CVE-2025-50181

Publication date 19 June 2025

Last updated 26 June 2025

Ubuntu priority

Cvss 3 Severity Score

Description

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-pip	25.04 plucky	Fixed in 25.0+dfsg-1ubuntu0.1
	24.10 oracular	Fixed in 24.2+dfsg-1ubuntu0.2
	24.04 LTS noble	Fixed in 24.0+dfsg-1ubuntu1.2
	22.04 LTS jammy	Fixed in 22.0.2+dfsg-1ubuntu0.6
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected
python-urllib3	25.04 plucky	Fixed in 2.3.0-2ubuntu0.1
	24.10 oracular	Fixed in 2.0.7-2ubuntu0.2
	24.04 LTS noble	Fixed in 2.0.7-1ubuntu0.2
	22.04 LTS jammy	Fixed in 1.26.5-1~exp1ubuntu0.3
	20.04 LTS focal	Fixed in 1.25.8-2ubuntu0.4+esm1
	18.04 LTS bionic	Fixed in 1.22-1ubuntu0.18.04.2+esm3
	16.04 LTS xenial	Fixed in 1.13.1-2ubuntu0.16.04.4+esm3
	14.04 LTS trusty	Not affected

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Notes

mdeslaur

On focal and earlier, the python-pip package bundles python-urllib3 binaries when built. After updating python-urllib3, a no-change rebuild of python-pip is required. On jammy and later, python-urllib3 is bundled in the python-pip package and needs to be patched.

Severity score breakdown

CVSS version: CVSS v3.0

Base score 5.3 · Medium

Base metrics

Parameter	Value
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	None
Availability impact	None

Scores

Parameter	Value
Base score	5.3 · Medium
Exploitability score	-
Impact score	-

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

USN-7599-1
urllib3 vulnerabilities
25 June 2025

USN-7599-2
pip vulnerability
26 June 2025

Other references

https://www.cve.org/CVERecord?id=CVE-2025-50181