Skip to content

azure_servicebus-7.13.0-py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.5) #54

New issue
New issue
Open
Open
azure_servicebus-7.13.0-py3-none-any.whl: 5 vulnerabilities (highest severity is: 7.5)#54
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend
@mend-bolt-for-github

Description

@mend-bolt-for-github
mend-bolt-for-github
bot
opened on Jun 4, 2025
Vulnerable Library - azure_servicebus-7.13.0-py3-none-any.whl

Path to dependency file: /default/dockerbuild/attic/ui/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019531/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019331/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019261/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019151/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (azure_servicebus version) Remediation Possible**
CVE-2025-66471 High 7.5 urllib3-2.2.3-py3-none-any.whl Transitive N/A* ❌
CVE-2025-66418 High 7.5 urllib3-2.2.3-py3-none-any.whl Transitive N/A* ❌
CVE-2025-50182 Medium 5.3 urllib3-2.2.3-py3-none-any.whl Transitive N/A* ❌
CVE-2025-50181 Medium 5.3 urllib3-2.2.3-py3-none-any.whl Transitive N/A* ❌
CVE-2024-47081 Medium 5.3 requests-2.32.3-py3-none-any.whl Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-66471

Vulnerable Library - urllib3-2.2.3-py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/ce/d9/5f4c13cecde62396b0d3fe530a50ccea91e7dfc1ccf0e09c228841bb5ba8/urllib3-2.2.3-py3-none-any.whl

Path to dependency file: /default/dockerbuild/attic/ui/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019531/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019331/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019261/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019151/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info

Dependency Hierarchy:

  • azure_servicebus-7.13.0-py3-none-any.whl (Root Library)
    • azure_core-1.32.0-py3-none-any.whl
      • requests-2.32.3-py3-none-any.whl
        • ❌ urllib3-2.2.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Publish Date: 2025-12-05

URL: CVE-2025-66471

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2xpw-w6gg-jr37

Release Date: 2025-12-05

Fix Resolution: urllib3 - 2.6.0,https://github.com/urllib3/urllib3.git - 2.6.0

Step up your Open Source Security Game with Mend here

CVE-2025-66418

Vulnerable Library - urllib3-2.2.3-py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/ce/d9/5f4c13cecde62396b0d3fe530a50ccea91e7dfc1ccf0e09c228841bb5ba8/urllib3-2.2.3-py3-none-any.whl

Path to dependency file: /default/dockerbuild/attic/ui/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019531/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019331/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019261/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019151/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info

Dependency Hierarchy:

  • azure_servicebus-7.13.0-py3-none-any.whl (Root Library)
    • azure_core-1.32.0-py3-none-any.whl
      • requests-2.32.3-py3-none-any.whl
        • ❌ urllib3-2.2.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Publish Date: 2025-12-05

URL: CVE-2025-66418

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-12-05

Fix Resolution: https://github.com/urllib3/urllib3.git - 2.6.0,urllib3 - 2.6.0

Step up your Open Source Security Game with Mend here

CVE-2025-50182

Vulnerable Library - urllib3-2.2.3-py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/ce/d9/5f4c13cecde62396b0d3fe530a50ccea91e7dfc1ccf0e09c228841bb5ba8/urllib3-2.2.3-py3-none-any.whl

Path to dependency file: /default/dockerbuild/attic/ui/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019531/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019331/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019261/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019151/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info

Dependency Hierarchy:

  • azure_servicebus-7.13.0-py3-none-any.whl (Root Library)
    • azure_core-1.32.0-py3-none-any.whl
      • requests-2.32.3-py3-none-any.whl
        • ❌ urllib3-2.2.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-06-19

URL: CVE-2025-50182

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-06-19

Fix Resolution: urllib3 - 2.5.0,https://github.com/urllib3/urllib3.git - 2.5.0

Step up your Open Source Security Game with Mend here

CVE-2025-50181

Vulnerable Library - urllib3-2.2.3-py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/ce/d9/5f4c13cecde62396b0d3fe530a50ccea91e7dfc1ccf0e09c228841bb5ba8/urllib3-2.2.3-py3-none-any.whl

Path to dependency file: /default/dockerbuild/attic/ui/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019531/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019331/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019261/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019151/env/lib/python3.8/site-packages/urllib3-2.2.3.dist-info

Dependency Hierarchy:

  • azure_servicebus-7.13.0-py3-none-any.whl (Root Library)
    • azure_core-1.32.0-py3-none-any.whl
      • requests-2.32.3-py3-none-any.whl
        • ❌ urllib3-2.2.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Publish Date: 2025-06-19

URL: CVE-2025-50181

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-06-19

Fix Resolution: urllib3 - 2.5.0,urllib3 - 2.5.0,https://github.com/urllib3/urllib3.git - 2.5.0

Step up your Open Source Security Game with Mend here

CVE-2024-47081

Vulnerable Library - requests-2.32.3-py3-none-any.whl

Python HTTP for Humans.

Library home page: https://files.pythonhosted.org/packages/f9/9b/335f9764261e915ed497fcdeb11df5dfd6f7bf257d4a6a2a686d80da4d54/requests-2.32.3-py3-none-any.whl

Path to dependency file: /default/dockerbuild/react-ui/crud-app/backend/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019411/env/lib/python3.8/site-packages/requests-2.32.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019531/env/lib/python3.8/site-packages/requests-2.32.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019261/env/lib/python3.8/site-packages/requests-2.32.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019331/env/lib/python3.8/site-packages/requests-2.32.3.dist-info,/tmp/ws-ua_20250115001842_FLMVYU/python_HMRKSI/202501150019151/env/lib/python3.8/site-packages/requests-2.32.3.dist-info

Dependency Hierarchy:

  • azure_servicebus-7.13.0-py3-none-any.whl (Root Library)
    • azure_core-1.32.0-py3-none-any.whl
      • ❌ requests-2.32.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with "trust_env=False" on one's Requests Session.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-06-09

URL: CVE-2024-47081

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9hjg-9r4m-mvj7

Release Date: 2025-06-09

Fix Resolution: https://github.com/psf/requests.git - v2.32.4,requests - 2.32.4,requests - 2.32.4

Step up your Open Source Security Game with Mend here

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions