SUSE-SU-2025:20255-1 Security update for python-requests
An attacker can bypass SSL certificate verification in python-requests if verify=False is set, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is SUSE-SU-2025:20255-1?
SUSE-SU-2025:20255-1 is a vulnerability in python-requests, published on 28 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for python-requests fixes the following issues:
Add patch to inject the default CA bundles if they are not specified. (bsc#1226321, bsc#1231500)
Remove Requires on python-py.
update to 2.32.3:
Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter.
Fixed issue where Requests started failing to run on Python versions compiled without the
sslmodule.To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is
Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification,
verify=True now reuses a global SSLContext which should improve request time
Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their
Which versions are affected by SUSE-SU-2025:20255-1?
Linux distribution packages (1)
python-requests SUSE:Linux Micro 6.1 | All versions | 2.32.3-slfo.1.1_2.1 |
How do I fix SUSE-SU-2025:20255-1?
Upgrade to a fixed version.
Is SUSE-SU-2025:20255-1 being exploited?
There is no known exploitation of SUSE-SU-2025:20255-1 in the wild and no public exploit code.