[ubuntu-cloud-archive/mitaka-proposed] python-urllib3 (Accepted)

[Corey Bryant]

 python-urllib3 (1.13.1-2ubuntu0.16.04.3~cloud0) trusty-mitaka; urgency=medium
 .
   * New update for the Ubuntu Cloud Archive.
 .
 python-urllib3 (1.13.1-2ubuntu0.16.04.3) xenial-security; urgency=medium
 .
   * SECURITY UPDATE: credential disclosure via cross-origin redirect
     - debian/patches/CVE-2018-20060-*.patch: backport logic to strip
       Authorization header when following a cross-origin redirect.
     - CVE-2018-20060
   * SECURITY UPDATE: CRLF injection issue
     - debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
       in urllib3/connection.py, urllib3/contrib/pyopenssl.py,
       urllib3/util/url.py, test/test_util.py.
     - debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
       characters in urllib3/util/url.py, test/test_util.py.
     - debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
       in urllib3/util/url.py.
     - CVE-2019-11236

Date: Wed, 22 May 2019 14:43:54 +0000
Changed-By: Openstack Ubuntu Testing Bot <openstack-testing-bot at ubuntu.com>
Signed-By: Openstack Ubuntu Testing Bot
Published-By: Corey Bryant <corey.bryant at canonical.com>