5.7

CVE-2021-3572: oracle agile_product_lifecycle_management Improper Input Validation

Modified
AliasesSUSE-SU-2021:2304-1SUSE-SU-2021:2441-1SUSE-SU-2021:4001-1
Published 10-11-2021Last modified 08-10-2026

Vulnerability summary

CVE-2021-3572 is a medium (CVSS 5.7) Improper Input Validation vulnerability in oracle agile_product_lifecycle_management. EPSS estimates a 1.83% chance of exploitation in the next 30 days, higher than 78.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.7, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.7/10
010
Medium · v3.1 (NVD)
EPSS score
1.83%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 6
MGASA-2021-0371OPENSUSE-SU-2022:1091-1OPENSUSE-SU-2024:12150-1RHSA-2021:3254RHSA-2021:4160RHSA-2021:4162

Timeline

  1. 10-11-2021
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

1.83%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.83% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse32 products
  • python-pip-wheel&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 10.0.1-3.9.1
  • python-pip&distro=HPE Helion OpenStack 8< 9.0.1-3.6.1
  • python-pip&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 20.0.2-6.15.1
  • python-pip&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 20.0.2-6.15.1
  • python-pip&distro=SUSE Linux Enterprise Module for Public Cloud 12< 10.0.1-13.6.1
Opensuse10 products
  • python-pip-wheel&distro=openSUSE Leap 15.2< 10.0.1-lp152.4.9.1
  • python-pip-wheel&distro=openSUSE Leap 15.3< 10.0.1-3.9.1
  • python-pip&distro=openSUSE Leap 15.2< 10.0.1-lp152.4.9.1
  • python-pip&distro=openSUSE Leap 15.3< 20.0.2-6.15.1
  • python3-core&distro=openSUSE Leap 15.3< 3.6.15-150300.10.21.1
Redhat4 products
  • platform-python-pip< 0:9.0.3-20.el8
  • python-pip< 0:9.0.3-20.el8
  • python3-pip< 0:9.0.3-20.el8
  • python3-pip-wheel< 0:9.0.3-20.el8
Oracle3 products
Debian1 product
  • python-pip< 20.3.4-2
Pypa1 product
PyPI1 product
  • pip< 21.1
Ubuntu1 product
  • python-pip< 1.5.4-1ubuntu4+esm1 | < 8.1.1-2ubuntu0.6+esm2 | < 9.0.1-2.3~ubuntu1.18.04.5+esm2

8 vendors · 53 products

References

43 links
Show all 43 references