CVE-2021-3572
MediumAdvisory
Published 10 Nov 2021In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.7
- base score, highest
- EPSS
- 0.018
- 78th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 376
- of 17,781 indexed, latest versions
- Container images
- 377
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Improper Input Validation in pip
Carried by container images the latest versions of 376 of 17,781 indexed charts deploy, on 377 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pippypi | 1.5.4, 8.1.1, 8.1.2, 9.0.0+27 more | 21.1 | 365 |
| python-pipdeb | 1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+3 more | 1.5.4-1ubuntu4+esm1, 8.1.1-2ubuntu0.6+esm2, 9.0.1-2.3~ubuntu1.18.04.5+esm2 | 27 |
| python-piprpm | 9.0.3-15.el8, 9.0.3-16.el8, 9.0.3-18.el8, 9.0.3-19.el8 | 0:9.0.3-20.el8 | 35 |
- OSV records
- GHSA-5xp3-jfq3-5q8xRHSA-2021:4455UBUNTU-CVE-2021-3572
- Also known as
- PYSEC-2021-437, USN-4961-2
Charts affected
376 by stars
Container images carrying it
377 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| amundsendev/ | 4d98eb21f5f9 | pip | 21.1 | 1 |
| amundsendev/ | 99dda9502c3e | pip | 21.1 | 1 |
| anchore/ | bde9eedf639d | pip python-pip | 21.1 0:9.0.3-20.el8 | 1 |
| anchore/ | ed9b3badd17c | pip python-pip | 21.1 0:9.0.3-20.el8 | 1 |
| apache/ | a7d9970c148f | pip | 21.1 | 1 |
| apache/ | af361b20bec0 | pip | 21.1 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | pip | 21.1 | 1 |
| apachepulsar/ | 4db6ff0b4045 | pip | 21.1 | 1 |
| apicurio/ | a97d67487532 | python-pip | 0:9.0.3-20.el8 | 1 |
| apsl/ | 51e2de5c2c70 | pip | 21.1 | 1 |
| aquasec/ | 0bf607ce9308 | pip | 21.1 | 1 |
| asdkant/ | a23d8bf7c885 | pip | 21.1 | 1 |
| assistiot/ | c3adbab6a3e7 | pip | 21.1 | 1 |
| assistiot/ | 0fce3ea719a5 | pip | 21.1 | 1 |
| assistiot/ | 0df4b4fa899a | pip | 21.1 | 1 |
| assistiot/ | 8b5d118bdf0e | pip | 21.1 | 1 |
| badsmoke/ | c54c004f24cc | pip | 21.1 | 1 |
| bbvalabs/ | 3ea299ae63c0 | pip | 21.1 | 1 |
| bicarus/ | b1dab0721e1c | pip | 21.1 | 1 |
| billimek/ | 801bba1228ac | pip | 21.1 | 1 |
| billimek/ | f14ccd7aad0e | pip | 21.1 | 1 |
| billimek/ | bf8158556035 | pip | 21.1 | 1 |
| blacktop/ | fc5e68e2f5ab | pip | 21.1 | 1 |
| blakeblackshear/ | ae269270ad9e | pip | 21.1 | 1 |
| bootc/ | f1383295e7be | pip | 21.1 | 1 |
| bryanalves/ | 42f0a130001d | pip | 21.1 | 1 |
| buildkite/ | aec38cfaae0e | pip | 21.1 | 1 |
| camptocamp/ | 35c91d5fda04 | pip | 21.1 | 1 |
| camptocamp/ | bff736b15623 | pip | 21.1 | 1 |
| camptocamp/ | 2924b43dbf40 | pip | 21.1 | 1 |
| cbanuka/ | c742770d4247 | pip | 21.1 | 1 |
| cdignam/ | 5a6a55b39cee | pip | 21.1 | 1 |
| ceph/ | 90f30824a96e | pip | 21.1 | 1 |
| ceticasbl/ | 6c0aa7567145 | pip | 21.1 | 1 |
| chaostoolkit/ | 734f3af86125 | pip | 21.1 | 1 |
| chaostoolkit/ | 7f4a7eb9f7df | pip | 21.1 | 1 |
| chaostoolkit/ | b95ba4961cfc | pip | 21.1 | 1 |
| cheyang/ | 46cc34755493 | pip | 21.1 | 1 |
| chorss/ | 5c549cacb8ab | pip | 21.1 | 1 |
| chubaofs/ | 15ff74209ce7 | pip | 21.1 | 1 |
| chubaofs/ | 205030e045f2 | pip | 21.1 | 1 |
| citizenstig/ | b81c818ccb86 | pip python-pip | 21.1 8.1.1-2ubuntu0.6+esm2 | 1 |
| ckan/ | 84d11924549f | pip | 21.1 | 1 |
| cloudve/ | af56e77ca587 | pip python-pip | 21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2 | 1 |
| cloudve/ | d79c1c5881c0 | pip | 21.1 | 1 |
| cockroachdb/ | 983312754620 | pip python-pip | 21.1 0:9.0.3-20.el8 | 1 |
| codaprotocol/ | 37c68e67a401 | pip | 21.1 | 1 |
| codaprotocol/ | 4ba4dd3a041f | pip | 21.1 | 1 |
| codekoala/ | 4a999b2cfff2 | pip | 21.1 | 1 |
| coderenvs/ | 1deffc4670e6 | pip | 21.1 | 1 |