How about this?
import apt
def is_security_update(pkgname, version):
try:
p = apt.Cache()[pkgname]
except:
return False
if version not in p.versions:
return False
if 'Debian-Security' in [o.label for o in
p.versions[version].origins]:
return True
return False