UbuntuUpdates.org

Package "python-urllib3"

Name: python-urllib3

Description:

HTTP library with thread-safe connection pooling for Python
Latest version: 1.13.1-2ubuntu0.16.04.4
Release: xenial (16.04)
Level: updates
Repository: main
Homepage: http://urllib3.readthedocs.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "python-urllib3"

All arch deb package
APT INSTALL

Other versions of "python-urllib3" in Xenial

Repository Area Version
base main 1.13.1-2
security main 1.13.1-2ubuntu0.16.04.4

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.13.1-2ubuntu0.16.04.4 2020-10-05 19:06:59 UTC

  python-urllib3 (1.13.1-2ubuntu0.16.04.4) xenial-security; urgency=medium

  * SECURITY UPDATE: CRLF injection via method parameter
    - debian/patches/CVE-2020-26137.patch: raise ValueError if method
      contains control characters in urllib3/connection.py,
      test/with_dummyserver/test_connectionpool.py.
    - CVE-2020-26137

 -- Marc Deslauriers <email address hidden> Thu, 01 Oct 2020 14:08:36 -0400
Source diff to previous version
CVE-2020-26137 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characte

Version: 1.13.1-2ubuntu0.16.04.3 2019-05-21 14:07:06 UTC

  python-urllib3 (1.13.1-2ubuntu0.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: credential disclosure via cross-origin redirect
    - debian/patches/CVE-2018-20060-*.patch: backport logic to strip
      Authorization header when following a cross-origin redirect.
    - CVE-2018-20060
  * SECURITY UPDATE: CRLF injection issue
    - debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
      in urllib3/connection.py, urllib3/contrib/pyopenssl.py,
      urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
      characters in urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
      in urllib3/util/url.py.
    - CVE-2019-11236

 -- Marc Deslauriers <email address hidden> Mon, 13 May 2019 15:26:05 -0400
Source diff to previous version
CVE-2018-20060 urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in ho
CVE-2019-11236 In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Version: 1.13.1-2ubuntu0.16.04.2 2018-08-30 13:06:35 UTC

  python-urllib3 (1.13.1-2ubuntu0.16.04.2) xenial; urgency=medium

  * d/p/07_support_ip_sans.patch: Cherry pick fix to support use of
    IP based SAN's in TLS certificates (LP: #1771988).

 -- James Page <email address hidden> Mon, 20 Aug 2018 15:54:33 +0100
Source diff to previous version
1771988 certificate validation with IP address based SAN's fails

Version: 1.13.1-2ubuntu0.16.04.1 2016-05-19 21:07:14 UTC

  python-urllib3 (1.13.1-2ubuntu0.16.04.1) xenial; urgency=medium

  * d/p/06_revert_square_brackets_httplib.patch: Cherry pick revert of
    change to behaviour with httplib which breaks IPv6 square bracket
    handling (LP: #1578351).

 -- James Page <email address hidden> Tue, 10 May 2016 10:00:32 +0100
1578351 mitaka ksclient fails to connect to v6 keystone


About   -   Send Feedback to @ubuntu_updates