{"id":"USN-5821-4","aliases":[],"status":"published","title":"python-pip regression","description":"USN-5821-3 fixed a vulnerability in pip. The update introduced\na minor regression in Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and\nUbuntu 18.04 LTS. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Sebastian Chnelik discovered that wheel incorrectly handled\n certain file names when validated against a regex expression.\n An attacker could possibly use this issue to cause a\n denial of service.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-03-02T15:31:43Z","modified":"2026-06-29T13:50:45Z","fixes":[{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","fixed_in":["1.5.4-1ubuntu4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","fixed_in":["8.1.1-2ubuntu0.6+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-pip","fixed_in":["9.0.1-2.3~ubuntu1.18.04.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1ubuntu4+esm4"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2","1.5.4-1ubuntu4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1-2ubuntu0.6+esm5"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3","8.1.1-2ubuntu0.6+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.1-2.3~ubuntu1.18.04.8"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.6","9.0.1-2.3~ubuntu1.18.04.7"]}],"references":[{"url":"https://ubuntu.com/security/notices/USN-5821-4","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2009130","tags":["report"]}],"sources":{"osv":[{"id":"USN-5821-4","title":"python-pip regression","description":"USN-5821-3 fixed a vulnerability in pip. The update introduced\na minor regression in Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and\nUbuntu 18.04 LTS. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Sebastian Chnelik discovered that wheel incorrectly handled\n certain file names when validated against a regex expression.\n An attacker could possibly use this issue to cause a\n denial of service.\n","status":"published","published":"2023-03-02T15:31:43Z","modified":"2026-06-29T13:50:45.836108146Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}