Denial of Service Vulnerability in Python Packaging Authority (PyPA) Wheel and Pip Packages
Summary
UBUNTU-CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. Affects python-pip versions < 1.5.4-1ubuntu4+esm3. Fixed in 1.5.4-1ubuntu4+esm3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Packaging Authority (PyPA) Wheel is a built-package format for Python that allows for faster installation of Python packages. It is widely used in the Python ecosystem to distribute packages efficiently. The affected packages include 'python-pip' and 'wheel', which are essential for managing Python packages and dependencies. This vulnerability affects versions of these packages prior to the patched versions, making them susceptible to denial of service attacks.
Vulnerability Detail
An issue discovered in PyPA Wheel versions 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker-controlled input to the wheel command line interface (CLI). This vulnerability can lead to service disruptions, affecting applications that rely on these packages for package management. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.5.4-1ubuntu4+esm3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-pipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the wheel CLI with untrusted input until the package is updated. Additionally, consider implementing input validation in your applications that utilize these packages.
Conclusion
The vulnerability in the PyPA Wheel and Pip packages poses a significant risk of denial of service attacks. It is crucial for users to update their packages to the patched versions to mitigate this risk. Employing best practices for input validation can also help in reducing exposure to this vulnerability.
See every vulnerability recorded for python-pip →
FAQ
The vulnerability allows remote attackers to exploit the wheel CLI, leading to a denial of service.
Versions of 'python-pip' and 'wheel' prior to the patched versions are affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Implement input validation and avoid using the wheel CLI with untrusted input as a temporary measure.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
