Jump to solution
Verify

urllib3 sdist has world-writable permissions (Fix)

Fixed
Spec
Package
urllib3
Fixed In
1.25
Verdict
Status
Fixed
Safe for prod
Yes
Risk
Low
Last verified
2026-02-09
Own content ratio
0.42
#1415 ai Updated: 2026-02-13
Issue #1415

The Fix

pip install urllib3==1.25

Based on closed urllib3/urllib3 issue #1415 · PR/commit linked

Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.

Jump to Verify Open PR/Commit
@@ -1,28 +1,40 @@ @@ -1,28 +1,40 @@ language: python -script: - - ./_travis/run.sh +sudo: false
repro.py
root@6821c0c367c3:~/urllib3-1.23# ls -lan total 152 drwxrwxrwx 8 1000 1000 4096 Jul 19 07:56 . drwx------ 1 0 0 4096 Jul 19 07:56 .. -rwxrwxrwx 1 1000 1000 28535 Jun 5 03:16 CHANGES.rst -rwxrwxrwx 1 1000 1000 8542 Jun 5 03:16 CONTRIBUTORS.txt -rwxrwxrwx 1 1000 1000 1175 Jun 5 03:04 LICENSE.txt -rwxrwxrwx 1 1000 1000 204 Jun 5 03:04 MANIFEST.in -rwxrwxrwx 1 1000 1000 1192 Jun 5 03:16 Makefile -rwxrwxrwx 1 1000 1000 41888 Jun 5 03:22 PKG-INFO -rwxrwxrwx 1 1000 1000 3780 Jun 5 03:16 README.rst drwxr-xr-x 3 0 0 4096 Jul 19 07:56 build -rwxrwxrwx 1 1000 1000 212 Jun 5 03:16 dev-requirements.txt drwxrwxrwx 4 1000 1000 4096 Jun 5 03:22 docs drwxrwxrwx 3 1000 1000 4096 Jun 5 03:22 dummyserver -rw-r--r-- 1 0 0 5966 Jul 19 07:56 record.txt -rwxrwxrwx 1 1000 1000 620 Jun 5 03:22 setup.cfg -rwxrwxrwx 1 1000 1000 2899 Jun 5 03:16 setup.py drwxrwxrwx 5 1000 1000 4096 Jun 5 03:22 test drwxrwxrwx 5 1000 1000 4096 Jun 5 03:22 urllib3 drwxrwxrwx 2 1000 1000 4096 Jun 5 03:22 urllib3.egg-info
verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.
fix.md
Option A — Upgrade to fixed release\npip install urllib3==1.25\nWhen NOT to use: This fix should not be applied if the release process is not properly configured.\n\n

Why This Fix Works in Production

  • Trigger: -rwxrwxrwx 1 1000 1000 28535 Jun 5 03:16 CHANGES.rst
  • Mechanism: Revises the release process to ensure that world-writable permissions are not set by default for the sdist.
  • Why the fix works: Revises the release process to ensure that world-writable permissions are not set by default for the sdist. (first fixed release: 1.25).
Production impact:
  • If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.

Why This Breaks in Prod

  • Production symptom (often without a traceback): -rwxrwxrwx 1 1000 1000 28535 Jun 5 03:16 CHANGES.rst

Proof / Evidence

  • GitHub issue: #1415
  • Fix PR: https://github.com/urllib3/urllib3/pull/1508
  • First fixed release: 1.25
  • Reproduced locally: No (not executed)
  • Last verified: 2026-02-09
  • Confidence: 0.95
  • Did this fix it?: Yes (upstream fix exists)
  • Own content ratio: 0.42

Discussion

High-signal excerpts from the issue thread (symptoms, repros, edge-cases).

Jump to Sources Open on GitHub
“@sethmlarson is this resolved now or will be by your modifications to releasing (https://github.com/urllib3/urllib3/pull/1508)?”
@crwilcox · 2019-01-04 · confirmation · source
“I'll check this out, we definitely should ensure that world-writeable is not the default for our sdist in our new release protocol.”
@sethmlarson · 2018-08-09 · source
“This will in theory fix that issue by removing the human element of releases unless there's some special transformation we need to do to the…”
@sethmlarson · 2019-01-04 · source

Failure Signature (Search String)

  • -rwxrwxrwx 1 1000 1000 28535 Jun 5 03:16 CHANGES.rst
Copy-friendly signature
signature.txt
Failure Signature ----------------- -rwxrwxrwx 1 1000 1000 28535 Jun 5 03:16 CHANGES.rst -rw-r--r-- 1 root root 28841 Jul 19 08:03 CHANGES.rst

Error Message

Signature-only (no traceback captured)
error.txt
Error Message ------------- -rwxrwxrwx 1 1000 1000 28535 Jun 5 03:16 CHANGES.rst -rw-r--r-- 1 root root 28841 Jul 19 08:03 CHANGES.rst

Minimal Reproduction

repro.py
root@6821c0c367c3:~/urllib3-1.23# ls -lan total 152 drwxrwxrwx 8 1000 1000 4096 Jul 19 07:56 . drwx------ 1 0 0 4096 Jul 19 07:56 .. -rwxrwxrwx 1 1000 1000 28535 Jun 5 03:16 CHANGES.rst -rwxrwxrwx 1 1000 1000 8542 Jun 5 03:16 CONTRIBUTORS.txt -rwxrwxrwx 1 1000 1000 1175 Jun 5 03:04 LICENSE.txt -rwxrwxrwx 1 1000 1000 204 Jun 5 03:04 MANIFEST.in -rwxrwxrwx 1 1000 1000 1192 Jun 5 03:16 Makefile -rwxrwxrwx 1 1000 1000 41888 Jun 5 03:22 PKG-INFO -rwxrwxrwx 1 1000 1000 3780 Jun 5 03:16 README.rst drwxr-xr-x 3 0 0 4096 Jul 19 07:56 build -rwxrwxrwx 1 1000 1000 212 Jun 5 03:16 dev-requirements.txt drwxrwxrwx 4 1000 1000 4096 Jun 5 03:22 docs drwxrwxrwx 3 1000 1000 4096 Jun 5 03:22 dummyserver -rw-r--r-- 1 0 0 5966 Jul 19 07:56 record.txt -rwxrwxrwx 1 1000 1000 620 Jun 5 03:22 setup.cfg -rwxrwxrwx 1 1000 1000 2899 Jun 5 03:16 setup.py drwxrwxrwx 5 1000 1000 4096 Jun 5 03:22 test drwxrwxrwx 5 1000 1000 4096 Jun 5 03:22 urllib3 drwxrwxrwx 2 1000 1000 4096 Jun 5 03:22 urllib3.egg-info

Environment

  • urllib3: 1.23

What Broke

World-writable permissions on installed files could lead to security vulnerabilities.

Fix Options (Details)

Option A — Upgrade to fixed release Safe default (recommended)

pip install urllib3==1.25

When NOT to use: This fix should not be applied if the release process is not properly configured.

Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.

Fix reference: https://github.com/urllib3/urllib3/pull/1508

First fixed release: 1.25

Last verified: 2026-02-09. Validate in your environment.

Get updates

We publish verified fixes weekly. No spam.

Subscribe

When NOT to Use This Fix

  • This fix should not be applied if the release process is not properly configured.

Verify Fix

verify
Re-run the minimal reproduction on your broken version, then apply the fix and re-run.

Did This Fix Work in Your Case?

Quick signal helps us prioritize which fixes to verify and improve.

Prevention

  • Add a CI check that diffs key outputs after upgrades (OpenAPI schema snapshots, JSON payload shapes, CLI output).
  • Upgrade behind a canary and run integration tests against the canary before 100% rollout.

Version Compatibility Table

VersionStatus
1.25 Fixed

Related Issues

No related fixes found.

Cluster: urllib3:configuration-error urllib3 hub urllib3 best practices All hubs All clusters
Related clusters: Data consistency SSL handshake Other

Sources

We don’t republish the full GitHub discussion text. Use the links above for context.

Source & Disclaimer: Analysis derived from GitHub Issue #1415. Not affiliated with the library maintainers. Verify before production use.