Description
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected products
- oracle / agile_product_lifecycle_management9.3.6 – 9.3.6
- oracle / communications_cloud_native_core_network_function_cloud_native_environment1.10.0 – 1.10.0
- oracle / communications_cloud_native_core_network_function_cloud_native_environment22.1.0 – 22.1.0
- oracle / communications_cloud_native_core_policy1.15.0 – 1.15.0
- oracle / communications_cloud_native_core_policy22.1.3 – 22.1.3
- pypa / pip21.1
Updated 8m ago · 8 sources