python3.9 (3.9.2-1+deb11u3) bullseye-security; urgency=high

python3.9 (3.9.2-1+deb11u3) bullseye-security; urgency=high

  * Non-maintainer upload by the LTS Team.

  [ Bastien Roucariès ]
  * Fix CVE-2025-0938:
    The Python standard library functions `urllib.parse.urlsplit` and
    `urlparse` accepted domain names that included square brackets
    which isn't valid according to RFC 3986.
    Square brackets are only meant to be used as delimiters for specifying
    IPv6 and IPvFuture hosts in URLs. This could result in differential
    parsing across the Python URL parser and other specification-compliant
    URL parsers.

  [ Sean Whitton ]
  - Fix CVE-2022-0391: Missing input sanitisation when parsing URLs, which
    could lead to injection accounts.
  - Fix CVE-2025-1795: The implementation of e-mail header parsing and
    folding would encode the comma used to separate list items which could
    cause receiving applications to interpret two items in the list as
    though they were one item.

[dgit import unpatched python3.9 3.9.2-1+deb11u3]