* SECURITY UPDATE: the ssl module accepted TLS certificate chains signed by any of eight compromised eMudhra intermediate CA keys. Those chains validate normally for as long as the platform root store still trusts the eMudhra roots, so whoever holds the keys can mint certificates that ssl accepts; removing the trust is primarily the root store's job, but that update has to reach every OS, container image and bundled trust store first. _ssl.c now carries a hardcoded denylist of the SHA-256 digests of the eight compromised RFC 5280 SubjectPublicKeyInfo structures and enforces it from a verify callback that runs once per certificate of the chain, failing verification with X509_V_ERR_CERT_REJECTED on a match. Matching the key rather than a certificate fingerprint also covers the cross-signed certificates that reuse one of those keys. - debian/patches/CVE-2026-115557.patch: backport of cpython 7dd8b4736a1419750b94a388e6d158be15836fe6 (main, gh-160040, GH-160042), which upstream shipped only in 3.11.18, 3.12.16, 3.13.18, 3.14.10 and 3.15.2. The denylist header and both C helpers are upstream's verbatim; it is installed as Modules/_ssl_distrusted_spki.h because 3.7 has no Modules/_ssl/ directory. 3.7's _set_verify_mode() keeps whatever context verify callback was set (always NULL here) instead of upstream's literal NULL, so that is what the new callback replaces, and upstream's newPySSLSocket() hunk is already present in 3.7 from bpo-37428. The new header is added to the _ssl extension's depends= in setup.py, 3.7 having no MODULE__SSL_DEPS. Upstream's test fixture and test are not carried. - CVE-2026-115557