Fix bsc#1257041 (CVE-2025-15367)

Add CVE-2025-15367-poplib-ctrl-chars.patch fixing bsc#1257041
(CVE-2025-15367) using gh#python/cpython!143924 and doing basically the
same as the previous patch for poplib library.

CVE-2024-6923-follow-up-EOL-email-headers.patch

@@ -0,0 +1,105 @@
+From 7ef18bbf2f92550e65547c0a55995c423e237944 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 23 Jan 2026 08:59:35 -0600
+Subject: [PATCH] gh-144125: email: verify headers are sound in BytesGenerator
+ (cherry picked from commit 052e55e7d44718fe46cbba0ca995cb8fcc359413)
+
+Co-authored-by: Seth Michael Larson <seth@python.org>
+Co-authored-by: Denis Ledoux <dle@odoo.com>
+Co-authored-by: Denis Ledoux <5822488+beledouxdenis@users.noreply.github.com>
+Co-authored-by: Petr Viktorin <302922+encukou@users.noreply.github.com>
+Co-authored-by: Bas Bloemsaat <1586868+basbloemsaat@users.noreply.github.com>
+---
+ Lib/email/generator.py                               | 12 +++++++++++-
+ Lib/test/test_email/test_generator.py                |  4 +++-
+ Lib/test/test_email/test_policy.py                   |  6 +++++-
+ .../2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst   |  4 ++++
+ 4 files changed, 23 insertions(+), 3 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
+
+diff --git a/Lib/email/generator.py b/Lib/email/generator.py
+index ce94f5c56fe34e..a03eb1fbbc9288 100644
+--- a/Lib/email/generator.py
++++ b/Lib/email/generator.py
+@@ -22,6 +22,7 @@
+ NLCRE = re.compile(r'\r\n|\r|\n')
+ fcre = re.compile(r'^From ', re.MULTILINE)
+ NEWLINE_WITHOUT_FWSP = re.compile(r'\r\n[^ \t]|\r[^ \n\t]|\n[^ \t]')
++NEWLINE_WITHOUT_FWSP_BYTES = re.compile(br'\r\n[^ \t]|\r[^ \n\t]|\n[^ \t]')
+ 
+ 
+ class Generator:
+@@ -429,7 +430,16 @@ def _write_headers(self, msg):
+         # This is almost the same as the string version, except for handling
+         # strings with 8bit bytes.
+         for h, v in msg.raw_items():
+-            self._fp.write(self.policy.fold_binary(h, v))
++            folded = self.policy.fold_binary(h, v)
++            if self.policy.verify_generated_headers:
++                linesep = self.policy.linesep.encode()
++                if not folded.endswith(linesep):
++                    raise HeaderWriteError(
++                        f'folded header does not end with {linesep!r}: {folded!r}')
++                if NEWLINE_WITHOUT_FWSP_BYTES.search(folded.removesuffix(linesep)):
++                    raise HeaderWriteError(
++                        f'folded header contains newline: {folded!r}')
++            self._fp.write(folded)
+         # A blank line always separates headers from body
+         self.write(self._NL)
+ 
+diff --git a/Lib/test/test_email/test_generator.py b/Lib/test/test_email/test_generator.py
+index c75a842c33578e..3ca79edf6a65d9 100644
+--- a/Lib/test/test_email/test_generator.py
++++ b/Lib/test/test_email/test_generator.py
+@@ -313,7 +313,7 @@ def test_flatten_unicode_linesep(self):
+         self.assertEqual(s.getvalue(), self.typ(expected))
+ 
+     def test_verify_generated_headers(self):
+-        """gh-121650: by default the generator prevents header injection"""
++        # gh-121650: by default the generator prevents header injection
+         class LiteralHeader(str):
+             name = 'Header'
+             def fold(self, **kwargs):
+@@ -334,6 +334,8 @@ def fold(self, **kwargs):
+ 
+                 with self.assertRaises(email.errors.HeaderWriteError):
+                     message.as_string()
++                with self.assertRaises(email.errors.HeaderWriteError):
++                    message.as_bytes()
+ 
+ 
+ class TestBytesGenerator(TestGeneratorBase, TestEmailBase):
+diff --git a/Lib/test/test_email/test_policy.py b/Lib/test/test_email/test_policy.py
+index baa35fd68e49c5..71ec0febb0fd86 100644
+--- a/Lib/test/test_email/test_policy.py
++++ b/Lib/test/test_email/test_policy.py
+@@ -296,7 +296,7 @@ def test_short_maxlen_error(self):
+                     policy.fold("Subject", subject)
+ 
+     def test_verify_generated_headers(self):
+-        """Turning protection off allows header injection"""
++        # Turning protection off allows header injection
+         policy = email.policy.default.clone(verify_generated_headers=False)
+         for text in (
+             'Header: Value\r\nBad: Injection\r\n',
+@@ -319,6 +319,10 @@ def fold(self, **kwargs):
+                     message.as_string(),
+                     f"{text}\nBody",
+                 )
++                self.assertEqual(
++                    message.as_bytes(),
++                    f"{text}\nBody".encode(),
++                )
+ 
+     # XXX: Need subclassing tests.
+     # For adding subclassed objects, make sure the usual rules apply (subclass
+diff --git a/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst b/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
+new file mode 100644
+index 00000000000000..e6333e724972c5
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2026-01-21-12-34-05.gh-issue-144125.TAz5uo.rst
+@@ -0,0 +1,4 @@
++:mod:`~email.generator.BytesGenerator` will now refuse to serialize (write) headers
++that are unsafely folded or delimited; see
++:attr:`~email.policy.Policy.verify_generated_headers`. (Contributed by Bas
++Bloemsaat and Petr Viktorin in :gh:`121650`).

CVE-2025-11468-email-hdr-fold-comment.patch

@@ -0,0 +1,108 @@
+From 636f0b674ac4f4778b3ba32e950fdfc58a54b9e1 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Mon, 19 Jan 2026 06:38:22 -0600
+Subject: [PATCH] gh-143935: Email preserve parens when folding comments
+ (GH-143936)
+
+Fix a bug in the folding of comments when flattening an email message
+using a modern email policy. Comments consisting of a very long sequence of
+non-foldable characters could trigger a forced line wrap that omitted the
+required leading space on the continuation line, causing the remainder of
+the comment to be interpreted as a new header field. This enabled header
+injection with carefully crafted inputs.
+(cherry picked from commit 17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2)
+
+Co-authored-by: Seth Michael Larson <seth@python.org>
+Co-authored-by: Denis Ledoux <dle@odoo.com>
+---
+ Lib/email/_header_value_parser.py                                        |   15 ++++++
+ Lib/test/test_email/test__header_value_parser.py                         |   23 ++++++++++
+ Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst |    6 ++
+ 3 files changed, 43 insertions(+), 1 deletion(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst
+
+Index: Python-3.13.11/Lib/email/_header_value_parser.py
+===================================================================
+--- Python-3.13.11.orig/Lib/email/_header_value_parser.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/email/_header_value_parser.py	2026-01-29 19:25:21.986346350 +0100
+@@ -101,6 +101,12 @@
+     return str(value).replace('\\', '\\\\').replace('"', '\\"')
+ 
+ 
++def make_parenthesis_pairs(value):
++    """Escape parenthesis and backslash for use within a comment."""
++    return str(value).replace('\\', '\\\\') \
++        .replace('(', '\\(').replace(')', '\\)')
++
++
+ def quote_string(value):
+     escaped = make_quoted_pairs(value)
+     return f'"{escaped}"'
+@@ -933,7 +939,7 @@
+         return ' '
+ 
+     def startswith_fws(self):
+-        return True
++        return self and self[0] in WSP
+ 
+ 
+ class ValueTerminal(Terminal):
+@@ -2924,6 +2930,13 @@
+                     [ValueTerminal(make_quoted_pairs(p), 'ptext')
+                      for p in newparts] +
+                     [ValueTerminal('"', 'ptext')])
++            if part.token_type == 'comment':
++                newparts = (
++                    [ValueTerminal('(', 'ptext')] +
++                    [ValueTerminal(make_parenthesis_pairs(p), 'ptext')
++                     if p.token_type == 'ptext' else p
++                     for p in newparts] +
++                    [ValueTerminal(')', 'ptext')])
+             if not part.as_ew_allowed:
+                 wrap_as_ew_blocked += 1
+                 newparts.append(end_ew_not_allowed)
+Index: Python-3.13.11/Lib/test/test_email/test__header_value_parser.py
+===================================================================
+--- Python-3.13.11.orig/Lib/test/test_email/test__header_value_parser.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/test/test_email/test__header_value_parser.py	2026-01-29 19:25:21.986906275 +0100
+@@ -3219,6 +3219,29 @@
+             with self.subTest(to=to):
+                 self._test(parser.get_address_list(to)[0], folded, policy=policy)
+ 
++    def test_address_list_with_long_unwrapable_comment(self):
++        policy = self.policy.clone(max_line_length=40)
++        cases = [
++            # (to, folded)
++            ('(loremipsumdolorsitametconsecteturadipi)<spy@example.org>',
++             '(loremipsumdolorsitametconsecteturadipi)<spy@example.org>\n'),
++            ('<spy@example.org>(loremipsumdolorsitametconsecteturadipi)',
++             '<spy@example.org>(loremipsumdolorsitametconsecteturadipi)\n'),
++            ('(loremipsum dolorsitametconsecteturadipi)<spy@example.org>',
++             '(loremipsum dolorsitametconsecteturadipi)<spy@example.org>\n'),
++             ('<spy@example.org>(loremipsum dolorsitametconsecteturadipi)',
++             '<spy@example.org>(loremipsum\n dolorsitametconsecteturadipi)\n'),
++            ('(Escaped \\( \\) chars \\\\ in comments stay escaped)<spy@example.org>',
++             '(Escaped \\( \\) chars \\\\ in comments stay\n escaped)<spy@example.org>\n'),
++            ('((loremipsum)(loremipsum)(loremipsum)(loremipsum))<spy@example.org>',
++             '((loremipsum)(loremipsum)(loremipsum)(loremipsum))<spy@example.org>\n'),
++            ('((loremipsum)(loremipsum)(loremipsum) (loremipsum))<spy@example.org>',
++             '((loremipsum)(loremipsum)(loremipsum)\n (loremipsum))<spy@example.org>\n'),
++        ]
++        for (to, folded) in cases:
++            with self.subTest(to=to):
++                self._test(parser.get_address_list(to)[0], folded, policy=policy)
++
+     # XXX Need tests with comments on various sides of a unicode token,
+     # and with unicode tokens in the comments.  Spaces inside the quotes
+     # currently don't do the right thing.
+Index: Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-14-40-31.gh-issue-143935.U2YtKl.rst	2026-01-29 19:25:21.987305397 +0100
+@@ -0,0 +1,6 @@
++Fixed a bug in the folding of comments when flattening an email message
++using a modern email policy. Comments consisting of a very long sequence of
++non-foldable characters could trigger a forced line wrap that omitted the
++required leading space on the continuation line, causing the remainder of
++the comment to be interpreted as a new header field. This enabled header
++injection with carefully crafted inputs.

CVE-2025-15366-imap-ctrl-chars.patch

@@ -0,0 +1,56 @@
+From 7485ee5e2cf81d3e5ad0d9c3be73cecd2ab4eec7 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 16 Jan 2026 10:54:09 -0600
+Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters
+
+---
+ Lib/imaplib.py                                                           |    4 +++-
+ Lib/test/test_imaplib.py                                                 |    6 ++++++
+ Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst |    1 +
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+Index: Python-3.13.11/Lib/imaplib.py
+===================================================================
+--- Python-3.13.11.orig/Lib/imaplib.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/imaplib.py	2026-02-05 21:42:59.341114857 +0100
+@@ -132,7 +132,7 @@
+ # We compile these in _mode_xxx.
+ _Literal = br'.*{(?P<size>\d+)}$'
+ _Untagged_status = br'\* (?P<data>\d+) (?P<type>[A-Z-]+)( (?P<data2>.*))?'
+-
++_control_chars = re.compile(b'[\x00-\x1F\x7F]')
+ 
+ 
+ class IMAP4:
+@@ -1000,6 +1000,8 @@
+             if arg is None: continue
+             if isinstance(arg, str):
+                 arg = bytes(arg, self._encoding)
++            if _control_chars.search(arg):
++                raise ValueError("Control characters not allowed in commands")
+             data = data + b' ' + arg
+ 
+         literal = self.literal
+Index: Python-3.13.11/Lib/test/test_imaplib.py
+===================================================================
+--- Python-3.13.11.orig/Lib/test/test_imaplib.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/test/test_imaplib.py	2026-02-05 21:42:59.341692695 +0100
+@@ -548,6 +548,12 @@
+         self.assertEqual(data[0], b'Returned to authenticated state. (Success)')
+         self.assertEqual(client.state, 'AUTH')
+ 
++    def test_control_characters(self):
++        client, _ = self._setup(SimpleIMAPHandler)
++        for c0 in support.control_characters_c0():
++            with self.assertRaises(ValueError):
++                client.login(f'user{c0}', 'pass')
++
+ 
+ class NewIMAPTests(NewIMAPTestsMixin, unittest.TestCase):
+     imap_class = imaplib.IMAP4
+Index: Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-41-06.gh-issue-143921.AeCOor.rst	2026-02-05 21:42:59.342115872 +0100
+@@ -0,0 +1 @@
++Reject control characters in IMAP commands.

CVE-2025-15367-poplib-ctrl-chars.patch

@@ -0,0 +1,48 @@
+From b6f733b285b1c4f27dacb5c2e1f292c914e8b933 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Fri, 16 Jan 2026 10:54:09 -0600
+Subject: [PATCH 1/2] Add 'test.support' fixture for C0 control characters
+
+---
+ Lib/poplib.py                                                            |    2 ++
+ Lib/test/test_poplib.py                                                  |    7 +++++++
+ Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst |    1 +
+ 3 files changed, 10 insertions(+)
+
+Index: Python-3.13.11/Lib/poplib.py
+===================================================================
+--- Python-3.13.11.orig/Lib/poplib.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/poplib.py	2026-02-05 22:06:33.769936918 +0100
+@@ -122,6 +122,8 @@
+     def _putcmd(self, line):
+         if self._debugging: print('*cmd*', repr(line))
+         line = bytes(line, self.encoding)
++        if re.search(b'[\x00-\x1F\x7F]', line):
++            raise ValueError('Control characters not allowed in commands')
+         self._putline(line)
+ 
+ 
+Index: Python-3.13.11/Lib/test/test_poplib.py
+===================================================================
+--- Python-3.13.11.orig/Lib/test/test_poplib.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/test/test_poplib.py	2026-02-05 22:06:33.770193070 +0100
+@@ -396,6 +396,13 @@
+         self.assertIsNone(self.client.sock)
+         self.assertIsNone(self.client.file)
+ 
++    def test_control_characters(self):
++        for c0 in control_characters_c0():
++            with self.assertRaises(ValueError):
++                self.client.user(f'user{c0}')
++            with self.assertRaises(ValueError):
++                self.client.pass_(f'{c0}pass')
++
+     @requires_ssl
+     def test_stls_capa(self):
+         capa = self.client.capa()
+Index: Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-43-47.gh-issue-143923.DuytMe.rst	2026-02-05 22:06:33.770449444 +0100
+@@ -0,0 +1 @@
++Reject control characters in POP3 commands.

CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch

@@ -0,0 +1,207 @@
+From 19ca21e044a9485c85b08aab297a5cbb8680b8d1 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Tue, 20 Jan 2026 15:23:42 -0600
+Subject: [PATCH] gh-143919: Reject control characters in http cookies (cherry
+ picked from commit 95746b3a13a985787ef53b977129041971ed7f70)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Co-authored-by: Seth Michael Larson <seth@python.org>
+Co-authored-by: Bartosz Sławecki <bartosz@ilikepython.com>
+Co-authored-by: sobolevn <mail@sobolevn.me>
+---
+ Doc/library/http.cookies.rst                                             |    4 
+ Lib/http/cookies.py                                                      |   25 ++++
+ Lib/test/support/__init__.py                                             |    8 +
+ Lib/test/test_http_cookies.py                                            |   52 +++++++++-
+ Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst |    1 
+ 5 files changed, 81 insertions(+), 9 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst
+
+Index: Python-3.13.11/Doc/library/http.cookies.rst
+===================================================================
+--- Python-3.13.11.orig/Doc/library/http.cookies.rst	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Doc/library/http.cookies.rst	2026-02-03 01:14:38.406889249 +0100
+@@ -275,9 +275,9 @@
+    Set-Cookie: chips=ahoy
+    Set-Cookie: vienna=finger
+    >>> C = cookies.SimpleCookie()
+-   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=\\012;";')
++   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=;";')
+    >>> print(C)
+-   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=\012;"
++   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=;"
+    >>> C = cookies.SimpleCookie()
+    >>> C["oreo"] = "doublestuff"
+    >>> C["oreo"]["path"] = "/"
+Index: Python-3.13.11/Lib/http/cookies.py
+===================================================================
+--- Python-3.13.11.orig/Lib/http/cookies.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/http/cookies.py	2026-02-03 01:14:38.407180728 +0100
+@@ -87,9 +87,9 @@
+ such trickeries do not confuse it.
+ 
+    >>> C = cookies.SimpleCookie()
+-   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=\\012;";')
++   >>> C.load('keebler="E=everybody; L=\\"Loves\\"; fudge=;";')
+    >>> print(C)
+-   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=\012;"
++   Set-Cookie: keebler="E=everybody; L=\"Loves\"; fudge=;"
+ 
+ Each element of the Cookie also supports all of the RFC 2109
+ Cookie attributes.  Here's an example which sets the Path
+@@ -170,6 +170,15 @@
+ })
+ 
+ _is_legal_key = re.compile('[%s]+' % re.escape(_LegalChars)).fullmatch
++_control_character_re = re.compile(r'[\x00-\x1F\x7F]')
++
++
++def _has_control_character(*val):
++    """Detects control characters within a value.
++    Supports any type, as header values can be any type.
++    """
++    return any(_control_character_re.search(str(v)) for v in val)
++
+ 
+ def _quote(str):
+     r"""Quote a string for use in a cookie header.
+@@ -292,12 +301,16 @@
+         K = K.lower()
+         if not K in self._reserved:
+             raise CookieError("Invalid attribute %r" % (K,))
++        if _has_control_character(K, V):
++            raise CookieError(f"Control characters are not allowed in cookies {K!r} {V!r}")
+         dict.__setitem__(self, K, V)
+ 
+     def setdefault(self, key, val=None):
+         key = key.lower()
+         if key not in self._reserved:
+             raise CookieError("Invalid attribute %r" % (key,))
++        if _has_control_character(key, val):
++            raise CookieError("Control characters are not allowed in cookies %r %r" % (key, val,))
+         return dict.setdefault(self, key, val)
+ 
+     def __eq__(self, morsel):
+@@ -333,6 +346,9 @@
+             raise CookieError('Attempt to set a reserved key %r' % (key,))
+         if not _is_legal_key(key):
+             raise CookieError('Illegal key %r' % (key,))
++        if _has_control_character(key, val, coded_val):
++            raise CookieError(
++                "Control characters are not allowed in cookies %r %r %r" % (key, val, coded_val,))
+ 
+         # It's a good key, so save it.
+         self._key = key
+@@ -486,7 +502,10 @@
+         result = []
+         items = sorted(self.items())
+         for key, value in items:
+-            result.append(value.output(attrs, header))
++            value_output = value.output(attrs, header)
++            if _has_control_character(value_output):
++                raise CookieError("Control characters are not allowed in cookies")
++            result.append(value_output)
+         return sep.join(result)
+ 
+     __str__ = output
+Index: Python-3.13.11/Lib/test/support/__init__.py
+===================================================================
+--- Python-3.13.11.orig/Lib/test/support/__init__.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/test/support/__init__.py	2026-02-03 01:16:59.080295540 +0100
+@@ -64,6 +64,7 @@
+     "force_not_colorized_test_class",
+     "make_clean_env",
+     "BrokenIter",
++    "control_characters_c0",
+     ]
+ 
+ 
+@@ -2845,3 +2846,10 @@
+     except (OSError, subprocess.CalledProcessError):
+         return False
+     return ('musl' in stdout)
++
++
++def control_characters_c0() -> list[str]:
++    """Returns a list of C0 control characters as strings.
++    C0 control characters defined as the byte range 0x00-0x1F, and 0x7F.
++    """
++    return [chr(c) for c in range(0x00, 0x20)] + ["\x7F"]
+Index: Python-3.13.11/Lib/test/test_http_cookies.py
+===================================================================
+--- Python-3.13.11.orig/Lib/test/test_http_cookies.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/test/test_http_cookies.py	2026-02-03 01:14:38.407381716 +0100
+@@ -18,10 +18,10 @@
+              'repr': "<SimpleCookie: chips='ahoy' vienna='finger'>",
+              'output': 'Set-Cookie: chips=ahoy\nSet-Cookie: vienna=finger'},
+ 
+-            {'data': 'keebler="E=mc2; L=\\"Loves\\"; fudge=\\012;"',
+-             'dict': {'keebler' : 'E=mc2; L="Loves"; fudge=\012;'},
+-             'repr': '''<SimpleCookie: keebler='E=mc2; L="Loves"; fudge=\\n;'>''',
+-             'output': 'Set-Cookie: keebler="E=mc2; L=\\"Loves\\"; fudge=\\012;"'},
++            {'data': 'keebler="E=mc2; L=\\"Loves\\"; fudge=;"',
++             'dict': {'keebler' : 'E=mc2; L="Loves"; fudge=;'},
++             'repr': '''<SimpleCookie: keebler='E=mc2; L="Loves"; fudge=;'>''',
++             'output': 'Set-Cookie: keebler="E=mc2; L=\\"Loves\\"; fudge=;"'},
+ 
+             # Check illegal cookies that have an '=' char in an unquoted value
+             {'data': 'keebler=E=mc2',
+@@ -564,6 +564,50 @@
+                 r'Set-Cookie: key=coded_val; '
+                 r'expires=\w+, \d+ \w+ \d+ \d+:\d+:\d+ \w+')
+ 
++    def test_control_characters(self):
++        for c0 in support.control_characters_c0():
++            morsel = cookies.Morsel()
++
++            # .__setitem__()
++            with self.assertRaises(cookies.CookieError):
++                morsel[c0] = "val"
++            with self.assertRaises(cookies.CookieError):
++                morsel["path"] = c0
++
++            # .setdefault()
++            with self.assertRaises(cookies.CookieError):
++                morsel.setdefault("path", c0)
++            with self.assertRaises(cookies.CookieError):
++                morsel.setdefault(c0, "val")
++
++            # .set()
++            with self.assertRaises(cookies.CookieError):
++                morsel.set(c0, "val", "coded-value")
++            with self.assertRaises(cookies.CookieError):
++                morsel.set("path", c0, "coded-value")
++            with self.assertRaises(cookies.CookieError):
++                morsel.set("path", "val", c0)
++
++    def test_control_characters_output(self):
++        # Tests that even if the internals of Morsel are modified
++        # that a call to .output() has control character safeguards.
++        for c0 in support.control_characters_c0():
++            morsel = cookies.Morsel()
++            morsel.set("key", "value", "coded-value")
++            morsel._key = c0  # Override private variable.
++            cookie = cookies.SimpleCookie()
++            cookie["cookie"] = morsel
++            with self.assertRaises(cookies.CookieError):
++                cookie.output()
++
++            morsel = cookies.Morsel()
++            morsel.set("key", "value", "coded-value")
++            morsel._coded_value = c0  # Override private variable.
++            cookie = cookies.SimpleCookie()
++            cookie["cookie"] = morsel
++            with self.assertRaises(cookies.CookieError):
++                cookie.output()
++
+ 
+ def load_tests(loader, tests, pattern):
+     tests.addTest(doctest.DocTestSuite(cookies))
+Index: Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-13-15.gh-issue-143919.kchwZV.rst	2026-02-03 01:14:38.407545685 +0100
+@@ -0,0 +1 @@
++Reject control characters in :class:`http.cookies.Morsel` fields and values.

CVE-2026-0865-wsgiref-ctrl-chars.patch

@@ -0,0 +1,156 @@
+From dd05b44d6d3fc8b6cced2e4fbc179f6e918bee15 Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <seth@python.org>
+Date: Sat, 17 Jan 2026 11:46:21 -0600
+Subject: [PATCH] gh-143916: Reject control characters in
+ wsgiref.headers.Headers  (GH-143917)
+
+* Add 'test.support' fixture for C0 control characters
+* gh-143916: Reject control characters in wsgiref.headers.Headers
+
+(cherry picked from commit f7fceed79ca1bceae8dbe5ba5bc8928564da7211)
+---
+ Lib/test/test_wsgiref.py                                                 |   18 +++++
+ Lib/wsgiref/headers.py                                                   |   34 ++++++----
+ Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst |    2 
+ 3 files changed, 40 insertions(+), 14 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
+
+Index: Python-3.13.11/Lib/test/test_wsgiref.py
+===================================================================
+--- Python-3.13.11.orig/Lib/test/test_wsgiref.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/test/test_wsgiref.py	2026-02-05 20:01:53.852125924 +0100
+@@ -1,6 +1,6 @@
+ from unittest import mock
+ from test import support
+-from test.support import socket_helper
++from test.support import socket_helper, control_characters_c0
+ from test.test_httpservers import NoLogRequestHandler
+ from unittest import TestCase
+ from wsgiref.util import setup_testing_defaults
+@@ -503,6 +503,22 @@
+             '\r\n'
+         )
+ 
++    def testRaisesControlCharacters(self):
++        for c0 in control_characters_c0():
++            with self.subTest(c0):
++                headers = Headers()
++                self.assertRaises(ValueError, headers.__setitem__, f"key{c0}", "val")
++                self.assertRaises(ValueError, headers.add_header, f"key{c0}", "val", param="param")
++                # HTAB (\x09) is allowed in values, not names.
++                if c0 == "\t":
++                    headers["key"] = f"val{c0}"
++                    headers.add_header("key", f"val{c0}")
++                    headers.setdefault(f"key", f"val{c0}")
++                else:
++                    self.assertRaises(ValueError, headers.__setitem__, "key", f"val{c0}")
++                    self.assertRaises(ValueError, headers.add_header, "key", f"val{c0}", param="param")
++                    self.assertRaises(ValueError, headers.add_header, "key", "val", param=f"param{c0}")
++
+ class ErrorHandler(BaseCGIHandler):
+     """Simple handler subclass for testing BaseHandler"""
+ 
+Index: Python-3.13.11/Lib/wsgiref/headers.py
+===================================================================
+--- Python-3.13.11.orig/Lib/wsgiref/headers.py	2025-12-05 17:06:33.000000000 +0100
++++ Python-3.13.11/Lib/wsgiref/headers.py	2026-02-05 20:01:53.852878361 +0100
+@@ -9,6 +9,11 @@
+ # existence of which force quoting of the parameter value.
+ import re
+ tspecials = re.compile(r'[ \(\)<>@,;:\\"/\[\]\?=]')
++# Disallowed characters for headers and values.
++# HTAB (\x09) is allowed in header values, but
++# not in header names. (RFC 9110 Section 5.5)
++_name_disallowed_re = re.compile(r'[\x00-\x1F\x7F]')
++_value_disallowed_re = re.compile(r'[\x00-\x08\x0A-\x1F\x7F]')
+ 
+ def _formatparam(param, value=None, quote=1):
+     """Convenience function to format and return a key=value pair.
+@@ -35,12 +40,15 @@
+         self._headers = headers
+         if __debug__:
+             for k, v in headers:
+-                self._convert_string_type(k)
+-                self._convert_string_type(v)
++                self._convert_string_type(k, name=True)
++                self._convert_string_type(v, name=False)
+ 
+-    def _convert_string_type(self, value):
++    def _convert_string_type(self, value, *, name):
+         """Convert/check value type."""
+         if type(value) is str:
++            regex = (_name_disallowed_re if name else _value_disallowed_re)
++            if regex.search(value):
++                raise ValueError("Control characters not allowed in headers")
+             return value
+         raise AssertionError("Header names/values must be"
+             " of type str (got {0})".format(repr(value)))
+@@ -53,14 +61,14 @@
+         """Set the value of a header."""
+         del self[name]
+         self._headers.append(
+-            (self._convert_string_type(name), self._convert_string_type(val)))
++            (self._convert_string_type(name, name=True), self._convert_string_type(val, name=False)))
+ 
+     def __delitem__(self,name):
+         """Delete all occurrences of a header, if present.
+ 
+         Does *not* raise an exception if the header is missing.
+         """
+-        name = self._convert_string_type(name.lower())
++        name = self._convert_string_type(name.lower(), name=True)
+         self._headers[:] = [kv for kv in self._headers if kv[0].lower() != name]
+ 
+     def __getitem__(self,name):
+@@ -87,13 +95,13 @@
+         fields deleted and re-inserted are always appended to the header list.
+         If no fields exist with the given name, returns an empty list.
+         """
+-        name = self._convert_string_type(name.lower())
++        name = self._convert_string_type(name.lower(), name=True)
+         return [kv[1] for kv in self._headers if kv[0].lower()==name]
+ 
+ 
+     def get(self,name,default=None):
+         """Get the first header value for 'name', or return 'default'"""
+-        name = self._convert_string_type(name.lower())
++        name = self._convert_string_type(name.lower(), name=True)
+         for k,v in self._headers:
+             if k.lower()==name:
+                 return v
+@@ -148,8 +156,8 @@
+         and value 'value'."""
+         result = self.get(name)
+         if result is None:
+-            self._headers.append((self._convert_string_type(name),
+-                self._convert_string_type(value)))
++            self._headers.append((self._convert_string_type(name, name=True),
++                self._convert_string_type(value, name=False)))
+             return value
+         else:
+             return result
+@@ -172,13 +180,13 @@
+         """
+         parts = []
+         if _value is not None:
+-            _value = self._convert_string_type(_value)
++            _value = self._convert_string_type(_value, name=False)
+             parts.append(_value)
+         for k, v in _params.items():
+-            k = self._convert_string_type(k)
++            k = self._convert_string_type(k, name=True)
+             if v is None:
+                 parts.append(k.replace('_', '-'))
+             else:
+-                v = self._convert_string_type(v)
++                v = self._convert_string_type(v, name=False)
+                 parts.append(_formatparam(k.replace('_', '-'), v))
+-        self._headers.append((self._convert_string_type(_name), "; ".join(parts)))
++        self._headers.append((self._convert_string_type(_name, name=True), "; ".join(parts)))
+Index: Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ Python-3.13.11/Misc/NEWS.d/next/Security/2026-01-16-11-07-36.gh-issue-143916.dpWeOD.rst	2026-02-05 20:01:14.851526154 +0100
+@@ -0,0 +1,2 @@
++Reject C0 control characters within wsgiref.headers.Headers fields, values,
++and parameters.

python313.changes

@@ -1,3 +1,30 @@
+-------------------------------------------------------------------
+Thu Feb  5 18:57:27 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
+
+- Add CVE-2026-0865-wsgiref-ctrl-chars.patch fixing bsc#1257042
+  (CVE-2026-0865) rejecting control characters in
+  wsgiref.headers.Headers, which could be abused for injecting
+  false HTTP headers.
+- Add CVE-2025-15366-imap-ctrl-chars.patch fixing bsc#1257044
+  (CVE-2025-15366) using gh#python/cpython!143922 and doing
+  basically the same as the previous patch for IMAP protocol.
+- Add CVE-2025-15367-poplib-ctrl-chars.patch fixing bsc#1257041
+  (CVE-2025-15367) using gh#python/cpython!143924 and doing
+  basically the same as the previous patch for poplib library.
+
+-------------------------------------------------------------------
+Tue Jan 27 16:31:12 UTC 2026 - Matej Cepl <mcepl@cepl.eu>
+
+- Add CVE-2024-6923-follow-up-EOL-email-headers.patch which is
+  a follow-up to the previous fix of CVE-2024-6923 further
+  encoding EOL possibly hidden in email headers (bsc#1257181).
+- Add CVE-2025-11468-email-hdr-fold-comment.patch preserving
+  parens when folding comments in email headers (bsc#1257029,
+  CVE-2025-11468).
+- Add CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch, which
+  rejects control characters in http cookies (bsc#1257031,
+  CVE-2026-0672).
+
 -------------------------------------------------------------------
 Thu Dec 11 21:36:09 UTC 2025 - Matej Cepl <mcepl@cepl.eu>
 

python313.spec

@@ -238,6 +238,26 @@ Patch45:        gh139257-Support-docutils-0.22.patch
 # PATCH-FIX-UPSTREAM pass-test_write_read_limited_history.patch bsc#[0-9]+ mcepl@suse.com
 # Fix readline history truncation when length is reduced
 Patch48:        pass-test_write_read_limited_history.patch
+# PATCH-FIX-UPSTREAM CVE-2024-6923-follow-up-EOL-email-headers.patch bsc#1257181 mcepl@suse.com
+# Encode newlines in headers when using ByteGenerator
+# patch from gh#python/cpython#144125
+Patch49:        CVE-2024-6923-follow-up-EOL-email-headers.patch
+# PATCH-FIX-UPSTREAM CVE-2025-11468-email-hdr-fold-comment.patch bsc#1257029 mcepl@suse.com
+# Email preserve parens when folding comments
+Patch50:        CVE-2025-11468-email-hdr-fold-comment.patch
+# PATCH-FIX-UPSTREAM CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch bsc#1257031 mcepl@suse.com
+# Reject control characters in http cookies
+Patch51:        CVE-2026-0672-http-hdr-inject-cookie-Morsel.patch
+# PATCH-FIX-UPSTREAM CVE-2026-0865-wsgiref-ctrl-chars.patch bsc#1257042 mcepl@suse.com
+# Reject control characters in wsgiref.headers.Headers
+Patch52:        CVE-2026-0865-wsgiref-ctrl-chars.patch
+# PATCH-FIX-UPSTREAM CVE-2025-15366-imap-ctrl-chars.patch bsc#1257044 mcepl@suse.com
+# Reject control characters in wsgiref.headers.Headers
+Patch53:        CVE-2025-15366-imap-ctrl-chars.patch
+# PATCH-FIX-UPSTREAM CVE-2025-15367-poplib-ctrl-chars.patch bsc#1257041 mcepl@suse.com
+# Reject control characters in poplib
+Patch54:        CVE-2025-15367-poplib-ctrl-chars.patch
+#### END OF PATCHES
 BuildRequires:  autoconf-archive
 BuildRequires:  automake
 BuildRequires:  fdupes