-2026-3446.patch1970-01-01 01:00:00.0 +0100 +++ python3.13-3.13.5/debian/patches/CVE-2026-3446.patch2026-05-05 14:21:14.0 +0200 @@ -0,0 +1,209 @@ +From 1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <[email protected]> +Date: Tue, 24 Mar 2026 00:52:20 +0100 +Subject: [PATCH] [3.13] gh-145264: Do not ignore excess Base64 data after the + first padded quad (GH-145267) (GH-146326) (GH-146348) + +--- python3.13-3.13.5.orig/Lib/test/test_binascii.py python3.13-3.13.5/Lib/test/test_binascii.py +@@ -143,17 +143,16 @@ class BinASCIITest(unittest.TestCase): + _assertRegexTemplate(r'(?i)Excess padding', data, non_strict_mode_expected_result) + + # Test excess data exceptions +-assertExcessData(b'ab==a', b'i') +-assertExcessData(b'ab===', b'i') +-assertExcessData(b'ab', b'i') +-assertExcessData(b'ab==:', b'i') +-assertExcessData(b'abc=a', b'i\xb7') +-assertExcessData(b'abc=:', b'i\xb7') +-assertExcessData(b'ab==\n', b'i') +-assertExcessData(b'abc==', b'i\xb7') +-assertExcessData(b'abc===', b'i\xb7') +-assertExcessData(b'abc', b'i\xb7') +-assertExcessData(b'abc=', b'i\xb7') ++assertExcessPadding(b'ab===', b'i') ++assertExcessPadding(b'ab', b'i') ++assertNonBase64Data(b'ab==:', b'i') ++assertExcessData(b'abc=a', b'i\xb7\x1a') ++assertNonBase64Data(b'abc=:', b'i\xb7') ++assertNonBase64Data(b'ab==\n', b'i') ++assertExcessPadding(b'abc==', b'i\xb7') ++assertExcessPadding(b'abc===', b'i\xb7') ++assertExcessPadding(b'abc', b'i\xb7') ++assertExcessPadding(b'abc=', b'i\xb7') + + # Test non-base64 data exceptions + assertNonBase64Data(b'\nab==', b'i') +@@ -175,6 +174,20 @@ class BinASCIITest(unittest.TestCase): + assertExcessPadding(b'abcd', b'i\xb7\x1d') + assertExcessPadding(b'abcd=', b'i\xb7\x1d') + ++def test_base64_excess_data(self): ++# Test excess data exceptions ++def assertExcessData(data, expected): ++assert_regex = r'(?i)Excess data' ++data = self.type2test(data) ++with self.assertRaisesRegex(binascii.Error, assert_regex): ++binascii.a2b_base64(data, strict_mode=True) ++self.assertEqual(binascii.a2b_base64(data, strict_mode=False), ++ expected) ++self.assertEqual(binascii.a2b_base64(data), expected) ++ ++assertExcessData(b'ab==c=', b'i\xb7') ++assertExcessData(b'ab==cd', b'i\xb7\x1d') ++assertExcessData(b'abc=d', b'i\xb7\x1d') + + def test_base64errors(self): + # Test base64 with invalid padding +--- python3.13-3.13.5.orig/Modules/binascii.c python3.13-3.13.5/Modules/binascii.c +@@ -383,7 +383,6 @@ binascii_a2b_base64_impl(PyObject *modul + const unsigned char *ascii_data = data->buf; + size_t ascii_len = data->len; + binascii_state *state = NULL; +-char padding_started = 0; + + /* Allocate the buffer */ + Py_ssize_t bin_len =
Bug#1135877: trixie-pu: package python3.13/3.13.5-2+deb13u2
Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:python3.13 User: [email protected] Usertags: pu This is a followup update to the +deb13u1 update already accepeted to trixie-proposed-updates a few weeks ago, which fixes a more low severity security issues, which have since then been backported to the upstream 3.13 branch. Tests were fine and everything looks in order in the tests triggered in debusine as well. The debdiff below is relative to the version already on trixie-p-u. Cheers, Moritz diff -Nru python3.13-3.13.5/debian/changelog python3.13-3.13.5/debian/changelog --- python3.13-3.13.5/debian/changelog 2026-04-06 14:24:14.0 +0200 +++ python3.13-3.13.5/debian/changelog 2026-05-05 23:05:52.0 +0200 @@ -1,3 +1,14 @@ +python3.13 (3.13.5-2+deb13u2) trixie; urgency=medium + + * CVE-2026-3446 + * CVE-2026-4224 + * CVE-2026-3644 + * CVE-2026-4519 + * CVE-2026-6019 (Closes: #1135116) + * CVE-2026-6100 + + -- Moritz Mühlenhoff Tue, 05 May 2026 23:05:52 +0200 + python3.13 (3.13.5-2+deb13u1) trixie; urgency=medium * CVE-2025-11468 (Closes: #1126787) diff -Nru python3.13-3.13.5/debian/patches/CVE-2026-3446.patch python3.13-3.13.5/debian/patches/CVE-2026-3446.patch --- python3.13-3.13.5/debian/patches/CVE-2026-3446.patch1970-01-01 01:00:00.0 +0100 +++ python3.13-3.13.5/debian/patches/CVE-2026-3446.patch2026-05-05 14:21:14.0 +0200 @@ -0,0 +1,209 @@ +From 1f9958f909c1b41a4ffc0b613ef8ec8fa5e7c474 Mon Sep 17 00:00:00 2001 +From: "Miss Islington (bot)" + <[email protected]> +Date: Tue, 24 Mar 2026 00:52:20 +0100 +Subject: [PATCH] [3.13] gh-145264: Do not ignore excess Base64 data after the + first padded quad (GH-145267) (GH-146326) (GH-146348) + +--- python3.13-3.13.5.orig/Lib/test/test_binascii.py python3.13-3.13.5/Lib/test/test_binascii.py +@@ -143,17 +143,16 @@ class BinASCIITest(unittest.TestCase): + _assertRegexTemplate(r'(?i)Excess padding', data, non_strict_mode_expected_result) + + # Test excess data exceptions +-assertExcessData(b'ab==a', b'i') +-assertExcessData(b'ab===', b'i') +-assertExcessData(b'ab', b'i') +-assertExcessData(b'ab==:', b'i') +-assertExcessData(b'abc=a', b'i\xb7') +-assertExcessData(b'abc=:', b'i\xb7') +-assertExcessData(b'ab==\n', b'i') +-assertExcessData(b'abc==', b'i\xb7') +-assertExcessData(b'abc===', b'i\xb7') +-assertExcessData(b'abc', b'i\xb7') +-assertExcessData(b'abc=', b'i\xb7') ++assertExcessPadding(b'ab===', b'i') ++assertExcessPadding(b'ab', b'i') ++assertNonBase64Data(b'ab==:', b'i') ++assertExcessData(b'abc=a', b'i\xb7\x1a') ++assertNonBase64Data(b'abc=:', b'i\xb7') ++assertNonBase64Data(b'ab==\n', b'i') ++assertExcessPadding(b'abc==', b'i\xb7') ++assertExcessPadding(b'abc===', b'i\xb7') ++assertExcessPadding(b'abc', b'i\xb7') ++assertExcessPadding(b'abc=', b'i\xb7') + + # Test non-base64 data exceptions + assertNonBase64Data(b'\nab==', b'i') +@@ -175,6 +174,20 @@ class BinASCIITest(unittest.TestCase): + assertExcessPadding(b'abcd', b'i\xb7\x1d') + assertExcessPadding(b'abcd=', b'i\xb7\x1d') + ++def test_base64_excess_data(self): ++# Test excess data exceptions ++def assertExcessData(data, expected): ++assert_regex = r'(?i)Excess data' ++data = self.type2test(data) ++with self.assertRaisesRegex(binascii.Error, assert_regex): ++binascii.a2b_base64(data, strict_mode=True) ++self.assertEqual(binascii.a2b_base64(data, strict_mode=False), ++ expected) ++self.assertEqual(binascii.a2b_base64(data), expected) ++ ++assertExcessData(b'ab==c=', b'i\xb7') ++assertExcessData(b'ab==cd', b'i\xb7\x1d') ++assertExcessData(b'abc=d', b'i\xb7\x1d') + + def test_base64errors(self): + # Test base64 with invalid padding +--- python3.13-3.13.5.orig/Modules/binascii.c python3.13-3.13.5/Modules/binascii.c +@@ -383,7 +383,6 @@ binascii_a2b_base64_impl(PyObject *modul + const unsigned char *ascii_data = data->buf; + size_t ascii_len = data->len; + binascii_state *state = NULL; +-char padding_started = 0; + + /* Allocate the buffer */ + Py_ssize_t bin_len = ((ascii_len+3)/4)*3; /* Upper bound, corrected later */ +@@ -394,14 +393,6 @@ binascii_a2b_base64_impl(PyObject *modul + return NULL; + unsigned char *bin_data_start = bin_data; + +-if (strict_mode && ascii_len > 0 && ascii_data[0] == '=') { +-state = get_binascii_state(module); +-if (state) { +-PyErr_SetString(state->Error, "Leading paddin
