From: Hetvi Thakar <[email protected]> Analysis: - NVD marks CVE-2018-20225 as disputed. [1] - pip searches all configured package indexes without priority and selects the highest matching version. --extra-index-url adds an equal-priority package source. [2] - Exploitation requires use of --extra-index-url and an attacker-published, higher-version package with the name of a private package. [1] - Upstream closed the related report as not planned, and Red Hat classified the issue as WONTFIX because this behavior is intentional. [3][4] - Record the disputed status; no source patch is available.
Reference: [1] https://nvd.nist.gov/vuln/detail/CVE-2018-20225 [2] https://pip.pypa.io/en/stable/cli/pip_install/ [3] https://github.com/pypa/pip/issues/12874 [4] https://bugzilla.redhat.com/show_bug.cgi?id=1835736 Signed-off-by: Hetvi Thakar <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- meta/recipes-devtools/python/python3-pip_24.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-devtools/python/python3-pip_24.0.bb b/meta/recipes-devtools/python/python3-pip_24.0.bb index d535e1f53d7..709ec9f2b6c 100644 --- a/meta/recipes-devtools/python/python3-pip_24.0.bb +++ b/meta/recipes-devtools/python/python3-pip_24.0.bb @@ -45,6 +45,7 @@ do_install:append() { } CVE_PRODUCT = "pypa:pip" +CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes" do_install:append(){ # pip vendors distlib which ships Windows launcher templates (*.exe).
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#246466): https://lists.openembedded.org/g/openembedded-core/message/246466 Mute This Topic: https://lists.openembedded.org/mt/121389735/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
