-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 27 Oct 2026 18:10:31 +0200
Source: python3.13
Architecture: source
Version: 3.13.18-1
Distribution: unstable
Urgency: medium
Maintainer: Matthias Klose <doko@debian.org>
Changed-By: Stefano Rivera <stefanor@debian.org>
Changes:
python3.13 (3.13.18-1) unstable; urgency=medium
.
* Python 3.13.18 release.
- CVE-2026-87910: tarfile: Honor None result of filter for link fallbacks.
- CVE-2026-12345: Fix race condition in the cleanup of TemporaryDirectory.
- CVE-2026-115557: Distrust compromised eMudhra intermediate CA keys.
- CVE-2026-114583: Reject links replacing the destination in tar_filter.
- CVE-2026-19553: Validate SSLContext.wrap_bio() parameters like
wrap_socket().
- CVE-2026-19445: Use-after-free for server-side SSLContext with sni.
- CVE-2026-82049: Fix tarfile `data`/`tar` filter bypass via hard link to
a symlink
- CVE-2026-15310: Bound zipfile decompression for bzip2/LZMA
- CVE-2026-19672: tarfile: handle a member that leaves the destination but
comes back.
- CVE-2026-17084: Don't consider Unicode codepoint attributes outside RFC
3454
- CVE-2026-15806: Scope HTTPPasswordMgr credentials by URL scheme
* Refresh patches.
* Update the module-install-* autopkgtests for setuptools 80.
Checksums-Sha1:
c8d4237704dd790a638d2af073e8d55897ee14ed 3704 python3.13_3.13.18-1.dsc
a1b6893ae86049fe445cbc3e241fdbf11963d9f2 23243936 python3.13_3.13.18.orig.tar.xz
541e44a2fdbe843f9206bdd7ed04f3f6b2d35d94 833 python3.13_3.13.18.orig.tar.xz.asc
51141fe6cdd63ae1c91d9dd9237e1f887024cdee 262280 python3.13_3.13.18-1.debian.tar.xz
949074fadc4640621055511031f14fc4554f9c4a 9747 python3.13_3.13.18-1_source.buildinfo
Checksums-Sha256:
b6ba67e05744b11615fb41390ef13aa1ca3035a5425909bcde46e053f4d77892 3704 python3.13_3.13.18-1.dsc
abb0102e6d4ae027509bcb82327d9dd85515b44a3ba8ad538cfc5e9847029f68 23243936 python3.13_3.13.18.orig.tar.xz
829de6c60c2d619efa4fc48505c0cfd241e00de3d7799aa77aa707fec2158e46 833 python3.13_3.13.18.orig.tar.xz.asc
8f12d82b3cedd95970133622a48a3c3309a3ce8560e5c026d3438d3aecc8ef8b 262280 python3.13_3.13.18-1.debian.tar.xz
0461cb52d8e38d5ef5771d90210e6f8035fa6979e0bf1ace1d7a38fc321ef0bc 9747 python3.13_3.13.18-1_source.buildinfo
Files:
0a03389c65c3ee2342740d63147b029d 3704 python optional python3.13_3.13.18-1.dsc
cbc80c41e346e11b93336b595ca1c440 23243936 python optional python3.13_3.13.18.orig.tar.xz
51ba3fa68f83630af16047ecb8d7ad84 833 python optional python3.13_3.13.18.orig.tar.xz.asc
1a1719c160bb5d8ccb988ad2c715dc87 262280 python optional python3.13_3.13.18-1.debian.tar.xz
2609a3881fb0ab7c320affa416b29650 9747 python optional python3.13_3.13.18-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iIkEARYKADIWIQTumtb5BSD6EfafSCRHew2wJjpU2AUCauGoXxQcc3RlZmFub3JA
ZGViaWFuLm9yZwAKCRBHew2wJjpU2BghAP4oGVYzEEB1lXlShYtEHZJxmRU3GyGH
6nM4N5cdqCJZtAD4+SXkumDuYF9HYQeeX7IuYUJcE+SNMJtfiCbNvuaaAw==
=d3Zy
-----END PGP SIGNATURE-----
