Arbitrary Configuration Injection in Python Pip via Mercurial URLs
Summary
DEBIAN-CVE-2023-5752: When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "-... Affects python-pip versions < 23.3+dfsg-1. Fixed in 23.3+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Pip is a package management system for Python that allows users to install and manage software packages written in Python. It simplifies the process of package installation and dependency management. However, prior to version 23.3, Pip had a vulnerability that allowed users to inject arbitrary configuration options when installing packages from Mercurial version control system (VCS) URLs.
Vulnerability Detail
The vulnerability arises when a user installs a package from a Mercurial VCS URL using Pip prior to version 23.3. The specified Mercurial revision can be manipulated to inject arbitrary configuration options into the 'hg clone' command, such as '--config'. This could lead to unauthorized modifications in how and which repository is installed, potentially allowing malicious actors to alter the installation process.
How To Fix
Minimum fixed version
23.3+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid installing packages from Mercurial URLs until they have updated to the patched version of Pip.
Conclusion
The vulnerability in Python Pip allows for arbitrary configuration injection when installing packages from Mercurial URLs, posing a risk to users. It is crucial to update to version 23.3+dfsg-1 or later to mitigate this risk. Users should also consider using Vulert to monitor and alert for open-source vulnerabilities in their software.
See every vulnerability recorded for python-pip →
FAQ
The vulnerability allows arbitrary configuration injection during package installation from Mercurial URLs, potentially compromising the installation process.
Versions of Python Pip prior to 23.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Pip immediately, avoid installing packages from Mercurial URLs as a temporary workaround.
More information can be found in the official vulnerability report at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5752.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
