CVE-2021-3572: Input Validation
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
Other sources
It was discovered that pip incorrectly handled unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository.
References:
https://packetstormsecurity.com/files/162712/USN-4961-1.txt
— Red Hat
pip package for python could allow a remote authenticated attacker to bypass security restrictions, caused by the improper handling of Unicode separators in git references. By creating a specially crafted tag, an attacker could exploit this vulnerability to install a different revision on a repository.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3572?
CVE-2021-3572 is a vulnerability found in python-pip that allows a remote attacker to install a different revision on a repository.
What is the severity of CVE-2021-3572?
CVE-2021-3572 has a severity level of medium.
How does CVE-2021-3572 affect data integrity?
CVE-2021-3572 poses a threat to data integrity.
How can I fix CVE-2021-3572?
To fix CVE-2021-3572, update python-pip to version 21.1.
Where can I find more information about CVE-2021-3572?
You can find more information about CVE-2021-3572 at the following references: [link1](https://packetstormsecurity.com/files/162712/USN-4961-1.txt), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1962857), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1962858).