Improper input validation in python-pip
Priority LOW 29CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 6 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01829 78th percentileScored 2026-11-07
Fix Partial pip (PyPI): 21.1Red Hat: 4 advisoriesRed Hat: 6 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | python-pip | fixed in python-pip 21.1 | — | No fix listed | CNA |
| — | pip (PyPI) | before 21.1 | 21.1 | Patch available | GHSA-5xp3-jfq3-5q8x |
- python-pip Vendor— Affected fixed in python-pip 21.1 Fixed in — No fix listed CNA
- pip (PyPI) Vendor— Affected before 21.1 Fixed in 21.1 Patch available GHSA-5xp3-jfq3-5q8x
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:* | before 21.1 | Vulnerable | pypa |
| cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* | 9.3.6 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* | 1.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* | 22.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:* | 22.1.3 | Vulnerable | Oracle |
- cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:* Versions before 21.1 Vulnerable ·pypa
- cpe:2.3:a:oracle:agile_product_lifecycle_management:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:* Versions 22.1.3 Vulnerable ·Oracle
Remediation
- Fix · GHSA-5xp3-jfq3-5q8x pip (PyPI) Fixed in 21.1 Advisory →
Red Hat 4 advisories
- RHSA-2021:4160 Released 2021-11-09 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat CodeReady Linux Builder (v. 8) Cython-0.29.21-5.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pybind11-2.6.1-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9 +33
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- RHSA-2021:4455 Released 2021-11-09 · Red Hat rating Lowpython-pip security update
- Red Hat Enterprise Linux AppStream (v. 8) python3-pip-9.0.3-20.el8
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-pip-9.0.3-20.el8, python-pip-9.0.3-20.el8, python3-pip-wheel-9.0.3-20.el8
- RHSA-2021:4162 Released 2021-11-09 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
Show 1 more Red Hat advisories
- RHSA-2021:3254 Released 2021-08-24 · Red Hat rating Moderaterh-python38 security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | — |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:4160, RHSA-2021:4162 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4160, RHSA-2021:4162, RHSA-2021:4455 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:4455 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3254 |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3572
- 2026-10-03 Alias added: GHSA-5xp3-jfq3-5q8x
- 2026-10-08 CISA SSVC decision points changed
- 2026-11-07 Affected versions changed · Red Hat
References
Patch 3
Advisory 2
Other 8
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://github.com/pypa/pip/pull/9827
- https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b
- https://access.redhat.com/errata/RHSA-2021:3254
- https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2021-437.yaml
- https://github.com/pypa/pip
- https://packetstormsecurity.com/files/162712/USN-4961-1.txt
- https://security.netapp.com/advisory/ntap-20240621-0006
Sources
- CVE-2021-3572 · CVE Program
- CVE-2021-3572 · NVD
- FIRST EPSS
- GHSA-5xp3-jfq3-5q8x · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3572 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences