diff options
| author | Jiaying Song <jiaying.song.cn@windriver.com> | 2024-11-25 15:46:11 +0800 |
|---|---|---|
| committer | Steve Sakoman <steve@sakoman.com> | 2024-12-02 06:23:20 -0800 |
| commit | 53801adf752419eb84504f007af4fdbe0cd43ce1 (patch) | |
| tree | 11c9f1717a91fef5800d9d6b50a263ebff215ec2 /scripts/lib | |
| parent | 4ec499266e90c103f8b764c4c998eb0302e11fc1 (diff) | |
| download | poky-53801adf752419eb84504f007af4fdbe0cd43ce1.tar.gz | |
python3-pip: fix CVE-2023-5752
When installing a package from a Mercurial VCS URL (ie "pip install
hg+...") with pip prior to v23.3, the specified Mercurial revision could
be used to inject arbitrary configuration options to the "hg clone" call
(ie "--config"). Controlling the Mercurial configuration can modify how
and which repository is installed. This vulnerability does not affect
users who aren't installing from Mercurial.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-5752
Upstream patches:
https://github.com/pypa/pip/pull/12306/commits/389cb799d0da9a840749fcd14878928467ed49b4
(From OE-Core rev: 862c0338fba06077a26c775b49f993eac63762c9)
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'scripts/lib')
0 files changed, 0 insertions, 0 deletions