Affected: Homebrew: pypy

When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Affected: PyPI: pip

When installing a package from a Mercurial VCS URL, e.g. `pip install hg+...`, with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the `hg clone` call (e.g. `--config`). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Affected: openEuler:20.03-LTS-SP4: python-pip

pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2>/dev/null); echo ${b:-/bash_completion.d}) Name: python-pip Version: 20.2.2 Release: 4 Summary: A tool for installing and managing Python packages License: MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL: http://www.pip-installer.org Source0: https://files.pythonhosted.org/packages/source/p/pip/pip-.tar.gz BuildArch: noarch Patch1: allow-stripping-given-prefix-from-wheel-RECORD-files. Patch2: emit-a-warning-when-running-with-root-privileges.patch Patch3: remove-existing-dist-only-if-path-conflicts.patch Patch6000: dummy-certifi.patch Patch6001: backport-CVE-2021-3572.patch Security Fix(es):

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial. (CVE-2023-5752)

When following cross-origin redirects for requests made using urllib3's high-level…

python310-pip-23.3.1-1.1 on GA media

Affected: PyPI: pip

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

pip: Mercurial configuration injectable in repo revision when installing via pip golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm python-cryptography: NULL-dereference when loading PKCS7 certificates pillow: Arbitrary Code Execution via the environment parameter python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode() python-pydantic: regular expression denial of service via crafted email string sqlparse: parsing heavily nested list leads to denial of service psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override aiohttp: XSS on index pages for static file handling python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words() python-pillow: buffer overflow in _imagingcms.c follow-redirects: Possible credential leak aiohttp: DoS when trying to parse malformed POST requests python-social-auth: Improper Handling of Case Sensitivity in social-auth-app-django jinja2: accept…

Security update for python-pip

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:22.04:LTS: python-pip, Ubuntu:24.04:LTS: python-pip, Ubuntu:25.04: python-pip

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Ein lokaler Angreifer kann eine Schwachstelle in Python "pip" ausnutzen, um Sicherheitsvorkehrungen zu umgehen.