Описание
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.
Отчет
This Important flaw in pip's wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user's permissions, using pip install with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.
Меры по смягчению последствий
To mitigate this issue, users should avoid installing Python wheels from untrusted sources. It is strongly advised against using pip install with elevated privileges, such as sudo, when installing wheels. Additionally, administrators should inspect entry_points.txt within wheels for path separators or absolute paths before installation.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| Migration Toolkit for Applications 8 | mta/mta-rhel9-operator | Affected | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-rhel9-operator | Affected | ||
| Migration Toolkit for Virtualization | mtv-candidate/mtv-rhel9-operator | Will not fix | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Not affected | ||
| OpenShift Lightspeed | openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-rhel9-operator | Not affected | ||
| Pen Drive Powered by Red Hat Lightspeed | pen-drive/pen-drive-scanner-rhel9 | Affected | ||
| Pen Drive Powered by Red Hat Lightspeed | pen-drive/pen-drive-scanner-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaii/model-opt-cuda-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8 High
CVSS3
Связанные уязвимости
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
pip can extract console_scripts and gui_scripts outside installation directory
pip would treat console_scripts and gui_scripts as paths instead of fi ...
EPSS
8 High
CVSS3