fix CVE-2023-43804

backport-CVE-2023-43804-added-the-Cookie-to-the-list-of-headers.patch

@@ -0,0 +1,28 @@
+From 01220354d389cd05474713f8c982d05c9b17aafb Mon Sep 17 00:00:00 2001
+From: Seth Michael Larson <sethmichaellarson@gmail.com>
+Date: Mon, 2 Oct 2023 11:43:46 -0500
+Subject: [PATCH] Backport GHSA-v845-jxx5-vc9f (#3139)
+
+Co-authored-by: Quentin Pradet <quentin.pradet@gmail.com>
+Co-authored-by: Illia Volochii <illia.volochii@gmail.com>
+
+Conflict:NA
+Reference:https://github.com/urllib3/urllib3/commit/01220354d389cd05474713f8c982d05c9b17aafb
+
+---
+ src/pip/_vendor/urllib3/util/retry.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pip/_vendor/urllib3/util/retry.py b/src/pip/_vendor/urllib3/util/retry.py
+index c7dc42f..c7c0427 100644
+--- a/src/pip/_vendor/urllib3/util/retry.py
++++ b/src/pip/_vendor/urllib3/util/retry.py
+@@ -217,7 +217,7 @@ class Retry(object):
+     RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
+ 
+     #: Default headers to be used for ``remove_headers_on_redirect``
+-    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Authorization"])
++    DEFAULT_REMOVE_HEADERS_ON_REDIRECT = frozenset(["Cookie", "Authorization"])
+ 
+     #: Maximum backoff time.
+     BACKOFF_MAX = 120

python-pip.spec

@@ -6,7 +6,7 @@ pip is the package installer for Python. You can use pip to install packages fro
 %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-%{_sysconfdir}/bash_completion.d})
 Name:           python-%{srcname}
 Version:        21.3.1
-Release:        6
+Release:        7
 Summary:        A tool for installing and managing Python packages
 License:        MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD)
 URL:            http://www.pip-installer.org
@@ -23,6 +23,7 @@ Patch6003:      backport-0002-CVE-2024-3651.patch
 Patch6004:      backport-0003-CVE-2024-3651.patch
 Patch6005:      backport-0004-CVE-2024-3651.patch
 Patch6006:      backport-0005-CVE-2024-3651.patch
+Patch6007:      backport-CVE-2023-43804-added-the-Cookie-to-the-list-of-headers.patch
 
 Source10: 	pip-allow-older-versions.patch
 
@@ -132,6 +133,9 @@ install -D -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/pip.conf
 %{python_wheeldir}/%{python_wheelname}
 
 %changelog
+* Wed Jun 19 2024 yangyuan <yangyuan32@huawei.com> - 21.3.1-7
+- fix CVE-2023-43804
+
 * Wed Jun 19 2024 yangyuan <yangyuan32@huawei.com> - 21.3.1-6
 - fix CVE-2024-3651