CVE catalog

CVE-2021-3572

python-pip: CVE-2021-3572

[CVE catalog]

Severity
Medium · CVSS 5.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.83% · Oct 25, 2026

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-pipsid26.2.2+dfsg-1fixed
Debianpython-pipforky26.2.2+dfsg-1fixed
Debianpython-piptrixie25.1.1+dfsg-1fixed
Debianpython-pipbookworm23.0.1+dfsg-1fixed
CpepipNot reported21.1fixed
Cpeagile_product_lifecycle_managementNot reportedNot reportedunknown
Cpecommunications_cloud_native_core_network_function_cloud_native_environmentNot reportedNot reportedunknown
Cpecommunications_cloud_native_core_policyNot reportedNot reportedunknown
Ubuntupython-pippro9.0.1-2vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.1vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.2vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.3vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.4vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.5vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.5+esm2fixed
Susepython3linux enterprise micro 5.23.6.15-150300.10.21.1fixed
Susepython3-corelinux enterprise micro 5.23.6.15-150300.10.21.1fixed
Opensusepython36tumbleweed3.6.15-10.1fixed
Susepython-piplinux enterprise module for basesystem 15 sp220.0.2-6.15.1fixed
Susepython-piplinux enterprise module for basesystem 15 sp320.0.2-6.15.1fixed
Susepython-piplinux enterprise module for python 2 15 sp220.0.2-6.15.1fixed
Susepython-piplinux enterprise module for python 2 15 sp320.0.2-6.15.1fixed
Opensusepython39-pipleap 15.320.2.4-7.8.1fixed
Susepythonlinux enterprise module for basesystem 15 sp32.7.18-150000.38.1fixed
Susepython-baselinux enterprise module for basesystem 15 sp32.7.18-150000.38.2fixed
Susepythonlinux enterprise module for desktop applications 15 sp32.7.18-150000.38.1fixed
Susepythonlinux enterprise module for python 2 15 sp32.7.18-150000.38.1fixed
Susepython-baselinux enterprise module for python 2 15 sp32.7.18-150000.38.2fixed
Susepythonlinux enterprise real time 15 sp22.7.18-150000.38.1fixed
Susepython-baselinux enterprise real time 15 sp22.7.18-150000.38.2fixed
Susepython39linux enterprise module for basesystem 15 sp33.9.10-150300.4.8.2fixed
Susepython39-corelinux enterprise module for basesystem 15 sp33.9.10-150300.4.8.1fixed
Susepython39-corelinux enterprise module for development tools 15 sp33.9.10-150300.4.8.1fixed
Opensusepython39leap 15.33.9.10-150300.4.8.2fixed
Opensusepython39-coreleap 15.33.9.10-150300.4.8.1fixed
Opensusepython39-documentationleap 15.33.9.10-150300.4.8.1fixed
Opensusepython39leap 15.43.9.10-150300.4.8.2fixed
Opensusepython39-coreleap 15.43.9.10-150300.4.8.1fixed
Opensusepython39-documentationleap 15.43.9.10-150300.4.8.1fixed
Susepython-pipopenstack cloud 99.0.1-4.6.1fixed
Susepython-pipopenstack cloud crowbar 99.0.1-4.6.1fixed
Susepython36-piplinux enterprise server 12 sp520.2.4-8.9.1fixed
Susepython36-piplinux enterprise server for sap applications 12 sp520.2.4-8.9.1fixed
Susepython3linux enterprise module for web and scripting 123.4.10-25.88.1fixed
Susepython3-baselinux enterprise module for web and scripting 123.4.10-25.88.1fixed
Susepython3linux enterprise software development kit 12 sp53.4.10-25.88.1fixed
Susepython3-baselinux enterprise software development kit 12 sp53.4.10-25.88.1fixed
Susepython3linux enterprise server 12 sp53.4.10-25.88.1fixed
Susepython3-baselinux enterprise server 12 sp53.4.10-25.88.1fixed
Susepython3linux enterprise server for sap applications 12 sp53.4.10-25.88.1fixed
Susepython3-baselinux enterprise server for sap applications 12 sp53.4.10-25.88.1fixed
Opensusepython-pipleap 15.320.0.2-6.15.1fixed
Ubuntupython-pippro9.0.1-2vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.1vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.2vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.3vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.4vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.5vulnerable
Ubuntupython-pippro9.0.1-2.3~ubuntu1.18.04.5+esm2fixed
Susepython39-piplinux enterprise module for basesystem 15 sp320.2.4-7.8.1fixed
Susepython-piphpe helion openstack 89.0.1-3.6.1fixed
Susepython-pipopenstack cloud 89.0.1-3.6.1fixed
Susepython-pipopenstack cloud crowbar 89.0.1-3.6.1fixed
Susepython3linux enterprise module for basesystem 15 sp33.6.15-150300.10.21.1fixed
Susepython3-corelinux enterprise module for basesystem 15 sp33.6.15-150300.10.21.1fixed
Susepython3-corelinux enterprise module for development tools 15 sp33.6.15-150300.10.21.1fixed
Opensusepython3leap 15.33.6.15-150300.10.21.1fixed
Opensusepython3-coreleap 15.33.6.15-150300.10.21.1fixed
Opensusepython3-documentationleap 15.33.6.15-150300.10.21.1fixed
Susepython36-corelinux enterprise software development kit 12 sp53.6.15-21.4fixed
Susepython36linux enterprise server 12 sp53.6.15-21.5fixed
Susepython36-corelinux enterprise server 12 sp53.6.15-21.4fixed
Susepython36linux enterprise server for sap applications 12 sp53.6.15-21.5fixed
Susepython36-corelinux enterprise server for sap applications 12 sp53.6.15-21.4fixed
Opensusepythonleap 15.32.7.18-150000.38.1fixed
Opensusepython-baseleap 15.32.7.18-150000.38.2fixed
Opensusepython-docleap 15.32.7.18-150000.38.1fixed
Opensusepython-pip-wheelleap 15.310.0.1-3.9.1fixed
Susepython-piplinux enterprise module for public cloud 1210.0.1-13.6.1fixed
Opensusepythontumbleweed2.7.18-18.1fixed
Opensusepython-pipleap 15.210.0.1-lp152.4.9.1fixed
Opensusepython-pip-wheelleap 15.210.0.1-lp152.4.9.1fixed
Susepython-pip-wheellinux enterprise module for basesystem 15 sp310.0.1-3.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-pipsourcesid20.3.4-2not yet assignedNot reportedNot reported
Debianpython-pipsourceforky20.3.4-2not yet assignedNot reportedNot reported
Debianpython-pipsourcetrixie20.3.4-2not yet assignedNot reportedNot reported
Debianpython-pipsourcebookworm20.3.4-2not yet assignedNot reportedNot reported
CpepipcpeNot reported21.1Not reportedNVD-CVE-2021-3572Not reported
Ubuntupython-pipdebpro9.0.1-2.3~ubuntu1.18.04.5+esm2Not reportedUSN-4961-2Not reported
Susepython3rpmlinux enterprise micro 5.23.6.15-150300.10.21.1Not reportedSUSE-SU-2022:0942-2Not reported
Susepython3-corerpmlinux enterprise micro 5.23.6.15-150300.10.21.1Not reportedSUSE-SU-2022:0942-2Not reported
Opensusepython36rpmtumbleweed3.6.15-10.1Not reportedOPENSUSE-SU-2024:11878-1Not reported
Susepython-piprpmlinux enterprise module for basesystem 15 sp220.0.2-6.15.1Not reportedSUSE-SU-2021:4001-1Not reported
Susepython-piprpmlinux enterprise module for basesystem 15 sp320.0.2-6.15.1Not reportedSUSE-SU-2021:4001-1Not reported
Susepython-piprpmlinux enterprise module for python 2 15 sp220.0.2-6.15.1Not reportedSUSE-SU-2021:4001-1Not reported
Susepython-piprpmlinux enterprise module for python 2 15 sp320.0.2-6.15.1Not reportedSUSE-SU-2021:4001-1Not reported
Opensusepython39-piprpmleap 15.320.2.4-7.8.1Not reportedOPENSUSE-SU-2022:0064-1Not reported
Susepythonrpmlinux enterprise module for basesystem 15 sp32.7.18-150000.38.1Not reportedSUSE-SU-2022:1091-1Not reported
Susepython-baserpmlinux enterprise module for basesystem 15 sp32.7.18-150000.38.2Not reportedSUSE-SU-2022:1091-1Not reported
Susepythonrpmlinux enterprise module for desktop applications 15 sp32.7.18-150000.38.1Not reportedSUSE-SU-2022:1091-1Not reported
Susepythonrpmlinux enterprise module for python 2 15 sp32.7.18-150000.38.1Not reportedSUSE-SU-2022:1091-1Not reported
Susepython-baserpmlinux enterprise module for python 2 15 sp32.7.18-150000.38.2Not reportedSUSE-SU-2022:1091-1Not reported
Susepythonrpmlinux enterprise real time 15 sp22.7.18-150000.38.1Not reportedSUSE-SU-2022:1091-1Not reported
Susepython-baserpmlinux enterprise real time 15 sp22.7.18-150000.38.2Not reportedSUSE-SU-2022:1091-1Not reported
Susepython39rpmlinux enterprise module for basesystem 15 sp33.9.10-150300.4.8.2Not reportedSUSE-SU-2022:1485-1Not reported
Susepython39-corerpmlinux enterprise module for basesystem 15 sp33.9.10-150300.4.8.1Not reportedSUSE-SU-2022:1485-1Not reported
Susepython39-corerpmlinux enterprise module for development tools 15 sp33.9.10-150300.4.8.1Not reportedSUSE-SU-2022:1485-1Not reported
Opensusepython39rpmleap 15.33.9.10-150300.4.8.2Not reportedSUSE-SU-2022:1485-1Not reported
Opensusepython39-corerpmleap 15.33.9.10-150300.4.8.1Not reportedSUSE-SU-2022:1485-1Not reported
Opensusepython39-documentationrpmleap 15.33.9.10-150300.4.8.1Not reportedSUSE-SU-2022:1485-1Not reported
Opensusepython39rpmleap 15.43.9.10-150300.4.8.2Not reportedSUSE-SU-2022:1485-1Not reported
Opensusepython39-corerpmleap 15.43.9.10-150300.4.8.1Not reportedSUSE-SU-2022:1485-1Not reported
Opensusepython39-documentationrpmleap 15.43.9.10-150300.4.8.1Not reportedSUSE-SU-2022:1485-1Not reported
Susepython-piprpmopenstack cloud 99.0.1-4.6.1Not reportedSUSE-SU-2021:2304-1Not reported
Susepython-piprpmopenstack cloud crowbar 99.0.1-4.6.1Not reportedSUSE-SU-2021:2304-1Not reported
Susepython36-piprpmlinux enterprise server 12 sp520.2.4-8.9.1Not reportedSUSE-SU-2022:0060-1Not reported
Susepython36-piprpmlinux enterprise server for sap applications 12 sp520.2.4-8.9.1Not reportedSUSE-SU-2022:0060-1Not reported
Susepython3rpmlinux enterprise module for web and scripting 123.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Susepython3-baserpmlinux enterprise module for web and scripting 123.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Susepython3rpmlinux enterprise software development kit 12 sp53.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Susepython3-baserpmlinux enterprise software development kit 12 sp53.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Susepython3rpmlinux enterprise server 12 sp53.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp53.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp53.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp53.4.10-25.88.1Not reportedSUSE-SU-2022:1044-1Not reported
Opensusepython-piprpmleap 15.320.0.2-6.15.1Not reportedOPENSUSE-SU-2021:4001-1Not reported
Ubuntupython-pipdebpro9.0.1-2.3~ubuntu1.18.04.5+esm2Not reportedUBUNTU-CVE-2021-3572Not reported
Susepython39-piprpmlinux enterprise module for basesystem 15 sp320.2.4-7.8.1Not reportedSUSE-SU-2022:0064-1Not reported
Susepython-piprpmhpe helion openstack 89.0.1-3.6.1Not reportedSUSE-SU-2021:2441-1Not reported
Susepython-piprpmopenstack cloud 89.0.1-3.6.1Not reportedSUSE-SU-2021:2441-1Not reported
Susepython-piprpmopenstack cloud crowbar 89.0.1-3.6.1Not reportedSUSE-SU-2021:2441-1Not reported
Susepython3rpmlinux enterprise module for basesystem 15 sp33.6.15-150300.10.21.1Not reportedSUSE-SU-2022:0942-1Not reported
Susepython3-corerpmlinux enterprise module for basesystem 15 sp33.6.15-150300.10.21.1Not reportedSUSE-SU-2022:0942-1Not reported
Susepython3-corerpmlinux enterprise module for development tools 15 sp33.6.15-150300.10.21.1Not reportedSUSE-SU-2022:0942-1Not reported
Opensusepython3rpmleap 15.33.6.15-150300.10.21.1Not reportedOPENSUSE-SU-2022:0942-1Not reported
Opensusepython3-corerpmleap 15.33.6.15-150300.10.21.1Not reportedOPENSUSE-SU-2022:0942-1Not reported
Opensusepython3-documentationrpmleap 15.33.6.15-150300.10.21.1Not reportedOPENSUSE-SU-2022:0942-1Not reported
Susepython36-corerpmlinux enterprise software development kit 12 sp53.6.15-21.4Not reportedSUSE-SU-2022:1094-1Not reported
Susepython36rpmlinux enterprise server 12 sp53.6.15-21.5Not reportedSUSE-SU-2022:1094-1Not reported
Susepython36-corerpmlinux enterprise server 12 sp53.6.15-21.4Not reportedSUSE-SU-2022:1094-1Not reported
Susepython36rpmlinux enterprise server for sap applications 12 sp53.6.15-21.5Not reportedSUSE-SU-2022:1094-1Not reported
Susepython36-corerpmlinux enterprise server for sap applications 12 sp53.6.15-21.4Not reportedSUSE-SU-2022:1094-1Not reported
Opensusepythonrpmleap 15.32.7.18-150000.38.1Not reportedOPENSUSE-SU-2022:1091-1Not reported
Opensusepython-baserpmleap 15.32.7.18-150000.38.2Not reportedOPENSUSE-SU-2022:1091-1Not reported
Opensusepython-docrpmleap 15.32.7.18-150000.38.1Not reportedOPENSUSE-SU-2022:1091-1Not reported
Opensusepython-pip-wheelrpmleap 15.310.0.1-3.9.1Not reportedOPENSUSE-SU-2021:4002-1Not reported
Susepython-piprpmlinux enterprise module for public cloud 1210.0.1-13.6.1Not reportedSUSE-SU-2021:4051-1Not reported
Opensusepythonrpmtumbleweed2.7.18-18.1Not reportedOPENSUSE-SU-2024:11877-1Not reported
Opensusepython-piprpmleap 15.210.0.1-lp152.4.9.1Not reportedOPENSUSE-SU-2021:1598-1Not reported
Opensusepython-pip-wheelrpmleap 15.210.0.1-lp152.4.9.1Not reportedOPENSUSE-SU-2021:1598-1Not reported
Susepython-pip-wheelrpmlinux enterprise module for basesystem 15 sp310.0.1-3.9.1Not reportedSUSE-SU-2021:4002-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [python-pip]

    Details (2)
    • 23.0.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · bookworm; dsa · python-pip · debian · 12

    • 23.0.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · bookworm; dsa · python-pip · debian · 12

  • Source package: [python-pip]

    Details (2)
    • 23.0.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · bookworm; dsa · python-pip · debian · 12

    • 23.0.1+dfsg-1 · all · bookworm

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · bookworm; dsa · python-pip · debian · 12

[Debian 13 (Trixie)]

  • Source package: [python-pip]

    Details (2)
    • 25.1.1+dfsg-1 · all · trixie

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · 13

    • 25.1.1+dfsg-1 · all · trixie

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · 13

  • Source package: [python-pip]

    Details (2)
    • 25.1.1+dfsg-1 · all · trixie

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · 13

    • 25.1.1+dfsg-1 · all · trixie

      Fixed · Fixed: 20.3.4-2

      dsa · python-pip · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]