* SECURITY UPDATE: ssl accepted TLS certificate chains signed by eMudhra intermediate CAs whose private keys were compromised (CWE-295). An attacker holding one of those keys can mint a certificate for any name that still chains to a publicly trusted root, and every ssl client keeps accepting it until the distrust reaches the platform root store, the container image, or a CA bundle vendored inside a Python package. - debian/patches/CVE-2026-115557.patch: backport of cpython gh-160040 / GH-160042, which adds Modules/_ssl/distrusted_spki.h - a denylist of the SHA-256 digests of the eight compromised SubjectPublicKeyInfo structures - and enforces it from a new _ssl_verify_callback() in Modules/_ssl.c, rejecting a matching chain with X509_V_ERR_CERT_REJECTED. Matching the public key rather than a certificate fingerprint also covers cross-signs that reuse one of those keys. Upstream shipped this in 3.11.18/3.12.16/3.13.18/3.14.10/3.15.2 only, so 3.9 needs it carried. The header keeps its upstream path, since 3.9 already has a Modules/_ssl/ directory. _set_verify_mode() installs the new callback in place of 3.9's "keep current verify cb" block, which matches upstream's end state because nothing else installs a context-level verify callback. Upstream's newPySSLSocket() hunk is already present in 3.9 verbatim. The Makefile.pre.in MODULE__SSL_DEPS hunk becomes an entry in the _ssl extension's depends list in setup.py, since 3.9 builds extensions from setup.py. X509_V_ERR_UNSPECIFIED gets an #ifndef fallback to its OpenSSL value (1) for el7's OpenSSL 1.0.2. Upstream's tests are not carried: they need the encrypted Lib/test/certdata/distrusted.zip fixture and the Lib/test/certdata layout that 3.9 does not have. - CVE-2026-115557