PYSEC-2021-437
At a glance
- Published
- Updated
- CVE
- CVE-2021-3572
- Aliases
- GHSA-5xp3-jfq3-5q8x
Description
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
Affected packages
| Package | Versions |
|---|---|
| PyPI · pip | introduced 0, fixed 21.1 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1962856 REPORT
- https://github.com/advisories/GHSA-5xp3-jfq3-5q8x ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |