Skip to content

Latest commit

 

History

History
51 lines (35 loc) · 1.5 KB

cve-2018-20225.md

File metadata and controls

51 lines (35 loc) · 1.5 KB
sidebar_label title description hide_table_of_contents sidebar_class_name toc_max_heading_level tags
CVE-2018-20225
CVE-2018-20225
Lifecycle of CVE-2018-20225
true
hide-from-sidebar
2
security
cve

CVE Details

CVE-2018-20225

Last Update

11/7/24

NIST CVE Summary

An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely

Our Official Summary

Waiting on a fix from third party mongodb vendor

CVE Severity

7.8

Status

Ongoing

Affected Products & Versions

  • Palette VerteX airgap 4.4.14, 4.5.8
  • Palette Enterprise airgap 4.5.8
  • Palette VerteX 4.5.8
  • Palette Enterprise 4.5.8

Revision History

  • 1.0 08/16/2024 Initial Publication
  • 2.0 08/17/2024 Added Palette VerteX airgap 4.4.14 to Affected Products
  • 3.0 09/25/2024 CVE remediated in Palette VerteX airgap 4.4.18
  • 4.0 11/7/2024 Added Palette VerteX airgap, VerteX, Palette airgap, and Palette Enterprise 4.5.8 to Affected Products