Backport security fixes from pip 21.1.1

python-pip.spec

@@ -22,7 +22,7 @@
 
 Name:           python-%{srcname}
 Version:        %{base_version}%{?prerel:~%{prerel}}
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -93,6 +93,17 @@ Patch5:         nowarn-pip._internal.main.patch
 # Upstream issue: https://github.com/pypa/packaging/issues/368
 Patch6:         no-version-warning.patch
 
+# Update vendored urrlib3 to 1.26.4 to fix CVE-2021-28363
+# Security patch backported from pip 21.1
+Patch7:         https://github.com/pypa/pip/pull/9760.patch
+
+# Don't split git references on unicode separators,
+# which could be maliciously used to install a different revision on the
+# repository.
+# Security patch backported from pip 21.1.1
+# Upstream PR: https://github.com/pypa/pip/pull/9827
+Patch8:         don-t-split-git-references-on-unicode-separators.patch
+
 # Downstream only patch
 # Users might have local installations of pip from using
 # `pip install --user --upgrade pip` on older/newer versions.
@@ -149,7 +160,7 @@ Provides: bundled(python%{1}dist(retrying)) = 1.3.3
 Provides: bundled(python%{1}dist(setuptools)) = 44
 Provides: bundled(python%{1}dist(six)) = 1.15
 Provides: bundled(python%{1}dist(toml)) = 0.10.2
-Provides: bundled(python%{1}dist(urllib3)) = 1.26.2
+Provides: bundled(python%{1}dist(urllib3)) = 1.26.4
 Provides: bundled(python%{1}dist(webencodings)) = 0.5.1
 }
 
@@ -396,6 +407,9 @@ pytest_k='not completion and
 %{python_wheeldir}/%{python_wheelname}
 
 %changelog
+* Mon May 17 2021 Karolina Surma <ksurma@redhat.com> - 21.0.1-3
+- Backport security fixes from pip 21.1.1
+
 * Sat Mar 13 2021 Miro Hrončok <mhroncok@redhat.com> - 21.0.1-2
 - python-pip-wheel: Remove bundled provides and libcrypt recommends for Python 2
   (The wheel is Python 3 only for a while)