CVE-2021-3572

Medium

Advisory

Published 10 Nov 2021In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.7; base score, highest
EPSS: 0.018; 78th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 376; of 17,781 indexed, latest versions
Container images: 377; deployed by those charts
Fix available: 3 of 3; affected packages

Improper Input Validation in pip

Carried by container images the latest versions of 376 of 17,781 indexed charts deploy, on 377 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+27 more	21.1	365
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+3 more	1.5.4-1ubuntu4+esm1, 8.1.1-2ubuntu0.6+esm2, 9.0.1-2.3~ubuntu1.18.04.5+esm2	27
python-piprpm	9.0.3-15.el8, 9.0.3-16.el8, 9.0.3-18.el8, 9.0.3-19.el8	0:9.0.3-20.el8	35

OSV records: GHSA-5xp3-jfq3-5q8x RHSA-2021:4455 UBUNTU-CVE-2021-3572
Also known as: PYSEC-2021-437, USN-4961-2

Charts affected

376 by stars

Chart

Latest

Affected images

Radar Score

cost-analyzerstatcan

1.82.2

1 of 9 See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :1.12.0	89739be9ff38	pip@21.0.1	21.1

Open the chart page →

16,506

datapusherstatcan

1.0.0

1 of 1 See more

datapusher statcan 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
keitaro/ckan-datapusher :0.0.17	5bf1a45f45c1	pip@20.2.3	21.1

Open the chart page →

3,044

prometheus-operatorstatcan

0.2.2

1 of 7 See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.151	7b98eecdf6d1	pip@20.1	21.1

Open the chart page →

12,237

sn-platform-slimstreamnative

1.11.44

1 of 6 See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	pip@20.0.2	21.1

Open the chart page →

10,134

csv-viewsvtech-public-helm-charts

1.0.0

1 of 1 See more

csv-view svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	pip@20.2.2	21.1

Open the chart page →

1,220

freeradiussvtech-public-helm-charts

0.1.5

1 of 4 See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	21.1

Open the chart page →

12,655

icinga2svtech-public-helm-charts

1.0.0

1 of 4 See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	pip@9.0.3	21.1

Open the chart page →

5,511

icinga2-reportsvtech-public-helm-charts

1.0.0

1 of 1 See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	pip@20.1.1	21.1

Open the chart page →

1,779

maxscalesvtech-public-helm-charts

1.0.0

1 of 2 See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	21.1

Open the chart page →

5,841

rundeck-option-providersvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	pip@20.2.2	21.1

Open the chart page →

1,428

gtmetrix-bqt3n

1.0.0

1 of 1 See more

1,287

hadoop-deploymenttejaswita-hadoop-helmchart

1.0.0

1 of 1 See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
apache/hadoop :3	af361b20bec0	pip@8.1.2	21.1

Open the chart page →

4,240

jenkinstnh

2.7.1

1 of 2 See more

4,423

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	python-pip@9.0.3-19.el8	0:9.0.3-20.el8

Open the chart page →

12,455

zookeepertwomartens

0.2.2

1 of 1 See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
confluentinc/cp-zookeeper :latest	7610a50b13e7	pip@9.0.3	21.1

Open the chart page →

1,733

weather-chartweather-web-app

0.1.0

1 of 1 See more

weather-chart weather-web-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
zohardocker12/weather_app_flask :latest	b86d60dbb68d	pip@20.0.2	21.1

Open the chart page →

2,670

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	pip@9.0.3 python-pip@9.0.3-19.el8	21.1 0:9.0.3-20.el8

Open the chart page →

28,605

ambassadorwenerme

6.9.5

1 of 2 See more

4,086

athens-proxywenerme

0.5.2

1 of 2 See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
gomods/athens :v0.11.0	efb811df7844	pip@19.2.3	21.1

Open the chart page →

4,984

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	pip@9.0.3	21.1

Open the chart page →

6,138

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.15.1	35034611d981	pip@20.3.4	21.1

Open the chart page →

22,665

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pip@9.0.3	21.1

Open the chart page →

10,285

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pip@9.0.3	21.1

Open the chart page →

11,784

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	pip@21.0	21.1

Open the chart page →

1,843

pypiwiremind

0.2.1

1 of 1 See more

423

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	21.1

Open the chart page →

6,016

Container images carrying it

377 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
forchaladtest/testwebapp :0.1	5909cf64ef53	pip@20.0.2	21.1	1
fossology/fossology :4.2.1	8bd1f22ba7bb	pip@18.1	21.1	1
foundationdb/foundationdb-kubernetes-sidecar :6.3.23-1	07e0ae17a7ca	pip@19.3.1	21.1	1
foundationdb/foundationdb-kubernetes-sidecar :6.2.30-1	9ceb2f948c9f	pip@21.0.1	21.1	1
foundationdb/foundationdb-kubernetes-sidecar :7.1.38-1	da1ee2731024	pip@19.3.1	21.1	1
frankescobar/allure-docker-service :2.21.0	8a4d7e9308de	pip@9.0.1	21.1	1
frankescobar/allure-docker-service :2.19.0	cafa03b94dac	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.5	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
galaxy/cloudman-server :latest	e5c265fe9fcd	pip@20.0.2	21.1	1
galaxy/galaxy-init :v18.01	0267bad550e6	pip@10.0.1 python-pip@1.5.4-1ubuntu4	21.1 1.5.4-1ubuntu4+esm1	1
galaxy/galaxy-stable :v18.01	8e577a626dfd	pip@1.5.4 python-pip@1.5.4-1ubuntu4	21.1 1.5.4-1ubuntu4+esm1	1
geoscienceaustralia/dea-k8s-data :latest	f4039b45572a	pip@20.2.3 python-pip@9.0.1-2.3~ubuntu1.18.04.2	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
gethue/hue :4.11.0	11b649636e68	pip@20.0.2	21.1	1
gethue/hue :4.10.0	5702b2c37ff9	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.5	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
getsentry/sentry-kubernetes :latest	6ac37974fd2a	pip@19.0.3	21.1	1
gomods/athens :v0.8.1	d714c7ff0231	pip@19.2.3	21.1	1
gomods/athens :v0.11.0	efb811df7844	pip@19.2.3	21.1	1
graphiteapp/graphite-statsd :1.1.7-6	04a0037cc2ae	pip@20.1.1	21.1	1
greenbirdit/locust :0.9.0	e99d53bdc944	pip@18.1	21.1	1
gristlabs/grist :0.7.9	6e71b1914a7e	pip@18.1	21.1	1
halkeye/slack-resurrect :v0.1.4	77b05e95fdb5	pip@19.1.1	21.1	1
hazelcast/management-center :5.3.2	f9d34300d330	pip@9.0.3	21.1	1
helga09/my_sql_shoes :v1.1.1	a03657d97897	pip@20.2.4	21.1	1
helicone/clickhouse-migration-runner :v2025.03.05-1	4c69b971a7e4	pip@20.0.2	21.1	1
hjacobs/kube-resource-report :21.2.1	45f93491c434	pip@21.0.1	21.1	1
hjacobs/kube-web-view :20.10.0	b44a9cf81a2f	pip@20.2.3	21.1	1
hmdmph/mongo-pod-labeler :1.0.1-alpine	79e4a170f3dc	pip@19.0.3	21.1	1
hmdmph/redis-pod-labeler :1.0.0-alpine	7f1381fe0f3b	pip@20.1.1	21.1	1
ibmcom/ibmcloud-object-storage-driver :1.8.16	c796a4c693b4	python-pip@9.0.3-16.el8	0:9.0.3-20.el8	1
ibmcom/ibmcloud-object-storage-plugin :1.8.16	9c73804b37a3	python-pip@9.0.3-16.el8	0:9.0.3-20.el8	1
ibmcom/ibm-enterprise-mongodb-ppc64le :4.4	d28bf361327a	pip@9.0.3 python-pip@9.0.3-18.el8	21.1 0:9.0.3-20.el8	1
ibmcom/icp-sert-bats :3.2.0	b558f2b444ae	pip@19.1.1	21.1	1
intel/dlstreamer-pipeline-server :2022.1.1-ubuntu20	aa8f5483a2ef	pip@20.0.2	21.1	1
istio/examples-bookinfo-productpage-v1 :1.17.0	6668bcf42ef0	pip@20.1.1	21.1	1
jmferrer/azure-devops-agent :latest	030f68ec6998	pip@9.0.3	21.1	1
julb/alertmanager-gchat-integration :1.0.5	837c4038a0dd	pip@21.0.1	21.1	1
julb/http-reqtrace :1.1.0	0806409af397	pip@20.2.4	21.1	1
julb/kubernetes-configmap-sync :1.1.0	d7d8836366ad	pip@20.2.4	21.1	1
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	pip@20.3.3	21.1	1
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	pip@20.0.2	21.1	1
jupyterhub/k8s-singleuser-sample :0.11.1	e3e6f3051df8	pip@20.2.4	21.1	1
jvstein/bitcoin-prometheus-exporter :v0.5.0	7cc385d038b1	pip@20.0.2	21.1	1
keitaro/ckan-datapusher :0.0.17	5bf1a45f45c1	pip@20.2.3	21.1	1
kennethreitz/httpbin :latest	599fe5e50731	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
kfirfer/kibana-index-pattern-updater :1.0.12	e88cfcec5c93	pip@20.3.3	21.1	1
kfirfer/percona-xtradb-healthcheck :0.0.1	ef7b909a8e6b	pip@20.2.4	21.1	1
kiwigrid/k8s-sidecar :1.1.0	3e86186656d3	pip@20.2.3	21.1	1
kiwigrid/k8s-sidecar :1.3.0	65095a82d4a1	pip@20.2.4	21.1	1
kiwigrid/k8s-sidecar :0.0.18	6eb52513d59e	pip@19.1.1	21.1	1
kiwigrid/k8s-sidecar :1.12.0	89739be9ff38	pip@21.0.1	21.1	1
kiwigrid/k8s-sidecar :0.0.16	899ccd0b1f54	pip@19.0.3	21.1	1