[AutoPR- Security] Patch python-urllib3 for CVE-2026-44431 [HIGH]

SPECS/python-urllib3/CVE-2026-44431.patch

@@ -0,0 +1,38 @@
+From 06a21d526f844601f99cf549cf8e670506243aff Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Fri, 15 May 2026 15:53:36 +0000
+Subject: [PATCH] Backport: Strip sensitive headers on cross-host redirects for
+ ProxyManager pools; add changelog entry
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc.patch
+---
+ src/urllib3/connectionpool.py | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/src/urllib3/connectionpool.py b/src/urllib3/connectionpool.py
+index c6ca390..c946c7b 100644
+--- a/src/urllib3/connectionpool.py
++++ b/src/urllib3/connectionpool.py
+@@ -900,6 +900,18 @@ class HTTPConnectionPool(ConnectionPool, RequestMethods):
+                 body = None
+                 headers = HTTPHeaderDict(headers)._prepare_for_method_change()
+
++            # Strip headers marked as unsafe to forward to the redirected location.
++            # Check remove_headers_on_redirect to avoid a potential network call within
++            # self.is_same_host() which may use socket.gethostbyname() in the future.
++            if retries.remove_headers_on_redirect and not self.is_same_host(
++                redirect_location
++            ):
++                new_headers = headers.copy()  # type: ignore[union-attr]
++                for header in headers:
++                    if header.lower() in retries.remove_headers_on_redirect:
++                        new_headers.pop(header, None)
++                headers = new_headers
++
+             try:
+                 retries = retries.increment(method, url, response=response, _pool=self)
+             except MaxRetryError:
+-- 
+2.45.4
+

SPECS/python-urllib3/python-urllib3.spec

@@ -1,7 +1,7 @@
 Summary:        A powerful, sanity-friendly HTTP client for Python.
 Name:           python-urllib3
 Version:        2.0.7
-Release:        4%{?dist}
+Release:        5%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -16,6 +16,7 @@ Patch3:         CVE-2025-50181.patch
 Patch4:         CVE-2025-66418.patch
 Patch5:         CVE-2025-66471.patch
 Patch6:         CVE-2026-21441.patch
+Patch7:         CVE-2026-44431.patch
 
 %description
 A powerful, sanity-friendly HTTP client for Python.
@@ -87,6 +88,9 @@ skiplist+=" or test_respect_retry_after_header_sleep"
 %{python3_sitelib}/*
 
 %changelog
+* Fri May 15 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.0.7-5
+- Patch for CVE-2026-44431
+
 * Fri Jan 09 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.0.7-4
 - Patch for CVE-2026-21441