Skip to content

Commit d977595

Browse files
authored
[Medium] patch python-pip for CVE-2025-50181 (microsoft#14370)
1 parent 696854a commit d977595

File tree

4 files changed

+115
-3
lines changed

4 files changed

+115
-3
lines changed
Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
From f05b1329126d5be6de501f9d1e3e36738bc08857 Mon Sep 17 00:00:00 2001
2+
From: Illia Volochii <[email protected]>
3+
Date: Wed, 18 Jun 2025 16:25:01 +0300
4+
Subject: [PATCH] Merge commit from fork
5+
6+
* Apply Quentin's suggestion
7+
8+
Co-authored-by: Quentin Pradet <[email protected]>
9+
10+
* Add tests for disabled redirects in the pool manager
11+
12+
* Add a possible fix for the issue with not raised `MaxRetryError`
13+
14+
* Make urllib3 handle redirects instead of JS when JSPI is used
15+
16+
* Fix info in the new comment
17+
18+
* State that redirects with XHR are not controlled by urllib3
19+
20+
* Remove excessive params from new test requests
21+
22+
* Add tests reaching max non-0 redirects
23+
24+
* Test redirects with Emscripten
25+
26+
* Fix `test_merge_pool_kwargs`
27+
28+
* Add a changelog entry
29+
30+
* Parametrize tests
31+
32+
* Drop a fix for Emscripten
33+
34+
* Apply Seth's suggestion to docs
35+
36+
Co-authored-by: Seth Michael Larson <[email protected]>
37+
38+
* Use a minor release instead of the patch one
39+
40+
Upstream Patch Reference: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857.patch
41+
---
42+
src/pip/_vendor/urllib3/poolmanager.py | 30 +++++++++++++++++++++++---
43+
1 file changed, 27 insertions(+), 3 deletions(-)
44+
45+
diff --git a/src/pip/_vendor/urllib3/poolmanager.py b/src/pip/_vendor/urllib3/poolmanager.py
46+
index fb51bf7..9cbcb6c 100644
47+
--- a/src/pip/_vendor/urllib3/poolmanager.py
48+
+++ b/src/pip/_vendor/urllib3/poolmanager.py
49+
@@ -3,6 +3,7 @@ from __future__ import absolute_import
50+
import collections
51+
import functools
52+
import logging
53+
+import typing
54+
55+
from ._collections import HTTPHeaderDict, RecentlyUsedContainer
56+
from .connectionpool import HTTPConnectionPool, HTTPSConnectionPool, port_by_scheme
57+
@@ -168,9 +169,32 @@ class PoolManager(RequestMethods):
58+
proxy = None
59+
proxy_config = None
60+
61+
- def __init__(self, num_pools=10, headers=None, **connection_pool_kw):
62+
- RequestMethods.__init__(self, headers)
63+
+ def __init__(
64+
+ self,
65+
+ num_pools: int = 10,
66+
+ headers: typing.Mapping[str, str] | None = None,
67+
+ **connection_pool_kw: typing.Any,
68+
+ ) -> None:
69+
+ super().__init__(headers)
70+
+ if "retries" in connection_pool_kw:
71+
+ retries = connection_pool_kw["retries"]
72+
+ if not isinstance(retries, Retry):
73+
+ # When Retry is initialized, raise_on_redirect is based
74+
+ # on a redirect boolean value.
75+
+ # But requests made via a pool manager always set
76+
+ # redirect to False, and raise_on_redirect always ends
77+
+ # up being False consequently.
78+
+ # Here we fix the issue by setting raise_on_redirect to
79+
+ # a value needed by the pool manager without considering
80+
+ # the redirect boolean.
81+
+ raise_on_redirect = retries is not False
82+
+ retries = Retry.from_int(retries, redirect=False)
83+
+ retries.raise_on_redirect = raise_on_redirect
84+
+ connection_pool_kw = connection_pool_kw.copy()
85+
+ connection_pool_kw["retries"] = retries
86+
self.connection_pool_kw = connection_pool_kw
87+
+
88+
+ self.pools: RecentlyUsedContainer[PoolKey, HTTPConnectionPool]
89+
self.pools = RecentlyUsedContainer(num_pools)
90+
91+
# Locally set the pool classes and keys so other PoolManagers can
92+
@@ -389,7 +413,7 @@ class PoolManager(RequestMethods):
93+
kw["body"] = None
94+
kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change()
95+
96+
- retries = kw.get("retries")
97+
+ retries = kw.get("retries", response.retries)
98+
if not isinstance(retries, Retry):
99+
retries = Retry.from_int(retries, redirect=redirect)
100+
101+
--
102+
2.45.2
103+

SPECS/python-pip/python-pip.spec

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ A tool for installing and managing Python packages}
55
Summary: A tool for installing and managing Python packages
66
Name: python-pip
77
Version: 24.2
8-
Release: 4%{?dist}
8+
Release: 5%{?dist}
99
License: MIT AND Python-2.0.1 AND Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND LGPL-2.1-only AND MPL-2.0 AND (Apache-2.0 OR BSD-2-Clause)
1010
Vendor: Microsoft Corporation
1111
Distribution: Azure Linux
@@ -14,9 +14,14 @@ URL: https://pip.pypa.io/
1414
Source0: https://github.com/pypa/pip/archive/%{version}/%{srcname}-%{version}.tar.gz
1515
Patch0: CVE-2024-37891.patch
1616
Patch1: CVE-2025-8869.patch
17+
Patch2: CVE-2025-50181.patch
1718

1819
BuildArch: noarch
1920

21+
%if 0%{?with_check}
22+
BuildRequires: git
23+
%endif
24+
2025
%description %{_description}
2126

2227
%package -n python3-pip
@@ -53,6 +58,10 @@ BuildRequires: python3-wheel
5358
%{python3_sitelib}/pip*
5459

5560
%changelog
61+
* Tue Sep 30 2025 Jyoti Kanase <[email protected]> - 24.2-4
62+
- Patch for CVE-2025-50181
63+
- Added %check
64+
5665
* Mon Sep 29 2025 Azure Linux Security Servicing Account <[email protected]> - 24.2-4
5766
- Patch for CVE-2025-8869
5867

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -549,7 +549,7 @@ python3-magic-5.45-1.azl3.noarch.rpm
549549
python3-markupsafe-2.1.3-1.azl3.aarch64.rpm
550550
python3-newt-0.52.23-1.azl3.aarch64.rpm
551551
python3-packaging-23.2-3.azl3.noarch.rpm
552-
python3-pip-24.2-4.azl3.noarch.rpm
552+
python3-pip-24.2-5.azl3.noarch.rpm
553553
python3-pygments-2.7.4-2.azl3.noarch.rpm
554554
python3-rpm-4.18.2-1.azl3.aarch64.rpm
555555
python3-rpm-generators-14-11.azl3.noarch.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -557,7 +557,7 @@ python3-magic-5.45-1.azl3.noarch.rpm
557557
python3-markupsafe-2.1.3-1.azl3.x86_64.rpm
558558
python3-newt-0.52.23-1.azl3.x86_64.rpm
559559
python3-packaging-23.2-3.azl3.noarch.rpm
560-
python3-pip-24.2-4.azl3.noarch.rpm
560+
python3-pip-24.2-5.azl3.noarch.rpm
561561
python3-pygments-2.7.4-2.azl3.noarch.rpm
562562
python3-rpm-4.18.2-1.azl3.x86_64.rpm
563563
python3-rpm-generators-14-11.azl3.noarch.rpm

0 commit comments

Comments
 (0)