[python-urllib3] package update

[springstim]

Product

Amazon Linux 2023

Package

python-urllib3

Why do you need this package?

Please make amzn2023.0.12 available here.

In the current version AL2023 (21.3.1-2.amzn2023.0.11 ) Python/pip3 installs a python-urllib3 package that has a security finding: CVE-2025-50181 (e.g. showing up in ECR image inspector scans). According to ECR scans, this finding can be remedied via:

• python3-pip: 0:21.3.1-2.amzn2023.0.12 -- but this is not yet available as a container image here yet
• python3-pip: 0:21.3.1-2.amzn2023.0.12 -- but this is not yet available as a container image here yet
• urllib3: 2.5.0 -- probably beyond the scope of AL2023

[alexey-tsvetnov]

The fix for CVE-2025-50181 is already available in the AL2023 version 2023.8.20250707 and was fixed yet on June 25-26:

• https://alas.aws.amazon.com/AL2023/ALAS2023-2025-1058.html
• https://alas.aws.amazon.com/AL2023/ALAS2023-2025-1059.html

# cat /etc/amazon-linux-release
Amazon Linux release 2023.8.20250707 (Amazon Linux)

# dnf install -qy python3-pip

Installed:
  libxcrypt-compat-4.4.33-7.amzn2023.x86_64                    python3-pip-21.3.1-2.amzn2023.0.12.noarch

# rpm -q python3-pip
python3-pip-21.3.1-2.amzn2023.0.12.noarch

# rpm -q --changelog python3-pip | head
* Thu Jun 26 2025 Bill Karh <willkarh@amazon.com> - 21.3.1-2.amzn2023.0.12
- Fix CVE-2025-50181


# dnf install -qy python3-urllib3

Installed:
  python3-idna-2.10-3.amzn2023.0.3.noarch                   python3-pysocks-1.7.1-8.amzn2023.0.2.noarch
  python3-six-1.15.0-5.amzn2023.0.2.noarch                  python3-urllib3-1.25.10-5.amzn2023.0.5.noarch

# rpm -q python3-urllib3
python3-urllib3-1.25.10-5.amzn2023.0.5.noarch

# rpm -q --changelog python3-urllib3 | head
* Wed Jun 25 2025 Bill Karh <willkarh@amazon.com> - 1.25.10-5.amzn2023.0.5
- Fix CVE-2025-50181

[alexey-tsvetnov]

@springstim,

In the current version AL2023

What version do you mean by "current"?
What version do you see in /etc/amazon-linux-release?

[springstim]

I apologize; I thought I was making a request to update the container image on Docker Hub: I was trying to ask for the Docker image to be updated with the new AL2023 release (in order to remedy various security findings).

[alexey-tsvetnov]

It looks like you are using a container from DockerHub. It's known for having delays in deployments.
But, there is a better option - public.ecr.aws/amazonlinux/amazonlinux:2023
It is public and you can use it right away by simply updating the image name in the code where it is used.
This image location is updated at the same time as new AMIs are released.

$ docker run --rm public.ecr.aws/amazonlinux/amazonlinux:2023 cat /etc/amazon-linux-release
Amazon Linux release 2023.8.20250707 (Amazon Linux)