What is CVE-2018-20225?

CVE-2018-20225 is a security vulnerability affecting pip, a package management system used in Python. The issue occurs when using the --extra-index-url option, which can lead to the installation of a package with the highest version number, even if the user intended to obtain a private package from a private index. This vulnerability has a severity rating of 7.8 (HIGH) and affects systems using pip for package management, particularly those using private Python packages with package names shadowed on the public Python Package Index (PyPI).

Who is impacted by this?

This vulnerability affects users of pip, particularly those who use the --extra-index-url option to obtain private packages from a private index. It can lead to the installation of a package with the highest version number, even if the user intended to obtain a private package. All versions of pip are affected by this vulnerability, posing a risk to systems using pip for package management.

What should I do if I’m affected?

If you're affected by the CVE-2018-20225 vulnerability, it's important to take action to mitigate the risk. Here are some simple steps to follow:

1. Use -index-url instead of -extra-index-url when installing packages, or explicitly set -index-url and use -extra-index-url.

2. Review your code and ensure dependencies are pinned to exact versions and hashes.

3. Consider using version-pinning and hash-pinning for deployments.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2018-20225 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which refers to improper input validation in pip's --extra-index-url option.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Red Hat Bugzilla - CVE-2018-20225

• Arbitrary code execution from pip's "—extra-index-url"

• Apache Mail Archives - GitHub pull request #7294