CVE-2023-5752

2023-10-2518:17:44

CWE-77

[email protected]

web.nvd.nist.gov

cve

2023

5752

injection

vulnerability

pip

install

mercurial

url

configuration

options

hg clone

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.3%

JSON

When installing a package from a Mercurial VCS URL (ie “pip install
hg+…”) with pip prior to v23.3, the specified Mercurial revision could
be used to inject arbitrary configuration options to the “hg clone”
call (ie “–config”). Controlling the Mercurial configuration can modify
how and which repository is installed. This vulnerability does not
affect users who aren’t installing from Mercurial.

Affected configurations

NVD

Node

pypapipRange<23.3

CPENameOperatorVersion
pypa:pippypa piplt23.3

CPE	Name	Operator	Version
pypa:pip	pypa pip	lt	23.3

CNA Affected

[
  {
    "collectionURL": "https://pypi.org",
    "defaultStatus": "affected",
    "packageName": "pip",
    "product": "pip",
    "repo": "https://github.com/pypa/pip",
    "vendor": "Pip maintainers",
    "versions": [
      {
        "status": "unaffected",
        "version": "23.3"
      }
    ]
  }
]