[ubuntu/disco-updates] python-urllib3 1.24.1-1ubuntu0.1 (Accepted)

[Ubuntu Archive Robot]

python-urllib3 (1.24.1-1ubuntu0.1) disco-security; urgency=medium

  * SECURITY UPDATE: CRLF injection issue
    - debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
      in src/urllib3/connection.py, src/urllib3/connectionpool.py,
      src/urllib3/contrib/pyopenssl.py, src/urllib3/contrib/socks.py,
      src/urllib3/poolmanager.py, src/urllib3/response.py,
      src/urllib3/util/ssl_.py, src/urllib3/util/url.py,
      test/__init__.py, test/test_util.py,
      test/with_dummyserver/test_https.py,
      test/with_dummyserver/test_socketlevel.py.
    - debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
      characters in src/urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
      in src/urllib3/util/url.py.
    - CVE-2019-11236
  * SECURITY UPDATE: CA cert mishandling
    - debian/patches/CVE-2019-11324.patch: don't load system certificates
      by default when any other CA cert parameters are specified in
      src/urllib3/util/ssl_.py.
    - CVE-2019-11324

Date: 2019-05-13 18:37:13.556923+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/python-urllib3/1.24.1-1ubuntu0.1
-------------- next part --------------
Sorry, changesfile not available.