CVE-2021-3572

Medium

Advisory

Published 10 Nov 2021In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.7; base score, highest
EPSS: 0.018; 78th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 376; of 17,781 indexed, latest versions
Container images: 377; deployed by those charts
Fix available: 3 of 3; affected packages

Improper Input Validation in pip

Carried by container images the latest versions of 376 of 17,781 indexed charts deploy, on 377 images.

Affected package	Affected versions	Fixed in	Images
pippypi	1.5.4, 8.1.1, 8.1.2, 9.0.0+27 more	21.1	365
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+3 more	1.5.4-1ubuntu4+esm1, 8.1.1-2ubuntu0.6+esm2, 9.0.1-2.3~ubuntu1.18.04.5+esm2	27
python-piprpm	9.0.3-15.el8, 9.0.3-16.el8, 9.0.3-18.el8, 9.0.3-19.el8	0:9.0.3-20.el8	35

OSV records: GHSA-5xp3-jfq3-5q8x RHSA-2021:4455 UBUNTU-CVE-2021-3572
Also known as: PYSEC-2021-437, USN-4961-2

Charts affected

376 by stars

Chart

Latest

Affected images

Radar Score

cost-analyzerstatcan

1.82.2

1 of 9 See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :1.12.0	89739be9ff38	pip@21.0.1	21.1

Open the chart page →

16,506

datapusherstatcan

1.0.0

1 of 1 See more

datapusher statcan 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
keitaro/ckan-datapusher :0.0.17	5bf1a45f45c1	pip@20.2.3	21.1

Open the chart page →

3,044

prometheus-operatorstatcan

0.2.2

1 of 7 See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.151	7b98eecdf6d1	pip@20.1	21.1

Open the chart page →

12,237

sn-platform-slimstreamnative

1.11.44

1 of 6 See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	pip@20.0.2	21.1

Open the chart page →

10,134

csv-viewsvtech-public-helm-charts

1.0.0

1 of 1 See more

csv-view svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	pip@20.2.2	21.1

Open the chart page →

1,220

freeradiussvtech-public-helm-charts

0.1.5

1 of 4 See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	21.1

Open the chart page →

12,655

icinga2svtech-public-helm-charts

1.0.0

1 of 4 See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	pip@9.0.3	21.1

Open the chart page →

5,511

icinga2-reportsvtech-public-helm-charts

1.0.0

1 of 1 See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	pip@20.1.1	21.1

Open the chart page →

1,779

maxscalesvtech-public-helm-charts

1.0.0

1 of 2 See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
library/mysql :8.2.0	212fe73edca5	pip@20.2.4	21.1

Open the chart page →

5,841

rundeck-option-providersvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	pip@20.2.2	21.1

Open the chart page →

1,428

gtmetrix-bqt3n

1.0.0

1 of 1 See more

1,287

hadoop-deploymenttejaswita-hadoop-helmchart

1.0.0

1 of 1 See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
apache/hadoop :3	af361b20bec0	pip@8.1.2	21.1

Open the chart page →

4,240

jenkinstnh

2.7.1

1 of 2 See more

4,423

hermestouk

0.6.0

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	python-pip@9.0.3-19.el8	0:9.0.3-20.el8

Open the chart page →

12,455

zookeepertwomartens

0.2.2

1 of 1 See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
confluentinc/cp-zookeeper :latest	7610a50b13e7	pip@9.0.3	21.1

Open the chart page →

1,733

weather-chartweather-web-app

0.1.0

1 of 1 See more

weather-chart weather-web-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
zohardocker12/weather_app_flask :latest	b86d60dbb68d	pip@20.0.2	21.1

Open the chart page →

2,670

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :14.0.0	3029dc0f1d38	pip@9.0.3 python-pip@9.0.3-19.el8	21.1 0:9.0.3-20.el8

Open the chart page →

28,605

ambassadorwenerme

6.9.5

1 of 2 See more

4,086

athens-proxywenerme

0.5.2

1 of 2 See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
gomods/athens :v0.11.0	efb811df7844	pip@19.2.3	21.1

Open the chart page →

4,984

minio-standalonewenerme

1.0.2

1 of 1 See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	pip@9.0.3	21.1

Open the chart page →

6,138

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.15.1	35034611d981	pip@20.3.4	21.1

Open the chart page →

22,665

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pip@9.0.3	21.1

Open the chart page →

10,285

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	pip@9.0.3	21.1

Open the chart page →

11,784

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	pip@21.0	21.1

Open the chart page →

1,843

pypiwiremind

0.2.1

1 of 1 See more

423

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2021-3572.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	pip@9.0.3	21.1

Open the chart page →

6,016

Container images carrying it

377 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
statcan/ckan :2.9	3921305425b8	pip@20.0.2	21.1	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	pip@20.0.2	21.1	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.10	ebcf7f033b54	pip@18.1	21.1	1
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	pip@20.2.2	21.1	1
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	pip@9.0.3	21.1	1
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	pip@20.2.2	21.1	1
t3nde/gtmetrix-bq :0.2.0	d2939e9a719b	pip@20.1	21.1	1
taigaio/taiga-protected :6.4.0	36318831b3e7	pip@21.0.1	21.1	1
temporalio/admin-tools :1.15.1	35034611d981	pip@20.3.4	21.1	1
tenableofficial/nessus :latest	c88e43fe1a8c	pip@9.0.3	21.1	1
tensorflow/tensorflow :1.6.0-devel	1e3172090703	pip@9.0.1	21.1	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
tobiasbp/db-backup :0.0.3	14bee6e33a26	pip@20.1.1	21.1	1
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	pip@20.1.1	21.1	1
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	pip@21.0	21.1	1
voltha/voltha-cli :1.6.0	c4e41e92f046	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
voltha/voltha-netconf :1.6.0	37f80524c207	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
voltha/voltha-ofagent :1.6.0	9ee8c1f4428c	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
voltha/voltha-tester :1.7.0	655c3048a602	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
voltha/voltha-voltha :1.6.0	ff596b62de59	pip@8.1.1 python-pip@8.1.1-2ubuntu0.4	21.1 8.1.1-2ubuntu0.6+esm2	1
weblate/weblate :3.11.3-1	82848df56ecd	pip@18.1	21.1	1
wiremind/pghoard :12-2019-11-26	4dea42c8166c	pip@19.3.1	21.1	1
ygqygq2/mysql-exec-sql :latest	54f30def1558	pip@20.2.4	21.1	1
yugabytedb/yugabyte :2026.1.1.1-b2	3926eedf0ff4	pip@9.0.3	21.1	1
yugabytedb/yugabyte :2026.1.1.0-b91	de2e00278645	pip@9.0.3	21.1	1
zohardocker12/weather_app_flask :latest	b86d60dbb68d	pip@20.0.2	21.1	1
gcr.io/google-samples/microservices-demo/loadgenerator :v0.2.3	360130ab5850	pip@21.0.1	21.1	1
gcr.io/google-samples/microservices-demo/recommendationservice :v0.2.3	5f60c4988859	pip@21.0.1	21.1	1
ghcr.io/appuio/maxscale-docker :6.4.6	13a01be102b0	pip@9.0.3	21.1	1
ghcr.io/aws-exporters/prometheus-ecr-exporter :0.1.4	42b0c87470d6	pip@20.3.4	21.1	1
ghcr.io/aws-exporters/prometheus-inspector-exporter :0.0.2	9c7c11293b3c	pip@20.3.4	21.1	1
ghcr.io/blakeblackshear/frigate :0.14.1	22e3d0b486df	pip@20.3.4	21.1	1
ghcr.io/blakeblackshear/frigate :0.13.0	7a5244e4c8dc	pip@20.3.4	21.1	1
ghcr.io/blakeblackshear/frigate :0.12.0	c862771e38e8	pip@20.3.4	21.1	1
ghcr.io/cloudnative-pg/postgresql :18	899d3ed526b6	pip@20.3.4	21.1	1
ghcr.io/cloudnative-pg/postgresql :14.5	b3b30d04b362	pip@20.3.4	21.1	1
ghcr.io/ctron/streamsheets-base :2.4.0	0cf25ed621e2	python-pip@9.0.3-19.el8	0:9.0.3-20.el8	1
ghcr.io/ctron/streamsheets-gateway :2.4.0	0635f17c9d2c	python-pip@9.0.3-19.el8	0:9.0.3-20.el8	1
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	python-pip@9.0.3-19.el8	0:9.0.3-20.el8	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	python-pip@9.0.3-19.el8	0:9.0.3-20.el8	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	python-pip@9.0.3-19.el8	0:9.0.3-20.el8	1
ghcr.io/dynamia-ai/hami-enterprise :v2.10.0-r0-openshift.c4e22e88	745504757300	pip@9.0.3	21.1	1
ghcr.io/grofers/legend :0.1	d6e901ad0ebd	pip@20.2.4	21.1	1
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	python-pip@9.0.3-16.el8	0:9.0.3-20.el8	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	pip@20.0.2	21.1	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	pip@20.0.2	21.1	1
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	pip@20.3.4	21.1	1
ghcr.io/porelli/firefox-sync :syncstorage-rs-mysql-0.18.2	7d244e514216	pip@20.3.4	21.1	1
ghcr.io/skyoo2003/digdag :0.0.1	821fd6a6f2cd	pip@20.3.4	21.1	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	pip@20.0.2	21.1	1