From c1c76342febc3e1010282f7dede8e282a7076c96 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Tue, 6 Jun 2023 19:52:14 -0400 Subject: [PATCH 1/3] Update to 1.26.16 --- .gitignore | 1 + 4855d71.patch | 28 ---------------------------- python-urllib3.spec | 11 +++++------ sources | 2 +- 4 files changed, 7 insertions(+), 35 deletions(-) delete mode 100644 4855d71.patch diff --git a/.gitignore b/.gitignore index 8a133f4..282aa2f 100644 --- a/.gitignore +++ b/.gitignore @@ -37,3 +37,4 @@ /urllib3-1.26.9.tar.gz /urllib3-1.26.12.tar.gz /urllib3-1.26.15.tar.gz +/urllib3-1.26.16.tar.gz diff --git a/4855d71.patch b/4855d71.patch deleted file mode 100644 index 22945ff..0000000 --- a/4855d71.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 4855d71ad5535bdff47a0dc5cfe09fb610ff6576 Mon Sep 17 00:00:00 2001 -From: Thomas Grainger -Date: Sat, 15 Apr 2023 20:41:24 +0100 -Subject: [PATCH] Fix test_ssl_object_attributes - -Co-authored-by: Seth Michael Larson ---- - test/test_ssltransport.py | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/test/test_ssltransport.py b/test/test_ssltransport.py -index a3b7381639..cace51db96 100644 ---- a/test/test_ssltransport.py -+++ b/test/test_ssltransport.py -@@ -229,8 +229,11 @@ def test_ssl_object_attributes(self) -> None: - assert ssock.selected_npn_protocol() is None - - shared_ciphers = ssock.shared_ciphers() -- assert type(shared_ciphers) == list -- assert len(shared_ciphers) > 0 -+ # SSLContext.shared_ciphers() changed behavior completely in a patch version. -+ # See: https://github.com/python/cpython/issues/96931 -+ assert shared_ciphers is None or ( -+ type(shared_ciphers) is list and len(shared_ciphers) > 0 -+ ) - - assert ssock.compression() is None - diff --git a/python-urllib3.spec b/python-urllib3.spec index 0a35290..817de93 100644 --- a/python-urllib3.spec +++ b/python-urllib3.spec @@ -7,7 +7,7 @@ %endif Name: python-urllib3 -Version: 1.26.15 +Version: 1.26.16 Release: 1%{?dist} Summary: HTTP library with thread-safe connection pooling, file post, and more @@ -16,10 +16,6 @@ License: MIT URL: https://github.com/urllib3/urllib3 Source: %{url}/archive/%{version}/urllib3-%{version}.tar.gz -# Accomodate the test to the changed behavior of SSLContext.shared_ciphers() in CPython -# See: https://github.com/python/cpython/issues/96931 -Patch: https://github.com/urllib3/urllib3/commit/4855d71.patch - BuildArch: noarch BuildRequires: python3-devel @@ -96,7 +92,7 @@ Requires: python3-urllib3+socks = %{version}-%{release} %prep -%autosetup -p1 -n urllib3-%{version} +%autosetup -n urllib3-%{version} # Make sure that the RECENT_DATE value doesn't get too far behind what the current date is. # RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date # (from test/test_connection.py) would fail. However, it shouldn't be to close to the build time either, @@ -170,6 +166,9 @@ ignore="${ignore-} --ignore=test/test_no_ssl.py" %changelog +* Sat Jul 01 2023 Benjamin A. Beasley - 1.26.16-1 +- Update to 1.26.16 + * Thu May 18 2023 Benjamin A. Beasley - 1.26.15-1 - Update to 1.26.15 diff --git a/sources b/sources index 0b52ef1..81f5417 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (urllib3-1.26.15.tar.gz) = edd52a05049a047b1bb913de1cc211a6f7b70802e9ddcb639a973fb910bf218210577a5375077b6569ef382c07668ad6057adb67a31475125c2e5517c603131d +SHA512 (urllib3-1.26.16.tar.gz) = 47cb993acabf169470448bc91b1a0d1fb4df6e60bf97ce6fb06f5397935f33f693cd0851a663fb36a7c5a4b19ed4dbcc0fcce9f45839315354a013f41d837f7a From aaf86657dd3d5f18be99910abe875f1579b55317 Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Mon, 2 Oct 2023 14:14:57 -0400 Subject: [PATCH 2/3] Update to 1.26.17: fix CVE-2023-43804 (GHSA-v845-jxx5-vc9f) --- .gitignore | 1 + python-urllib3.spec | 5 ++++- sources | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 282aa2f..67a6808 100644 --- a/.gitignore +++ b/.gitignore @@ -38,3 +38,4 @@ /urllib3-1.26.12.tar.gz /urllib3-1.26.15.tar.gz /urllib3-1.26.16.tar.gz +/urllib3-1.26.17.tar.gz diff --git a/python-urllib3.spec b/python-urllib3.spec index 817de93..70e0634 100644 --- a/python-urllib3.spec +++ b/python-urllib3.spec @@ -7,7 +7,7 @@ %endif Name: python-urllib3 -Version: 1.26.16 +Version: 1.26.17 Release: 1%{?dist} Summary: HTTP library with thread-safe connection pooling, file post, and more @@ -166,6 +166,9 @@ ignore="${ignore-} --ignore=test/test_no_ssl.py" %changelog +* Mon Oct 02 2023 Benjamin A. Beasley - 1.26.17-1 +- Update to 1.26.17: fix CVE-2023-43804 (GHSA-v845-jxx5-vc9f) + * Sat Jul 01 2023 Benjamin A. Beasley - 1.26.16-1 - Update to 1.26.16 diff --git a/sources b/sources index 81f5417..3272333 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (urllib3-1.26.16.tar.gz) = 47cb993acabf169470448bc91b1a0d1fb4df6e60bf97ce6fb06f5397935f33f693cd0851a663fb36a7c5a4b19ed4dbcc0fcce9f45839315354a013f41d837f7a +SHA512 (urllib3-1.26.17.tar.gz) = ee235b2e31c34f26ab872623ef17a1119c9776c5a1bf0b4eb5ec92139de7c585dcf3cf90bfc2c6e1db5a1819aafbe6e732a8c540a4ae64ed7659267906c09768 From 9262ba3f78614c02080db6fea2a57193a019b9ef Mon Sep 17 00:00:00 2001 From: Maxwell G Date: Tue, 17 Oct 2023 15:28:43 -0500 Subject: [PATCH 3/3] Update to 1.26.18. Mitigates CVE-2023-45803 / GHSA-g4mx-q9vg-27p4. (cherry picked from commit 0502dda22208c4e09903ec551f0f705ca23329b5) Ref: https://github.com/advisories/GHSA-g4mx-q9vg-27p4 --- .gitignore | 1 + python-urllib3.spec | 6 +++++- sources | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 67a6808..1a390e6 100644 --- a/.gitignore +++ b/.gitignore @@ -39,3 +39,4 @@ /urllib3-1.26.15.tar.gz /urllib3-1.26.16.tar.gz /urllib3-1.26.17.tar.gz +/urllib3-1.26.18.tar.gz diff --git a/python-urllib3.spec b/python-urllib3.spec index 70e0634..3359198 100644 --- a/python-urllib3.spec +++ b/python-urllib3.spec @@ -7,7 +7,7 @@ %endif Name: python-urllib3 -Version: 1.26.17 +Version: 1.26.18 Release: 1%{?dist} Summary: HTTP library with thread-safe connection pooling, file post, and more @@ -166,6 +166,10 @@ ignore="${ignore-} --ignore=test/test_no_ssl.py" %changelog +* Tue Oct 17 2023 Maxwell G - 1.26.18-1 +- Update to 1.26.18. +- Mitigates CVE-2023-45803 / GHSA-g4mx-q9vg-27p4. + * Mon Oct 02 2023 Benjamin A. Beasley - 1.26.17-1 - Update to 1.26.17: fix CVE-2023-43804 (GHSA-v845-jxx5-vc9f) diff --git a/sources b/sources index 3272333..a21e385 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (urllib3-1.26.17.tar.gz) = ee235b2e31c34f26ab872623ef17a1119c9776c5a1bf0b4eb5ec92139de7c585dcf3cf90bfc2c6e1db5a1819aafbe6e732a8c540a4ae64ed7659267906c09768 +SHA512 (urllib3-1.26.18.tar.gz) = 62c0af4b11e797a85420ef3f0888f2e608334329eddd88b9fe563b5437189cbea8dbbcd53f999557d9828fcf4bf03b8ca9f6e3d401533bc4ae8ff96e3ece1557