Arbitrary Code Execution Vulnerability in Pip Software from PyPA
CVE-2018-20225

7.8HIGH

Key Information:

Vendor: Pypa
Status: Pip
Vendor: CVE Published:; 8 May 2020

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-20225?

A vulnerability has been identified in the Pip package manager, used across various Python projects. This issue arises when users utilize the --extra-index-url option, which can inadvertently lead to the installation of a malicious package version from an attackers' private index instead of the intended private package. The attack requires that the desired package is absent in the public index, allowing the adversary to upload a malicious version. Users are advised to exercise caution while using the --extra-index-url feature to ensure secure package management and prevent potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

cve-2018-20225
Created by brabster