CVE-2021-3572

Medium

Published: —Translated: 06/07/2026(UTC)NVD NIST

Summary

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could use this issue to install a different revision on a repository, threatening data integrity. The issue is fixed in version 21.1.

Risk Assessment

The organization is at risk of downloading an unauthorized revision of code from a git repository, which could lead to data integrity breaches and potential injection of malicious code.

Recommendation

Immediately upgrade python-pip to version 21.1 or later. Verify the integrity of downloaded packages and use trusted sources.

Original NVD description (English source)

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.