{
    "summary": {
        "snap": {
            "added": [],
            "removed": [],
            "diff": []
        },
        "deb": {
            "added": [],
            "removed": [],
            "diff": [
                "gnu-coreutils",
                "libnss3:s390x",
                "libpython3.13:s390x",
                "libpython3.13-minimal:s390x",
                "libpython3.13-stdlib:s390x",
                "python3.13",
                "python3.13-gdbm",
                "python3.13-minimal",
                "sos"
            ]
        }
    },
    "diff": {
        "deb": [
            {
                "name": "gnu-coreutils",
                "from_version": {
                    "source_package_name": "coreutils",
                    "source_package_version": "9.5-1ubuntu4",
                    "version": "9.5-1ubuntu4"
                },
                "to_version": {
                    "source_package_name": "coreutils",
                    "source_package_version": "9.5-1ubuntu4.1",
                    "version": "9.5-1ubuntu4.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2137373
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * Fix slow performance of 'du' on large directories (>= 10K files)",
                            "    on Lustre filesystems by skipping inode sorting. The default",
                            "    behaviour of sorting dirents by inode numbers negatively impacts",
                            "    performance on Lustre because it interferes with Lustre's ability",
                            "    to prefetch file metadata via statahead. (LP: #2137373)",
                            "    - d/p/lp2137373-skip-dirent-inode-sorting-for-lustre.patch",
                            ""
                        ],
                        "package": "coreutils",
                        "version": "9.5-1ubuntu4.1",
                        "urgency": "medium",
                        "distributions": "questing",
                        "launchpad_bugs_fixed": [
                            2137373
                        ],
                        "author": "Munir Siddiqui <munir.siddiqui@canonical.com>",
                        "date": "Fri, 23 Jan 2026 18:34:28 +0500"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libnss3:s390x",
                "from_version": {
                    "source_package_name": "nss",
                    "source_package_version": "2:3.114-1",
                    "version": "2:3.114-1"
                },
                "to_version": {
                    "source_package_name": "nss",
                    "source_package_version": "2:3.114-1ubuntu0.1",
                    "version": "2:3.114-1ubuntu0.1"
                },
                "cves": [
                    {
                        "cve": "CVE-2026-2781",
                        "url": "https://ubuntu.com/security/CVE-2026-2781",
                        "cve_description": "Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-02-24 14:16:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2026-2781",
                                "url": "https://ubuntu.com/security/CVE-2026-2781",
                                "cve_description": "Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-02-24 14:16:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY UPDATE: integer overflow in platform-independent ghash",
                            "    - debian/patches/CVE-2026-2781.patch: properly cast len in",
                            "      nss/lib/freebl/gcm.c.",
                            "    - CVE-2026-2781",
                            ""
                        ],
                        "package": "nss",
                        "version": "2:3.114-1ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "questing-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Marc Deslauriers <marc.deslauriers@ubuntu.com>",
                        "date": "Thu, 26 Feb 2026 13:27:13 -0500"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libpython3.13:s390x",
                "from_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.3",
                    "version": "3.13.7-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.4",
                    "version": "3.13.7-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2025-15366",
                        "url": "https://ubuntu.com/security/CVE-2025-15366",
                        "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-15367",
                        "url": "https://ubuntu.com/security/CVE-2025-15367",
                        "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-0865",
                        "url": "https://ubuntu.com/security/CVE-2026-0865",
                        "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2025-15366",
                                "url": "https://ubuntu.com/security/CVE-2025-15366",
                                "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-15367",
                                "url": "https://ubuntu.com/security/CVE-2025-15367",
                                "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-0865",
                                "url": "https://ubuntu.com/security/CVE-2026-0865",
                                "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15366",
                            "    - debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC",
                            "      9051 IMAP conformance and introduces behavior regressions avoided",
                            "      by upstream.",
                            "    - CVE-2025-15366",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15367",
                            "    - debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior",
                            "      regressions, aligning with upstream backporting decisions.",
                            "    - CVE-2025-15367",
                            "  * SECURITY REGRESSION: Allow HTAB in wsgiref header values",
                            "    - debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values",
                            "      (excluding names) in Lib/wsgiref/headers.py, add test coverage.",
                            "    - CVE-2026-0865",
                            ""
                        ],
                        "package": "python3.13",
                        "version": "3.13.7-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "questing-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Vyom Yadav <vyom.yadav@canonical.com>",
                        "date": "Tue, 03 Mar 2026 17:49:54 +0530"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libpython3.13-minimal:s390x",
                "from_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.3",
                    "version": "3.13.7-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.4",
                    "version": "3.13.7-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2025-15366",
                        "url": "https://ubuntu.com/security/CVE-2025-15366",
                        "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-15367",
                        "url": "https://ubuntu.com/security/CVE-2025-15367",
                        "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-0865",
                        "url": "https://ubuntu.com/security/CVE-2026-0865",
                        "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2025-15366",
                                "url": "https://ubuntu.com/security/CVE-2025-15366",
                                "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-15367",
                                "url": "https://ubuntu.com/security/CVE-2025-15367",
                                "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-0865",
                                "url": "https://ubuntu.com/security/CVE-2026-0865",
                                "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15366",
                            "    - debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC",
                            "      9051 IMAP conformance and introduces behavior regressions avoided",
                            "      by upstream.",
                            "    - CVE-2025-15366",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15367",
                            "    - debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior",
                            "      regressions, aligning with upstream backporting decisions.",
                            "    - CVE-2025-15367",
                            "  * SECURITY REGRESSION: Allow HTAB in wsgiref header values",
                            "    - debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values",
                            "      (excluding names) in Lib/wsgiref/headers.py, add test coverage.",
                            "    - CVE-2026-0865",
                            ""
                        ],
                        "package": "python3.13",
                        "version": "3.13.7-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "questing-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Vyom Yadav <vyom.yadav@canonical.com>",
                        "date": "Tue, 03 Mar 2026 17:49:54 +0530"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "libpython3.13-stdlib:s390x",
                "from_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.3",
                    "version": "3.13.7-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.4",
                    "version": "3.13.7-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2025-15366",
                        "url": "https://ubuntu.com/security/CVE-2025-15366",
                        "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-15367",
                        "url": "https://ubuntu.com/security/CVE-2025-15367",
                        "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-0865",
                        "url": "https://ubuntu.com/security/CVE-2026-0865",
                        "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2025-15366",
                                "url": "https://ubuntu.com/security/CVE-2025-15366",
                                "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-15367",
                                "url": "https://ubuntu.com/security/CVE-2025-15367",
                                "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-0865",
                                "url": "https://ubuntu.com/security/CVE-2026-0865",
                                "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15366",
                            "    - debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC",
                            "      9051 IMAP conformance and introduces behavior regressions avoided",
                            "      by upstream.",
                            "    - CVE-2025-15366",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15367",
                            "    - debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior",
                            "      regressions, aligning with upstream backporting decisions.",
                            "    - CVE-2025-15367",
                            "  * SECURITY REGRESSION: Allow HTAB in wsgiref header values",
                            "    - debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values",
                            "      (excluding names) in Lib/wsgiref/headers.py, add test coverage.",
                            "    - CVE-2026-0865",
                            ""
                        ],
                        "package": "python3.13",
                        "version": "3.13.7-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "questing-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Vyom Yadav <vyom.yadav@canonical.com>",
                        "date": "Tue, 03 Mar 2026 17:49:54 +0530"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "python3.13",
                "from_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.3",
                    "version": "3.13.7-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.4",
                    "version": "3.13.7-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2025-15366",
                        "url": "https://ubuntu.com/security/CVE-2025-15366",
                        "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-15367",
                        "url": "https://ubuntu.com/security/CVE-2025-15367",
                        "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-0865",
                        "url": "https://ubuntu.com/security/CVE-2026-0865",
                        "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2025-15366",
                                "url": "https://ubuntu.com/security/CVE-2025-15366",
                                "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-15367",
                                "url": "https://ubuntu.com/security/CVE-2025-15367",
                                "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-0865",
                                "url": "https://ubuntu.com/security/CVE-2026-0865",
                                "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15366",
                            "    - debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC",
                            "      9051 IMAP conformance and introduces behavior regressions avoided",
                            "      by upstream.",
                            "    - CVE-2025-15366",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15367",
                            "    - debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior",
                            "      regressions, aligning with upstream backporting decisions.",
                            "    - CVE-2025-15367",
                            "  * SECURITY REGRESSION: Allow HTAB in wsgiref header values",
                            "    - debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values",
                            "      (excluding names) in Lib/wsgiref/headers.py, add test coverage.",
                            "    - CVE-2026-0865",
                            ""
                        ],
                        "package": "python3.13",
                        "version": "3.13.7-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "questing-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Vyom Yadav <vyom.yadav@canonical.com>",
                        "date": "Tue, 03 Mar 2026 17:49:54 +0530"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "python3.13-gdbm",
                "from_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.3",
                    "version": "3.13.7-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.4",
                    "version": "3.13.7-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2025-15366",
                        "url": "https://ubuntu.com/security/CVE-2025-15366",
                        "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-15367",
                        "url": "https://ubuntu.com/security/CVE-2025-15367",
                        "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-0865",
                        "url": "https://ubuntu.com/security/CVE-2026-0865",
                        "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2025-15366",
                                "url": "https://ubuntu.com/security/CVE-2025-15366",
                                "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-15367",
                                "url": "https://ubuntu.com/security/CVE-2025-15367",
                                "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-0865",
                                "url": "https://ubuntu.com/security/CVE-2026-0865",
                                "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15366",
                            "    - debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC",
                            "      9051 IMAP conformance and introduces behavior regressions avoided",
                            "      by upstream.",
                            "    - CVE-2025-15366",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15367",
                            "    - debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior",
                            "      regressions, aligning with upstream backporting decisions.",
                            "    - CVE-2025-15367",
                            "  * SECURITY REGRESSION: Allow HTAB in wsgiref header values",
                            "    - debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values",
                            "      (excluding names) in Lib/wsgiref/headers.py, add test coverage.",
                            "    - CVE-2026-0865",
                            ""
                        ],
                        "package": "python3.13",
                        "version": "3.13.7-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "questing-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Vyom Yadav <vyom.yadav@canonical.com>",
                        "date": "Tue, 03 Mar 2026 17:49:54 +0530"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "python3.13-minimal",
                "from_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.3",
                    "version": "3.13.7-1ubuntu0.3"
                },
                "to_version": {
                    "source_package_name": "python3.13",
                    "source_package_version": "3.13.7-1ubuntu0.4",
                    "version": "3.13.7-1ubuntu0.4"
                },
                "cves": [
                    {
                        "cve": "CVE-2025-15366",
                        "url": "https://ubuntu.com/security/CVE-2025-15366",
                        "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2025-15367",
                        "url": "https://ubuntu.com/security/CVE-2025-15367",
                        "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    },
                    {
                        "cve": "CVE-2026-0865",
                        "url": "https://ubuntu.com/security/CVE-2026-0865",
                        "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                        "cve_priority": "medium",
                        "cve_public_date": "2026-01-20 22:15:00 UTC"
                    }
                ],
                "launchpad_bugs_fixed": [],
                "changes": [
                    {
                        "cves": [
                            {
                                "cve": "CVE-2025-15366",
                                "url": "https://ubuntu.com/security/CVE-2025-15366",
                                "cve_description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2025-15367",
                                "url": "https://ubuntu.com/security/CVE-2025-15367",
                                "cve_description": "The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            },
                            {
                                "cve": "CVE-2026-0865",
                                "url": "https://ubuntu.com/security/CVE-2026-0865",
                                "cve_description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.",
                                "cve_priority": "medium",
                                "cve_public_date": "2026-01-20 22:15:00 UTC"
                            }
                        ],
                        "log": [
                            "",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15366",
                            "    - debian/patches/CVE-2025-15366.patch: Reverted. Patch breaks RFC",
                            "      9051 IMAP conformance and introduces behavior regressions avoided",
                            "      by upstream.",
                            "    - CVE-2025-15366",
                            "  * SECURITY REGRESSION: Revert patch for CVE-2025-15367",
                            "    - debian/patches/CVE-2025-15367.patch: Reverted to prevent behavior",
                            "      regressions, aligning with upstream backporting decisions.",
                            "    - CVE-2025-15367",
                            "  * SECURITY REGRESSION: Allow HTAB in wsgiref header values",
                            "    - debian/patches/CVE-2026-0865-2.patch: Permit HTAB in header values",
                            "      (excluding names) in Lib/wsgiref/headers.py, add test coverage.",
                            "    - CVE-2026-0865",
                            ""
                        ],
                        "package": "python3.13",
                        "version": "3.13.7-1ubuntu0.4",
                        "urgency": "medium",
                        "distributions": "questing-security",
                        "launchpad_bugs_fixed": [],
                        "author": "Vyom Yadav <vyom.yadav@canonical.com>",
                        "date": "Tue, 03 Mar 2026 17:49:54 +0530"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            },
            {
                "name": "sos",
                "from_version": {
                    "source_package_name": "sos",
                    "source_package_version": "4.10.0-1",
                    "version": "4.10.0-1"
                },
                "to_version": {
                    "source_package_name": "sos",
                    "source_package_version": "4.10.2-0ubuntu0.1",
                    "version": "4.10.2-0ubuntu0.1"
                },
                "cves": [],
                "launchpad_bugs_fixed": [
                    2136302
                ],
                "changes": [
                    {
                        "cves": [],
                        "log": [
                            "",
                            "  * New 4.10.2 upstream release. (LP: #2136302)",
                            "",
                            "  * For more details, full release note is available here:",
                            "    - https://github.com/sosreport/sos/releases/tag/4.10.2",
                            "",
                            "  * d/control:",
                            "    - Add gpg to Recommends so that we are able to encrypt and",
                            "      decrypt sos reports",
                            "    - Update Replaces and Breaks with the new package version to ensure the",
                            "      upgrade path works",
                            "",
                            "  * d/copyright: Aligned copyright with upstream Debian",
                            "",
                            "  * Former patches, now fixed:",
                            "    - d/p/0001-Fix-Cleaner-Obfuscate-File.patch",
                            ""
                        ],
                        "package": "sos",
                        "version": "4.10.2-0ubuntu0.1",
                        "urgency": "medium",
                        "distributions": "questing",
                        "launchpad_bugs_fixed": [
                            2136302
                        ],
                        "author": "Bryan Fraschetti <bryan.fraschetti@canonical.com>",
                        "date": "Tue, 16 Dec 2025 12:32:13 -0500"
                    }
                ],
                "notes": null,
                "is_version_downgrade": false
            }
        ],
        "snap": []
    },
    "added": {
        "deb": [],
        "snap": []
    },
    "removed": {
        "deb": [],
        "snap": []
    },
    "notes": "Changelog diff for Ubuntu 25.10 questing image from daily image serial 20260226 to 20260310",
    "from_series": "questing",
    "to_series": "questing",
    "from_serial": "20260226",
    "to_serial": "20260310",
    "from_manifest_filename": "daily_manifest.previous",
    "to_manifest_filename": "manifest.current"
}