* SECURITY UPDATE: imaplib.IMAP4._command() concatenated each command argument into the wire-level command without inspecting it, so a caller passing user-controlled text could inject additional IMAP commands using CR/LF or other control characters. - debian/patches/CVE-2025-15366.patch: backport of cpython 6262704b (gh-143921, Seth Larson). Adds a module-level _control_chars regex and rejects any byte in [\x00-\x1F\x7F] with ValueError before concatenating each argument. Upstream-main-only fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464). - CVE-2025-15366 * SECURITY UPDATE: poplib.POP3._putcmd() encoded its argument and sent it to the server without inspecting it, allowing the same command injection via user() / pass_() / apop() / rpop() / top(). - debian/patches/CVE-2025-15367.patch: backport of cpython b234a2b6 (gh-143923, Seth Larson). Rejects any byte in [\x00-\x1F\x7F] with ValueError before sending. Upstream-main-only fix; mirrors Red Hat's python3-3.6.8-21.el7_9.4 (RHSA-2026:6464). - CVE-2025-15367