CVE-2021-3572 log

Severity Medium
Remote Yes
Type Silent downgrade
A security issue has been found in pip before version 21.1. Maliciously formatted tags could be used to hijack a commit-based pin. Using the fact that all of unicode's whitespace characters were allowed as separators - which git allows as a part of a tag name - it is possible to force a different revision to be installed if an attacker gains access to the repository.
Group Package Affected Fixed Severity Status Ticket
AVG-2036 python-pip 20.3.4-4 21.0-1 Medium Fixed