CVE-2021-3572

Medium

Advisory

Published 10 Nov 2021In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.7; base score, highest
EPSS: 0.018; 78th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 376; of 17,781 indexed, latest versions
Container images: 377; deployed by those charts
Fix available: 3 of 3; affected packages

Improper Input Validation in pip

Carried by container images the latest versions of 376 of 17,781 indexed charts deploy, on 377 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+27 more	21.1	365
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+3 more	1.5.4-1ubuntu4+esm1, 8.1.1-2ubuntu0.6+esm2, 9.0.1-2.3~ubuntu1.18.04.5+esm2	27
python-piprpm	9.0.3-15.el8, 9.0.3-16.el8, 9.0.3-18.el8, 9.0.3-19.el8	0:9.0.3-20.el8	35

OSV records: GHSA-5xp3-jfq3-5q8x RHSA-2021:4455 UBUNTU-CVE-2021-3572
Also known as: PYSEC-2021-437, USN-4961-2

Charts affected

376 by stars

Chart

Latest

Affected images

Radar Score

cost-analyzerstatcan

1.82.2

1 of 9 See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :1.12.0	89739be9ff38	pip@21.0.1	21.1

Open the chart page →

16,506

datapusherstatcan

1.0.0

1 of 1 See more

datapusher statcan 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
keitaro/ckan-datapusher :0.0.17	5bf1a45f45c1	pip@20.2.3	21.1

Open the chart page →

3,044

prometheus-operatorstatcan

0.2.2

1 of 7 See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.151	7b98eecdf6d1	pip@20.1	21.1

Open the chart page →

12,237

sn-platform-slimstreamnative

1.11.44

1 of 6 See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	pip@20.0.2	21.1

Open the chart page →

10,134

csv-viewsvtech-public-helm-charts

1.0.0

1 of 1 See more

csv-view svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	pip@20.2.2	21.1

Open the chart page →

1,220

freeradiussvtech-public-helm-charts

0.1.5

1 of 4 See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	21.1

Open the chart page →

12,655

icinga2svtech-public-helm-charts

1.0.0

1 of 4 See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	pip@9.0.3	21.1

Open the chart page →

5,511

icinga2-reportsvtech-public-helm-charts

1.0.0

1 of 1 See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	pip@20.1.1	21.1

Open the chart page →

1,779

maxscalesvtech-public-helm-charts

1.0.0

1 of 2 See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	21.1

Open the chart page →

5,841

rundeck-option-providersvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	pip@20.2.2	21.1

Open the chart page →

1,428

gtmetrix-bqt3n

1.0.0

1 of 1 See more

1,287

hadoop-deploymenttejaswita-hadoop-helmchart

1.0.0

1 of 1 See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
apache/hadoop :3	af361b20bec0	pip@8.1.2	21.1

Open the chart page →

4,240

jenkinstnh

2.7.1

1 of 2 See more

4,423

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	python-pip@9.0.3-19.el8	0:9.0.3-20.el8

Open the chart page →

12,455

zookeepertwomartens

0.2.2

1 of 1 See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
confluentinc/cp-zookeeper :latest	7610a50b13e7	pip@9.0.3	21.1

Open the chart page →

1,733

weather-chartweather-web-app

0.1.0

1 of 1 See more

weather-chart weather-web-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
zohardocker12/weather_app_flask :latest	b86d60dbb68d	pip@20.0.2	21.1

Open the chart page →

2,670

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	pip@9.0.3 python-pip@9.0.3-19.el8	21.1 0:9.0.3-20.el8

Open the chart page →

28,605

ambassadorwenerme

6.9.5

1 of 2 See more

4,086

athens-proxywenerme

0.5.2

1 of 2 See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
gomods/athens :v0.11.0	efb811df7844	pip@19.2.3	21.1

Open the chart page →

4,984

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	pip@9.0.3	21.1

Open the chart page →

6,138

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.15.1	35034611d981	pip@20.3.4	21.1

Open the chart page →

22,665

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pip@9.0.3	21.1

Open the chart page →

10,285

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pip@9.0.3	21.1

Open the chart page →

11,784

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	pip@21.0	21.1

Open the chart page →

1,843

pypiwiremind

0.2.1

1 of 1 See more

423

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	21.1

Open the chart page →

6,016

Container images carrying it

377 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
octoprint/octoprint :1.4.0	106c26efcd8a	pip@20.3.1	21.1	1
odaniait/aws-kubectl :latest	3fff8a8570ec	pip@20.0.2	21.1	1
omecproject/mme-exporter :paging-latest	bcc5f19fd676	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.1	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
omecproject/progran-synchronizer :comac-1.0.0	d109a8e57e71	pip@9.0.3 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
opendatacube/pipelines :wofs-1.22	5d810e8504b8	pip@19.0.3 python-pip@9.0.1-2.3~ubuntu1	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
opendatacube/restcube :latest	91870111837c	pip@19.3.1 python-pip@9.0.1-2.3~ubuntu1	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
opendatacube/wms :latest	1b90cdf68831	pip@19.3.1 python-pip@9.0.1-2.3~ubuntu1	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
openelevation/open-elevation :latest	82fb21612e86	pip@20.0.2	21.1	1
openwhisk/kafkaprovider :2.1.0	63dc3d2a0904	pip@19.3.1	21.1	1
openwhisk/ow-utils :1.0.0	c80dba0de3aa	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.4	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
pecan/monitor :1.7.2	73b2074f3fec	pip@20.2.3	21.1	1
phntom/stocks-nasdaq-crawler :0.0.28	d2b844700b57	pip@20.2.3	21.1	1
pnnlmiscscripts/gitlab-runner-operator :0.1.3-1	155131891741	pip@9.0.3 python-pip@9.0.3-15.el8	21.1 0:9.0.3-20.el8	1
pnnlmiscscripts/tenant-namespace-operator :0.1.24-1	8af4b7551d40	pip@20.2.4	21.1	1
prompve/prometheus-pve-exporter :2.0.1	ff6749eb03b0	pip@20.1.1	21.1	1
pypiserver/pypiserver :v1.4.2	c9250d3c418d	pip@20.2.3	21.1	1
redash/redash :10.0.0.b50363	9392753c0376	pip@20.2.4	21.1	1
rezachalak/bzen-mongo :1.0.0	34f694325191	pip@20.0.2	21.1	1
rhasspy/wyoming-whisper :1.0.0	80b99ddeef6c	pip@20.3.4	21.1	1
richardchesterwood/k8s-fleetman-webapp-angular :release2	ed7d720878ac	pip@9.0.1	21.1	1
roadiehq/community-backstage-image :latest	ef355bf5b639	pip@19.2.3	21.1	1
samueldg/snappass :latest	3987195edbe6	pip@19.3.1	21.1	1
scrapinghub/splash :3.4.1	a5f89bc84606	pip@9.0.1 python-pip@9.0.1-2.3~ubuntu1.18.04.1	21.1 9.0.1-2.3~ubuntu1.18.04.5+esm2	1
seafileltd/seafile-mc :9.0.10	6693911bcc40	pip@20.0.2	21.1	1
seafileltd/seafile-mc :10.0.1	70628f29c663	pip@20.0.2	21.1	1
seafileltd/seafile-mc :9.0.9	7ac833196f60	pip@20.0.2	21.1	1
seafileltd/seafile-mc :8.0.7	ed0fcda5e6a9	pip@20.0.2	21.1	1
seldonio/locust-core :0.8	1d0da98a2d76	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
seldonio/seldon-request-logger :1.11.2	4e985d2006a8	pip@19.3.1 python-pip@9.0.3-19.el8	21.1 0:9.0.3-20.el8	1
skylenet/ethereum-genesis-generator :latest	210353ce7c89	pip@20.3.4	21.1	1
socialmediamacroscope/autophrase :0.1.5	70fb11d4f531	pip@20.0.2	21.1	1
socialmediamacroscope/collect_reddit_comment :0.1.2	19d3d26d53ee	pip@9.0.1	21.1	1
socialmediamacroscope/image_crawler :0.1.2	f508216be63c	pip@9.0.1	21.1	1
softonic/gar-exporter :0.2.1	a64d6c0e0ae5	pip@20.2.4	21.1	1
softonic/mysql-backup :0.4.0	d9487a8dd70f	pip@18.1	21.1	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	pip@20.0.2	21.1	1
stackstorm/st2actionrunner :3.8	88235ba70cad	pip@20.3.3	21.1	1
stackstorm/st2api :3.8	6f56d239d280	pip@20.3.3	21.1	1
stackstorm/st2auth :3.8	33ecfda16608	pip@20.3.3	21.1	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	pip@20.3.3	21.1	1
stackstorm/st2notifier :3.8	f190a6212195	pip@20.3.3	21.1	1
stackstorm/st2rulesengine :3.8	259503496ff9	pip@20.3.3	21.1	1
stackstorm/st2scheduler :3.8	b1de2055c362	pip@20.3.3	21.1	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	pip@20.3.3	21.1	1
stackstorm/st2stream :3.8	1c8904a3bf67	pip@20.3.3	21.1	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	pip@20.3.3	21.1	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	pip@20.3.3	21.1	1
stakater/descheduler :v0.3.0	a47e96ebb285	pip@9.0.1	21.1	1
stakater/restful-distributed-lock-manager :0.5.3	4f8e409f30c2	pip@9.0.1	21.1	1
stakewiselabs/bls-horcrux :v1.0.0	2afd0c0b34cb	pip@21.0	21.1	1