Vulnerability-Lookup

CVE-2023-5752 (GCVE-0-2023-5752)

Vulnerability from cvelistv5 – Published: 2023-10-24 20:56 – Updated: 2025-11-03 17:31

Title

Mercurial configuration injectable in repo revision when installing via pip

Summary

When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-08 13:38 UTC

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

PSF mitre root

References

8 references

URL	Tags
https://github.com/pypa/pip/pull/12306	patch
https://mail.python.org/archives/list/security-an…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version	CPE status
Pip maintainers	pip	Unaffected: 23.3	guessed

Credits

Paul Gerste

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:31:06.982Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "patch",
              "x_transferred"
            ],
            "url": "https://github.com/pypa/pip/pull/12306"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-5752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-08T13:38:11.134953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-17T14:16:23.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org",
          "defaultStatus": "affected",
          "packageName": "pip",
          "product": "pip",
          "repo": "https://github.com/pypa/pip",
          "vendor": "Pip maintainers",
          "versions": [
            {
              "status": "unaffected",
              "version": "23.3"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Paul Gerste"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When installing a package from a Mercurial VCS URL  (ie \"pip install \nhg+...\") with pip prior to v23.3, the specified Mercurial revision could\n be used to inject arbitrary configuration options to the \"hg clone\" \ncall (ie \"--config\"). Controlling the Mercurial configuration can modify\n how and which repository is installed. This vulnerability does not \naffect users who aren\u0027t installing from Mercurial.\u003cbr\u003e"
            }
          ],
          "value": "When installing a package from a Mercurial VCS URL  (ie \"pip install \nhg+...\") with pip prior to v23.3, the specified Mercurial revision could\n be used to inject arbitrary configuration options to the \"hg clone\" \ncall (ie \"--config\"). Controlling the Mercurial configuration can modify\n how and which repository is installed. This vulnerability does not \naffect users who aren\u0027t installing from Mercurial."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T16:10:12.807Z",
        "orgId": "28c92f92-d60d-412d-b760-e73465c3df22",
        "shortName": "PSF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/pypa/pip/pull/12306"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Mercurial configuration injectable in repo revision when installing via pip",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "28c92f92-d60d-412d-b760-e73465c3df22",
    "assignerShortName": "PSF",
    "cveId": "CVE-2023-5752",
    "datePublished": "2023-10-24T20:56:05.469Z",
    "dateReserved": "2023-10-24T15:04:01.631Z",
    "dateUpdated": "2025-11-03T17:31:06.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-5752",
      "date": "2026-09-15",
      "epss": "0.00476",
      "percentile": "0.39842"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"23.3\", \"matchCriteriaId\": \"349B8FCB-AAFF-42A1-BCDF-D40EF91FC62E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"When installing a package from a Mercurial VCS URL  (ie \\\"pip install \\nhg+...\\\") with pip prior to v23.3, the specified Mercurial revision could\\n be used to inject arbitrary configuration options to the \\\"hg clone\\\" \\ncall (ie \\\"--config\\\"). Controlling the Mercurial configuration can modify\\n how and which repository is installed. This vulnerability does not \\naffect users who aren\u0027t installing from Mercurial.\\n\"}, {\"lang\": \"es\", \"value\": \"Al instalar un paquete desde una URL de Mercurial VCS (es decir, \\\"pip install hg+...\\\") con pip anterior a v23.3, la revisi\\u00f3n de Mercurial especificada podr\\u00eda usarse para inyectar opciones de configuraci\\u00f3n arbitrarias a la llamada \\\"hg clone\\\" (es decir, \\\" --config\\u201d). Controlar la configuraci\\u00f3n de Mercurial puede modificar c\\u00f3mo y qu\\u00e9 repositorio se instala. Esta vulnerabilidad no afecta a los usuarios que no instalan desde Mercurial.\"}]",
      "id": "CVE-2023-5752",
      "lastModified": "2024-11-21T08:42:24.920",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cna@python.org\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\", \"baseScore\": 3.3, \"baseSeverity\": \"LOW\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 1.4}]}",
      "published": "2023-10-25T18:17:44.867",
      "references": "[{\"url\": \"https://github.com/pypa/pip/pull/12306\", \"source\": \"cna@python.org\", \"tags\": [\"Patch\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/\", \"source\": \"cna@python.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/\", \"source\": \"cna@python.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/\", \"source\": \"cna@python.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/\", \"source\": \"cna@python.org\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/\", \"source\": \"cna@python.org\"}, {\"url\": \"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/\", \"source\": \"cna@python.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/pypa/pip/pull/12306\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cna@python.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cna@python.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-77\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-77\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T15:14:42.000Z",
      "cve": "CVE-2023-5752",
      "id": "msrc_CVE-2023-5752",
      "initial_release_date": "2023-10-01T00:00:00.000Z",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Mercurial configuration injectable in repo revision when installing via pip",
      "url": "https://msrc.microsoft.com/csaf/vex/2023/msrc_cve-2023-5752.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-5752\",\"sourceIdentifier\":\"cna@python.org\",\"published\":\"2023-10-25T18:17:44.867\",\"lastModified\":\"2026-06-17T06:49:17.790\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When installing a package from a Mercurial VCS URL  (ie \\\"pip install \\nhg+...\\\") with pip prior to v23.3, the specified Mercurial revision could\\n be used to inject arbitrary configuration options to the \\\"hg clone\\\" \\ncall (ie \\\"--config\\\"). Controlling the Mercurial configuration can modify\\n how and which repository is installed. This vulnerability does not \\naffect users who aren\u0027t installing from Mercurial.\"},{\"lang\":\"es\",\"value\":\"Al instalar un paquete desde una URL de Mercurial VCS (es decir, \\\"pip install hg+...\\\") con pip anterior a v23.3, la revisi\u00f3n de Mercurial especificada podr\u00eda usarse para inyectar opciones de configuraci\u00f3n arbitrarias a la llamada \\\"hg clone\\\" (es decir, \\\" --config\u201d). Controlar la configuraci\u00f3n de Mercurial puede modificar c\u00f3mo y qu\u00e9 repositorio se instala. Esta vulnerabilidad no afecta a los usuarios que no instalan desde Mercurial.\"}],\"affected\":[{\"source\":\"cna@python.org\",\"affectedData\":[{\"vendor\":\"Pip maintainers\",\"product\":\"pip\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://pypi.org\",\"packageName\":\"pip\",\"repo\":\"https://github.com/pypa/pip\",\"versions\":[{\"version\":\"23.3\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cna@python.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-08T13:38:11.134953Z\",\"id\":\"CVE-2023-5752\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cna@python.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"23.3\",\"matchCriteriaId\":\"349B8FCB-AAFF-42A1-BCDF-D40EF91FC62E\"}]}]}],\"references\":[{\"url\":\"https://github.com/pypa/pip/pull/12306\",\"source\":\"cna@python.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/\",\"source\":\"cna@python.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/\",\"source\":\"cna@python.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/\",\"source\":\"cna@python.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/\",\"source\":\"cna@python.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/\",\"source\":\"cna@python.org\"},{\"url\":\"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/\",\"source\":\"cna@python.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/pypa/pip/pull/12306\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T23:18:38+00:00",
      "cve": "CVE-2023-5752",
      "id": "CVE-2023-5752",
      "initial_release_date": "2023-10-25T00:00:00+00:00",
      "product_status:fixed": "8",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "296",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "pip: Mercurial configuration injectable in repo revision when installing via pip",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-5752.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:15:53Z",
      "cve": "CVE-2023-5752",
      "id": "CVE-2023-5752",
      "initial_release_date": "2023-11-22T00:13:49Z",
      "product_status:known_affected": "428",
      "product_status:known_not_affected": "5",
      "product_status:recommended": "55",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-5752",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-5752.json",
      "version": "57"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/pypa/pip/pull/12306\", \"tags\": [\"patch\", \"x_transferred\"]}, {\"url\": \"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T17:31:06.982Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-5752\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-08T13:38:11.134953Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-17T14:16:19.887Z\"}}], \"cna\": {\"title\": \"Mercurial configuration injectable in repo revision when installing via pip\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Paul Gerste\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/pypa/pip\", \"vendor\": \"Pip maintainers\", \"product\": \"pip\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"23.3\"}], \"packageName\": \"pip\", \"collectionURL\": \"https://pypi.org\", \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://github.com/pypa/pip/pull/12306\", \"tags\": [\"patch\"]}, {\"url\": \"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"When installing a package from a Mercurial VCS URL  (ie \\\"pip install \\nhg+...\\\") with pip prior to v23.3, the specified Mercurial revision could\\n be used to inject arbitrary configuration options to the \\\"hg clone\\\" \\ncall (ie \\\"--config\\\"). Controlling the Mercurial configuration can modify\\n how and which repository is installed. This vulnerability does not \\naffect users who aren\u0027t installing from Mercurial.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"When installing a package from a Mercurial VCS URL  (ie \\\"pip install \\nhg+...\\\") with pip prior to v23.3, the specified Mercurial revision could\\n be used to inject arbitrary configuration options to the \\\"hg clone\\\" \\ncall (ie \\\"--config\\\"). Controlling the Mercurial configuration can modify\\n how and which repository is installed. This vulnerability does not \\naffect users who aren\u0027t installing from Mercurial.\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"28c92f92-d60d-412d-b760-e73465c3df22\", \"shortName\": \"PSF\", \"dateUpdated\": \"2024-06-10T16:10:12.807Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-5752\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T17:31:06.982Z\", \"dateReserved\": \"2023-10-24T15:04:01.631Z\", \"assignerOrgId\": \"28c92f92-d60d-412d-b760-e73465c3df22\", \"datePublished\": \"2023-10-24T20:56:05.469Z\", \"assignerShortName\": \"PSF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

RHSA-2024:3781

Vulnerability from csaf_redhat - Published: 2024-06-10 18:41 - Updated: 2026-08-26 16:10

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Severity

Moderate

Scope

20 vulnerabilities in this advisory, including CVE-2023-5752.

CVE-2023-5752

A flaw was found in the Python pip package. The pip could allow a local authenticated attacker to bypass security restrictions due to a flaw when installing a package from a Mercurial VCS URL. By sending a specially crafted request, an attacker can inject arbitrary configuration options to the "hg clone" call to modify how and which repository is installed.

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fixed: 8 products Known not affected: 276 products

https://access.redhat.com/errata/RHSA-2024:3781

Open the full advisory

RHSA-2024_3781

Vulnerability from csaf_redhat - Published: 2024-06-10 18:41 - Updated: 2024-12-18 02:26

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

Severity

Moderate

Scope

20 vulnerabilities in this advisory, including CVE-2023-5752.

CVE-2023-5752

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Fixed: 16 products Known not affected: 308 products

https://access.redhat.com/errata/RHSA-2024:3781

Open the full advisory

SUSE-SU-2023:4987-1

Vulnerability from csaf_suse - Published: 2023-12-28 15:06 - Updated: 2023-12-28 15:06

Summary

Security update for python-pip

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-5752.

CVE-2023-5752

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 4 products

Open the full advisory

SUSE-SU-2023:4988-1

Vulnerability from csaf_suse - Published: 2023-12-28 15:06 - Updated: 2023-12-28 15:06

Summary

Security update for python-pip

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-5752.

CVE-2023-5752

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 4 products

Open the full advisory

SUSE-SU-2024:0892-1

Vulnerability from csaf_suse - Published: 2024-03-14 13:25 - Updated: 2024-03-14 13:25

Summary

Security update for python36-pip

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-5752.

CVE-2023-5752

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 2 products

Open the full advisory

SUSE-SU-2024:3156-1

Vulnerability from csaf_suse - Published: 2024-09-06 10:13 - Updated: 2024-09-06 10:13

Summary

Security update for python312-pip

Severity

Low

Scope

1 vulnerability in this advisory, including CVE-2023-5752.

CVE-2023-5752

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Recommended: 2 products

Open the full advisory

ubuntu-cve-2023-5752

Vulnerability from osv_ubuntu

Published

2023-10-25 18:17

Modified

2025-09-08 16:55

Summary

Details

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

3.3 (Low)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2023-5752	REPORT
	https://github.com/pypa/pip/pull/12306	REPORT
	https://mail.python.org/archives/list/security-an…	REPORT
	https://github.com/advisories/GHSA-mq26-g339-26xf	REPORT
	https://www.cve.org/CVERecord?id=CVE-2023-5752	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-pip",
            "binary_version": "1.5.4-1ubuntu4+esm5"
          },
          {
            "binary_name": "python-pip-whl",
            "binary_version": "1.5.4-1ubuntu4+esm5"
          },
          {
            "binary_name": "python3-pip",
            "binary_version": "1.5.4-1ubuntu4+esm5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "python-pip",
        "purl": "pkg:deb/ubuntu/python-pip@1.5.4-1ubuntu4+esm5?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.1-2",
        "1.5.4-1",
        "1.5.4-1ubuntu1",
        "1.5.4-1ubuntu3",
        "1.5.4-1ubuntu4",
        "1.5.4-1ubuntu4+esm1",
        "1.5.4-1ubuntu4+esm2",
        "1.5.4-1ubuntu4+esm3",
        "1.5.4-1ubuntu4+esm4",
        "1.5.4-1ubuntu4+esm5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-pip",
            "binary_version": "8.1.1-2ubuntu0.6+esm11"
          },
          {
            "binary_name": "python-pip-whl",
            "binary_version": "8.1.1-2ubuntu0.6+esm11"
          },
          {
            "binary_name": "python3-pip",
            "binary_version": "8.1.1-2ubuntu0.6+esm11"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "python-pip",
        "purl": "pkg:deb/ubuntu/python-pip@8.1.1-2ubuntu0.6+esm11?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.6-7ubuntu1",
        "1.5.6-7ubuntu2",
        "8.0.2-7",
        "8.0.3-1",
        "8.0.3-2",
        "8.1.0-1",
        "8.1.0-2",
        "8.1.1-1",
        "8.1.1-2",
        "8.1.1-2ubuntu0.1",
        "8.1.1-2ubuntu0.2",
        "8.1.1-2ubuntu0.4",
        "8.1.1-2ubuntu0.6",
        "8.1.1-2ubuntu0.6+esm2",
        "8.1.1-2ubuntu0.6+esm3",
        "8.1.1-2ubuntu0.6+esm4",
        "8.1.1-2ubuntu0.6+esm5",
        "8.1.1-2ubuntu0.6+esm6",
        "8.1.1-2ubuntu0.6+esm8",
        "8.1.1-2ubuntu0.6+esm10",
        "8.1.1-2ubuntu0.6+esm11"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-pip",
            "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm7"
          },
          {
            "binary_name": "python-pip-whl",
            "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm7"
          },
          {
            "binary_name": "python3-pip",
            "binary_version": "9.0.1-2.3~ubuntu1.18.04.8+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "python-pip",
        "purl": "pkg:deb/ubuntu/python-pip@9.0.1-2.3~ubuntu1.18.04.8+esm7?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.1-2",
        "9.0.1-2.3~ubuntu1",
        "9.0.1-2.3~ubuntu1.18.04.1",
        "9.0.1-2.3~ubuntu1.18.04.2",
        "9.0.1-2.3~ubuntu1.18.04.3",
        "9.0.1-2.3~ubuntu1.18.04.4",
        "9.0.1-2.3~ubuntu1.18.04.5",
        "9.0.1-2.3~ubuntu1.18.04.5+esm2",
        "9.0.1-2.3~ubuntu1.18.04.5+esm3",
        "9.0.1-2.3~ubuntu1.18.04.6",
        "9.0.1-2.3~ubuntu1.18.04.6+esm1",
        "9.0.1-2.3~ubuntu1.18.04.7",
        "9.0.1-2.3~ubuntu1.18.04.7+esm1",
        "9.0.1-2.3~ubuntu1.18.04.8",
        "9.0.1-2.3~ubuntu1.18.04.8+esm1",
        "9.0.1-2.3~ubuntu1.18.04.8+esm2",
        "9.0.1-2.3~ubuntu1.18.04.8+esm4",
        "9.0.1-2.3~ubuntu1.18.04.8+esm6",
        "9.0.1-2.3~ubuntu1.18.04.8+esm7"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python-pip-whl",
            "binary_version": "20.0.2-5ubuntu1.11+esm3"
          },
          {
            "binary_name": "python3-pip",
            "binary_version": "20.0.2-5ubuntu1.11+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "python-pip",
        "purl": "pkg:deb/ubuntu/python-pip@20.0.2-5ubuntu1.11+esm3?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "18.1-5",
        "18.1-5build1",
        "18.1-5ubuntu1",
        "20.0.2-2",
        "20.0.2-4",
        "20.0.2-5",
        "20.0.2-5ubuntu1",
        "20.0.2-5ubuntu1.1",
        "20.0.2-5ubuntu1.3",
        "20.0.2-5ubuntu1.4",
        "20.0.2-5ubuntu1.5",
        "20.0.2-5ubuntu1.6",
        "20.0.2-5ubuntu1.7",
        "20.0.2-5ubuntu1.8",
        "20.0.2-5ubuntu1.9",
        "20.0.2-5ubuntu1.10",
        "20.0.2-5ubuntu1.10+esm2",
        "20.0.2-5ubuntu1.11",
        "20.0.2-5ubuntu1.11+esm2",
        "20.0.2-5ubuntu1.11+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-pip",
            "binary_version": "22.0.2+dfsg-1ubuntu0.6"
          },
          {
            "binary_name": "python3-pip-whl",
            "binary_version": "22.0.2+dfsg-1ubuntu0.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "python-pip",
        "purl": "pkg:deb/ubuntu/python-pip@22.0.2+dfsg-1ubuntu0.6?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "20.3.4-4",
        "21.3.1+dfsg-3",
        "22.0.2+dfsg-1",
        "22.0.2+dfsg-1ubuntu0.1",
        "22.0.2+dfsg-1ubuntu0.2",
        "22.0.2+dfsg-1ubuntu0.3",
        "22.0.2+dfsg-1ubuntu0.4",
        "22.0.2+dfsg-1ubuntu0.5",
        "22.0.2+dfsg-1ubuntu0.6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-pip",
            "binary_version": "24.0+dfsg-1ubuntu1.2"
          },
          {
            "binary_name": "python3-pip-whl",
            "binary_version": "24.0+dfsg-1ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "python-pip",
        "purl": "pkg:deb/ubuntu/python-pip@24.0+dfsg-1ubuntu1.2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "23.2+dfsg-1",
        "23.3+dfsg-1",
        "24.0+dfsg-1",
        "24.0+dfsg-1ubuntu1",
        "24.0+dfsg-1ubuntu1.1",
        "24.0+dfsg-1ubuntu1.2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "python3-pip",
            "binary_version": "25.0+dfsg-1ubuntu0.1"
          },
          {
            "binary_name": "python3-pip-whl",
            "binary_version": "25.0+dfsg-1ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.04",
        "name": "python-pip",
        "purl": "pkg:deb/ubuntu/python-pip@25.0+dfsg-1ubuntu0.1?arch=source\u0026distro=plucky"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.2+dfsg-1",
        "24.2+dfsg-1ubuntu0.1",
        "24.3.1+dfsg-1",
        "25.0+dfsg-1",
        "25.0+dfsg-1ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "When installing a package from a Mercurial VCS URL  (ie \"pip install hg+...\") with pip prior to v23.3, the specified Mercurial revision could  be used to inject arbitrary configuration options to the \"hg clone\" call (ie \"--config\"). Controlling the Mercurial configuration can modify  how and which repository is installed. This vulnerability does not affect users who aren\u0027t installing from Mercurial.",
  "id": "UBUNTU-CVE-2023-5752",
  "modified": "2025-09-08T16:55:58Z",
  "published": "2023-10-25T18:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-5752"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pypa/pip/pull/12306"
    },
    {
      "type": "REPORT",
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/advisories/GHSA-mq26-g339-26xf"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-5752"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2023-5752"
  ],
  "withdrawn": "2025-09-17T17:09:51Z"
}

WID-SEC-W-2023-3228

Vulnerability from csaf_certbund - Published: 2023-12-28 23:00 - Updated: 2025-10-26 23:00

Summary

Python (pip): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Severity

Niedrig

Scope

1 vulnerability in this advisory, including CVE-2023-5752.

CVE-2023-5752

Known affected: 16 products

Open the full advisory

WID-SEC-W-2024-1328

Vulnerability from csaf_certbund - Published: 2024-06-10 22:00 - Updated: 2025-10-19 22:00

Summary

Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Severity

Hoch

Scope

20 vulnerabilities in this advisory, including CVE-2023-5752.

CVE-2023-5752

Known affected: 15 products

Open the full advisory

WID-SEC-W-2024-3222

Vulnerability from csaf_certbund - Published: 2024-10-15 22:00 - Updated: 2024-10-15 22:00

Summary

Oracle PeopleSoft: Mehrere Schwachstellen

Severity

Hoch

Scope

12 vulnerabilities in this advisory, including CVE-2023-5752.

CVE-2023-5752

In Oracle PeopleSoft existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer oder authentisierter Angreifer die Vertraulichkeit, Integrität und Verfügbarkeit gefährden. Für die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle veröffentlicht keine weiteren Details zu diesen Schwachstellen (außer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadenshöhe ausschließlich auf Basis der CVSS Impact Matrix. Der Maximalwert für diese Produkte ist "HIGH" für "Confidentiality", "Integrity" und "Availability" über alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert "MITTEL" für die Schadenshöhe.

Known affected: 4 products Last affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2023-5752 (GCVE-0-2023-5752)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature