python-urllib3 (1.26.5-1~exp1ubuntu0.7) jammy-security; urgency=medium

  * SECURITY UPDATE: sensitive headers not stripped in cross-origin redirects
    - debian/patches/CVE-2026-44431.patch: remove sensitive headers in proxy
      pools too in src/urllib3/connectionpool.py,
      test/with_dummyserver/test_proxy_poolmanager.py.
    - CVE-2026-44431

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 22 May 2026 16:41:35 -0400

python-urllib3 (1.26.5-1~exp1ubuntu0.6) jammy-security; urgency=medium

  * SECURITY REGRESSION: Missing _has_decoded_content from CVE-2026-21441
    (LP: #2138420)
    - debian/patches/CVE-2026-21441-fix1.patch: Implement _has_decoded_content
      and decoded checks in src/urllib3/response.py. Add tests in
      test/test_response.py.

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Fri, 16 Jan 2026 19:39:26 -0330

python-urllib3 (1.26.5-1~exp1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Decompression bomb in HTTP redirect responses.
    - debian/patches/CVE-2026-21441.patch: Add decode_content to self.read()
      in src/urllib3/response.py. Add tests in
      test/with_dummyserver/test_connectionpool.py.
    - CVE-2026-21441

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 08 Jan 2026 16:06:10 -0330

python-urllib3 (1.26.5-1~exp1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service due to unbounded decompression chain.
    - debian/patches/CVE-2025-66418.patch: Add max_decode_links limit and
      checks in src/urllib3/response.py. Add test in test/test_response.py.
    - CVE-2025-66418

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Wed, 10 Dec 2025 17:29:42 -0330

python-urllib3 (1.26.5-1~exp1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Information disclosure through improperly disabled
    redirects.
    - debian/patches/CVE-2025-50181.patch: Add "retries" check and set retries
      to Retry.from_int(retries, redirect=False) as well as set
      raise_on_redirect in ./src/urllib3/poolmanager.py.
    - CVE-2025-50181

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 23 Jun 2025 17:07:25 -0230

python-urllib3 (1.26.5-1~exp1ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: The Proxy-Authorization header is not correctly stripped
    when redirecting to a different host.
    - debian/patches/CVE-2024-37891.patch: Add "Proxy-Authorization" to
      DEFAULT_REMOVE_HEADERS_ON_REDIRECT in src/urllib3/util/retry.py. Add
      header to tests.
    - CVE-2024-37891

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Thu, 17 Oct 2024 10:19:08 -0230

python-urllib3 (1.26.5-1~exp1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: http cookie leakage via http redirect
    - debian/patches/CVE-2023-43804.patch: removes the cookie from the 
      http request when it is redirected to a different origin.
    - CVE-2023-43804
  * SECURITY UPDATE: http body leakage via http redirect
    - debian/patches/CVE-2023-45803.patch: removes the body from the 
      http request when it is redirected to a different origin and the 
      http verb is changed to GET.
    - CVE-2023-45803

 -- Jorge Sancho Larraz <jorge.sancho.larraz@canonical.com>  Tue, 24 Oct 2023 17:20:49 +0200

python-urllib3 (1.26.5-1~exp1) unstable; urgency=medium

  * New upstream version 1.26.5
    - CVE-2021-33503: Catastrophic backtracking in URL authority parser when
      passed URL containing many @ characters. (Closes: #989848)
  * Refresh patches.

 -- Daniele Tricoli <eriol@debian.org>  Sun, 27 Jun 2021 17:02:18 +0200

python-urllib3 (1.26.4-1) unstable; urgency=medium

  * Team upload.
  * New upstream release.
    - Enforces certificate validation in some cases involving HTTPS to HTTPS
      proxies CVE-2021-28363.

 -- Stefano Rivera <stefanor@debian.org>  Tue, 11 May 2021 20:30:00 -0400

python-urllib3 (1.26.2-1) unstable; urgency=medium

  * New upstream version 1.26.2
  * Refresh patches.
  * debian/control
    - Bump debhelper compatibility level to 13.
    - Bump Standards-Version to 4.5.1 (no changes needed).
  * debian/copyright
    - Update copyright years.
  * debian/rules
    - Ignore test_ssltransport.py.
  * debian/watch
    - Bump version to 4.

 -- Daniele Tricoli <eriol@debian.org>  Thu, 31 Dec 2020 02:22:32 +0100

# For older changelog entries, run 'apt-get changelog python3-urllib3'
