Huawei EulerOS: Security Advisory for python-pip (EulerOS-SA-2021-2796)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python-pip (EulerOS-SA-2021-2761)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

python39:3.9 and python39-devel:3.9 security update

modwsgi 4.7.1-4 - Convert from Fedora to the python39 module in RHEL8 - Resolves: rhbz1877430 4.7.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora33MassRebuild 4.7.1-2 - Rebuilt for Python 3.9 4.7.1-1 - update to 4.7.1 1721376 numpy 1.19.4-3 - Adjusted the postun scriptlets to enable...

python-pip security update

9.0.3-20 - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references Resolves: rhbz1962856...

auto-dl (0.1.1), chalice (>=1.0.1, <=1.2.2) +14 more potentially affected by CVE-2021-3572 via pip (9.0.3)

pip PYPI version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - auto-dl 0.1.1 - chalice =1.0.1, =1.5.119, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =1.5.6, =0.2.0, =2.1.6.16123016, =2.1.1.16070814,...

cli-pipeline (1.5.114), medikit (0.5.20) potentially affected by CVE-2021-3572 via pip (10.0.0b2)

pip PYPI version 10.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cli-pipeline 1.5.114 - medikit 0.5.20 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

khan-mongo (0.1.6), uranium (>=0.2.35, <=0.2.37) potentially affected by CVE-2021-3572 via pip (8.1.2)

pip PYPI version 8.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - khan-mongo 0.1.6 - uranium =0.2.35, =0.2.37 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

pycellfit (>=0.2.0, <=0.2.3) potentially affected by CVE-2021-3572 via pip (20.2.0)

pip PYPI version 20.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - pycellfit =0.2.0, =0.2.3 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

sprinter (1.4.2), uranium (>=0.2.8, <=0.2.22) +1 more potentially affected by CVE-2021-3572 via pip (7.1.0)

pip PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - sprinter 1.4.2 - uranium =0.2.8, =0.2.22 - yt-formula-node 0.0.4 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

uranium (>=0.2.23, <=0.2.34) potentially affected by CVE-2021-3572 via pip (7.1.2)

pip PYPI version 7.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - uranium =0.2.23, =0.2.34 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

aadetools (>=0.0.3, <=0.0.5), autocut3d (0.1.0) +14 more potentially affected by CVE-2021-3572 via pip (19.2.3)

pip PYPI version 19.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aadetools =0.0.3, =1.10.0, =0.1.4, =0.4.2, =2.0.0, =0.0.4, =0.2.4, =2019.9.2, =2019.10.22 - rtopy 0.1.0 - student-mixture 0.1.10 and more Source cves:...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), cfn-docgen (>=0.0.1, <=0.1.4) +1 more potentially affected by CVE-2021-3572 via pip (20.2.3)

pip PYPI version 20.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.1, =0.0.8, =0.0.11 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

chalice (>=1.6.2, <=1.8.0), commit-helper (3.4.13) +6 more potentially affected by CVE-2021-3572 via pip (18.1.0)

pip PYPI version 18.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.6.2, =0.1.6, =0.0.3, =3.2.0, =4.0.0 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

notebooktoall (>=0.1.7, <=0.2.0), python-dev-tools (>=2019.2.25, <=2019.3.1) potentially affected by CVE-2021-3572 via pip (19.0.2)

pip PYPI version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - notebooktoall =0.1.7, =2019.2.25, =2019.3.1 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

agave (>=0.1.1, <=0.1.7), bankruptcy (>=0.0.2, <=0.0.5) +12 more potentially affected by CVE-2021-3572 via pip (>=21.0.0, <=21.0.1)

pip PYPI version =21.0.0, =0.1.1, =0.0.2, =0.2.0, =1.22.1, =0.0.60, =1.0.2, =2.0.3, =0.6.3, =0.0.7, =0.0.39, =0.5.0, =0.1.0, =0.2.1 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

bentodev (>=0.1.17, <=2018.11.2), clacks (0.1.1.dev845) +6 more potentially affected by CVE-2021-3572 via pip (9.0.1)

pip PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - bentodev =0.1.17, =2.4.0, =0.2.0, =0.1.4, =1.2.0, =1.11.0 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1...

GHSA-5XP3-JFQ3-5Q8X Improper Input Validation in pip

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1...

aegea (>=2.0.0, <=2.2.5), chalice (>=1.14.1, <=1.16.0) +2 more potentially affected by CVE-2021-3572 via pip (20.1.1)

pip PYPI version 20.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aegea =2.0.0, =1.14.1, =0.1.0, =0.2.0 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...

python-dev-tools (>=2019.4.24, <=2019.5.3) potentially affected by CVE-2021-3572 via pip (19.1.0)

pip PYPI version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.4.24, =2019.5.3 Source cves: CVE-2021-3572 Source advisory: OSV:GHSA-5XP3-JFQ3-5Q8X...