Arbitrary Configuration Injection in Python Pip - CVE-2023-5752
Summary
UBUNTU-CVE-2023-5752: When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "-... Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Pip is a package management system used to install and manage software packages written in Python. It allows users to install packages from the Python Package Index (PyPI) and other repositories. The vulnerability in question affects various versions of Python Pip across multiple Ubuntu LTS releases, making it critical for users relying on this tool for package management.
Vulnerability Detail
The vulnerability arises when installing packages from a Mercurial VCS URL (e.g., 'pip install hg+...'). Prior to version 23.3, the specified Mercurial revision could be exploited to inject arbitrary configuration options into the 'hg clone' command, such as '--config'. This could lead to unauthorized modifications in how and which repository is installed, potentially compromising the integrity of the software being installed. Users who do not install from Mercurial are not affected by this issue.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing packages from Mercurial VCS URLs until they have updated to a secure version of Python Pip. Additionally, consider using alternative package sources that do not rely on Mercurial.
Conclusion
CVE-2023-5752 presents a significant risk to users of Python Pip, particularly those who install packages from Mercurial VCS URLs. It is crucial to update to the latest version of Python Pip to mitigate this vulnerability and ensure the integrity of software installations.
See every vulnerability recorded for python-pip →
FAQ
CVE-2023-5752 is a vulnerability in Python Pip that allows arbitrary configuration injection when installing packages from Mercurial VCS URLs.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized modifications to the software being installed, which could lead to security breaches or the installation of malicious code.
Yes, users should update to Python Pip version 23.3 or later to patch this vulnerability.
If immediate updating is not possible, avoid installing packages from Mercurial VCS URLs as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
