Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:0892-1

Опубликовано: 14 мар. 2024
Источник: suse-cvrf

Описание

Security update for python36-pip

This update for python36-pip fixes the following issues:

  • CVE-2023-5752: Fixed possible injection of arbitrary configuration through Mercurial parameter. (bsc#1217353)

Список пакетов

SUSE Linux Enterprise Server 12 SP5
python36-pip-20.2.4-8.15.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
python36-pip-20.2.4-8.15.1

Ссылки

Описание

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Затронутые продукты
SUSE Linux Enterprise Server 12 SP5:python36-pip-20.2.4-8.15.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5:python36-pip-20.2.4-8.15.1
Ссылки