CVEvulnerability

CVE-2021-3572

5.7 MEDIUM Published 2021-11-10 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2021-11-10
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.7 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-20

Description

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

Affected configurations

• pypa pip (< 21.1) • oracle agile product lifecycle management 9.3.6 • oracle communications cloud native core network function cloud native environment 1.10.0 • oracle communications cloud native core network function cloud native environment 22.1.0 • oracle communications cloud native core policy 1.15.0 • oracle communications cloud native core policy 22.1.3

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References