CVE-2021-3572 log

Source	CVE Red Hat MITRE NVD Debian Ubuntu SUSE Alpine Mageia CVE Details CIRCL Bugs Arch Linux Red Hat Gentoo SUSE GitHub Lists oss-security full-disclosure bugtraq Misc GitHub code web search
Severity	Medium
Remote	Yes
Type	Silent downgrade
Description	A security issue has been found in pip before version 21.1. Maliciously formatted tags could be used to hijack a commit-based pin. Using the fact that all of unicode's whitespace characters were allowed as separators - which git allows as a part of a tag name - it is possible to force a different revision to be installed if an attacker gains access to the repository.

Group	Package	Affected	Fixed	Severity	Status	Ticket
AVG-2036	python-pip	20.3.4-4	21.0-1	Medium	Fixed

References
https://github.com/pypa/pip/pull/9827 https://github.com/pypa/pip/commit/ca832b2836e0bffa7cf95589acdcd71230f5834e