Lucene search

UbuntuUSN-5821-3

HistoryFeb 28, 2023 - 12:00 a.m.

pip regression

2023-02-2800:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

64.5%

JSON

Releases

Ubuntu 22.10
Ubuntu 22.04 LTS
Ubuntu 20.04 LTS
Ubuntu 18.04 ESM
Ubuntu 16.04 ESM
Ubuntu 14.04 ESM

Packages

python-pip - Python package installer

Details

USN-5821-1 fixed a vulnerability in wheel and pip. Unfortunately,
it was missing a commit to fix it properly in pip.

We apologize for the inconvenience.

Original advisory details:

Sebastian Chnelik discovered that wheel incorrectly handled
certain file names when validated against a regex expression.
An attacker could possibly use this issue to cause a
denial of service.

OSVersionArchitecturePackageVersionFilename
Ubuntu22.10noarchpython3-pip-whl< 22.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu22.10noarchpython3-pip< 22.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu22.04noarchpython3-pip-whl< 22.0.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu22.04noarchpython3-pip< 22.0.2+dfsg-1ubuntu0.2UNKNOWN
Ubuntu20.04noarchpython-pip-whl< 20.0.2-5ubuntu1.8UNKNOWN
Ubuntu20.04noarchpython3-pip< 20.0.2-5ubuntu1.8UNKNOWN
Ubuntu18.04noarchpython-pip< 9.0.1-2.3~ubuntu1.18.04.7UNKNOWN
Ubuntu18.04noarchpython-pip-whl< 9.0.1-2.3~ubuntu1.18.04.7UNKNOWN
Ubuntu18.04noarchpython3-pip< 9.0.1-2.3~ubuntu1.18.04.7UNKNOWN
Ubuntu16.04noarchpython-pip< 8.1.1-2ubuntu0.6+esm4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	22.10	noarch	python3-pip-whl	< 22.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	22.10	noarch	python3-pip	< 22.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	22.04	noarch	python3-pip-whl	< 22.0.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	22.04	noarch	python3-pip	< 22.0.2+dfsg-1ubuntu0.2	UNKNOWN
Ubuntu	20.04	noarch	python-pip-whl	< 20.0.2-5ubuntu1.8	UNKNOWN
Ubuntu	20.04	noarch	python3-pip	< 20.0.2-5ubuntu1.8	UNKNOWN
Ubuntu	18.04	noarch	python-pip	< 9.0.1-2.3~ubuntu1.18.04.7	UNKNOWN
Ubuntu	18.04	noarch	python-pip-whl	< 9.0.1-2.3~ubuntu1.18.04.7	UNKNOWN
Ubuntu	18.04	noarch	python3-pip	< 9.0.1-2.3~ubuntu1.18.04.7	UNKNOWN
Ubuntu	16.04	noarch	python-pip	< 8.1.1-2ubuntu0.6+esm4	UNKNOWN