Jiaying Song 53801adf75 python3-pip: fix CVE-2023-5752 ...

When installing a package from a Mercurial VCS URL (ie "pip install
hg+...") with pip prior to v23.3, the specified Mercurial revision could
be used to inject arbitrary configuration options to the "hg clone" call
(ie "--config"). Controlling the Mercurial configuration can modify how
and which repository is installed. This vulnerability does not affect
users who aren't installing from Mercurial.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-5752

Upstream patches:
https://github.com/pypa/pip/pull/12306/commits/389cb799d0da9a840749fcd14878928467ed49b4

(From OE-Core rev: 862c0338fba06077a26c775b49f993eac63762c9)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

2024-12-02 06:23:20 -08:00

..

0001-change-shebang-to-python3.patch

…

CVE-2023-5752.patch

python3-pip: fix CVE-2023-5752

2024-12-02 06:23:20 -08:00

no_shebang_mangling.patch

…

reproducible.patch

…