Skip to content
VulniPulse
Sign in
Advisory severityMedium4.5Vendor: LowRed Hat Linux

Medium [CVE-2021-3572] flaw was found in python-pip in the way it handled Unicode separators in git references

This medium-severity Red Hat Linux advisory covers CVE-2021-3572 affecting Red Hat Enterprise Linux 8, Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS, Red Hat Enterprise Linux 9.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2021-3572 Source published Source updated

VulniPulse record published

CVE-2021-3572
Affected products & platforms
Red Hat LinuxRed Hat Enterprise Linux
Open source advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository.

The highest threat from this vulnerability is to data integrity. This flaw has been rated as having a security impact of Low.

To exploit this flaw, the attacker needs access to the repository to create a specially crafted tag and force a different revision to be installed. Red Hat severity: Low — CVSS 4.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N).

Weakness: CWE-20. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Software Collections for Red Hat Enterprise Linux 7; Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9.

Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2021:4160, RHSA-2021:4162, RHSA-2021:4455, RHSA-2021:3254.

Affected products named by the advisory: Red Hat package: python-pip; Red Hat package: python-virtualenv.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Fixed versions
  • 21.1
  • python39:3.9-8050020210811100211.d428a79b
  • python39-devel:3.9-8050020210811100211.d428a79b
  • python38:3.8-8050020210811101222.e3d35cca
  • python38-devel:3.8-8050020210811101222.e3d35cca
  • python-pip-0:9.0.3-20.el8
  • rh-python38-babel-0:2.7.0-12.el7
  • rh-python38-python-0:3.8.11-2.el7
  • rh-python38-python-cryptography-0:2.8-5.el7
  • rh-python38-python-jinja2-0:2.10.3-6.el7
  • rh-python38-python-lxml-0:4.4.1-7.el7
  • rh-python38-python-pip-0:19.3.1-2.el7
  • rh-python38-python-urllib3-0:1.25.7-7.el7
  • RHSA-2021:4160
  • RHSA-2021:4162
  • RHSA-2021:4455
  • RHSA-2021:3254

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Mitigation

Upgrade to a fixed release: 21.1, python39:3.9-8050020210811100211.d428a79b, python39-devel:3.9-8050020210811100211.d428a79b, python38:3.8-8050020210811101222.e3d35cca, python38-devel:3.8-8050020210811101222.e3d35cca, python-pip-0:9.0.3-20.el8. That is the remediation for this advisory.

The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.

Official advisory · high-confidence parse· fetched 6 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.