CVE-2018-20225

Katalog CVE

CVSS 7.8 · High EPSS 1,8%

Kerentanan Improper Input Validation pada pypa pip. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Rincian

Terbit di NVD

8 Mei 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://pip.pypa.io/en/stable/news/ release notes · advisory vendor
• https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=1835736
• https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arr...