The vulnerability of the Python programming language’s pip module, related to the lack of data cleaning at the control level, allows attackers to alter the repository configuration.

🗓️ 22 Nov 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Python pip data cleaning flaw at control level enables attackers to modify repository configurations.

Reporter	Title	Published	Views	Family All 120
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	17 Dec 202509:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	7 Mar 202515:14	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Analytics - NPS Product	15 Jul 202515:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Access is vulnerable to multiple Security Vulnerabilities	15 Apr 202502:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Iot Component uses axios 1.7.9 and Python-3.8.17 which is vulnerable to CVE-2023-40217, CVE-2024-6232, CVE-2022-40897, CVE-2024-6345, CVE-2023-5752 and CVE-2025-27152	25 Jun 202508:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.3	7 Oct 202516:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx.ai on Cloud Pak for Data is vulnerable to python-Python-3.12.0b4 (Publicly disclosed vulnerability found by Mend) due to python pip package ( CVE-2023-5752, PRISMA-2022-0168)	5 Jun 202608:14	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for August 2025.	15 Sep 202507:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Iot Component uses axios 1.7.9 and Python-3.8.17 which is vulnerable to CVE-2023-40217, CVE-2024-6232, CVE-2022-40897, CVE-2024-6345, CVE-2023-5752 and CVE-2025-27152	25 Jun 202507:57	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to arbitrary configuration injection due to pip:22.3.1	10 Mar 202515:34	–	ibm

Vulners

Node

red_hat red_hat_quayMatch3

OR

novell suse_manager_retail_branch_serverMatch4.3

OR

novell suse_manager_proxyMatch4.3

OR

novell suse_manager_serverMatch4.3

OR

red_hat red_hat_ansible_automation_platformMatch2

OR

red_hat red_hat_ansible_automation_platformMatch1.2

OR

python python-pipRange<23.3

OR

google android_studioMatch2025.2.3.9

OR

red_hat red_hat_enterprise_linuxMatch9

OR

fedora fedoraMatch39

OR

novell opensuse_leapMatch15.6

Source	Link
github	www.github.com/pypa/pip/pull/12306
mail	www.mail.python.org/archives/list/[email protected]/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/
vuldb	www.vuldb.com/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2023-5752
access	www.access.redhat.com/security/cve/cve-2023-5752
bodhi	www.bodhi.fedoraproject.org/updates/FEDORA-2024-797928fed3
suse	www.suse.com/security/cve/CVE-2023-5752.html
wiki	www.wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17
wiki	www.wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47

10 Feb 2026 00:00Current

CVSS 24.6

CVSS 35.5

EPSS0.00075

Python pip module data cleaning control level repository configuration