Security issue CVE-2018-20225 raised for PIP

[shripad-bhat]

Description

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. This vulnerability was first assigned with CVE-2018-20225, but it is still under dispute. However, this vulnerability still poses a threat when using the --extra-index-url.

Expected behavior

No response

pip version

24.1.2

Python version

3.11.18

OS

Redhat

How to Reproduce

NA

Output

No response

Code of Conduct

• I agree to follow the PSF Code of Conduct.

[notatallshaw]

Thanks for your report, this CVE has been reported previously in #9612, which was folded into the discussion in #8606.

In general, there are always choices users need to make with security vs. flexibility trade offs. Choices a user could make to help mitigate this kind of attack vector are:

• Do not use any index you do not control
• Expose only which packages you want to publicly access via a private mirror/proxy
• Resolve and review all your packages ahead of installing, using a mechanism like a lock file (available using tools like pip-tools, uv, pdm, rye, poetry, etc. [and somewhat possible using pip's report feature] you should also review what packages you allow as sdists vs. wheels when resolving)
• Switch to a tool (uv, pdm, poetry, etc.) which allows index prioritisation (you will need to review the specific behaviour the tool has implemented)