python2.7 (2.7.18-1~20.04.7) focal-security; urgency=medium

  * SECURITY UPDATE: User-after-free
    - debian/patches/CVE-2022-48560.patch: Fix posible crash in heapq with
      custom comparison operators in  Modules/_heapqmodule.c,
      Lib/test/test_heapq.py.
    - CVE-2022-48560
  * SECURITY UPDATE: xml external entity processing
    - debian/patches/CVE-2022-48565.patch: rejects XML entity declarations in
      plist files.
    - CVE-2022-48565
  * SECURITY UPDATE: breaking of constant-time guarantee for crypto operations
    - debian/patches/CVE-2022-48566.patch: adds ``volatile`` to the accumulator
      variable result in ``hmac.compare_digest``, making
      constant-time-defeating optimizations less likely.
    - CVE-2022-48566
  * SECURITY UPDATE: Possible Bypass Blocklisting
    - debian/patches/CVE-2023-24329.patch: enforce
      that a scheme must begin with an alphabetical ASCII character
      in Lib/urlparse.py, Lib/test/test_urlparse.py.
    - debian/patches/CVE-2023-24329-2.patch: adds a complementary patch/fix
      for CVE-2023-24329 that was partially fixed before. This patch starts
      stripping C0 control and space chars in 'urlsplit' in Lib/urlparse.py,
      Lib/test/test_urlparse.py.
    - CVE-2023-24329
  * SECURITY UPDATE: TLS handshake bypass
    - debian/patches/CVE-2023-40217.diff: avoid ssl pre-close flaw in ssl.py.
    - CVE-2023-40217

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 09 Dec 2024 16:35:20 -0300

python2.7 (2.7.18-1~20.04.6) focal-security; urgency=medium

  * SECURITY REGRESSION: regression for CVE-2024-6232
    - d/p/fix-regression-lp2089071.patch: fix incomplete update for
      CVE-2024-6232 (LP: #2089071)

 -- Nishit Majithia <nishit.majithia@canonical.com>  Thu, 21 Nov 2024 15:28:47 +0530

python2.7 (2.7.18-1~20.04.5) focal-security; urgency=medium

  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2024-6232.patch: Remove backtracking when parsing
      tarfile headers
    - CVE-2024-6232
  * SECURITY UPDATE: header injection issue
    - debian/patches/CVE-2024-6923.patch: Encode newlines in headers
    - CVE-2024-6923

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 13 Nov 2024 10:42:32 +0530

python2.7 (2.7.18-1~20.04.4) focal; urgency=medium

  * Add d/p/add-optimization-flags-to-cflags.diff: Add optimization flags to
    cflags when compiling C modules. (LP: #2002043)

 -- Mitchell Dzurick <mitchell.dzurick@canonical.com>  Wed, 31 Jan 2024 09:23:13 -0700

python2.7 (2.7.18-1~20.04.3) focal-security; urgency=medium

  * SECURITY UPDATE: Injection Attack
    - debian/patches/CVE-2015-20107.patch: Make mailcap refuse to match unsafe
      filenames/types/param in Lib/mailcap.py.
    - CVE-2015-20107

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Fri, 01 Jul 2022 09:27:04 -0300

python2.7 (2.7.18-1~20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-9674.patch: add pitfalls to
      zipfile module doc in Doc/library/zipfile.rst,
      Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst.
    - CVE-2019-9674
  * SECURITY UPDATE: Misleading information
    - debian/patches/CVE-2019-17514.patch: explain that the orderness of the
      of the result is system-dependant in Doc/library/glob.rst.
    - CVE-2019-17514
  * SECURITY UPDATE: Infinite loop
    - debian/patches/CVE-2019-20907.patch: avoid infinite loop in the
      tarfile module in Lib/tarfile.py, Lib/test/test_tarfile.py.
    - CVE-2019-20907
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2020-8492.patch: fix the regex to prevent
      the regex denial of service in Lib/urllib2.py.
    - CVE-2020-8492
  * SECURITY UPDATE: CRLF injection
    - debian/patches/CVE-2020-26116.patch: prevent header injection
      in http methods in Lib/httplib.py, Lib/test/test_httlib.py.
    - CVE-2020-26116
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2021-3177.patch: use improved patch backport.
    - CVE-2021-3177

 -- Paulo Flabiano Smorigo <pfsmorigo@canonical.com>  Mon, 08 Mar 2021 13:02:45 +0000

python2.7 (2.7.18-1~20.04) focal; urgency=medium

  * SRU: LP: #1890272: Update to to the final 2.7.18 release.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 04 Aug 2020 13:16:42 +0200

python2.7 (2.7.18-1) unstable; urgency=medium

  * Python 2.7.18 release.
  * Let the Python2 end-of-life banner point to the python3 packages, not to
    the online documentation.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 20 Apr 2020 22:30:41 +0200

python2.7 (2.7.18~rc1-2) unstable; urgency=medium

  * Ignore some autopkg tests:
    - test_ssl: Fails with OPENSSL_TLS_SECURITY_LEVEL=2.
    - tst_io: Fails on Ubuntu's autopkg test infrastructure.
  * Lower OpenSSL security level from 2 to 1 during testing as test_ssl
    assumes that.
  * Add XB-Cnf-Visible-Pkgname header on the python*-minimal package to
    point command-not-found at the full one. LP: #1867157

 -- Matthias Klose <doko@debian.org>  Tue, 07 Apr 2020 14:05:55 +0200

python2.7 (2.7.18~rc1-1) unstable; urgency=medium

  * Python 2.7.18 release candidate 1.
    - bpo-38576: Disallow control characters in hostnames in http.client,
      addressing CVE-2019-18348.
  * Make autopkgtests cross-test-friendly (Steve Langasek).

 -- Matthias Klose <doko@debian.org>  Tue, 07 Apr 2020 11:34:05 +0200

# For older changelog entries, run 'apt-get changelog python2.7-doc'
