CVE-2023-5752

描述

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

如何修補 CVE-2023-5752

要修補 CVE-2023-5752,請將受影響套件升級到下列已修補版本。

• —升級至 20.3.4-4+deb11u2 或更新版本
• —升級至 20.3.4-4+deb11u2 或更新版本
• —升級至 23.3 或更新版本
• —升級至 23.3 或更新版本

CVE-2023-5752 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 20.3.4-4+deb11u2
• from 0, < 20.3.4-4+deb11u2
• from 0, < 23.3
• from 0, < 23.3

CVSS 分數

參考連結(15)

• ADVISORYgithub.com/advisories/GHSA-mq26-g339-26xf
• ADVISORYmail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-5752
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2023-5752