Upgrade urllib3 to 1.25.3, requests to 2.22.0

- Fix urllib3 CVE-2019-11324 (#1774595)
- Fix urllib3 CVE-2019-11236 (#1775363)

python-pip.spec

@@ -23,7 +23,7 @@ Name:           python-%{srcname}
 # When updating, update the bundled libraries versions bellow!
 # You can use vendor_meta.sh in the dist git repo
 Version:        19.0.3
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -50,6 +50,7 @@ Summary:        A tool for installing and managing Python packages
 # idna: BSD
 # urllib3: MIT
 # certifi: MPLv2.0
+# rfc3986: ASL 2.0
 # setuptools: MIT
 # webencodings: BSD
 
@@ -107,6 +108,19 @@ Patch4:         dummy-certifi.patch
 # https://github.com/pypa/pip/pull/6728
 Patch6:         python39.patch
 
+# Upgrade urllib3 to 1.25.3
+# This bundles rfc3986
+# https://github.com/pypa/pip/commit/0d620c4a03a8b3765ec45785299244e1a494d750
+# CVE-2019-11324: Certification mishandle when error should be thrown
+# https://bugzilla.redhat.com/show_bug.cgi?id=1774595
+# CVE-2019-11236: CRLF injection due to not encoding the '\r\n' sequence
+# https://bugzilla.redhat.com/show_bug.cgi?id=1775363
+Patch7:         urllib3-1.25.3.patch
+
+# Upgrade requests to 2.22.0 (needed for urllib3 1.25.3)
+# https://github.com/pypa/pip/commit/8e8d28dd8ecc9226ea4e0f75d54151df90f4d78e
+Patch8:         requests-2.22.0.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older/newer versions.
@@ -154,11 +168,12 @@ Provides: bundled(python%{1}dist(pep517)) = 0.5.0
 Provides: bundled(python%{1}dist(progress)) = 1.4
 Provides: bundled(python%{1}dist(pyparsing)) = 2.3.1
 Provides: bundled(python%{1}dist(pytoml)) = 0.1.20
-Provides: bundled(python%{1}dist(requests)) = 2.21.0
+Provides: bundled(python%{1}dist(requests)) = 2.22.0
 Provides: bundled(python%{1}dist(retrying)) = 1.3.3
 Provides: bundled(python%{1}dist(setuptools)) = 40.6.3
 Provides: bundled(python%{1}dist(six)) = 1.12.0
-Provides: bundled(python%{1}dist(urllib3)) = 1.24.1
+Provides: bundled(python%{1}dist(urllib3)) = 1.25.3
+Provides: bundled(python%{1}dist(rfc3986)) = 1.3.2
 Provides: bundled(python%{1}dist(webencodings)) = 0.5.1
 }
 
@@ -300,6 +315,8 @@ popd
 %patch3 -p1
 %patch4 -p1
 %patch6 -p1
+%patch7 -p1
+%patch8 -p1
 
 # this goes together with patch4
 rm src/pip/_vendor/certifi/*.pem
@@ -520,6 +537,11 @@ ln -sf %{buildroot}%{_bindir}/pip3 _bin/pip
 %endif
 
 %changelog
+* Thu Jan 02 2020 Miro Hrončok <mhroncok@redhat.com> - 19.0.3-6
+- Upgrade urllib3 to 1.25.3, requests to 2.22.0
+- Fix urllib3 CVE-2019-11324 (#1774595)
+- Fix urllib3 CVE-2019-11236 (#1775363)
+
 * Mon Nov 25 2019 Miro Hrončok <mhroncok@redhat.com> - 19.0.3-5
 - Make python-pip-wheel work with Python 3.9