[ubuntu-cloud-archive/queens-proposed] python-urllib3 (Accepted)

[Corey Bryant]

 python-urllib3 (1.22-1ubuntu0.18.04.1~cloud0) xenial-queens; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 python-urllib3 (1.22-1ubuntu0.18.04.1) bionic-security; urgency=medium
 .
   * SECURITY UPDATE: credential disclosure via cross-origin redirect
     - debian/patches/CVE-2018-20060-*.patch: backport logic to strip
       Authorization header when following a cross-origin redirect.
     - CVE-2018-20060
   * SECURITY UPDATE: CRLF injection issue
     - debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
       in urllib3/connection.py, urllib3/connectionpool.py,
       urllib3/contrib/pyopenssl.py, urllib3/contrib/socks.py,
       urllib3/util/url.py, test/test_util.py.
     - debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
       characters in urllib3/util/url.py, test/test_util.py.
     - debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
       in urllib3/util/url.py.
     - CVE-2019-11236
   * SECURITY UPDATE: CA cert mishandling
     - debian/patches/CVE-2019-11324.patch: don't load system certificates
       by default when any other CA cert parameters are specified in
       urllib3/util/ssl_.py.
     - CVE-2019-11324
   * debian/patches/fix_cert_error.patch: fix failing test.

Date: Wed, 22 May 2019 04:25:20 +0000
Changed-By: Openstack Ubuntu Testing Bot <openstack-testing-bot at ubuntu.com>
Signed-By: Openstack Ubuntu Testing Bot
Published-By: Corey Bryant <corey.bryant at canonical.com>