MEDIUM 5.7 Microsoft
CVE-2021-3572
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
Microsoft Security Update 2021-Nov: A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
Affected Products
- cm1 python-pip 19.2-2 on CBL Mariner 1.0
- cbl2 python-virtualenv 20.26.6-1 on CBL-Mariner 2.0
- cbl2 python-virtualenv 20.26.6-1 on CBL Mariner 2.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-3572
- https://nvd.nist.gov/vuln/detail/CVE-2021-3572
This medium severity vulnerability with a CVSS score of 5.7 was published on 2021-11-09 via Microsoft. Affected: cm1 python-pip 19.2-2 on CBL Mariner 1.0, cbl2 python-virtualenv 20.26.6-1 on CBL-Mariner 2.0, cbl2 python-virtualenv 20.26.6-1 on CBL Mariner 2.0.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.