diff --git a/SOURCES/00320-CVE-2019-9636.patch b/SOURCES/00320-CVE-2019-9636.patch
new file mode 100644
index 0000000..ffc9620
--- /dev/null
+++ b/SOURCES/00320-CVE-2019-9636.patch
@@ -0,0 +1,123 @@
+diff --git a/Doc/library/urllib.parse.rst b/Doc/library/urllib.parse.rst
+index 40098d0..1b3d4e3 100644
+--- a/Doc/library/urllib.parse.rst
++++ b/Doc/library/urllib.parse.rst
+@@ -118,6 +118,11 @@ or on combining URL components into a URL string.
+ See section :ref:`urlparse-result-object` for more information on the result
+ object.
+
++ Characters in the :attr:`netloc` attribute that decompose under NFKC
++ normalization (as used by the IDNA encoding) into any of ``/``, ``?``,
++ ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is
++ decomposed before parsing, no error will be raised.
++
+ .. versionchanged:: 3.2
+ Added IPv6 URL parsing capabilities.
+
+@@ -126,6 +131,10 @@ or on combining URL components into a URL string.
+ false), in accordance with :rfc:`3986`. Previously, a whitelist of
+ schemes that support fragments existed.
+
++ .. versionchanged:: 3.5.7
++ Characters that affect netloc parsing under NFKC normalization will
++ now raise :exc:`ValueError`.
++
+
+ .. function:: parse_qs(qs, keep_blank_values=False, strict_parsing=False, encoding='utf-8', errors='replace')
+
+@@ -231,6 +240,15 @@ or on combining URL components into a URL string.
+ See section :ref:`urlparse-result-object` for more information on the result
+ object.
+
++ Characters in the :attr:`netloc` attribute that decompose under NFKC
++ normalization (as used by the IDNA encoding) into any of ``/``, ``?``,
++ ``#``, ``@``, or ``:`` will raise a :exc:`ValueError`. If the URL is
++ decomposed before parsing, no error will be raised.
++
++ .. versionchanged:: 3.5.7
++ Characters that affect netloc parsing under NFKC normalization will
++ now raise :exc:`ValueError`.
++
+
+ .. function:: urlunsplit(parts)
+
+diff --git a/Lib/test/test_urlparse.py b/Lib/test/test_urlparse.py
+index 0552f90..d425b47 100644
+--- a/Lib/test/test_urlparse.py
++++ b/Lib/test/test_urlparse.py
+@@ -1,3 +1,5 @@
++import sys
++import unicodedata
+ import unittest
+ import urllib.parse
+
+@@ -910,6 +912,27 @@ class UrlParseTestCase(unittest.TestCase):
+ expected.append(name)
+ self.assertCountEqual(urllib.parse.__all__, expected)
+
++ def test_urlsplit_normalization(self):
++ # Certain characters should never occur in the netloc,
++ # including under normalization.
++ # Ensure that ALL of them are detected and cause an error
++ illegal_chars = '/:#?@'
++ hex_chars = {'{:04X}'.format(ord(c)) for c in illegal_chars}
++ denorm_chars = [
++ c for c in map(chr, range(128, sys.maxunicode))
++ if (hex_chars & set(unicodedata.decomposition(c).split()))
++ and c not in illegal_chars
++ ]
++ # Sanity check that we found at least one such character
++ self.assertIn('\u2100', denorm_chars)
++ self.assertIn('\uFF03', denorm_chars)
++
++ for scheme in ["http", "https", "ftp"]:
++ for c in denorm_chars:
++ url = "{}://netloc{}false.netloc/path".format(scheme, c)
++ with self.subTest(url=url, char='{:04X}'.format(ord(c))):
++ with self.assertRaises(ValueError):
++ urllib.parse.urlsplit(url)
+
+ class Utility_Tests(unittest.TestCase):
+ """Testcase to test the various utility functions in the urllib."""
+diff --git a/Lib/urllib/parse.py b/Lib/urllib/parse.py
+index 01c9e58..6e88195 100644
+--- a/Lib/urllib/parse.py
++++ b/Lib/urllib/parse.py
+@@ -318,6 +318,21 @@ def _splitnetloc(url, start=0):
+ delim = min(delim, wdelim) # use earliest delim position
+ return url[start:delim], url[delim:] # return (domain, rest)
+
++def _checknetloc(netloc):
++ if not netloc or not any(ord(c) > 127 for c in netloc):
++ return
++ # looking for characters like \u2100 that expand to 'a/c'
++ # IDNA uses NFKC equivalence, so normalize for this check
++ import unicodedata
++ netloc2 = unicodedata.normalize('NFKC', netloc)
++ if netloc == netloc2:
++ return
++ _, _, netloc = netloc.rpartition('@') # anything to the left of '@' is okay
++ for c in '/?#@:':
++ if c in netloc2:
++ raise ValueError("netloc '" + netloc2 + "' contains invalid " +
++ "characters under NFKC normalization")
++
+ def urlsplit(url, scheme='', allow_fragments=True):
+ """Parse a URL into 5 components:
+ <scheme>://<netloc>/<path>?<query>#<fragment>
+@@ -347,6 +362,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
+ url, fragment = url.split('#', 1)
+ if '?' in url:
+ url, query = url.split('?', 1)
++ _checknetloc(netloc)
+ v = SplitResult(scheme, netloc, url, query, fragment)
+ _parse_cache[key] = v
+ return _coerce_result(v)
+@@ -370,6 +386,7 @@ def urlsplit(url, scheme='', allow_fragments=True):
+ url, fragment = url.split('#', 1)
+ if '?' in url:
+ url, query = url.split('?', 1)
++ _checknetloc(netloc)
+ v = SplitResult(scheme, netloc, url, query, fragment)
+ _parse_cache[key] = v
+ return _coerce_result(v)
diff --git a/SPECS/python.spec b/SPECS/python.spec
index a368e63..5386cd5 100644
--- a/SPECS/python.spec
+++ b/SPECS/python.spec
@@ -146,7 +146,7 @@
Summary: Version 3 of the Python programming language aka Python 3000
Name: %{?scl_prefix}python
Version: %{pybasever}.1
-Release: 11%{?dist}
+Release: 12%{?dist}
License: Python
Group: Development/Languages
@@ -735,6 +735,11 @@ Patch242: 00242-CVE-2016-1000110-httpoxy.patch
Patch300: 00300-change-so-version-scl.patch
+# 00320 #
+# Security fix for CVE-2019-9636: Information Disclosure due to urlsplit improper NFKC normalization
+# FIXED UPSTREAM: https://bugs.python.org/issue36216
+# Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1689322
+Patch320: 00320-CVE-2019-9636.patch
# (New patches go here ^^^)
#
@@ -1038,6 +1043,8 @@ sed -r -i s/'_PIP_VERSION = "[0-9.]+"'/'_PIP_VERSION = "%{pip_version}"'/ Lib/en
%patch237 -p1
%patch242 -p1
+%patch320 -p1
+
cat %{PATCH300} | sed -e "s/__SCL_NAME__/%{?scl}/" \
| patch -p1
@@ -1995,6 +2002,10 @@ rm -fr %{buildroot}
# ======================================================
%changelog
+* Tue Apr 09 2019 Tomas Orsava <torsava@redhat.com> - 3.5.1-12
+- Security fix for CVE-2019-9636
+Resolves: rhbz#1689319
+
* Wed Sep 14 2016 Tomas Orsava <torsava@redhat.com> - 3.5.1-11
- Updated .pyc 'bytecompilation with the newly installed interpreter' to also
recompile optimized .pyc files