{"id":"SUSE-SU-2025:20255-1","aliases":[],"status":"published","title":"Security update for python-requests","description":"This update for python-requests fixes the following issues:\n\n- Add patch to inject the default CA bundles if they are not specified.\n    (bsc#1226321, bsc#1231500)\n\n- Remove Requires on python-py. \n\n- update to 2.32.3:\n  * Fixed bug breaking the ability to specify custom SSLContexts\n    in sub-classes of HTTPAdapter.\n  * Fixed issue where Requests started failing to run on Python\n    versions compiled without the `ssl` module.\n\n  * To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,\n    we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing\n    custom HTTPAdapters will need to migrate their code to use this new API. get_connection is\n  * Fixed an issue where setting verify=False on the first request from a Session\n    will cause subsequent requests to the same origin to also ignore cert verification,\n  * verify=True now reuses a global SSLContext which should improve request time\n  * Requests now supports optional use of character detection (chardet or charset_normalizer)\n    when repackaged or vendored. This enables pip and other projects to minimize their","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-03-28T13:56:14Z","modified":"2026-03-23T04:50:45Z","fixes":[{"ecosystem":"SUSE:Linux Micro 6.1","package":"python-requests","fixed_in":["2.32.3-slfo.1.1_2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.3-slfo.1.1_2.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520255-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226321","tags":["report"]},{"url":"https://bugzilla.suse.com/1231500","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2025:20255-1","title":"Security update for python-requests","description":"This update for python-requests fixes the following issues:\n\n- Add patch to inject the default CA bundles if they are not specified.\n    (bsc#1226321, bsc#1231500)\n\n- Remove Requires on python-py. \n\n- update to 2.32.3:\n  * Fixed bug breaking the ability to specify custom SSLContexts\n    in sub-classes of HTTPAdapter.\n  * Fixed issue where Requests started failing to run on Python\n    versions compiled without the `ssl` module.\n\n  * To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0,\n    we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing\n    custom HTTPAdapters will need to migrate their code to use this new API. get_connection is\n  * Fixed an issue where setting verify=False on the first request from a Session\n    will cause subsequent requests to the same origin to also ignore cert verification,\n  * verify=True now reuses a global SSLContext which should improve request time\n  * Requests now supports optional use of character detection (chardet or charset_normalizer)\n    when repackaged or vendored. This enables pip and other projects to minimize their\n","status":"published","published":"2025-03-28T13:56:14Z","modified":"2026-03-23T04:50:45.947025Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}