Package: pipenv Version: 2024.0.1+ds-3 Severity: important Tags: security X-Debbugs-Cc: Debian Security Team <[email protected]>
Dear Maintainer, I noticed that pipenv is indirectly affected by the eMudhra CA compromise. In an empty directory I created a fresh Pipenv by installing a random package: $ pipenv install pyyaml $ pipenv --venv /home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8 This now creates a new pipenv and seeds it with a vulnerable pip version: $ pipenv run pip3 --version pip 25.1.1 from /home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8/lib/python3.13/site-packages/pip (python 3.13) The compromised certificates are located in the file: /home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8/lib/python3.13/site-packages/pip/_vendor/certifi/cacert.pem Namely, certificates with these sha256 fingerprints are still included: D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B I can work around that issue by explicitly installing a newer pip version, e.g., $ pipenv install pip $ pipenv run pip3 --version pip 26.2.2 from /home/steiny/.local/share/virtualenvs/tmp-3dZbUrH8/lib/python3.13/site-packages/pip (python 3.13) So, the version of pip seeded into a fresh Pipenv should be updated. Best, Maximilian -- System Information: Debian Release: 13.7 APT prefers stable-security APT policy: (990, 'stable-security'), (990, 'stable'), (100, 'stable-updates') Architecture: amd64 (x86_64) Kernel: Linux 6.12.113+deb13-amd64 (SMP w/16 CPU threads; PREEMPT) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages pipenv depends on: ii python3 3.13.5-1 ii python3-certifi 2025.1.31+ds-1 ii python3-pkg-resources 78.1.1-0.1 ii python3-virtualenv 20.31.2+ds-1+deb13u1 pipenv recommends no packages. pipenv suggests no packages. -- no debconf information
