python3.5 (3.5.2-2ubuntu0~16.04.13) xenial-security; urgency=medium

  * SECURITY UPDATE: Code execution from content received via HTTP
    - debian/patches/CVE-2020-27619.patch: no longer call eval() on
      content received via HTTP in Lib/test/multibytecodec_support.py.
    - CVE-2020-27619
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2021-3177.patch: replace snprintf with Python unicode
      formatting in ctypes param reprs in Lib/ctypes/test/test_parameters.py,
      Modules/_ctypes/callproc.c.
    - CVE-2021-3177

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Tue, 26 Jan 2021 10:30:48 -0300

python3.5 (3.5.2-2ubuntu0~16.04.12) xenial-security; urgency=medium

  * SECURITY UPDATE: CRLF injection
    - debian/patches/CVE-2020-26116.patch: prevent header injection
      in http methods in Lib/httplib.py, Lib/test/test_httlib.py.
    - CVE-2020-26116
  * debian/patches/skipping_broken_test_httphandlertest.patch:
    - skipping Lib/test/test_logging.py was hanging during building time
      causing the building to be killed after 150 minutes of hang.


 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Wed, 07 Oct 2020 14:19:02 -0300

python3.5 (3.5.2-2ubuntu0~16.04.11) xenial-security; urgency=medium

  * SECURITY UPDATE: Misleading information
    - debian/patches/CVE-2019-17514.patch: explain that the orderness of the
      of the result is system-dependant in Doc/library/glob.rst.
    - CVE-2019-17514
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-9674.patch: add pitfalls to
      zipfile module doc in Doc/library/zipfile.rst,
      Misc/NEWS.d/next/Documentation/2019-06-04-09-29-00.bpo-36260.WrGuc-.rst.
    - CVE-2019-9674
  * SECURITY UPDATE: Infinite loop
    - debian/patches/CVE-2019-20907.patch: avoid infinite loop in the
      tarfile module in Lib/tarfile.py, Lib/test/test_tarfile.py and add
      Lib/test/recursion.tar binary for test.
    - CVE-2019-20907
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2020-14422.patch: Resolve hash collisions for
      IPv4Interface and IPv6Interface in Lib/ipaddress.py,
      Lib/test/test_ipaddress.py.
    - CVE-2020-14422

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Fri, 17 Jul 2020 11:04:10 -0300

python3.5 (3.5.2-2ubuntu0~16.04.10) xenial-security; urgency=medium

  * SECURITY UPDATE: CRLF injection
    - debian/patches/CVE-2019-18348.patch: disallow control characters
      in hostnames in http.client in Lib/http/client.py, Lib/test/test_urllib.py.
    - CVE-2019-18348
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2020-8492.patch: fix the regex to prevent
      the regex denial of service in Lib/urllib/request.py,
    - CVE-2020-8492

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Thu, 16 Apr 2020 14:47:17 -0300

python3.5 (3.5.2-2ubuntu0~16.04.9) xenial-security; urgency=medium

  * SECURITY UPDATE: incorrect email address parsing
    - debian/patches/CVE-2019-16056.patch: don't parse domains containing @
      in Lib/email/_header_value_parser.py, Lib/email/_parseaddr.py,
      Lib/test/test_email/test__header_value_parser.py,
      Lib/test/test_email/test_email.py.
    - CVE-2019-16056
  * SECURITY UPDATE: XSS in documentation XML-RPC server
    - debian/patches/CVE-2019-16935.patch: escape the server_title in
      Lib/xmlrpc/server.py, Lib/test/test_docxmlrpc.py.
    - CVE-2019-16935
  * debian/patches/avoid_test_docxmlrpc_race.patch: avoid race in
    test_docxmlrpc server setup in Lib/test/test_docxmlrpc.py.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 08 Oct 2019 09:06:37 -0400

python3.5 (3.5.2-2ubuntu0~16.04.8) xenial-security; urgency=medium

  * SECURITY UPDATE: incorrect cookie domain check
    - debian/patches/CVE-2018-20852.patch: prefix dot in domain for proper
      subdomain validation in Lib/http/cookiejar.py,
      Lib/test/test_http_cookiejar.py.
    - CVE-2018-20852
  * SECURITY UPDATE: integer overflow in pickle
    - debian/patches/CVE-2018-20406.patch: avoid relying on signed overflow
      in _pickle memos in Modules/_pickle.c.
    - CVE-2018-20406
  * SECURITY UPDATE: NULL pointer dereference via X509 certificate
    - debian/patches/CVE-2019-5010.patch: fix segfault in ssl cert parser
      in Lib/test/talos-2019-0758.pem, Lib/test/test_ssl.py,
      Modules/_ssl.c.
    - CVE-2019-5010
  * SECURITY UPDATE: improper handling of unicode encoding
    - debian/patches/CVE-2019-9636.patch: add check for characters in
      netloc that normalize to separators in Doc/library/urllib.parse.rst,
      Lib/test/test_urlparse.py, Lib/urllib/parse.py.
    - CVE-2019-9636
  * SECURITY UPDATE: HTTP header injection
    - debian/patches/CVE-2019-9740.patch: disallow control chars in http
      URLs in Lib/http/client.py, Lib/test/test_urllib.py,
      Lib/test/test_xmlrpc.py.
    - CVE-2019-9740
    - CVE-2019-9947
  * SECURITY UPDATE: urllib support the local_file: scheme
    - debian/patches/CVE-2019-9948.patch: disallow file reading in
      Lib/urllib/request.py, Lib/test/test_urllib.py.
    - CVE-2019-9948
  * SECURITY UPDATE: incomplete fix for CVE-2019-9636
    - debian/patches/CVE-2019-10160-1.patch: fix handling of
      pre-normalization characters in urlsplit() in
      Lib/test/test_urlparse.py, Lib/urllib/parse.py.
    - debian/patches/CVE-2019-10160-2.patch: correct fix to handle
      decomposition in usernames in Lib/test/test_urlparse.py,
      Lib/urllib/parse.py.
    - CVE-2019-10160
  * debian/patches/issue9146.diff: fix FIPS mode environments where MD5
    isn't available in Modules/_hashopenssl.c. (LP: #1835135)

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 10 Jul 2019 07:58:48 -0400

python3.5 (3.5.2-2ubuntu0~16.04.5) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS via catastrophic backtracking
    - debian/patches/CVE-2018-106x.patch: fix expressions in
      Lib/difflib.py, Lib/poplib.py. Added tests to
      Lib/test/test_difflib.py, Lib/test/test_poplib.py.
    - CVE-2018-1060
    - CVE-2018-1061
  * SECURITY UPDATE: incorrect Expat hash salt initialization
    - debian/patches/CVE-2018-14647.patch: call SetHashSalt in
      Include/pyexpat.h, Modules/_elementtree.c, Modules/pyexpat.c.
    - CVE-2018-14647

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 12 Nov 2018 08:43:14 -0500

python3.5 (3.5.2-2ubuntu0~16.04.4) xenial-security; urgency=medium

  * SECURITY UPDATE: integer overflow in the PyBytes_DecodeEscape
    function
    - debian/patches/CVE-2017-1000158.patch: fix this integer overflow
      in Objects/bytesobject.c.
    - CVE-2017-1000158

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Thu, 23 Nov 2017 13:37:01 -0300

python3.5 (3.5.2-2ubuntu0~16.04.3) xenial; urgency=medium

  * Explicitly use the system python for byte compilation in postinst scripts.
    (LP: #1682934)

 -- Brian Murray <brian@ubuntu.com>  Thu, 14 Sep 2017 15:51:06 -0700

python3.5 (3.5.2-2ubuntu0~16.04.2) xenial; urgency=medium

  * SRU: LP: #1711724 Fix dict segfault. Issue #27945.

 -- Clint Byrum <clint@ubuntu.com>  Fri, 18 Aug 2017 10:48:00 -0700

# For older changelog entries, run 'apt-get changelog libpython3.5-minimal'
