Package "python3-apt"

  python-apt (1.6.5ubuntu0.5) bionic-security; urgency=medium

  * REGRESSION UPDATE: Passing a file descriptor to apt_inst.ArFile or
    apt_inst.DebFile caused a segmentation fault (LP: #1907676)
    - python/arfile.cc: Fix segmentation fault when opening fd, track
      lifetime correctly

 -- Marc Deslauriers <email address hidden> Thu, 10 Dec 2020 09:48:08 -0500

  python-apt (1.6.5ubuntu0.4) bionic-security; urgency=high

  * SECURITY UPDATE: various memory and file descriptor leaks (LP: #1899193)
    - python/arfile.cc, python/generic.h, python/tag.cc, python/tarfile.cc:
      fix file descriptor and memory leaks
    - python/apt_instmodule.cc, python/apt_instmodule.h, python/arfile.h:
      Avoid reference cycle with control,data members in apt_inst.DebFile
      objects
    - tests/test_cve_2020_27351.py: Test cases for DebFile (others not easily
      testable)
    - CVE-2020-27351
  * data/templates: Update mirror lists

 -- Julian Andres Klode <email address hidden> Tue, 01 Dec 2020 20:16:11 +0100

  python-apt (1.6.5ubuntu0.2) bionic-security; urgency=medium

  * SECURITY REGRESSION: crash with ubuntu-release-upgrader (LP: #1860606)
    - apt/cache.py: make allow_unauthenticated argument to
      fetch_archives() optional.

 -- Marc Deslauriers <email address hidden> Wed, 22 Jan 2020 16:52:51 -0500

  python-apt (1.6.5ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Check that repository is trusted before downloading
    files from it (LP: #1858973)
    - apt/cache.py: Add checks to fetch_archives() and commit()
    - apt/package.py: Add checks to fetch_binary() and fetch_source()
    - CVE-2019-15796
  * SECURITY UPDATE: Do not use MD5 for verifying downloadeds
    (Closes: #944696) (#LP: #1858972)
    - apt/package.py: Use all hashes when fetching packages, and
      check that we have trusted hashes when downloading
    - CVE-2019-15795
  * To work around the new checks, the parameter allow_unauthenticated=True
    can be passed to the functions. It defaults to the value of the
    APT::Get::AllowUnauthenticated option.
    - Bump Breaks aptdaemon (<< 1.1.1+bzr982-0ubuntu21.2), as it will have
      to set that parameter after having done validation.
  * Automatic changes and fixes for external regressions:
    - Adjustments to test suite and CI to fix CI regressions
    - Automatic mirror list update

 -- Julian Andres Klode <email address hidden> Wed, 15 Jan 2020 17:01:17 +0100