CVE-2021-3572: Input Validation
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
Other sources
It was discovered that pip incorrectly handled unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository.
References:
https://packetstormsecurity.com/files/162712/USN-4961-1.txt
— Red Hat
pip package for python could allow a remote authenticated attacker to bypass security restrictions, caused by the improper handling of Unicode separators in git references. By creating a specially crafted tag, an attacker could exploit this vulnerability to install a different revision on a repository.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-20.el8 - Upgrade
Upgrade
redhat/rh-python38-babelto a version that resolves this vulnerability.Fixed in 0:2.7.0-12.el7 - Upgrade
Upgrade
redhat/rh-python38-pythonto a version that resolves this vulnerability.Fixed in 0:3.8.11-2.el7 - Upgrade
Upgrade
redhat/rh-python38-python-cryptographyto a version that resolves this vulnerability.Fixed in 0:2.8-5.el7 - Upgrade
Upgrade
redhat/rh-python38-python-jinja2to a version that resolves this vulnerability.Fixed in 0:2.10.3-6.el7 - Upgrade
Upgrade
redhat/rh-python38-python-lxmlto a version that resolves this vulnerability.Fixed in 0:4.4.1-7.el7 - Upgrade
Upgrade
redhat/rh-python38-python-pipto a version that resolves this vulnerability.Fixed in 0:19.3.1-2.el7 - Upgrade
Upgrade
redhat/rh-python38-python-urllib3to a version that resolves this vulnerability.Fixed in 0:1.25.7-7.el7 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 21.1 - Upgrade
Upgrade
pip/pipto a version that resolves this vulnerability.Fixed in 21.1 - Upgrade
Upgrade
python-pipto a version that resolves this vulnerability.Fixed in 21.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3572?
CVE-2021-3572 is a vulnerability found in python-pip that allows a remote attacker to install a different revision on a repository.
What is the severity of CVE-2021-3572?
CVE-2021-3572 has a severity level of medium.
How does CVE-2021-3572 affect data integrity?
CVE-2021-3572 poses a threat to data integrity.
How can I fix CVE-2021-3572?
To fix CVE-2021-3572, update python-pip to version 21.1.
Where can I find more information about CVE-2021-3572?
You can find more information about CVE-2021-3572 at the following references: [link1](https://packetstormsecurity.com/files/162712/USN-4961-1.txt), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1962857), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1962858).