python:3.11-slim-bookworm CVE-2023-5752

[trottomv]

Library	Vulnerability	Severity	Status	Installed Version	Fixed Version	Title
pip (METADATA)	CVE-2023-5752	MEDIUM	fixed	23.2.1	23.3	pip: Mercurial configuration injectable in repo revision when installing via pip Link

[LaurentGoderre]

Need to be updated here: https://github.com/python/cpython/blob/9560e0d6d7a316341939b4016e47e03bd5bf17c3/Lib/ensurepip/__init__.py#L13

[LaurentGoderre]

python/cpython#112517

[trottomv]

Hi @LaurentGoderre

Is it not necessary to modify the pip version here as well?

python/3.11/slim-bookworm/Dockerfile

Line 137 in 8bc80d1

ENV PYTHON_PIP_VERSION 23.2.1

(and in the "not slim" bookworm also)

python/3.11/bookworm/Dockerfile

Line 103 in 8bc80d1

ENV PYTHON_PIP_VERSION 23.2.1

[LaurentGoderre]

@trottomv that version is derived from the location I pointed to in the update script.

[rv0lt]

As far as I am aware, that issue is only going to be fixed in python 3.13 (currently in alpha). The maintainers decided against back porting to previous versions

python/cpython#112719