CVE-2021-3572
MEDIUM
Published Nov 10, 20214y ago · Modified Jun 17, 20262w ago
5.7 CVSS 3.1
Published Nov 10, 2021 4y ago
Last Modified Jun 17, 2026 2w ago
Description
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity High
Availability None
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-20 Improper Input Validation Validation
Affected Products 6
| Vendor | Product | Version | Range |
|---|---|---|---|
| pypa | pip | * | <21.1 |
| oracle | agile_plm | 9.3.6 | any |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | any |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 22.1.0 | any |
| oracle | communications_cloud_native_core_policy | 1.15.0 | any |
| oracle | communications_cloud_native_core_policy | 22.1.3 | any |
References 4
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1962856
- security.netapp.com https://security.netapp.com/advisory/ntap-20240621-0006/
- oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
- oracle.com https://www.oracle.com/security-alerts/cpujul2022.html
Remediation
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1962856
- oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
- oracle.com https://www.oracle.com/security-alerts/cpujul2022.html