Debian Package Tracker - python-urllib3

general

source: python-urllib3 (main)
version: 1.24.1-1
maintainer: Debian Python Modules Team (archive) (DMD)
uploaders: Daniele Tricoli [DMD]
arch: all
std-ver: 4.3.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.9.1-3
o-o-sec: 1.9.1-3+deb8u1
oldstable: 1.19.1-1
old-bpo: 1.24.1-1~bpo9+1
stable: 1.24.1-1
testing: 1.24.1-1
unstable: 1.24.1-1

versioned links

1.9.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.9.1-3+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.19.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.24.1-1~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.24.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python-urllib3
python3-urllib3

action needed

A new upstream version is available: 1.25.5 high

A new upstream version 1.25.5 is available, you should consider packaging it.

Created: 2019-08-16 Last update: 2019-09-22 06:40

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
CVE-2019-11236: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Please fix them.

Created: 2019-03-13 Last update: 2019-07-07 09:01

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
CVE-2019-11236: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Please fix them.

Created: 2019-03-13 Last update: 2019-07-07 09:01

3 security issues in stretch high

There are 3 open security issues in stretch.

2 important issues:

CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
CVE-2019-11236: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

1 issue skipped by the security teams:

CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Please fix them.

Created: 2018-12-12 Last update: 2019-07-07 09:01

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
CVE-2019-11236: In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

Please fix them.

Created: 2019-07-07 Last update: 2019-07-07 09:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.24.1-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 5dde17ec0904e6e03966556e112172fcd98f342e
Author: Ondřej Nový <onovy@debian.org>
Date:   Fri Jul 19 23:56:54 2019 +0200

    Bump Standards-Version to 4.4.0

commit d194b48b16dea59c44ff8c29c20306ee42123915
Author: Ondřej Nový <onovy@debian.org>
Date:   Fri Jul 19 23:56:54 2019 +0200

    Use debhelper-compat instead of debian/compat

Created: 2019-07-20 Last update: 2019-09-15 21:30

1 ignored security issue in jessie low

There is 1 open security issue in jessie.

1 issue skipped by the security teams:

CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

Please fix it.

Created: 2018-12-12 Last update: 2019-07-07 09:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.4.0 instead of 4.3.0).

Created: 2019-07-08 Last update: 2019-07-08 20:09

news

[rss feed]

[2019-06-20] Accepted python-urllib3 1.9.1-3+deb8u1 (source all) into oldstable (Roberto C. Sanchez)
[2019-03-31] Accepted python-urllib3 1.24.1-1~bpo9+1 (source) into stretch-backports->backports-policy, stretch-backports (Mattia Rizzolo)
[2019-02-21] python-urllib3 1.24.1-1 MIGRATED to testing (Debian testing watch)
[2019-02-11] Accepted python-urllib3 1.24.1-1 (source all) into unstable (Daniele Tricoli)
[2019-01-10] Accepted python-urllib3 1.24.1-1~exp1 (source all) into experimental (Daniele Tricoli)
[2018-10-29] Accepted python-urllib3 1.24-1~bpo9+1 (source all) into stretch-backports, stretch-backports (Mattia Rizzolo)
[2018-10-29] python-urllib3 1.24-1 MIGRATED to testing (Debian testing watch)
[2018-10-25] Accepted python-urllib3 1.24-1 (source all) into unstable (Daniele Tricoli)
[2018-10-19] Accepted python-urllib3 1.24-1~exp1 (source all) into experimental (Daniele Tricoli) (signed by: Pierre-Elliott Bécue)
[2018-01-10] python-urllib3 1.22-1 MIGRATED to testing (Debian testing watch)
[2018-01-04] Accepted python-urllib3 1.22-1 (source) into unstable (Ondřej Nový)
[2017-08-09] python-urllib3 1.21.1-1 MIGRATED to testing (Debian testing watch)
[2017-08-03] Accepted python-urllib3 1.21.1-1 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2016-12-31] python-urllib3 1.19.1-1 MIGRATED to testing (Debian testing watch)
[2016-12-12] Accepted python-urllib3 1.19.1-1 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2016-12-05] Accepted python-urllib3 1.16-1~bpo8+1 (source all) into jessie-backports (Ondřej Nový)
[2016-09-18] python-urllib3 1.16-1 MIGRATED to testing (Debian testing watch)
[2016-09-13] Accepted python-urllib3 1.16-1 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2016-06-01] python-urllib3 1.15.1-2 MIGRATED to testing (Debian testing watch)
[2016-05-26] Accepted python-urllib3 1.15.1-2 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2016-05-24] Accepted python-urllib3 1.15.1-1 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2016-04-25] python-urllib3 1.13.1-2 MIGRATED to testing (Debian testing watch)
[2016-02-12] Accepted python-urllib3 1.13.1-2 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2015-12-31] python-urllib3 1.13.1-1 MIGRATED to testing (Debian testing watch)
[2015-12-25] Accepted python-urllib3 1.13.1-1 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2015-12-21] Accepted python-urllib3 1.12-1~bpo8+1 (source all) into jessie-backports, jessie-backports (Thomas Goirand)
[2015-10-24] python-urllib3 1.12-1 MIGRATED to testing (Britney)
[2015-10-18] Accepted python-urllib3 1.12-1 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)
[2015-09-15] python-urllib3 1.11-2 MIGRATED to testing (Britney)
[2015-09-09] Accepted python-urllib3 1.11-2 (source all) into unstable (Daniele Tricoli) (signed by: Piotr Ozarowski)

bugs [bug history graph]

all: 3
RC: 0
I&N: 3
M&W: 0
F&P: 0
patch: 0

links

homepage
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.24.1-1ubuntu1
1 bug
patches for 1.24.1-1ubuntu1