From: Guido van Rossum <guido@python.org>
Date: Tue, 29 Mar 2011 19:55:41 +0000 (-0700)
Subject: Merge issue 11662.
X-Git-Tag: v3.2.1b1~183^2~1^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=acb63092b7966f6329c337960729559e1c503364;p=python

Merge issue 11662.
---

acb63092b7966f6329c337960729559e1c503364
diff --cc Misc/NEWS
index bd390a05b4,91d9ce6081..a03477a90d
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@@ -44,20 -44,9 +44,23 @@@ Core and Builtin
  Library
  -------
  
 +- Issue #11696: Fix ID generation in msilib.
 +
 +- Issue #9696: Fix exception incorrectly raised by xdrlib.Packer.pack_int when
 +  trying to pack a negative (in-range) integer.
 +
 +- Issue #11675: multiprocessing.[Raw]Array objects created from an integer size
 +  are now zeroed on creation.  This matches the behaviour specified by the
 +  documentation.
 +
 +- Issue #7639: Fix short file name generation in bdist_msi.
 +
 +- Issue #11659: Fix ResourceWarning in test_subprocess introduced by #11459.
 +  Patch by Ben Hayden.
 +
+ - Issue #11662: Make urllib and urllib2 ignore redirections if the
+   scheme is not HTTP, HTTPS or FTP (CVE-2011-1521).
+ 
  - Issue #5537: Fix time2isoz() and time2netscape() functions of
    httplib.cookiejar for expiration year greater than 2038 on 32-bit systems.