SOURCES/CVE-2024-37891.patch

@@ -1,39 +0,0 @@
-From 584378407efb03cef247320b541388f460cb72a2 Mon Sep 17 00:00:00 2001
-From: Lumir Balhar <lbalhar@redhat.com>
-Date: Mon, 1 Jul 2024 12:40:39 +0200
-Subject: [PATCH] CVE-2024-37891
-
----
- src/urllib3/util/retry.py | 2 +-
- test/test_retry.py        | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py
-index c4a687c..8b86956 100644
---- a/src/urllib3/util/retry.py
-+++ b/src/urllib3/util/retry.py
-@@ -151,7 +151,7 @@ class Retry(object):
- 
-     RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
- 
--    DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Cookie', 'Authorization'])
-+    DEFAULT_REDIRECT_HEADERS_BLACKLIST = frozenset(['Cookie', 'Authorization', 'Proxy-Authorization'])
- 
-     #: Maximum backoff time.
-     BACKOFF_MAX = 120
-diff --git a/test/test_retry.py b/test/test_retry.py
-index c6bba74..a525028 100644
---- a/test/test_retry.py
-+++ b/test/test_retry.py
-@@ -253,7 +253,7 @@ class TestRetry(object):
-     def test_retry_default_remove_headers_on_redirect(self):
-         retry = Retry()
- 
--        assert retry.remove_headers_on_redirect == {'authorization', 'cookie'}
-+        assert retry.remove_headers_on_redirect == {'authorization', 'proxy-authorization', 'cookie'}
- 
-     def test_retry_set_remove_headers_on_redirect(self):
-         retry = Retry(remove_headers_on_redirect=['x-api-secret'])
--- 
-2.45.2
-

SPECS/python-urllib3.spec

@@ -2,7 +2,7 @@
 
 Name:           python-%{srcname}
 Version:        1.24.2
-Release:        8%{?dist}
+Release:        7%{?dist}
 Summary:        Python HTTP library with thread-safe connection pooling and file post
 
 License:        MIT
@@ -48,13 +48,6 @@ Patch4: CVE-2023-43804.patch
 # Upstream fix: https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9
 Patch5: CVE-2023-45803.patch
 
-# CVE-2024-37891
-# Added the `Proxy-Authorization` header to the list of headers to strip from requests
-# when redirecting to a different host.
-# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-37891
-# Upstream fix: https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468
-Patch6: CVE-2024-37891.patch
-
 %description
 Python HTTP module with connection pooling and file POST abilities.
 
@@ -86,7 +79,6 @@ Python3 HTTP module with connection pooling and file POST abilities.
 %patch3 -p1
 %patch4 -p1
 %patch5 -p1
-%patch6 -p1
 
 # Make sure that the RECENT_DATE value doesn't get too far behind what the current date is.
 # RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date
@@ -162,10 +154,6 @@ popd
 
 
 %changelog
-* Mon Jul 01 2024 Lumír Balhar <lbalhar@redhat.com> - 1.24.2-8
-- Security fix for CVE-2024-37891
-Resolves: RHEL-45334
-
 * Tue Dec 12 2023 Lumír Balhar <lbalhar@redhat.com> - 1.24.2-7
 - Security fix for CVE-2023-45803
 Resolves: RHEL-16872