Amazon Linux 2023 Security Advisory: ALAS2023-2025-1096
Advisory Released Date: 2025-08-08
Advisory Updated Date: 2025-08-08
Severity:
Medium
Issue Overview:
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0. (CVE-2025-50181)
Affected Packages:
python3.12-pip
Issue Correction:
Run dnf update python3.12-pip --releasever 2023.8.20250808 or dnf update --advisory ALAS2023-2025-1096 --releasever 2023.8.20250808 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
noarch:
python3.12-pip-wheel-23.2.1-4.amzn2023.0.5.noarch
python3.12-pip-23.2.1-4.amzn2023.0.5.noarch
src:
python3.12-pip-23.2.1-4.amzn2023.0.5.src