Lax cookie parsing in http.cookies could be a security issue when
combined with non-standard cookie handling in some Web browsers.
Reported by Sergey Bobrov.
diff --git a/Misc/ACKS b/Misc/ACKS
index f9a4426..1ca0479 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -136,6 +136,7 @@
Pablo Bleyer
Erik van Blokland
Eric Blossom
+Sergey Bobrov
Finn Bock
Paul Boddie
Matthew Boedicker
diff --git a/Misc/NEWS b/Misc/NEWS
index e5f8f76..2907c1c 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -21,6 +21,9 @@
Library
-------
+- Lax cookie parsing in http.cookies could be a security issue when combined
+ with non-standard cookie handling in some Web browsers. Reported by
+ Sergey Bobrov.
- Issue #21147: sqlite3 now raises an exception if the request contains a null
character instead of truncate it. Based on patch by Victor Stinner.