[ubuntu/resolute-proposed] python-urllib3 2.5.0-1ubuntu2 (Accepted)

[Hlib Korzhynskyy]

python-urllib3 (2.5.0-1ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: Decompression bomb in HTTP redirect responses.
    - debian/patches/CVE-2026-21441.patch: Add decode_content to self.read()
      in src/urllib3/response.py. Add tests in
      test/with_dummyserver/test_connectionpool.py and dummyserver/app.py.
    - CVE-2026-21441

Date: Mon, 12 Jan 2026 15:25:41 -0330
Changed-By: Hlib Korzhynskyy <hlib.korzhynskyy at canonical.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Signed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/python-urllib3/2.5.0-1ubuntu2
-------------- next part --------------
Format: 1.8
Date: Mon, 12 Jan 2026 15:25:41 -0330
Source: python-urllib3
Built-For-Profiles: noudeb
Architecture: source
Version: 2.5.0-1ubuntu2
Distribution: resolute
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Hlib Korzhynskyy <hlib.korzhynskyy at canonical.com>
Changes:
 python-urllib3 (2.5.0-1ubuntu2) resolute; urgency=medium
 .
   * SECURITY UPDATE: Decompression bomb in HTTP redirect responses.
     - debian/patches/CVE-2026-21441.patch: Add decode_content to self.read()
       in src/urllib3/response.py. Add tests in
       test/with_dummyserver/test_connectionpool.py and dummyserver/app.py.
     - CVE-2026-21441
Checksums-Sha1:
 64af015bede0271343a771f6620b5c40afcb3567 2856 python-urllib3_2.5.0-1ubuntu2.dsc
 a57b2ee825343adbfdd5fff179b9951171dbe587 45992 python-urllib3_2.5.0-1ubuntu2.debian.tar.xz
 41b3b7a244cdf2f23cbded36a95a93df7c02ca01 9253 python-urllib3_2.5.0-1ubuntu2_source.buildinfo
Checksums-Sha256:
 03a0c6e51433d29964c1f13f9dddeac73a82df817df78a3fc6c9efadcc6f5879 2856 python-urllib3_2.5.0-1ubuntu2.dsc
 ef757f93fe98dd8867dd3d76e60ea61211cd8085e364b295b42342dd0150065f 45992 python-urllib3_2.5.0-1ubuntu2.debian.tar.xz
 5aa5a823d636131454b685c1801fc6ebc8f0c187c779d903a979bd978fe91e82 9253 python-urllib3_2.5.0-1ubuntu2_source.buildinfo
Files:
 80d35125bf8b41088119deac3da74fbd 2856 python optional python-urllib3_2.5.0-1ubuntu2.dsc
 9dea1574ba77a370abb256a03220b8ca 45992 python optional python-urllib3_2.5.0-1ubuntu2.debian.tar.xz
 6458e3ef5f6ad22fb2e8a79bac3fede3 9253 python optional python-urllib3_2.5.0-1ubuntu2_source.buildinfo
Original-Maintainer: Debian Python Team <team+python at tracker.debian.org>