import UBI python-urllib3-1.24.2-8.el8_10
This commit is contained in:
parent
60a97d676a
commit
e3d1f8d4ac
1
.python-urllib3.metadata
Normal file
1
.python-urllib3.metadata
Normal file
@ -0,0 +1 @@
|
||||
02f5f10287e42a0e9d8666bbec9c51c4aec5bfc7 SOURCES/urllib3-1.24.2.tar.gz
|
39
SOURCES/CVE-2024-37891.patch
Normal file
39
SOURCES/CVE-2024-37891.patch
Normal file
@ -0,0 +1,39 @@
|
||||
From 584378407efb03cef247320b541388f460cb72a2 Mon Sep 17 00:00:00 2001
|
||||
From: Lumir Balhar <lbalhar@redhat.com>
|
||||
Date: Mon, 1 Jul 2024 12:40:39 +0200
|
||||
Subject: [PATCH] CVE-2024-37891
|
||||
|
||||
---
|
||||
src/urllib3/util/retry.py | 2 +-
|
||||
test/test_retry.py | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py
|
||||
index c4a687c..8b86956 100644
|
||||
--- a/src/urllib3/util/retry.py
|
||||
+++ b/src/urllib3/util/retry.py
|
||||
@@ -151,7 +151,7 @@ class Retry(object):
|
||||
|
||||
RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
|
||||
|
||||
- DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Cookie', 'Authorization'])
|
||||
+ DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Cookie', 'Authorization', 'Proxy-Authorization'])
|
||||
|
||||
#: Maximum backoff time.
|
||||
BACKOFF_MAX = 120
|
||||
diff --git a/test/test_retry.py b/test/test_retry.py
|
||||
index c6bba74..a525028 100644
|
||||
--- a/test/test_retry.py
|
||||
+++ b/test/test_retry.py
|
||||
@@ -253,7 +253,7 @@ class TestRetry(object):
|
||||
def test_retry_default_remove_headers_on_redirect(self):
|
||||
retry = Retry()
|
||||
|
||||
- assert retry.remove_headers_on_redirect == {'authorization', 'cookie'}
|
||||
+ assert retry.remove_headers_on_redirect == {'authorization', 'proxy-authorization', 'cookie'}
|
||||
|
||||
def test_retry_set_remove_headers_on_redirect(self):
|
||||
retry = Retry(remove_headers_on_redirect=['x-api-secret'])
|
||||
--
|
||||
2.45.2
|
||||
|
@ -2,7 +2,7 @@
|
||||
|
||||
Name: python-%{srcname}
|
||||
Version: 1.24.2
|
||||
Release: 7%{?dist}
|
||||
Release: 8%{?dist}
|
||||
Summary: Python HTTP library with thread-safe connection pooling and file post
|
||||
|
||||
License: MIT
|
||||
@ -48,6 +48,13 @@ Patch4: CVE-2023-43804.patch
|
||||
# Upstream fix: https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9
|
||||
Patch5: CVE-2023-45803.patch
|
||||
|
||||
# CVE-2024-37891
|
||||
# Added the `Proxy-Authorization` header to the list of headers to strip from requests
|
||||
# when redirecting to a different host.
|
||||
# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-37891
|
||||
# Upstream fix: https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468
|
||||
Patch6: CVE-2024-37891.patch
|
||||
|
||||
%description
|
||||
Python HTTP module with connection pooling and file POST abilities.
|
||||
|
||||
@ -79,6 +86,7 @@ Python3 HTTP module with connection pooling and file POST abilities.
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
%patch6 -p1
|
||||
|
||||
# Make sure that the RECENT_DATE value doesn't get too far behind what the current date is.
|
||||
# RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date
|
||||
@ -154,6 +162,10 @@ popd
|
||||
|
||||
|
||||
%changelog
|
||||
* Mon Jul 01 2024 Lumír Balhar <lbalhar@redhat.com> - 1.24.2-8
|
||||
- Security fix for CVE-2024-37891
|
||||
Resolves: RHEL-45334
|
||||
|
||||
* Tue Dec 12 2023 Lumír Balhar <lbalhar@redhat.com> - 1.24.2-7
|
||||
- Security fix for CVE-2023-45803
|
||||
Resolves: RHEL-16872
|
||||
|
Loading…
Reference in New Issue
Block a user