Security fix for the bundled urllib3 for CVE-2025-50181

setuptools now normalizes the dist-info directory names to lowercase
according to PEP 491

Also egg-info directories are not created anymore

[skip changelog]

(cherry picked from commit 97a9e3e215)

python-pip.spec

@@ -68,6 +68,11 @@ Patch:          dummy-certifi.patch
 # this warning is juts moot. Also, the warning breaks CPython test suite.
 Patch:          nowarn-pip._internal.main.patch
 
+# Patch for the bundled urllib3 for CVE-2025-50181
+# Redirects are not disabled when retries are disabled on PoolManager instantiation
+# Upstream fix: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
+Patch:          urllib3-CVE-2025-50181.patch
+
 # Remove -s from Python shebang - ensure that packages installed with pip
 # to user locations are seen by pip itself
 %undefine _py3_shebang_s

tests/pip_install_upgrade/runtest.sh

@@ -18,14 +18,14 @@ RPM_BUILD_ROOT=/ /usr/bin/pip install 'Pello==1.0.1'
 /usr/bin/pip freeze | grep '^Pello==1\.0\.2$'
 
 # Both installations should still exist
-test -d "${RPM_SITELIB}/Pello-1.0.1-py${PYTHON_VERSION}.egg-info" || test -d "${RPM_SITELIB}/Pello-1.0.1.dist-info"
+test -d "${RPM_SITELIB}/pello-1.0.1.dist-info"
 test -d "${LOCAL_SITELIB}/Pello-1.0.2.dist-info"
 
 # Let's ditch the local one
 /usr/bin/pip uninstall --yes Pello
 
 # It should only remove one of them
-test -d "${RPM_SITELIB}/Pello-1.0.1-py${PYTHON_VERSION}.egg-info" || test -d "${RPM_SITELIB}/Pello-1.0.1.dist-info"
+test -d "${RPM_SITELIB}/pello-1.0.1.dist-info"
 ! test -d "${LOCAL_SITELIB}/Pello-1.0.2.dist-info"
 
 # And pip should still see the RPM-installed one

tests/tests.yml

@@ -13,9 +13,6 @@
     - smoke36:
         dir: python/smoke
         run: VERSION=3.6 TOX=false ./venv.sh
-    - smoke38:
-        dir: python/smoke
-        run: VERSION=3.8 ./venv.sh
     - smoke39:
         dir: python/smoke
         run: VERSION=3.9 ./venv.sh
@@ -34,9 +31,6 @@
     - smoke314:
         dir: python/smoke
         run: VERSION=3.14 ./venv.sh
-    - smoke38_virtualenv:
-        dir: python/smoke
-        run: VERSION=3.8 METHOD=virtualenv ./venv.sh
     - smoke39_virtualenv:
         dir: python/smoke
         run: VERSION=3.9 METHOD=virtualenv ./venv.sh
@@ -72,7 +66,6 @@
     - gcc
     - virtualenv
     - python3.6
-    - python3.8
     - python3.9
     - python3.10-devel
     - python3.11-devel

urllib3-CVE-2025-50181.patch

@@ -0,0 +1,51 @@
+From b3d543d7e16af844394316360ef1bf0b9d10f1b1 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 18 Jun 2025 16:25:01 +0300
+Subject: [PATCH] Security fix for CVE-2025-50181
+
+Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
+Co-authored-by: Quentin Pradet <quentin.pradet@gmail.com>
+Co-authored-by: Seth Michael Larson <sethmichaellarson@gmail.com>
+---
+ src/pip/_vendor/urllib3/poolmanager.py | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/src/pip/_vendor/urllib3/poolmanager.py b/src/pip/_vendor/urllib3/poolmanager.py
+index fb51bf7..a8de7c6 100644
+--- a/src/pip/_vendor/urllib3/poolmanager.py
++++ b/src/pip/_vendor/urllib3/poolmanager.py
+@@ -170,6 +170,22 @@ class PoolManager(RequestMethods):
+ 
+     def __init__(self, num_pools=10, headers=None, **connection_pool_kw):
+         RequestMethods.__init__(self, headers)
++        if "retries" in connection_pool_kw:
++            retries = connection_pool_kw["retries"]
++            if not isinstance(retries, Retry):
++                # When Retry is initialized, raise_on_redirect is based
++                # on a redirect boolean value.
++                # But requests made via a pool manager always set
++                # redirect to False, and raise_on_redirect always ends
++                # up being False consequently.
++                # Here we fix the issue by setting raise_on_redirect to
++                # a value needed by the pool manager without considering
++                # the redirect boolean.
++                raise_on_redirect = retries is not False
++                retries = Retry.from_int(retries, redirect=False)
++                retries.raise_on_redirect = raise_on_redirect
++                connection_pool_kw = connection_pool_kw.copy()
++                connection_pool_kw["retries"] = retries
+         self.connection_pool_kw = connection_pool_kw
+         self.pools = RecentlyUsedContainer(num_pools)
+ 
+@@ -389,7 +405,7 @@ class PoolManager(RequestMethods):
+             kw["body"] = None
+             kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change()
+ 
+-        retries = kw.get("retries")
++        retries = kw.get("retries", response.retries)
+         if not isinstance(retries, Retry):
+             retries = Retry.from_int(retries, redirect=redirect)
+ 
+-- 
+2.51.0
+