SOURCES/CVE-2024-37891.patch

@@ -1,66 +0,0 @@
-From 18163d7efbc35b488e6c829a5cf73846d75ef330 Mon Sep 17 00:00:00 2001
-From: Quentin Pradet <quentin.pradet@gmail.com>
-Date: Thu, 26 Sep 2024 12:55:43 +0200
-Subject: [PATCH] Merge pull request from GHSA-34jh-p97f-mpxf
-
-* [1.26] Strip Proxy-Authorization header on redirects
-
-* Set release date
----
- src/urllib3/util/retry.py     | 4 +++-
- test/test_retry.py            | 6 +++++-
- test/test_retry_deprecated.py | 6 +++++-
- 3 files changed, 13 insertions(+), 3 deletions(-)
-
-diff --git a/src/urllib3/util/retry.py b/src/urllib3/util/retry.py
-index 60ef6c4..9a1e90d 100644
---- a/src/urllib3/util/retry.py
-+++ b/src/urllib3/util/retry.py
-@@ -235,7 +235,9 @@ class Retry(object):
-     RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
- 
-     #: Default headers to be used for ``remove_headers_on_redirect``
--    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"])
-+    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(
-+        ["Cookie", "Authorization", "Proxy-Authorization"]
-+    )
- 
-     #: Maximum backoff time.
-     DEFAULT_BACKOFF_MAX = 120
-diff --git a/test/test_retry.py b/test/test_retry.py
-index 471d2e3..75660b4 100644
---- a/test/test_retry.py
-+++ b/test/test_retry.py
-@@ -293,7 +293,11 @@ class TestRetry(object):
-     def test_retry_default_remove_headers_on_redirect(self):
-         retry = Retry()
- 
--        assert retry.remove_headers_on_redirect == {"authorization", "cookie"}
-+        assert retry.remove_headers_on_redirect == {
-+            "authorization",
-+            "proxy-authorization",
-+            "cookie",
-+        }
- 
-     def test_retry_set_remove_headers_on_redirect(self):
-         retry = Retry(remove_headers_on_redirect=["X-API-Secret"])
-diff --git a/test/test_retry_deprecated.py b/test/test_retry_deprecated.py
-index d7905cd..0d22b0a 100644
---- a/test/test_retry_deprecated.py
-+++ b/test/test_retry_deprecated.py
-@@ -295,7 +295,11 @@ class TestRetry(object):
-     def test_retry_default_remove_headers_on_redirect(self):
-         retry = Retry()
- 
--        assert retry.remove_headers_on_redirect == {"authorization", "cookie"}
-+        assert retry.remove_headers_on_redirect == {
-+            "authorization",
-+            "proxy-authorization",
-+            "cookie",
-+        }
- 
-     def test_retry_set_remove_headers_on_redirect(self):
-         retry = Retry(remove_headers_on_redirect=["X-API-Secret"])
--- 
-2.46.0
-

SPECS/python3.12-urllib3.spec

@@ -6,7 +6,7 @@
 
 Name:           python%{python3_pkgversion}-urllib3
 Version:        1.26.18
-Release:        2%{?dist}.1
+Release:        2%{?dist}
 Summary:        HTTP library with thread-safe connection pooling, file post, and more
 
 # SPDX
@@ -16,12 +16,6 @@ Source:         %{url}/archive/%{version}/urllib3-%{version}.tar.gz
 
 BuildArch:      noarch
 
-# CVE-2024-37891
-# Proxy-authorization request header is not stripped during cross-origin redirects.
-# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-37891
-# Upstream fix: https://github.com/urllib3/urllib3/commit/40b6d1605814dd1db0a46e202d6e56f2e4c9a468
-Patch:          CVE-2024-37891.patch
-
 BuildRequires:  python%{python3_pkgversion}-devel
 BuildRequires:  python%{python3_pkgversion}-rpm-macros
 BuildRequires:  python%{python3_pkgversion}-setuptools
@@ -78,7 +72,7 @@ many critical features that are missing from the Python standard libraries:
 
 
 %prep
-%autosetup -n urllib3-%{version} -p1
+%autosetup -n urllib3-%{version}
 # Make sure that the RECENT_DATE value doesn't get too far behind what the current date is.
 # RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date
 # (from test/test_connection.py) would fail. However, it shouldn't be to close to the build time either,
@@ -136,10 +130,6 @@ ignore="${ignore-} --ignore=test/test_no_ssl.py"
 
 
 %changelog
-* Thu Sep 26 2024 Lumír Balhar <lbalhar@redhat.com> - 1.26.18-2.1
-- Security fix for CVE-2024-37891
-Resolves: RHEL-59997
-
 * Tue Jan 23 2024 Miro Hrončok <mhroncok@redhat.com> - 1.26.18-2
 - Rebuilt for timestamp .pyc invalidation mode