python:3.11-slim-bookworm CVE-2023-5752

[Matteo Vitali]

Library	Vulnerability	Severity	Status	Installed Version	Fixed Version	Title
pip (METADATA)	CVE-2023-5752	MEDIUM	fixed	23.2.1	23.3	pip: Mercurial configuration injectable in repo revision when installing via pip Link

[Laurent Goderre]

Need to be updated here: https://github.com/python/cpython/blob/9560e0d6d7a316341939b4016e47e03bd5bf17c3/Lib/ensurepip/__init__.py#L13

[Laurent Goderre]

python/cpython#112517

[Matteo Vitali]

Hi @LaurentGoderre

Is it not necessary to modify the pip version here as well?

python/3.11/slim-bookworm/Dockerfile

Line 137 in 8bc80d1

 ENV PYTHON_PIP_VERSION 23.2.1 

(and in the "not slim" bookworm also)

python/3.11/bookworm/Dockerfile

Line 103 in 8bc80d1

 ENV PYTHON_PIP_VERSION 23.2.1 

[Laurent Goderre]

@trottomv that version is derived from the location I pointed to in the update script.

[Álvaro Revuelta]

As far as I am aware, that issue is only going to be fixed in python 3.13 (currently in alpha). The maintainers decided against back porting to previous versions

python/cpython#112719