diff mbox series

[wrynose] python3-pip: set CVE_STATUS for CVE-2018-20225

Message ID 20260907082218.2177656-1-hthakar@cisco.com
State New
Headers show
Series [wrynose] python3-pip: set CVE_STATUS for CVE-2018-20225 | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Sept. 7, 2026, 8:22 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

Analysis:
- NVD marks CVE-2018-20225 as disputed. [1]
- pip searches all configured package indexes without priority and selects
  the highest matching version. --extra-index-url adds an equal-priority
  package source. [2]
- Exploitation requires use of --extra-index-url and an attacker-published,
  higher-version package with the name of a private package. [1]
- Upstream closed the related report as not planned, and Red Hat classified
  the issue as WONTFIX because this behavior is intentional. [3][4]
- Record the disputed status; no source patch is available.

Reference:
[1] https://nvd.nist.gov/vuln/detail/CVE-2018-20225
[2] https://pip.pypa.io/en/stable/cli/pip_install/
[3] https://github.com/pypa/pip/issues/12874
[4] https://bugzilla.redhat.com/show_bug.cgi?id=1835736

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-devtools/python/python3-pip_26.0.1.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-devtools/python/python3-pip_26.0.1.bb b/meta/recipes-devtools/python/python3-pip_26.0.1.bb
index 1a2cbc397a..46fa63e6a6 100644
--- a/meta/recipes-devtools/python/python3-pip_26.0.1.bb
+++ b/meta/recipes-devtools/python/python3-pip_26.0.1.bb
@@ -34,6 +34,8 @@  SRC_URI[sha256sum] = "c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b29661
 
 CVE_PRODUCT = "pypa:pip"
 
+CVE_STATUS[CVE-2018-20225] = "disputed: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes"
+
 do_install:append(){
 	# pip vendors distlib which ships Windows launcher templates (*.exe).
 	# Keep them only when building for a Windows (mingw) host.