CVE-2023-5752

Name	CVE-2023-5752
Description	When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4348-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-pip (PTS)	bullseye	20.3.4-4+deb11u1	vulnerable
	bullseye (security)	20.3.4-4+deb11u2	fixed
	bookworm	23.0.1+dfsg-1	vulnerable
	trixie	25.1.1+dfsg-1	fixed
	forky	25.2+dfsg-1	fixed
	sid	25.3+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-pip	source	bullseye	20.3.4-4+deb11u2		DLA-4348-1
python-pip	source	(unstable)	23.3+dfsg-1

Notes

[bookworm] - python-pip <no-dsa> (Minor issue)
[buster] - python-pip <no-dsa> (Minor issue)
https://github.com/pypa/pip/pull/12119 (23.2)
https://github.com/pypa/pip/pull/12306 (23.3)
https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/