CVE-2021-3572

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes.

Security Fix(es):

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.(CVE-2021-3572)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Information disclosure via pydoc (CVE-2021-3426)

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

• python-jinja2: ReDoS vulnerability in the urlize filter (CVE-2020-28493)

• python: Information disclosure via pydoc (CVE-2021-3426)

• python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code (CVE-2021-20095, CVE-2021-42771)

• python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters (CVE-2021-23336)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Information disclosure via pydoc (CVE-2021-3426)

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python-psutil: Double free because of refcount mishandling (CVE-2019-18874)

• python-jinja2: ReDoS vulnerability in the urlize filter (CVE-2020-28493)

• python: Information disclosure via pydoc (CVE-2021-3426)

• python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code (CVE-2021-20095, CVE-2021-42771)

• python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters (CVE-2021-23336)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

pip is a package management system used to install and manage software packages written in Python. Many packages can be found in the Python Package Index (PyPI). pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python".

Security Fix(es):

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• Merge Oracle Linux 7 changes
• CVE-2019-20916: sanitize Content-Disposition filename to prevent directory traversal

• Merge Oracle Linux 7 changes
• CVE-2019-20916: sanitize Content-Disposition filename to prevent directory traversal

TuxCare rebuilt pip to address 4 CVEs. Fixed in 9.0.0.post2+tuxcare.

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository (CVE-2021-3572).

The bundled python-urllib3 was also vulnerable to: The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted (CVE-2021-28363).

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect (CVE-2021-33503).

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python39-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python3 fixes the following issues:

• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

This update for python fixes the following issues:

• CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse (bsc#1195396).
• CVE-2021-4189: Fixed ftplib not to trust the PASV response (bsc#1194146).
• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

These are all security issues fixed in the python-2.7.18-18.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-3.6.15-10.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.13-2.1 package on the GA media of openSUSE Tumbleweed.

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

Root has patched CVE-2021-3572 in the pip package for Root:PyPI. Multiple fixed versions available.

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python36-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python39-pip fixes the following issues:

• CVE-2021-3572: Fixed incorrect handling of unicode separators in git references (bsc#1186819).

This update for python3 fixes the following issues:

• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

This update for python3 fixes the following issues:

• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

This update for python3 fixes the following issues:

• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

This update for python fixes the following issues:

• CVE-2022-0391: Fixed URL sanitization containing ASCII newline and tabs in urlparse (bsc#1195396).
• CVE-2021-4189: Fixed ftplib not to trust the PASV response (bsc#1194146).
• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

This security update for python36 fixes the following issues:

• CVE-2021-3572: Update bundled pip wheel - pip incorrectly handled unicode separators in git references (bsc#1186819).

This update for python39 fixes the following issues:

• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

• Update to 3.9.10 (jsc#SLE-23849)

• Remove shebangs from from python-base libraries in _libdir. (bsc#1193179)

• Update to 3.9.9:

  • Core and Builtins
    • bpo-30570: Fixed a crash in issubclass() from infinite recursion when searching pathological bases tuples.
    • bpo-45494: Fix parser crash when reporting errors involving invalid continuation characters. Patch by Pablo Galindo.
    • bpo-45385: Fix reference leak from descr_check. Patch by Dong-hee Na.
    • bpo-45167: Fix deepcopying of types.GenericAlias objects.
    • bpo-44219: Release the GIL while performing isatty system calls on arbitrary file descriptors. In particular, this affects os.isatty(), os.device_encoding() and io.TextIOWrapper. By extension, io.open() in text mode is also affected. This change solves a deadlock in os.isatty(). Patch by Vincent Michel in bpo-44219.
    • bpo-44959: Added fallback to extension modules with '.sl' suffix on HP-UX
    • bpo-44050: Extensions that indicate they use global state (by setting m_size to -1) can again be used in multiple interpreters. This reverts to behavior of Python 3.8.
    • bpo-45121: Fix issue where Protocol.init raises RecursionError when it's called directly or via super(). Patch provided by Yurii Karabas.
    • bpo-45083: When the interpreter renders an exception, its name now has a complete qualname. Previously only the class name was concatenated to the module name, which sometimes resulted in an incorrect full name being displayed.
    • bpo-45738: Fix computation of error location for invalid continuation characters in the parser. Patch by Pablo Galindo.
    • Library
    • bpo-45678: Fix bug in Python 3.9 that meant functools.singledispatchmethod failed to properly wrap the attributes of the target method. Patch by Alex Waygood.
    • bpo-45679: Fix caching of multi-value typing.Literal. Literal[True, 2] is no longer equal to Literal[1, 2].
    • bpo-45438: Fix typing.Signature string representation for generic builtin types.
    • bpo-45581: sqlite3.connect() now correctly raises MemoryError if the underlying SQLite API signals memory error. Patch by Erlend E. Aasland.
    • bpo-39679: Fix bug in functools.singledispatchmethod that caused it to fail when attempting to register a classmethod() or staticmethod() using type annotations. Patch contributed by Alex Waygood.
    • bpo-45515: Add references to zoneinfo in the datetime documentation, mostly replacing outdated references to dateutil.tz. Change by Paul Ganssle.
    • bpo-45467: Fix incremental decoder and stream reader in the 'raw-unicode-escape' codec. Previously they failed if the escape sequence was split.
    • bpo-45461: Fix incremental decoder and stream reader in the 'unicode-escape' codec. Previously they failed if the escape sequence was split.
    • bpo-45239: Fixed email.utils.parsedate_tz() crashing with UnboundLocalError on certain invalid input instead of returning None. Patch by Ben Hoyt.
    • bpo-44904: Fix bug in the doctest module that caused it to fail if a docstring included an example with a classmethod property. Patch by Alex Waygood.
    • bpo-45406: Make inspect.getmodule() catch FileNotFoundError raised by :'func:inspect.getabsfile, and return None to indicate that the module could not be determined.
    • bpo-45262: Prevent use-after-free in asyncio. Make sure the cached running loop holder gets cleared on dealloc to prevent use-after-free in get_running_loop
    • bpo-45386: Make xmlrpc.client more robust to C runtimes where the underlying C strftime function results in a ValueError when testing for year formatting options.
    • bpo-45371: Fix clang rpath issue in distutils. The UnixCCompiler now uses correct clang option to add a runtime library directory (rpath) to a shared library.
    • bpo-20028: Improve error message of csv.Dialect when initializing.…

This update for python3 fixes the following issues:

Security issues fixed:

• CVE-2021-3572: Update bundled pip wheel to the latest SLE version (bsc#1186819)
• CVE-2015-20107: avoid command injection in the mailcap module (bsc#1198511).

Other bugs fixed:

• Remove shebangs from from python-base libraries in _libdir (bsc#1193179, bsc#1192249).

USN-4961-1 fixed a vulnerability in pip. This update provides the corresponding updates for Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.

Original advisory details:

It was discovered that pip incorrectly handled unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository.