Protection Mechanism Failure in urllib3 - CVE-2025-50181

Vulnerability identifier: #VU111979

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-50181

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of the Redirect object when handling redirects and retries. A remote attacker can force the library to follow redirects even if explicitly disabled with PoolManager.

urllib3
Debian Linux
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Basesystem Module
Python 3 Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Data System
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
Fusion Content-Aware Storage
QRadar Investigation Assistant
Storage Sentinel Anomaly Scan Engine
watsonx Orchestrate Developer Edition
Truststore Manager
Guardium Data Security Center (GDSC)
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
watsonx Code Assistant On Prem
watsonx.data integration
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Maximo Application Suite - Location Service for Esri Component
Maximo Application Suite Ai Service
Maximo Application Suite - Predict Component
Astronomer with IBM
QRadar App SDK
Data Cataloging
SOAR QRadar Plugin App
watsonx.data
PeopleSoft Enterprise PeopleTools
IBM InfoSphere Information Server
python-urllib3 (Ubuntu package)
python-urllib3
python3-urllib3
python-urllib3 (Debian package)
python3-urllib3-doc
python311-urllib3
pypy
python3-pip
python2-pip
python-pip-wheel
python-pip-help
python-pip
python-pip (Ubuntu package)

Install updates from vendor's website.

urllib3 - update to 2.5.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
Fusion Content-Aware Storage - update to 1.1.3
IBM Cloud Pak for Data System - update to 1.0.10.0
QRadar Investigation Assistant - update to 1.1.0
Storage Sentinel Anomaly Scan Engine - update to 1.1.12
watsonx Orchestrate Developer Edition - update to 1.13.0
Truststore Manager - update to 1.7.1
watsonx.data - update to 2.3.1
IBM Fusion HCI - update to 2.13.0
Guardium Data Security Center (GDSC) - update to 3.8.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.3
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
watsonx Code Assistant On Prem - update to 5.3.0
watsonx.data integration - update to 5.3.1
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.29, 8.7.23, 9.0.16, 9.1.2
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.25, 8.11.23, 9.0.15, 9.1.5
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.21, 9.0.13, 9.1.3
Maximo Application Suite Ai Service - update to 9.1.1
Maximo Application Suite - Predict Component - update to 9.1.1
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
Astronomer with IBM - update to 1.1.0
python-urllib3 (Ubuntu package) - addressed in versions 1.13.1-2ubuntu0.16.04.4+esm3, 1.22-1ubuntu0.18.04.2+esm3, 1.25.8-2ubuntu0.4+esm1, 1.26.5-1~exp1ubuntu0.3, 2.0.7-1ubuntu0.2, 2.0.7-2ubuntu0.2, 2.3.0-2ubuntu0.1
python-urllib3 - update to 1.25.10-3.43.1
python3-urllib3 - addressed in versions 1.25.10-3.43.1, 1.25.10-150300.4.18.1
python-urllib3 (Debian package) - addressed in versions 1.26.12-1+deb12u2, 2.3.0-3+deb13u1
python-urllib3 - update to 1.26.18-3
python3-urllib3 - update to 1.26.18-3
python3-urllib3-doc - update to 1.26.19-2
python3-urllib3 - update to 1.26.19-2
python311-urllib3 - update to 2.0.7-150400.7.21.1
QRadar App SDK - update to 2.2.4
Data Cataloging - update to 2.5.3
SOAR QRadar Plugin App - update to 5.6.2
pypy - addressed in versions 7.3.20-2.fc41, 7.3.20-2.fc42, 7.3.20-2.fc43
python3-pip - addressed in versions 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-10, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-7, 23.3.1-9
python2-pip - addressed in versions 20.2.2-12, 20.2.2-14, 20.2.2-15
python-pip-wheel - addressed in versions 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-10, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-7, 23.3.1-9
python-pip-help - addressed in versions 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-10, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-7, 23.3.1-9
python-pip - addressed in versions 20.2.2-12, 20.2.2-14, 20.2.2-15, 21.3.1-10, 21.3.1-11, 21.3.1-13, 21.3.1-14, 23.3.1-7, 23.3.1-9
python-pip (Ubuntu package) - addressed in versions 22.0.2+dfsg-1ubuntu0.6, 24.0+dfsg-1ubuntu1.2, 24.2+dfsg-1ubuntu0.2, 25.0+dfsg-1ubuntu0.1
python-pip-wheel - update to 23.3.1-3
python3-pip - update to 23.3.1-3
python-pip - addressed in versions 24.2-3.fc41, 24.3.1-5.fc42, 25.1.1-17.fc43

• https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
• https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v

• Incorrect handling of redirects in urllib3
• Ubuntu update for python-urllib3
• Ubuntu update for python-pip
• Fedora 43 update for pypy
• Fedora 42 update for pypy
• Fedora 41 update for pypy
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• Multiple vulnerabilities in IBM Maximo AI Service
• openEuler update for python-urllib3
• SUSE update for python-urllib3
• SUSE update for python-urllib3
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• SUSE update for python-urllib3
• Multiple vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM QRadar App SDK
• Fedora 41 update for python-pip
• Fedora 43 update for python-pip
• Fedora 42 update for python-pip
• openEuler update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 22.03 LTS SP3 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• Anolis OS update for python-pip
• Anolis OS update for python-urllib3
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Maximo Application Suite - Predict Component
• Multiple vulnerabilities in IBM Truststore Manager
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• IBM watsonx Orchestrate Developer Edition update for urllib3
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Edge Data Collector
• Multiple vulnerabilities in Astronomer with IBM
• IBM Maximo Application Suite - Monitor Component update for urllib3
• Multiple vulnerabilities in IBM Storage Sentinel Anomaly Scan Engine
• Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
• Debian update for python-urllib3
• openEuler 24.03 LTS SP1 update for python-pip
• openEuler 20.03 LTS SP4 update for python-pip
• openEuler 24.03 LTS update for python-pip
• openEuler 24.03 LTS SP2 update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• openEuler 20.03 LTS SP4 update for python-pip
• openEuler 24.03 LTS SP1 update for python-pip
• openEuler 24.03 LTS update for python-pip
• openEuler 22.03 LTS SP4 update for python-pip
• openEuler 24.03 LTS SP3 update for python-pip
• openEuler 24.03 LTS SP2 update for python-pip
• Multiple vulnerabilities in IBM watsonx.data integration
• Multiple vulnerabilities in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Watson Knowledge Catalog on-prem
• Multiple vulnerabilities in IBM Fusion, IBM Fusion HCI, IBM Fusion Data Cataloging, and IBM Fusion Content-Aware Storage