python-urllib3 (1.13.1-2ubuntu0.16.04.4) xenial-security; urgency=medium

  * SECURITY UPDATE: CRLF injection via method parameter
    - debian/patches/CVE-2020-26137.patch: raise ValueError if method
      contains control characters in urllib3/connection.py,
      test/with_dummyserver/test_connectionpool.py.
    - CVE-2020-26137

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 01 Oct 2020 14:08:36 -0400

python-urllib3 (1.13.1-2ubuntu0.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: credential disclosure via cross-origin redirect
    - debian/patches/CVE-2018-20060-*.patch: backport logic to strip
      Authorization header when following a cross-origin redirect.
    - CVE-2018-20060
  * SECURITY UPDATE: CRLF injection issue
    - debian/patches/CVE-2019-11236-1.patch: check for control chars in URL
      in urllib3/connection.py, urllib3/contrib/pyopenssl.py,
      urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-2.patch: percent-encode invalid target
      characters in urllib3/util/url.py, test/test_util.py.
    - debian/patches/CVE-2019-11236-3.patch: don't use embedded python-six
      in urllib3/util/url.py.
    - CVE-2019-11236

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 13 May 2019 15:26:05 -0400

python-urllib3 (1.13.1-2ubuntu0.16.04.2) xenial; urgency=medium

  * d/p/07_support_ip_sans.patch: Cherry pick fix to support use of
    IP based SAN's in TLS certificates (LP: #1771988).

 -- James Page <james.page@ubuntu.com>  Mon, 20 Aug 2018 15:54:33 +0100

python-urllib3 (1.13.1-2ubuntu0.16.04.1) xenial; urgency=medium

  * d/p/06_revert_square_brackets_httplib.patch: Cherry pick revert of
    change to behaviour with httplib which breaks IPv6 square bracket
    handling (LP: #1578351).

 -- James Page <james.page@ubuntu.com>  Tue, 10 May 2016 10:00:32 +0100

python-urllib3 (1.13.1-2) unstable; urgency=medium

  * debian/control
    - Remove python-urllib3-whl and python3-wheel B-D. (Closes: #814467)
    - Use secure URI for Vcs-Git.
    - Bump Standards-Version to 3.9.7 (no changes needed).
    - Bump X-Python3-Version to >= 3.2.
  * debian/copyright
    - Update copyright years.
  * debian/python-urllib3-whl.install
    - Remove.
  * debian/rules
    - Remove override_dh_auto_install since it's no longer needed to build the
      wheel package.

 -- Daniele Tricoli <eriol@mornie.org>  Fri, 12 Feb 2016 01:35:42 +0100

python-urllib3 (1.13.1-1) unstable; urgency=medium

  * New upstream release.
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh.
  * debian/patches/05_avoid-embedded-ssl-match-hostname.patch
    - Refresh.

 -- Daniele Tricoli <eriol@mornie.org>  Wed, 23 Dec 2015 23:02:05 +0100

python-urllib3 (1.12-1) unstable; urgency=medium

  * New upstream release.
  * debian/control
    - Update Vcs fields for git migration.
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh.
  * debian/patches/06_rely-on-six-to-import-httplib-or-http.client.patch
    - Remove since included in this release.

 -- Daniele Tricoli <eriol@mornie.org>  Sun, 11 Oct 2015 03:31:25 +0200

python-urllib3 (1.11-2) unstable; urgency=medium

  * debian/patches/06_rely-on-six-to-import-httplib-or-http.client.patch
    - Rely on six to import httplib or http.client. Thanks to Edward Betts
      for the report. (Closes: #796356)

 -- Daniele Tricoli <eriol@mornie.org>  Sun, 23 Aug 2015 21:19:59 +0200

python-urllib3 (1.11-1) unstable; urgency=medium

  * New upstream release.
  * debian/control
    - Add python{,3}-tornado to Build-Depends.
    - Add python-ntlm to python-urllib3's Suggests.
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh.

 -- Daniele Tricoli <eriol@mornie.org>  Mon, 17 Aug 2015 18:51:43 +0200

python-urllib3 (1.10.4-1) unstable; urgency=medium

  * New upstream release.
  * debian/watch
    - Use pypi.debian.net redirector.
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh.

 -- Daniele Tricoli <eriol@mornie.org>  Sun, 03 May 2015 17:18:55 +0200

python-urllib3 (1.10-1) experimental; urgency=medium

  * New upstream release.
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh.
  * debian/patches/06_do-not-make-SSLv3-mandatory.patch
    - Remove since it was merged upstream.

 -- Daniele Tricoli <eriol@mornie.org>  Thu, 15 Jan 2015 22:58:53 +0100

python-urllib3 (1.9.1-3) unstable; urgency=medium

  [ Stefano Rivera ]
  * Replace 05_do-not-use-embedded-ssl-match-hostname.patch with
    05_avoid-embedded-ssl-match-hostname.patch. Users may use virtualenv with
    cPython << 2.7.9 (or Debian python2.7 2.7.8-7). (Closes: #755106, #763389)

  [ Daniele Tricoli ]
  * debian/patches/06_do-not-make-SSLv3-mandatory.patch
    - Since SSL version 3 is insecure it is supported only if Python
      supports it. (Closes: #770246)

 -- Daniele Tricoli <eriol@mornie.org>  Thu, 20 Nov 2014 13:17:59 +0100

python-urllib3 (1.9.1-2) unstable; urgency=medium

  * debian/control
    - Bump python{,3}-nose to >=1.3.3 to build urllib3 on Wheezy. Thanks to
      Nick Phillips for the report. (Closes: #765035)

 -- Daniele Tricoli <eriol@mornie.org>  Tue, 21 Oct 2014 02:59:57 +0200

python-urllib3 (1.9.1-1) unstable; urgency=medium

  * New upstream release.
  * debian/control
    - Bump Standards-Version to 3.9.6 (no changes needed).
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh.
  * debian/patches/05_do-not-use-embedded-ssl-match-hostname.patch
    - Refresh.
  * debian/patches/06_add-test-init-py.patch
    - Remove since fixed upstream.
  * debian/rules
    - Exclude with_dummyserver tests since they are also failing upstream.

 -- Daniele Tricoli <eriol@mornie.org>  Tue, 23 Sep 2014 04:28:42 +0200

python-urllib3 (1.9-1) unstable; urgency=medium

  * New upstream release
  * debian/control
    - Add python-ndg-httpsclient, python-openssl and python-pyasn1 into
      python-urllib3's Recomends to ensure that SNI works as expected and to
      prevent CRIME attack
    - Add python3-ndg-httpsclient, python3-openssl and python3-pyasn1 into
      python3-urllib3's Suggests since Python 3 already support SNI and
      and SSL compression can be disabled using OP_NO_COMPRESSION
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh
  * debian/patches/02_require-cert-verification.patch
    - Refresh
  * debian/patches/05_do-not-use-embedded-ssl-match-hostname.patch
    - Refresh
  * debian/patches/06_relax-test-requirements.patch
    - Remove since upstream now does not specify version of packages needed
      for testing inside setup.py
  * debian/patches/06_add-test-init-py.patch
    - Add needed test/__init__.py file not shipped in sdist

 -- Daniele Tricoli <eriol@mornie.org>  Mon, 01 Sep 2014 02:56:44 +0200

python-urllib3 (1.8.3-1) unstable; urgency=medium

  * New upstream release (Closes: #754090)
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refresh
  * debian/patches/04_relax_nosetests_options.patch
    - Refresh

 -- Daniele Tricoli <eriol@mornie.org>  Mon, 07 Jul 2014 16:09:06 +0200

python-urllib3 (1.8.2-1) unstable; urgency=medium

  * New upstream release
  * debian/clean
    - Removed .coverage entry
  * debian/control
    - Added python3-coverage, python3-mock, python3-nose to Build-Depends
    - Bumped python(3)-coverage to (>=3.6)
    - Removed python-tornado from Build-Depends since it was used only for
      dummyserver
  * debian/copyright
    - Updated copyright years
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refreshed
  * debian/patches/02_require-cert-verification.patch
    - Refreshed
  * debian/patches/03_no-setuptools.patch
    - Superseded by debian/patches/setuptools.patch
  * debian/patches/03_force-setuptools.patch
    - Renamed from setuptools.patch
    - Added description
  * debian/patches/05_do-not-use-embedded-ssl-match-hostname.patch
    - Do not use embedded copy of ssl.match_hostname
  * debian/patches/06_relax-test-requirements.patch
    - Relax version of packages needed for testing
  * debian/rules
    - Enabled tests at build time also for Python 3 using the custom build
      plugin of pybuild
    - Cleaned .coverage file generated by nose using coverage plugin
    - No need to remove dummyserver since it is not installed anymore

 -- Daniele Tricoli <eriol@mornie.org>  Wed, 28 May 2014 19:41:18 +0200

python-urllib3 (1.8-2) unstable; urgency=medium

  * Team upload.
  * d/control: 
    - Fix python-urllib3-whl Depends.
    - Fix typo in python-urllib3-whl description.

 -- Barry Warsaw <barry@debian.org>  Thu, 22 May 2014 18:19:16 -0400

python-urllib3 (1.8-1) unstable; urgency=medium

  * Team upload.

  [ Daniele Tricoli ]
  * New upstream release
  * debian/control
    - Bumped Standards-Version to 3.9.5 (no changes needed)
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refreshed
  * debian/patches/02_require-cert-verification.patch
    - Refreshed

  [ Barry Warsaw ]
  * d/control:
    - Added python-setuptools, python3-setuptools, and python3-wheel to
      Build-Depends.
    - Added python-urllib3-whl binary package.
  * d/rules:
    - Build the universal wheels.
    - Simplify through use of PYBUILD_NAME.
  * d/python-urllib3-whl.install: Added.
  * d/patches/setuptools.patch: Use setuptools.setup() so that the
    bdist_wheel command will work.

 -- Barry Warsaw <barry@debian.org>  Thu, 15 May 2014 17:21:50 -0400

python-urllib3 (1.7.1-1) unstable; urgency=low

  * New upstream release
  * Switched to pybuild
  * debian/clean
    - Switched to debian/clean for cleaning instead of using debian/rules
  * debian/compat
    - Bumped debhelper compatibility level to 9
  * debian/control
    - Added python-mock to Build-Depends
    - Bumped debhelper B-D to (>= 9)
  * debian/copyright
    - Removed stanza about mimetools_choose_boundary since not shipped
      anymore
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refreshed
  * debian/patches/02_require-cert-verification.patch
    - Refreshed
  * debian/patches/04_relax_nosetests_options.patch
    - Refreshed
  * debian/patches/05_fix_python3_syntax_error_in_ntlmpool.patch
    - Removed since fixed upstream
  * debian/patches/06_fix_abuse_of_match_hostname_for_DoS.patch
    - Removed since fixed upstream
  * debian/watch
    - Switched download URL to https

 -- Daniele Tricoli <eriol@mornie.org>  Thu, 17 Oct 2013 13:28:10 +0200

python-urllib3 (1.6-2) unstable; urgency=high

  * debian/patches/06_fix_abuse_of_match_hostname_for_DoS.patch
    - Added upstream patch to fix possible abuse of ssl.match_hostname()
      for denial of service using certificates with many wildcards
      (CVE-2013-2099) (Closes: #709070) Thanks Henri Salo and Jakub
      Wilk for the report

 -- Daniele Tricoli <eriol@mornie.org>  Mon, 20 May 2013 19:34:17 +0200

python-urllib3 (1.6-1) unstable; urgency=low

  [ Jakub Wilk ]
  * Use canonical URIs for Vcs-* fields.

  [ Daniele Tricoli ]
  * New upstream release
  * Upload to unstable (Closes: #707780)
  * debian/control
    - Added python3-six to Build-Depends field
    - Bumped debhelper dependency to 8.1 for build-{arch,indep} support
    - Removed python-setuptools from Build-Depends field
  * debian/copyright
    - Updated copyright years
    - Added stanza for urllib3/packages/ordered_dict.py
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refreshed
  * debian/patches/02_require-cert-verification.patch
    - Refreshed
  * debian/patches/03_no-setuptools.patch
    - Do not use setuptools
  * debian/patches/04_relax_nosetests_options.patch
    - Do not use logging-clear-handlers to see all logging output and
      disabled cover-min-percentage since it require python-nose (>= 1.3):
      this way it will be easier to backport python-urllib3 to Wheezy.
  * debian/patches/05_fix_python3_syntax_error_in_ntlmpool.patch
    - Fix syntax error 'unicodeescape' codec can't decode bytes in
      position 130-132 for Python3

 -- Daniele Tricoli <eriol@mornie.org>  Sat, 11 May 2013 15:15:38 +0200

python-urllib3 (1.5-1) experimental; urgency=low

  * New upstream release
  * debian/control
    - Bumped Standards-Version to 3.9.4 (no changes needed)
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refreshed
  * debian/rules
    - Run tests only for python2.7 since upstream is using
      assertRaises() as a context manager

 -- Daniele Tricoli <eriol@mornie.org>  Fri, 09 Nov 2012 04:23:18 +0100

python-urllib3 (1.3-3) unstable; urgency=low

  * debian/control
    - Added ca-certificates to Recommends field
  * debian/patches/02_require-cert-verification.patch
    - require SSL certificate validation by default by using
      CERT_REQUIRED and using the system
      /etc/ssl/certs/ca-certificates.crt.
      Thanks to Jamie Strandboge for report and patch
      (Closes: #686872)

 -- Daniele Tricoli <eriol@mornie.org>  Mon, 10 Sep 2012 14:33:35 +0200

python-urllib3 (1.3-2) unstable; urgency=low

  * debian/control
    - Tightened B-D of python-coverage to >= 3.4 (Closes: #668427)
    - Fixed typo in python3-urllib3's ${python3:Depends}
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refreshed
  * debian/rules
    - Actually remove the embedded python-six from binary packages
    - Cleaned .egg-info to build packages twice in a row

 -- Daniele Tricoli <eriol@mornie.org>  Tue, 17 Apr 2012 21:34:49 +0200

python-urllib3 (1.3-1) unstable; urgency=low

  * New upstream release
  * debian/control
    - Bumped Standards-Version to 3.9.3 (no changes needed)
  * debian/patches/01_do-not-use-embedded-python-six.patch
    - Refreshed

 -- Daniele Tricoli <eriol@mornie.org>  Thu, 29 Mar 2012 02:09:04 +0200

python-urllib3 (1.2.2-1) unstable; urgency=low

  * Initial release (Closes: #648783)

 -- Daniele Tricoli <eriol@mornie.org>  Fri, 10 Feb 2012 04:41:11 +0100
