Bug 721672 (CVE-2018-20225)

Summary:	dev-python/pip: Possible code execution via untrusted packages from external indexes (CVE-2018-20225)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html
Whiteboard:	C2 [upstream cve]
Package list:		Runtime testing required:	---

Description Sam James archtester

2020-05-08 18:59:12 UTC

Description:
"An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number)."