Repository navigation
python:3.11-slim-bookworm CVE-2023-5752 #889
Description
| Library | Vulnerability | Severity | Status | Installed Version | Fixed Version | Title |
|---|---|---|---|---|---|---|
| pip (METADATA) | CVE-2023-5752 | MEDIUM | fixed | 23.2.1 | 23.3 | pip: Mercurial configuration injectable in repo revision when installing via pip Link |
Activity
[-]CVE-2023-5752[/-][+]python:3.11-slim-bookworm CVE-2023-5752[/+]LaurentGoderre commentedon Dec 4, 2023
Need to be updated here: https://github.com/python/cpython/blob/9560e0d6d7a316341939b4016e47e03bd5bf17c3/Lib/ensurepip/__init__.py#L13
LaurentGoderre commentedon Dec 4, 2023
python/cpython#112517
trottomv commentedon Dec 5, 2023
Hi @LaurentGoderre
Is it not necessary to modify the pip version here as well?
python/3.11/slim-bookworm/Dockerfile
Line 137 in 8bc80d1
(and in the "not slim" bookworm also)
python/3.11/bookworm/Dockerfile
Line 103 in 8bc80d1
LaurentGoderre commentedon Dec 5, 2023
@trottomv that version is derived from the location I pointed to in the update script.
rv0lt commentedon Jan 12, 2024
As far as I am aware, that issue is only going to be fixed in python 3.13 (currently in alpha). The maintainers decided against back porting to previous versions
python/cpython#112719
edmorley commentedon Aug 24, 2024
As filed, this issue is now resolved since the Python 3.11 images now ship with pip 24.0:
python/versions.json
Lines 24 to 32 in cc2cf19
Images for older Python versions do still include older pip, but that's by design (since these Docker images intentionally ship with the same pip version that is bundled with the
ensurepipmodule for that Python version).As such, this issue can be closed.