Ubuntu alert USN-7599-1 (python-urllib3)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-7599-1] urllib3 vulnerabilities
Date:
             
 
Thu, 26 Jun 2025 00:41:26 +0000
Message-ID:
             
 
<E1uUagA-0000aZ-W5@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-7599-1
June 25, 2025

python-urllib3 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 25.04
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

urllib3 could be made to expose sensitive information over the network.

Software Description:
- python-urllib3: HTTP library with thread-safe connection pooling

Details:

Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)

Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 25.04
  python3-urllib3                 2.3.0-2ubuntu0.1

Ubuntu 24.10
  python3-urllib3                 2.0.7-2ubuntu0.2

Ubuntu 24.04 LTS
  python3-urllib3                 2.0.7-1ubuntu0.2

Ubuntu 22.04 LTS
  python3-urllib3                 1.26.5-1~exp1ubuntu0.3

Ubuntu 20.04 LTS
  python3-urllib3                 1.25.8-2ubuntu0.4+esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  python-urllib3                  1.22-1ubuntu0.18.04.2+esm3
                                  Available with Ubuntu Pro
  python3-urllib3                 1.22-1ubuntu0.18.04.2+esm3
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  python-urllib3                  1.13.1-2ubuntu0.16.04.4+esm3
                                  Available with Ubuntu Pro
  python3-urllib3                 1.13.1-2ubuntu0.16.04.4+esm3
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-7599-1
  CVE-2025-50181, CVE-2025-50182

Package Information:
  https://launchpad.net/ubuntu/+source/python-urllib3/2.3.0...
  https://launchpad.net/ubuntu/+source/python-urllib3/2.0.7...
  https://launchpad.net/ubuntu/+source/python-urllib3/2.0.7...
  https://launchpad.net/ubuntu/+source/python-urllib3/1.26....


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmhclwoACgkQcpJm3tlz
hgHEpw/+JK5B0GnPC9TBS6kPfY8F484s7zQG1X3JESeLasI5dmFHej/xxuJiZMBU
TtxyjW03ETElMWZDLzhhDh1fEGtCyvdo1zg5wHm9xYRa4fFnAe7uMcppgJ74sE5J
wdWLZDlOG4nXLJktBFdXxrCf7gUejpoLH3P9+TT7JJ1OMtbTpAgrJINValmhK9TE
AIicyF+QKXta3DJeYkLAfB9ZG3xqoryTQ9M+ryiPgBcbFXCM9R+EE894i02juvf5
GJVZISV9f5jygGIuNApkgtOGeDLH1cXFaVyucKFlcKhC5XjGBFxclwihYjgjsKW+
hnysIkLfDZiMveWA6dVnUYlCKlooNhacIsFqKcuwbDtHAz4u0m+mtsOp3xKk4V9V
CoYQtmj2nCi2G5o+d171YCMO+sLP6YbD9KEiaa5CdeBTc9KWPZGq88nnpmXLsobn
LhxanbXE8V/OYol0DFwn4k9P3kpMCv8/ARul/UciUpHrGsOGq9duohhBg+uyYvXy
RXbDCJyf6utQV7WPlFf1O4RtWBcUetq1AcWYW3Hn38vYvwU3VSyCFD66gwrK+J2D
qDv+qZ3wz3yd1Wn3qL3jpV/7lsF72IcuPzd5ESE2zjIIdeOO+cB99gbgLxO5Gy7o
u6Tb1tmMNpEuNzg+Ym9GltF9HNc7YCHEKji6NpPc8u/fMa6XxWc=
=lPIw
-----END PGP SIGNATURE-----