CVE-2021-3572 Improper Input Validation in pip
A remote attacker can install a different repository revision by exploiting Unicode separator handling in git references, compromising data integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-3572?
CVE-2021-3572 is a medium-severity vulnerability in Oracle Agile Product Lifecycle Management, published on 10 Nov 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.
Weakness: CWE-20
Which versions are affected by CVE-2021-3572?
3 open source packages ship an affected version, including pip. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
pip PyPI | All versions | 21.1 |
pip PyPI | All versions | 21.1 |
pip PyPI | All versions | 21.1 |
Linux distribution packages (37)
python3-pip AlmaLinux:8 | All versions | 9.0.3-20.el8 |
python3-pip Red Hat:enterprise_linux:8::appstream | All versions | 0:9.0.3-20.el8 |
platform-python-pip Red Hat:enterprise_linux:8::baseos | All versions | 0:9.0.3-20.el8 |
python-pip Red Hat:enterprise_linux:8::baseos | All versions | 0:9.0.3-20.el8 |
python3-pip-wheel Red Hat:enterprise_linux:8::baseos | All versions | 0:9.0.3-20.el8 |
python-pip SUSE:HPE Helion OpenStack 8 | All versions | 9.0.1-3.6.1 |
python3 SUSE:Linux Enterprise Micro 5.2 | All versions | 3.6.15-150300.10.21.1 |
python3-core SUSE:Linux Enterprise Micro 5.2 | All versions | 3.6.15-150300.10.21.1 |
python-pip SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 20.0.2-6.15.1 |
python-pip SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 20.0.2-6.15.1 |
python-pip-wheel SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 10.0.1-3.9.1 |
python3 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 3.6.15-150300.10.21.1 |
python3-core SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 3.6.15-150300.10.21.1 |
python39-pip SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 20.2.4-7.8.1 |
python3-core SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 3.6.15-150300.10.21.1 |
python-pip SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 10.0.1-13.6.1 |
python-pip SUSE:Linux Enterprise Module for Python 2 15 SP2 | All versions | 20.0.2-6.15.1 |
python-pip SUSE:Linux Enterprise Module for Python 2 15 SP3 | All versions | 20.0.2-6.15.1 |
python3 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 3.4.10-25.88.1 |
python3-base SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 3.4.10-25.88.1 |
python3 SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.4.10-25.88.1 |
python3-base SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.4.10-25.88.1 |
python36 SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.15-21.5 |
python36-core SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.15-21.4 |
python36-pip SUSE:Linux Enterprise Server 12 SP5 | All versions | 20.2.4-8.9.1 |
python3 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.4.10-25.88.1 |
python3-base SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.4.10-25.88.1 |
python36 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.6.15-21.5 |
python36-core SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.6.15-21.4 |
python36-pip SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 20.2.4-8.9.1 |
python3 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.4.10-25.88.1 |
python3-base SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.4.10-25.88.1 |
python36-core SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.6.15-21.4 |
python-pip SUSE:OpenStack Cloud 8 | All versions | 9.0.1-3.6.1 |
python-pip SUSE:OpenStack Cloud 9 | All versions | 9.0.1-4.6.1 |
python-pip SUSE:OpenStack Cloud Crowbar 8 | All versions | 9.0.1-3.6.1 |
python-pip SUSE:OpenStack Cloud Crowbar 9 | All versions | 9.0.1-4.6.1 |
Products include Oracle Agile Product Lifecycle Management, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Oracle Communications Cloud Native Core Policy, Pypa Pip.
How do I fix CVE-2021-3572?
Upgrade pip to 21.1 or later.
Is CVE-2021-3572 being exploited?
There is no known exploitation of CVE-2021-3572 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Agile Product Lifecycle Management
- CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization
- CVE-2024-21287 Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization
- CVE-2019-2725 Oracle WebLogic Server, Injection
- CVE-2025-21556 Missing authorization in Oracle Agile PLM Framework
- CVE-2026-71040 Auth bypass in Oracle Agile PLM
All Oracle Agile Product Lifecycle Management vulnerabilities
Sources
Also known as ALSA-2021:4455, AZL-86103, DEBIAN-CVE-2021-3572, GHSA-5xp3-jfq3-5q8x, OESA-2021-1284, PYSEC-2021-437 and 22 more.