Change logs for python-urllib3 source package in Bionic

python-urllib3 (1.22-1ubuntu0.18.04.2) bionic-security; urgency=medium

  * SECURITY UPDATE: CRLF injection via method parameter
    - debian/patches/CVE-2020-26137.patch: raise ValueError if method
      contains control characters in urllib3/connection.py,
      test/with_dummyserver/test_connectionpool.py.
    - CVE-2020-26137

 -- Marc Deslauriers <email address hidden>  Thu, 01 Oct 2020 14:00:15 -0400

python-urllib3 (1.22-1ubuntu0.18.04.1) bionic-security; urgency=medium

  * SECURITY UPDATE: credential disclosure via cross-origin redirect
    - debian/patches/CVE-2018-20060-*.patch: backport logic to strip
      Authorization header when following a cross-origin redirect.
    - CVE-2018-20060
  * SECURITY UPDATE: CRLF injection issue
    - debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
      in urllib3/connection.py, urllib3/connectionpool.py,
      urllib3/contrib/pyopenssl.py, urllib3/contrib/socks.py,
      urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
      characters in urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
      in urllib3/util/url.py.
    - CVE-2019-11236
  * SECURITY UPDATE: CA cert mishandling
    - debian/patches/CVE-2019-11324.patch: don't load system certificates
      by default when any other CA cert parameters are specified in
      urllib3/util/ssl_.py.
    - CVE-2019-11324
  * debian/patches/fix_cert_error.patch: fix failing test.

 -- Marc Deslauriers <email address hidden>  Mon, 13 May 2019 14:27:58 -0400

python-urllib3 (1.22-1) unstable; urgency=medium

  * Team upload.
  * New upstream release (Closes: #876334)
  * d/watch
    - Check upstream signature
    - Use https
  * Bump debhelper compat level to 11
  * Standards-Version is 4.1.3 now (no changes needed)
  * Add python{3,}-pytest to B-D
  * Use pytest for unit tests (same as upstream) and skip timing tests
  * Skip test_recent_date test
  * Use autopkgtest-pkg-python testsuite instead of hardcoded one

 -- Ondřej Nový <email address hidden>  Thu, 04 Jan 2018 15:09:14 +0100

python-urllib3 (1.21.1-1) unstable; urgency=medium

  * New upstream release. (Closes: #861642)
  * debian/control
    - Add python-psutil{,3} to Build-Depends.
    - Add version constraint for six. (Closes: #857006)
    - Bump Standards-Version to 4.0.0 (no changes needed).
  * debian/copyright
    - Update copyright years.
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh.
  * debian/tests/control
    - Add autodep8 tests. (Closes: #796717)

 -- Daniele Tricoli <email address hidden>  Fri, 14 Jul 2017 01:21:44 +0200