diff -pruN 3.4.5-1/debian/changelog 3.4.5-1ubuntu1/debian/changelog --- 3.4.5-1/debian/changelog 2026-01-19 09:11:29.000000000 +0000 +++ 3.4.5-1ubuntu1/debian/changelog 2026-03-20 19:17:25.000000000 +0000 @@ -1,3 +1,22 @@ +python-ldap (3.4.5-1ubuntu1) resolute; urgency=medium + + * Merge with Debian unstable (LP: #2144841). Remaining changes: + - {d/t/{startserver,upstream}: fix apparmor access to test directory + - d/t/apparmor.sh: ignore apparmor control failures on Ubuntu+armhf (LP #2008393) + - d/t/apparmor.sh: fix testing apparmor profile write access (LP #2130351) + * Dropped changes, included upstream: + - SECURITY UPDATE: Improper special character escape when supplying + non-string data types. + - debian/patches/CVE-2025-61911.patch: Raise exception when type is not str + in Lib/ldap/filter.py. + - CVE-2025-61911 + - SECURITY UPDATE: Denial of service through improperly escaped null byte. + - debian/patches/CVE-2025-61912.patch: Change NULL byte escape from \\\000 + to \\00 in Lib/ldap/dn.py. + - CVE-2025-61912 + + -- Nick Rosbrook Fri, 20 Mar 2026 15:17:25 -0400 + python-ldap (3.4.5-1) unstable; urgency=medium * New upstream version 3.4.5 @@ -17,6 +36,41 @@ python-ldap (3.4.5-1) unstable; urgency= -- Michael Fladischer Mon, 19 Jan 2026 09:11:29 +0000 +python-ldap (3.4.4-2ubuntu4) resolute; urgency=medium + + * No-change rebuild to drop Python 3.13 bits. + + -- Matthias Klose Fri, 20 Mar 2026 12:00:19 +0100 + +python-ldap (3.4.4-2ubuntu3) resolute; urgency=medium + + * SECURITY UPDATE: Improper special character escape when supplying + non-string data types. + - debian/patches/CVE-2025-61911.patch: Raise exception when type is not str + in Lib/ldap/filter.py. + - CVE-2025-61911 + * SECURITY UPDATE: Denial of service through improperly escaped null byte. + - debian/patches/CVE-2025-61912.patch: Change NULL byte escape from \\\000 + to \\00 in Lib/ldap/dn.py. + - CVE-2025-61912 + + -- Hlib Korzhynskyy Mon, 15 Dec 2025 14:46:18 -0330 + +python-ldap (3.4.4-2ubuntu2) resolute; urgency=medium + + * d/t/apparmor.sh: fix testing apparmor profile write access (LP: #2130351) + + -- Jonas Jelten Mon, 08 Dec 2025 15:45:13 +0100 + +python-ldap (3.4.4-2ubuntu1) resolute; urgency=medium + + * d/t/{startserver,upstream}: fix slapd apparmor access to test directory + (LP: #2130351) + - d/t/apparmor.sh: ignore apparmor control failures on Ubuntu+armhf + (LP: #2008393) + + -- Jonas Jelten Tue, 11 Nov 2025 17:53:15 +0100 + python-ldap (3.4.4-2) unstable; urgency=medium * Team Upload diff -pruN 3.4.5-1/debian/control 3.4.5-1ubuntu1/debian/control --- 3.4.5-1/debian/control 2026-01-19 09:11:29.000000000 +0000 +++ 3.4.5-1ubuntu1/debian/control 2026-03-20 19:17:25.000000000 +0000 @@ -1,7 +1,8 @@ Source: python-ldap Section: python Priority: optional -Maintainer: Debian Python Team +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian Python Team Uploaders: Willem van den Akker , Michael Fladischer , diff -pruN 3.4.5-1/debian/tests/apparmor.sh 3.4.5-1ubuntu1/debian/tests/apparmor.sh --- 3.4.5-1/debian/tests/apparmor.sh 1970-01-01 00:00:00.000000000 +0000 +++ 3.4.5-1ubuntu1/debian/tests/apparmor.sh 2026-03-20 16:34:19.000000000 +0000 @@ -0,0 +1,58 @@ +# apparmor profile adjustments during testing + +if command -v aa-enabled > /dev/null; then + apparmor_enabled=$(test "$(aa-enabled)" = "Yes" && echo true || echo false) +else + apparmor_enabled=false +fi + +_apparmor_check() { + # allow command to fail if running on Ubuntu-armhf (due to LP: #2008393) + "$@" && return 0 + _ret=$? + + if [ "$(dpkg-vendor --query Vendor)-$(dpkg --print-architecture)" = "Ubuntu-armhf" ]; then + echo "WARNING: failed to perform apparmor command: $*" >&2 + echo "On armhf and Ubuntu DEP8 infrastructure, this is not a fatal error." >&2 + echo "See LP: #2008393 for details." >&2 + return 0 + fi + + echo "apparmor command failed: $*" >&2 + exit $_ret +} + +_apparmor_cleanup() { + if [ "$apparmor_enabled" = true ]; then + echo "reverting apparmor adjustments..." + sudo rm /etc/apparmor.d/local/usr.sbin.slapd + + if [ -f /etc/apparmor.d/local/usr.sbin.slapd.bak ]; then + sudo mv /etc/apparmor.d/local/usr.sbin.slapd.bak /etc/apparmor.d/local/usr.sbin.slapd + fi + + _apparmor_check sudo apparmor_parser -W -T -r /etc/apparmor.d/usr.sbin.slapd + fi +} + +apparmor_setup() { + # if apparmor is used, allow access to test directory + if [ "$apparmor_enabled" = true ]; then + _apparmor_allowdir=$1 + if [ -z "$_apparmor_allowdir" ]; then + echo "no directory to allow given to apparmor_setup" + exit 1 + fi + trap "_apparmor_cleanup" EXIT + + if [ -f /etc/apparmor.d/local/usr.sbin.slapd ]; then + sudo mv /etc/apparmor.d/local/usr.sbin.slapd /etc/apparmor.d/local/usr.sbin.slapd.bak + fi + + # this directory is like /etc/slapd + echo "allowing $_apparmor_allowdir in apparmor..." + echo "$_apparmor_allowdir/** kwr," | sudo tee -a /etc/apparmor.d/local/usr.sbin.slapd + + _apparmor_check sudo apparmor_parser -W -T -r /etc/apparmor.d/usr.sbin.slapd + fi +} diff -pruN 3.4.5-1/debian/tests/control 3.4.5-1ubuntu1/debian/tests/control --- 3.4.5-1/debian/tests/control 2026-01-19 09:11:29.000000000 +0000 +++ 3.4.5-1ubuntu1/debian/tests/control 2026-03-20 16:33:30.000000000 +0000 @@ -9,3 +9,4 @@ Depends: @builddeps@, Restrictions: allow-stderr, + needs-sudo, diff -pruN 3.4.5-1/debian/tests/startserver 3.4.5-1ubuntu1/debian/tests/startserver --- 3.4.5-1/debian/tests/startserver 2026-01-19 09:11:29.000000000 +0000 +++ 3.4.5-1ubuntu1/debian/tests/startserver 2026-03-20 16:33:30.000000000 +0000 @@ -2,6 +2,10 @@ set -e +. debian/tests/apparmor.sh + +apparmor_setup ${AUTOPKGTEST_TMP} + cd ${AUTOPKGTEST_TMP} for p in $(py3versions -s); do $p -c "import slapdtest; server = slapdtest.SlapdObject(); server.start(); assert server.port > 0 and server.port < 65536; server.stop()" diff -pruN 3.4.5-1/debian/tests/upstream 3.4.5-1ubuntu1/debian/tests/upstream --- 3.4.5-1/debian/tests/upstream 2026-01-19 09:11:29.000000000 +0000 +++ 3.4.5-1ubuntu1/debian/tests/upstream 2026-03-20 16:33:30.000000000 +0000 @@ -2,6 +2,10 @@ set -e +. debian/tests/apparmor.sh + +apparmor_setup ${AUTOPKGTEST_TMP} + cp -r Tests ${AUTOPKGTEST_TMP} cd ${AUTOPKGTEST_TMP} for p in $(py3versions -s); do