CVE-2021-3572CWE-20

CVE-2021-3572

Medium · published November 10, 2021

CVSS v3.1

5.7

EPSS

Percentile

78.7

In the wild

Unconfirmed

What it is

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

The record

Technical detail

CVSS v3.1: 5.7 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.01829 · 78.7th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2021-11-10T23:15Z

Affected products (6)

Product	Versions	Fixed in
pypa/pip	< 21.1	21.1
oracle/agile_product_lifecycle_management	all versions	—
oracle/communications_cloud_native_core_network_function_cloud_native_environment	all versions	—
oracle/communications_cloud_native_core_network_function_cloud_native_environment	all versions	—
oracle/communications_cloud_native_core_policy	all versions	—
oracle/communications_cloud_native_core_policy	all versions	—

References (8)

https://bugzilla.redhat.com/show_bug.cgi?id=1962856 · [email protected]https://security.netapp.com/advisory/ntap-20240621-0006/ · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]https://www.oracle.com/security-alerts/cpujul2022.html · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=1962856 · af854a3a-2127-422b-91ae-364da2661108 https://security.netapp.com/advisory/ntap-20240621-0006/ · af854a3a-2127-422b-91ae-364da2661108 https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108 https://www.oracle.com/security-alerts/cpujul2022.html · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

10 NOV 17:55Z
A flaw was found in python-pip in the way it handled Unicode separators in git references
cvelistv5