The vulnerability of the Python programming language’s pip module lies in the insufficient validation of input data, which allows attackers to compromise the integrity of data.

🗓️ 22 Jun 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Python package installer has insufficient input data validation, risking data integrity.

Reporter	Title	Published	Views	Family All 202
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT uses multiple third party dependencies which is vulnerable to CVEs.	7 Apr 202519:17	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	7 Mar 202515:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Access is vulnerable to multiple Security Vulnerabilities	15 Apr 202502:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services for May 2024 - Multiple CVEs addressed	1 Jul 202408:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework v1 (CentOS6) is End of Life	14 Dec 202120:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to multiple Operator package issues	1 May 202521:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	27 Sep 202422:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to urllib3 for python man-in-the-middle and security bypass vulnerabilities( CVE-2021-3572,CVE-2021-28363,)	5 Jul 202321:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	18 Jul 202411:16	–	ibm
IBM Security Bulletins	Security Bulletin: A buffer overread, security restrictions bypass, a use-after-free, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	25 Mar 202523:50	–	ibm

Vulners

Node

OR

oracle communications_cloud_native_core_policyMatch1.15.0

python python-pipRange<21.1

oracle agile_plmMatch9.3.6

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch1.10.0

oracle communications_cloud_native_core_network_function_cloud_native_environmentMatch22.1.0

oracle communications_cloud_native_core_policyMatch22.1.3

Source	Link
oracle	www.oracle.com/security-alerts/cpuapr2022.html
oracle	www.oracle.com/security-alerts/cpujul2022.html
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
github	www.github.com/pypa/pip/issues/6413
github	www.github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2024-0830SE17
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47
web	www.web.nvd.nist.gov/view/vuln/detail

11 Nov 2024 00:00Current

6.7Medium risk

Vulners AI Score6.7

CVSS 35.7

CVSS 26.8

EPSS0.01687

Python package installer input validation data integrity