Lucene search

GitHub Advisory DatabaseGHSA-G3P5-FJJ9-H8GJ

HistoryMay 13, 2022 - 1:11 a.m.

Improper Input Validation in pip

2022-05-1301:11:25

CWE-20

GitHub Advisory Database

github.com

pip

input validation

pypi

integrity checks

man-in-the-middle

arbitrary code

crafted response

software

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

73.0%

JSON

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a “pip install” operation.

Affected configurations

Vulners

Node

pypapipRange<1.3

VendorProductVersionCPE
pypapip*cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pypa	pip	*	cpe:2.3:a:pypa:pip::::::::

References

www.pip-installer.org/en/latest/installing.html

www.pip-installer.org/en/latest/news.html#changelog

www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/

bugzilla.redhat.com/show_bug.cgi?id=968059

github.com/advisories/GHSA-g3p5-fjj9-h8gj

github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2013-8.yaml

github.com/pypa/pip/issues/425

github.com/pypa/pip/pull/791/files

nvd.nist.gov/vuln/detail/CVE-2013-1629

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

73.0%

JSON

Related for GHSA-G3P5-FJJ9-H8GJ