Skip to content

Improper Input Validation in pip

Moderate severity GitHub Reviewed Published Nov 15, 2021 to the GitHub Advisory Database • Updated Jun 21, 2024

Package

pip pip (pip)

Affected versions

< 21.1

Patched versions

21.1

Description

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

References

Published by the National Vulnerability Database Nov 10, 2021
Reviewed Nov 12, 2021
Published to the GitHub Advisory Database Nov 15, 2021
Last updated Jun 21, 2024

Severity

Moderate
5.7
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weaknesses

CVE ID

CVE-2021-3572

GHSA ID

GHSA-5xp3-jfq3-5q8x

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.