Critical Vulnerability in python-pip: Potential Information Disclosure
Summary
USN-7599-2: python-pip vulnerability. Affects python-pip versions < 22.0.2+dfsg-1ubuntu0.6. Fixed in 22.0.2+dfsg-1ubuntu0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-pip is a package management system for Python that allows users to install and manage software packages written in Python. It is widely used in various applications and environments to facilitate the installation of libraries and dependencies. The recent vulnerabilities discovered in urllib3, which python-pip relies on, expose users to potential security risks, particularly concerning sensitive information leakage.
Vulnerability Detail
The vulnerabilities identified in python-pip stem from issues in urllib3, specifically CVE-2025-50181 and CVE-2025-50182. The first vulnerability allows urllib3 to handle redirects even when explicitly disabled, potentially enabling an attacker to obtain sensitive information. The second vulnerability, which affects only Ubuntu 25.04, involves incorrect handling of retry and redirect parameters when using Node.js, also leading to possible information disclosure. These vulnerabilities could be exploited by malicious actors to gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
22.0.2+dfsg-1ubuntu0.6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the use of urllib3 for handling redirects by modifying their code to avoid using the PoolManager or by implementing custom logic to handle redirects securely. However, this is not a long-term solution and updating to the patched versions is strongly recommended.
Conclusion
The vulnerabilities in python-pip pose significant risks related to information disclosure. Users are strongly encouraged to update to the latest patched versions to mitigate these risks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for python-pip →
FAQ
python-pip is a package management system for Python that simplifies the installation and management of Python packages.
The vulnerabilities include CVE-2025-50181 and CVE-2025-50182, which can lead to potential information disclosure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, consider implementing workarounds such as disabling the use of urllib3 for handling redirects.
Detailed information can be found in the Ubuntu Security Notices, specifically USN-7599-2, which outlines the vulnerabilities and their implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
