CVE-2023-5752

Al instalar un paquete desde una URL de Mercurial VCS (es decir, "pip install hg+...") con pip anterior a v23.3, la revisión de Mercurial especificada podría usarse para inyectar opciones de configuración arbitrarias a la llamada "hg clone" (es decir, " --config”). Controlar la configuración de Mercurial puede modificar cómo y qué repositorio se instala. Esta vulnerabilidad no afecta a los usuarios que no instalan desde Mercurial.

A flaw was found in the Python pip package. The pip could allow a local authenticated attacker to bypass security restrictions due to a flaw when installing a package from a Mercurial VCS URL. By sending a specially crafted request, an attacker can inject arbitrary configuration options to the "hg clone" call to modify how and which repository is installed.

An update is now available for Red Hat Ansible Automation Platform 2.4. Issues addressed include HTTP request smuggling, buffer overflow, code execution, cross site scripting, denial of service, memory exhaustion, null pointer, and password leak vulnerabilities.