Vulnerability · Published Nov 10, 2021 · Assigned by redhat

CVE-2021-3572

Medium 5.7

In plain English

A medium-severity improper input validation in python-pip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.7Medium
Exploit odds (30 days)1.8%top 21.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8python3-pip9.0.3-20.el8ALSA-2021:4455
AlmaLinux:8python38-Cython0.29.14-4.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-PyMySQL0.10.1-1.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-asn1crypto1.2.0-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-atomicwrites1.3.0-8.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-attrs19.3.0-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-babel2.7.0-11.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-cffi1.13.2-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-chardet3.0.4-19.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-cryptography2.8-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-idna2.8-6.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-jinja22.10.3-5.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-markupsafe1.1.1-6.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-mod_wsgi4.6.8-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-more-itertools7.2.0-5.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-numpy1.17.3-6.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-numpy-doc1.17.3-6.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-numpy-f2py1.17.3-6.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-packaging19.2-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-pluggy0.13.0-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-ply3.11-10.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-psutil5.6.4-4.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-psycopg22.8.4-4.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-psycopg2-doc2.8.4-4.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-psycopg2-tests2.8.4-4.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-py1.8.0-8.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-pycparser2.19-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-pyparsing2.4.5-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-pysocks1.7.1-4.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-pytest4.6.6-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-pytz2019.3-3.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-pyyaml5.4.1-1.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-requests2.22.0-9.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-scipy1.3.1-4.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-setuptools41.6.0-5.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-setuptools-wheel41.6.0-5.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-six1.12.0-10.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-urllib31.25.7-5.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-wcwidth0.1.7-16.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-wheel0.33.6-6.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python38-wheel-wheel0.33.6-6.module_el8.6.0+2778+cd494b30ALSA-2021:4162
AlmaLinux:8python39-Cython0.29.21-5.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-PyMySQL0.10.1-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-attrs20.3.0-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-cffi1.14.3-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-chardet3.0.4-19.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-cryptography3.3.1-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-idna2.10-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-iniconfig1.1.1-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-mod_wsgi4.7.1-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-more-itertools8.5.0-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-numpy1.19.4-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-numpy-doc1.19.4-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-numpy-f2py1.19.4-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-packaging20.4-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-pluggy0.13.1-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-ply3.11-10.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-psutil5.8.0-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-psycopg22.8.6-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-psycopg2-doc2.8.6-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-psycopg2-tests2.8.6-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-py1.10.0-1.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-pycparser2.20-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-pyparsing2.4.7-5.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-pysocks1.7.1-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-pytest6.0.2-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-pyyaml5.4.1-1.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-requests2.25.0-2.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-scipy1.5.4-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-setuptools50.3.2-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-setuptools-wheel50.3.2-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-six1.15.0-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-toml0.10.1-5.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-urllib31.25.10-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-wcwidth0.2.5-3.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-wheel1:0.35.1-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
AlmaLinux:8python39-wheel-wheel1:0.35.1-4.module_el8.6.0+2780+a40f65e1ALSA-2021:4160
Debian:12python-pip20.3.4-2DEBIAN-CVE-2021-3572
Debian:13python-pip20.3.4-2DEBIAN-CVE-2021-3572
Debian:14python-pip20.3.4-2DEBIAN-CVE-2021-3572
PyPIpip21.1GHSA-5xp3-jfq3-5q8x
PyPIpip21.1PYSEC-2021-437
Rocky Linux:8Cython0:0.29.14-4.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8Cython0:0.29.21-5.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8PyYAML0:5.4.1-1.module+el8.5.0+672+ab6eb015RLSA-2021:4160
Rocky Linux:8PyYAML0:5.4.1-1.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8PyYAML0:5.4.1-1.module+el8.4.0+574+843c4898RLSA-2021:4162
Rocky Linux:8PyYAML0:5.4.1-1.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8babel0:2.7.0-11.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8mod_wsgi0:4.7.1-4.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8mod_wsgi0:4.6.8-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8numpy0:1.19.4-3.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8numpy0:1.17.3-6.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8pybind110:2.6.1-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8pytest0:6.0.2-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8pytest0:4.6.6-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-PyMySQL0:0.10.1-2.module+el8.4.0+597+ddf0ddeaRLSA-2021:4160
Rocky Linux:8python-PyMySQL0:0.10.1-1.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-PyMySQL0:0.10.1-1.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python-PyMySQL0:0.10.1-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-asn1crypto0:1.2.0-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-atomicwrites0:1.3.0-8.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-attrs0:20.3.0-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-attrs0:19.3.0-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-cffi0:1.13.2-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-cffi0:1.14.3-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-chardet0:3.0.4-19.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-chardet0:3.0.4-19.module+el8.4.0+570+c2eaf144RLSA-2021:4160
Rocky Linux:8python-cryptography0:3.3.1-2.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python-cryptography0:2.8-3.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python-cryptography0:2.8-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-cryptography0:3.3.1-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-idna0:2.8-6.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-idna0:2.10-3.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-iniconfig0:1.1.1-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-jinja20:2.10.3-5.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python-lxml0:4.6.2-3.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python-lxml0:4.4.1-6.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python-markupsafe0:1.1.1-6.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-more-itertools0:7.2.0-5.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-more-itertools0:8.5.0-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-packaging0:20.4-4.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-packaging0:19.2-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-pluggy0:0.13.0-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-pluggy0:0.13.1-3.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-ply0:3.11-10.module+el8.4.0+570+c2eaf144RLSA-2021:4160
Rocky Linux:8python-ply0:3.11-10.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-psutil0:5.8.0-4.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python-psutil0:5.8.0-4.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-psutil0:5.6.4-4.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python-psycopg20:2.8.6-2.module+el8.6.0+795+de4edbccRLSA-2021:4160
Rocky Linux:8python-psycopg20:2.8.6-2.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python-psycopg20:2.8.6-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-psycopg20:2.8.4-4.module+el8.6.0+794+eba84017RLSA-2021:4162
Rocky Linux:8python-psycopg20:2.8.4-4.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-py0:1.8.0-8.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-py0:1.10.0-1.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-pycparser0:2.19-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-pycparser0:2.20-3.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-pysocks0:1.7.1-4.module+el8.4.0+570+c2eaf144RLSA-2021:4160
Rocky Linux:8python-pysocks0:1.7.1-4.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-requests0:2.22.0-9.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-requests0:2.25.0-2.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-toml0:0.10.1-5.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-urllib30:1.25.7-5.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python-urllib30:1.25.10-4.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python-wcwidth0:0.2.5-3.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python-wcwidth0:0.1.7-16.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python-wheel1:0.35.1-4.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python-wheel0:0.33.6-6.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python380:3.8.8-4.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python390:3.9.6-2.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python3x-pip0:19.3.1-4.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python3x-pip0:20.2.4-6.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python3x-pyparsing0:2.4.7-5.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8python3x-pyparsing0:2.4.5-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python3x-setuptools0:41.6.0-5.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8python3x-setuptools0:50.3.2-4.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8python3x-six0:1.12.0-10.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8python3x-six0:1.15.0-3.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8pytz0:2019.3-3.module+el8.4.0+570+c2eaf144RLSA-2021:4162
Rocky Linux:8scipy0:1.5.4-3.module+el8.4.0+574+843c4898RLSA-2021:4160
Rocky Linux:8scipy0:1.3.1-4.module+el8.5.0+672+ab6eb015RLSA-2021:4162
Rocky Linux:8scipy0:1.5.4-3.module+el8.5.0+673+10283621RLSA-2021:4160
Rocky Linux:8scipy0:1.3.1-4.module+el8.4.0+570+c2eaf144RLSA-2021:4162

Affected products (as reported)

VendorProductVersions
n/a python-pip fixed in python-pip 21.1

Weakness: CWE-20

References