Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia: 2021-0371 Moderate: python-pip Unicode Handling Issues

mageia
Calendar Grey July 25, 2021
Dist Mageia Esm H88
Recent updates to python-pip in Mageia patch security flaws, notably concerning Unicode processing and potential Denial-of-Service issues.
A flaw was found in python-pip in the way it handled Unicode separators in git references

Summary

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository (CVE-2021-3572).
The bundled python-urllib3 was also vulnerable to: The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted (CVE-2021-28363).
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect (CVE-2021-335...

Read the Full Advisory

References

- https://bugs.mageia.org/show_bug.cgi?id=29010

- https://bugs.mageia.org/show_bug.cgi?id=29041

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3L3JUBMPJJ7WYXI6JHX6KKYPPX676PR6/

- https://lists.suse.com/pipermail/sle-security-updates/2021-July/009129.html

- https://www.cve.org/CVERecord?id=CVE-2021-3572

- https://www.cve.org/CVERecord?id=CVE-2021-28363

- https://www.cve.org/CVERecord?id=CVE-2021-33503

Topics%20covered

Topics Covered

security advisory moderate denial of service unicode issue mageia python-pip

Resolution

SRPMS

- 8/core/python-pip-20.3.3-3.3.mga8

Publication date: 25 Jul 2021
URL: https://advisories.mageia.org/MGASA-2021-0371.html
Type: security
CVE: CVE-2021-3572, CVE-2021-28363, CVE-2021-33503

Topics%20covered

Topics Covered

security advisory moderate denial of service unicode issue mageia python-pip

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here