Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:3156-1

Опубликовано: 06 сент. 2024
Источник: suse-cvrf

Описание

Security update for python312-pip

This update for python312-pip fixes the following issues:

  • CVE-2023-5752: Avoiding injection of arbitrary configuration through Mercurial parameter. (bsc#1217353)

Список пакетов

Container bci/python:latest
python312-pip-23.2.1-150600.3.3.1
SUSE Linux Enterprise Module for Python 3 15 SP6
python312-pip-23.2.1-150600.3.3.1
openSUSE Leap 15.6
python312-pip-23.2.1-150600.3.3.1

Ссылки

Описание

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Затронутые продукты
Container bci/python:latest:python312-pip-23.2.1-150600.3.3.1
SUSE Linux Enterprise Module for Python 3 15 SP6:python312-pip-23.2.1-150600.3.3.1
openSUSE Leap 15.6:python312-pip-23.2.1-150600.3.3.1
Ссылки