-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 14 May 2026 10:00:00 +0700
Source: python3.9
Architecture: source
Version: 3.9.2-1+deb11u7
Distribution: bullseye-security
Urgency: high
Maintainer: Matthias Klose <doko@debian.org>
Changed-By: Arnaud Rebillout <arnaudr@debian.org>
Changes:
python3.9 (3.9.2-1+deb11u7) bullseye-security; urgency=high
.
* Non-maintainer upload by the LTS Team.
* Apply upstream patches for the following CVEs:
- CVE-2025-13462: Incorrect parsing of TarInfo header when GNU long name
and type AREGTYPE are combined
- CVE-2026-2297: SourcelessFileLoader does not use io.open_code()
- CVE-2026-3644: Reject control characters in more places in
http.cookies.Morsel (follow-up of patch for CVE-2026-0672)
- CVE-2026-4224: pyexpat.c: Unbounded C recursion in conv_content_model
causes crash
- CVE-2026-4519: Reject leading dashes in webbrowser.open()
Checksums-Sha1:
0a38863f1b8007053d63925fab021e4b4938c53a 3641 python3.9_3.9.2-1+deb11u7.dsc
110ca5bca7989f9558a54ee6762e6774a4b9644a 18889164 python3.9_3.9.2.orig.tar.xz
4d7afd040c42a3fcc113ea348a02af8a71b3ba3a 324084 python3.9_3.9.2-1+deb11u7.debian.tar.xz
6b78b897bc09391058ef3a8b19cbaa76a177919c 6452 python3.9_3.9.2-1+deb11u7_source.buildinfo
Checksums-Sha256:
dae824dd38ae9524f4d715c0cb2e144c9de20bb4f077194a132eac1475ebae85 3641 python3.9_3.9.2-1+deb11u7.dsc
3c2034c54f811448f516668dce09d24008a0716c3a794dd8639b5388cbde247d 18889164 python3.9_3.9.2.orig.tar.xz
ee2581147074d1eb494adfb8223833eeaf1c6d04cf5c0593e93bec28194bc86d 324084 python3.9_3.9.2-1+deb11u7.debian.tar.xz
a5130213f890c6a97135a8a197511699c0ffab5e4b2fe6f6b0a6d133f32bab7e 6452 python3.9_3.9.2-1+deb11u7_source.buildinfo
Files:
24553169ba7bae653b1c4ef55165828b 3641 python optional python3.9_3.9.2-1+deb11u7.dsc
f0dc9000312abeb16de4eccce9a870ab 18889164 python optional python3.9_3.9.2.orig.tar.xz
58da3d68a20ff551845935d9316b6085 324084 python optional python3.9_3.9.2-1+deb11u7.debian.tar.xz
eb0045b01c53f4c758f11dbcb72fecaf 6452 python optional python3.9_3.9.2-1+deb11u7_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJHBAEBCgAxFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmoGov8THGFybmF1ZHJA
ZGViaWFuLm9yZwAKCRDnJeh5FGACFvDmEACQEWq8gUiyxiAnJI8z0XEbegrv1NmA
a134shKEnMWM4Ql9Edt+hfJuH5AHXRC1GarIP0TFsBrDJ55lsWhQcDDxG8kEBZMH
Wr2gtupp7wflQoBWwRrTkzpNT28XlHF0STHpndOUw/oanCcc9wFsf1tRMrRJvD91
+3sEc+aiD+7k73qew/PAmg2Ga3ZouYIR8VzfRWb+radRCjjzP9hJ8OrYzkPn5aJw
pO9VhXvBwSEYHyAX+OpPX4Gfi82QsVHfq1pscVul7Y9n4Y81+dW9Wr5osDLoRhoV
FXE4ZmrWtXYYMekbYOww+9D/SMrXC2MTukjWWxxDTusG3K+VB3LLKmboqOjmr10P
EZz3ABDUoREJCvTMZoAlJrnC+850PoEPQgQ5g+l16TVaw+cOUfkislDyj7iRDMUd
iWIccTlbpbHw1d5eVctuakteNJ4sN/dqZ6cbSe0qmrg1JuIwR36GXozHjW9hgUBg
yydMC4+44eKDrGti26l/wJW5NNGtizJnBZXLoNgJydSD4eYI40NGmahTiZm3KCSe
ufxZdyguQRAEGxo2OqoFfHeozng6PRfF3UPfL+T61tsI4bXikxC5A5pCk/1UGqmC
tdYJrRxbE9WV2+lpfVNvU3+ULRu69v/3h0UDHSFxNtZ+9BpUTjMj8c3AykYkGMb0
Y3KzDnBncbLUVQ==
=o3+x
-----END PGP SIGNATURE-----
