Protection Mechanism Failure in urllib3 - CVE-2025-50182

Vulnerability identifier: #VU111980

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-50182

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect implementation of the Redirect object when handling redirects and retries in a Pyodide runtime. A remote attacker can force the library to follow redirects even if explicitly disabled.

urllib3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Cloud Pak for Data System
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite - Manage Component
IBM Maximo Application Suite
IBM Cloud Pak for Business Automation
QRadar Investigation Assistant
watsonx Orchestrate Developer Edition
Truststore Manager
Guardium Data Security Center (GDSC)
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Maximo Application Suite - Location Service for Esri Component
Maximo Application Suite Ai Service
Maximo Application Suite - Predict Component
Business Automation Insights
Astronomer with IBM
QRadar App SDK
SOAR QRadar Plugin App
IBM InfoSphere Information Server
Ubuntu
python-urllib3 (Ubuntu package)
python-pip (Ubuntu package)

Install updates from vendor's website.

urllib3 - update to 2.5.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.1
QRadar Investigation Assistant - update to 1.1.0
IBM Cloud Pak for Data System - update to 1.0.10.0
watsonx Orchestrate Developer Edition - update to 1.13.0
Truststore Manager - update to 1.7.1
Guardium Data Security Center (GDSC) - update to 3.8.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.2.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.29, 8.7.23, 9.0.16, 9.1.2
IBM Maximo Application Suite - addressed in versions 8.10.30, 8.11.27, 9.0.16, 9.1.5
Maximo Application Suite - Monitor Component - addressed in versions 8.10.25, 8.11.23, 9.0.15, 9.1.5
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.21, 9.0.13, 9.1.3
Maximo Application Suite Ai Service - update to 9.1.1
Maximo Application Suite - Predict Component - update to 9.1.1
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
Business Automation Insights - update to 25.0.0.0.1
Astronomer with IBM - update to 1.1.0
python-urllib3 (Ubuntu package) - addressed in versions 1.13.1-2ubuntu0.16.04.4+esm3, 1.22-1ubuntu0.18.04.2+esm3, 1.25.8-2ubuntu0.4+esm1, 1.26.5-1~exp1ubuntu0.3, 2.0.7-1ubuntu0.2, 2.0.7-2ubuntu0.2, 2.3.0-2ubuntu0.1
QRadar App SDK - update to 2.2.4
SOAR QRadar Plugin App - update to 5.6.2
python-pip (Ubuntu package) - addressed in versions 22.0.2+dfsg-1ubuntu0.6, 24.0+dfsg-1ubuntu1.2, 24.2+dfsg-1ubuntu0.2, 25.0+dfsg-1ubuntu0.1
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF006, 24.0.1-IF005, 25.0.0-IF001

• https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f
• https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5

• Incorrect handling of redirects in urllib3
• Ubuntu update for python-urllib3
• Ubuntu update for python-pip
• Multiple vulnerabilities in IBM QRadar Investigation Assistant
• Multiple vulnerabilities in IBM Maximo AI Service
• Multiple vulnerabilities in IBM Guardium Data Security Center
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Multiple vulnerabilities in IBM Maximo Application Suite - Location Service for Esri Component
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM QRadar App SDK
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Maximo Application Suite - Predict Component
• Multiple vulnerabilities in IBM Truststore Manager
• IBM watsonx Orchestrate Developer Edition update for urllib3
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Edge Data Collector
• Multiple vulnerabilities in Astronomer with IBM
• IBM Maximo Application Suite - Monitor Component update for urllib3
• Multiple vulnerabilities in IBM Cloud Pak for Data System
• Multiple vulnerabilities in IBM Watson Knowledge Catalog on-prem