CVE-2023-5752: pip - Mercurial configuration injectable in repo revision when installing via pip
Summary
CVE-2023-5752: When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "-... Affects python-pip versions < e3dc91dad93a020b3034a87ebe59027f63370fe8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pip is a package management system used to install and manage software packages written in Python. It is the standard package manager for Python and is widely used in the Python community. pip allows users to easily install packages from various sources, including PyPI (Python Package Index), version control systems like Git and Mercurial, and local directories. It provides a command-line interface for installing, upgrading, and removing packages, as well as managing package dependencies.
Vulnerability Detail
The vulnerability (CVE-2023-5752) in pip allows for the injection of arbitrary configuration options to the 'hg clone' call when installing a package from a Mercurial VCS URL. This can be exploited by specifying a malicious Mercurial revision, which can modify the way and which repository is installed. The vulnerability affects pip versions prior to v23.3 and only impacts users who are installing packages from Mercurial. The vulnerability has a CVSS score of 3.3, indicating a medium severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update pip to the fixed version.
Conclusion
The vulnerability in pip allows for the injection of arbitrary configuration options when installing packages from Mercurial VCS URLs. To mitigate this vulnerability, it is important to update pip to version 23.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-pip →
FAQ
pip is a package management system used to install and manage software packages written in Python.
Mercurial is a distributed version control system used for managing software projects.
Users who are installing packages from Mercurial VCS URLs using pip versions prior to v23.3 are affected by this vulnerability.
The vulnerability allows for the injection of arbitrary configuration options, which can modify the way and which repository is installed when installing packages from Mercurial VCS URLs.
To fix this vulnerability, update your pip installation to version 23.3 or later by running the command 'pip install --upgrade pip'.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
