CVE-2021-3572
Summary
| CVE | CVE-2021-3572 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-11-10 18:15:00 UTC |
| Updated | 2022-10-05 02:14:00 UTC |
| Description | A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Oracle | Agile Plm | 9.3.6 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Network Function Cloud Native Environment | 1.10.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Network Function Cloud Native Environment | 22.1.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Policy | 1.15.0 | All | All | All |
| Application | Oracle | Communications Cloud Native Core Policy | 22.1.3 | All | All | All |
| Application | Pypa | Pip | All | All | All | All |
| Application | Pypa | Pip | 21.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Oracle Critical Patch Update Advisory - April 2022 | MISC | www.oracle.com | |
| 1962856 – (CVE-2021-3572) CVE-2021-3572 python-pip: Incorrect handling of unicode separators in git references | MISC | bugzilla.redhat.com | |
| Oracle Critical Patch Update Advisory - July 2022 | N/A | www.oracle.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159466 Oracle Enterprise Linux Security Update for python39:3.9 and python39-devel:3.9 (ELSA-2021-4160)
- 159467 Oracle Enterprise Linux Security Update for python38:3.8 and python38-devel:3.8 (ELSA-2021-4162)
- 159516 Oracle Enterprise Linux Security Update for python-pip (ELSA-2021-4455)
- 160714 Oracle Enterprise Linux Security Update for python-pip (ELSA-2023-12349)
- 180032 Debian Security Update for python-pip (CVE-2021-3572)
- 239580 Red Hat Update for rh-python38 (RHSA-2021:3254)
- 239827 Red Hat Update for python-pip (RHSA-2021:4455)
- 239841 Red Hat Update for python39:3.9 and python39-devel:3.9 (RHSA-2021:4160)
- 239845 Red Hat Update for python38:3.8 and python38-devel:3.8 (RHSA-2021:4162)
- 296061 Oracle Solaris 11.4 Support Repository Update (SRU) 42.113.1 Missing (CPUJAN2022)
- 353121 Amazon Linux Security Advisory for python-pip : ALAS2-2022-1742
- 377327 Alibaba Cloud Linux Security Update for python-pip (ALINUX3-SA-2022:0103)
- 378883 Splunk Enterprise August Third Party Package Updates (SVD-2023-0808)
- 379452 IBM Cognos Analytics Multiple Vulnerabilities (7123154)
- 670726 EulerOS Security Update for python-pip (EulerOS-SA-2021-2484)
- 670815 EulerOS Security Update for python-pip (EulerOS-SA-2021-2720)
- 670932 EulerOS Security Update for python-pip (EulerOS-SA-2021-2695)
- 751505 OpenSUSE Security Update for python-pip (openSUSE-SU-2021:4001-1)
- 751507 OpenSUSE Security Update for python-pip (openSUSE-SU-2021:4002-1)
- 751528 OpenSUSE Security Update for python-pip (openSUSE-SU-2021:1598-1)
- 751594 SUSE Enterprise Linux Security Update for python36-pip (SUSE-SU-2022:0060-1)
- 751597 OpenSUSE Security Update for python39-pip (openSUSE-SU-2022:0064-1)
- 751926 OpenSUSE Security Update for python3 (openSUSE-SU-2022:0942-1)
- 751946 SUSE Enterprise Linux Security Update for python3 (SUSE-SU-2022:1044-1)
- 751961 OpenSUSE Security Update for python (openSUSE-SU-2022:1091-1)
- 751964 SUSE Enterprise Linux Security Update for python36 (SUSE-SU-2022:1094-1)
- 751979 SUSE Enterprise Linux Security Update for python (SUSE-SU-2022:1091-1)
- 751996 SUSE Enterprise Linux Security Update for python3 (SUSE-SU-2022:0942-1)
- 752011 SUSE Enterprise Linux Security Update for python39-pip (SUSE-SU-2022:0064-1)
- 752098 SUSE Enterprise Linux Security Update for python39 (SUSE-SU-2022:1485-1)
- 752335 SUSE Enterprise Linux Security Update for python3 (SUSE-SU-2022:2351-1)
- 900808 Common Base Linux Mariner (CBL-Mariner) Security Update for python-pip (9273)
- 901311 Common Base Linux Mariner (CBL-Mariner) Security Update for python-pip (9273-1)
- 940209 AlmaLinux Security Update for python-pip (ALSA-2021:4455)
- 940526 AlmaLinux Security Update for python38:3.8 and python38-devel:3.8 (ALSA-2021:4162)
- 940559 AlmaLinux Security Update for python39:3.9 and python39-devel:3.9 (ALSA-2021:4160)
- 960239 Rocky Linux Security Update for python39:3.9 and python39-devel:3.9 (RLSA-2021:4160)
- 960342 Rocky Linux Security Update for python38:3.8 and python38-devel:3.8 (RLSA-2021:4162)
- 980106 Python (pip) Security Update for pip (GHSA-5xp3-jfq3-5q8x)