VDB
DEBIAN-CVE-2023-5752
DEBIAN-CVE-2023-5752
PUBLISHED
CVSS 3.299999952316284 LOW
When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
Risk Scores
CVSS 3.1
3.299999952316284
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | python-pip | 26.0.1+dfsg-1, 23.0.1+dfsg-1, 23.1.2+dfsg-1 |
| Debian:14 | python-pip | 0, 0, 0 |
| Debian:13 | python-pip | 0, 0, 0 |
| Debian:11 | python-pip | 0, 20.3.4-4, 20.3.4-4 |
Exploit Intelligence
- cve_test.go (github-poc)
- cve_test.go (github-poc)
Timeline
- Oct 25, 2023 CVE Published
- Apr 28, 2026 CVE Updated