python-urllib3 (1.13.1-2ubuntu0.16.04.3) xenial-security; urgency=medium
* SECURITY UPDATE: credential disclosure via cross-origin redirect
- debian/patches/CVE-2018-20060-*.patch: backport logic to strip
Authorization header when following a cross-origin redirect.
- CVE-2018-20060
* SECURITY UPDATE: CRLF injection issue
- debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
in urllib3/connection.py, urllib3/contrib/pyopenssl.py,
urllib3/util/url.py, test/test_util.py.
- debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
characters in urllib3/util/url.py, test/test_util.py.
- debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
in urllib3/util/url.py.
- CVE-2019-11236
Date: 2019-05-14 13:14:14.921079+00:00
Changed-By: Marc Deslauriers <marc.deslauri...@canonical.com>
Signed-By: Ubuntu Archive Robot
<cjwatson+ubuntu-archive-ro...@chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/python-urllib3/1.13.1-2ubuntu0.16.04.3
Sorry, changesfile not available.
--
Xenial-changes mailing list
Xenial-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/xenial-changes
