From 19a859ea4000236ba954a6b542c428e24c7ec796 Mon Sep 17 00:00:00 2001
From: Lumir Balhar <lbalhar@redhat.com>
Date: Mon, 1 Jul 2024 12:41:45 +0200
Subject: [PATCH] Security fix for CVE-2024-37891

Resolves: RHEL-45334
---
 CVE-2024-37891.patch | 39 +++++++++++++++++++++++++++++++++++++++
 python-urllib3.spec  | 14 +++++++++++++-
 2 files changed, 52 insertions(+), 1 deletion(-)
 create mode 100644 CVE-2024-37891.patch

diff --git a/CVE-2024-37891.patch b/CVE-2024-37891.patch
new file mode 100644
index 0000000..380de74
--- /dev/null
+++ b/CVE-2024-37891.patch
@@ -0,0 +1,39 @@
+From 584378407efb03cef247320b541388f460cb72a2 Mon Sep 17 00:00:00 2001
+From: Lumir Balhar <lbalhar@redhat.com>
+Date: Mon, 1 Jul 2024 12:40:39 +0200
+Subject: [PATCH] CVE-2024-37891
+
+---
+ src/urllib3/util/retry.py | 2 +-
+ test/test_retry.py        | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py
+index c4a687c..8b86956 100644
+--- a/src/urllib3/util/retry.py
++++ b/src/urllib3/util/retry.py
+@@ -151,7 +151,7 @@ class Retry(object):
+ 
+     RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
+ 
+-    DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Cookie', 'Authorization'])
++    DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Cookie', 'Authorization', 'Proxy-Authorization'])
+ 
+     #: Maximum backoff time.
+     BACKOFF_MAX = 120
+diff --git a/test/test_retry.py b/test/test_retry.py
+index c6bba74..a525028 100644
+--- a/test/test_retry.py
++++ b/test/test_retry.py
+@@ -253,7 +253,7 @@ class TestRetry(object):
+     def test_retry_default_remove_headers_on_redirect(self):
+         retry = Retry()
+ 
+-        assert retry.remove_headers_on_redirect == {'authorization', 'cookie'}
++        assert retry.remove_headers_on_redirect == {'authorization', 'proxy-authorization', 'cookie'}
+ 
+     def test_retry_set_remove_headers_on_redirect(self):
+         retry = Retry(remove_headers_on_redirect=['x-api-secret'])
+-- 
+2.45.2
+
diff --git a/python-urllib3.spec b/python-urllib3.spec
index 14f0843..ad769b9 100644
--- a/python-urllib3.spec
+++ b/python-urllib3.spec
@@ -2,7 +2,7 @@
 
 Name:           python-%{srcname}
 Version:        1.24.2
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        Python HTTP library with thread-safe connection pooling and file post
 
 License:        MIT
@@ -48,6 +48,13 @@ Patch4: CVE-2023-43804.patch
 # Upstream fix: https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9
 Patch5: CVE-2023-45803.patch
 
+# CVE-2024-37891
+# Added the `Proxy-Authorization` header to the list of headers to strip from requests
+# when redirecting to a different host.
+# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-37891
+# Upstream fix: https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468
+Patch6: CVE-2024-37891.patch
+
 %description
 Python HTTP module with connection pooling and file POST abilities.
 
@@ -79,6 +86,7 @@ Python3 HTTP module with connection pooling and file POST abilities.
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
+%patch6 -p1
 
 # Make sure that the RECENT_DATE value doesn't get too far behind what the current date is.
 # RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date
@@ -154,6 +162,10 @@ popd
 
 
 %changelog
+* Mon Jul 01 2024 Lumír Balhar <lbalhar@redhat.com> - 1.24.2-8
+- Security fix for CVE-2024-37891
+Resolves: RHEL-45334
+
 * Tue Dec 12 2023 Lumír Balhar <lbalhar@redhat.com> - 1.24.2-7
 - Security fix for CVE-2023-45803
 Resolves: RHEL-16872