[ubuntu/cosmic-security] python-urllib3 1.22-1ubuntu0.18.10.1 (Accepted)

Marc Deslauriers marc.deslauriers at canonical.com
Tue May 21 12:56:49 UTC 2019

python-urllib3 (1.22-1ubuntu0.18.10.1) cosmic-security; urgency=medium

  * SECURITY UPDATE: credential disclosure via cross-origin redirect
    - debian/patches/CVE-2018-20060-*.patch: backport logic to strip
      Authorization header when following a cross-origin redirect.
    - CVE-2018-20060
  * SECURITY UPDATE: CRLF injection issue
    - debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
      in urllib3/connection.py, urllib3/connectionpool.py,
      urllib3/contrib/pyopenssl.py, urllib3/contrib/socks.py,
      urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
      characters in urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
      in urllib3/util/url.py.
    - CVE-2019-11236
  * SECURITY UPDATE: CA cert mishandling
    - debian/patches/CVE-2019-11324.patch: don't load system certificates
      by default when any other CA cert parameters are specified in
    - CVE-2019-11324
  * debian/patches/fix_cert_error.patch: fix failing test.

Date: 2019-05-13 19:10:15.533915+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
-------------- next part --------------
Sorry, changesfile not available.

More information about the Cosmic-changes mailing list