CVE-2023-5752 Mercurial configuration injectable in repo revision when installing via pip

2023-10-2420:56:05

CWE-77

PSF

www.cve.org

cve-2023-5752

mercurial

configuration

vulnerability

pip

repository

injectable

revision

installation

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

When installing a package from a Mercurial VCS URL (ie “pip install
hg+…”) with pip prior to v23.3, the specified Mercurial revision could
be used to inject arbitrary configuration options to the “hg clone”
call (ie “–config”). Controlling the Mercurial configuration can modify
how and which repository is installed. This vulnerability does not
affect users who aren’t installing from Mercurial.

CNA Affected

[
  {
    "collectionURL": "https://pypi.org",
    "defaultStatus": "affected",
    "packageName": "pip",
    "product": "pip",
    "repo": "https://github.com/pypa/pip",
    "vendor": "Pip maintainers",
    "versions": [
      {
        "status": "unaffected",
        "version": "23.3"
      }
    ]
  }
]