From: Hetvi Thakar <[email protected]> Analysis: - NVD marks CVE-2018-20225 as disputed. [1] - pip searches all configured package indexes without priority and selects the highest matching version. --extra-index-url adds an equal-priority package source. [2] - Exploitation requires use of --extra-index-url and an attacker-published, higher-version package with the name of a private package. [1] - Upstream closed the related report as not planned, and Red Hat classified the issue as WONTFIX because this behavior is intentional. [3][4] - Record the disputed status; no source patch is available.
Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2018-20225 [2] https://pip.pypa.io/en/stable/cli/pip_install/ [3] https://github.com/pypa/pip/issues/12874 [4] https://bugzilla.redhat.com/show_bug.cgi?id=1835736 Signed-off-by: Hetvi Thakar <[email protected]> --- meta/recipes-devtools/python/python3-pip_26.0.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-devtools/python/python3-pip_26.0.1.bb b/meta/recipes-devtools/python/python3-pip_26.0.1.bb index 1a2cbc397a..46fa63e6a6 100644 --- a/meta/recipes-devtools/python/python3-pip_26.0.1.bb +++ b/meta/recipes-devtools/python/python3-pip_26.0.1.bb @@ -34,6 +34,8 @@ SRC_URI[sha256sum] = "c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b29661 CVE_PRODUCT = "pypa:pip" +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes" + do_install:append(){ # pip vendors distlib which ships Windows launcher templates (*.exe). # Keep them only when building for a Windows (mingw) host. -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245240): https://lists.openembedded.org/g/openembedded-core/message/245240 Mute This Topic: https://lists.openembedded.org/mt/121125677/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
