Debian 10 Buster: DLA-3610-1 Critical: python-urllib3 Data Leak

CVE-2019-11236

Hanno Böck discovered that an attacker controlling the request
parameter can inject headers by injecting CR/LF chars. The issue is
similar to CPython's CVE-2019-9740.

CVE-2019-11324

Christian Heimes discovered that when verifying HTTPS connections
upon passing an SSLContext to urllib3, system CA certificates are
loaded into the SSLContext by default in addition to any
manually-specified CA certificates.
This causes TLS handshakes that should fail given only the manually
specified certs to succeed based on system CA certs.

CVE-2020-26137

It was discovered that CRLF injection was possible if the attacker
controls the HTTP request method, as demonstrated by inserting CR
and LF control characters in the first argument of putrequest().
The issue is similar to urllib's CVE-2020-26116.

CVE-2023-43804

It was discovered that the Cookie request header isn't stripped
during cross-origin redirects. It is therefore possible for a user