security fix in pip 21.1: Don't split git references on unicode separators #9827

[smartsammler]

In pip 21.1 there is a security fix for an issue with git references: https://github.com/pypa/pip/pull/9827

pip 21.1 release notes: https://pip.pypa.io/en/stable/news/

I think it would be great, if this security fix could be made available to Ubuntu Focal.

I tested it with the ubuntu:focal docker container.

cat /etc/lsb-release:

lsb-release:
```
$ lsb-release -rd

Description: Ubuntu 20.04.2 LTS
Release: 20.04
```
```
$ apt-cache policy python3-pip
python3-pip:
  Installed: (none)
  Candidate: 20.0.2-5ubuntu1.3
  Version table:
     20.0.2-5ubuntu1.3 500
        500 http://archive.ubuntu.com/ubuntu focal-updates/universe amd64 Packages
     20.0.2-5ubuntu1.1 500
        500 http://security.ubuntu.com/ubuntu focal-security/universe amd64 Packages
     20.0.2-5ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu focal/universe amd64 Packages
```

I expected that this security fix is back-ported or pip is upgraded to 21.1.
Until now, It seems not to be back-ported, as far as I understand the commits in the python3-pip package from this year correctly (https://code.launchpad.net/~usd-import-team/ubuntu/+source/python-pip/+git/python-pip/+ref/ubuntu/focal-updates).
> Recent commits
>
> e36399c... by Stefano Rivera on 2021-02-27
>
> 20.0.2-5ubuntu1.3 (patches unapplied)
>
> Imported using git-ubuntu import.
> d635985... by Stefano Rivera on 2021-01-26
>
> 20.0.2-5ubuntu1.2 (patches unapplied)
>
> Imported using git-ubuntu import.

PS: I'm sorry if this issue is wrong, but I'm confused, because in my container the package is called python3-pip, though here I can only select python-pip.

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Stefano Rivera (stefanor)]

Fixed in https://launchpad.net/ubuntu/+source/python-pip/20.3.4-2 in impish.

[Stefano Rivera (stefanor)]

Tested:
1. build
2. autopkgtest
3. verified git repos still install via pip

[Marc Deslauriers (mdeslaur)]

ACK on the debdiff in comment #3.

I have uploaded the package for building in the security team PPA here:
https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

Once it is built, could you please test it, and describe the testing you've performed, and I'll release it as a security update.

Thanks!

[Stefano Rivera (stefanor)]

Tested:
1. Clean installation of update
2. Upgrading to security update
3. pip installing from PyPI
4. pip installing from git
5. pip installing within a virtualenv

LGTM.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-pip - 20.0.2-5ubuntu1.5

---------------
python-pip (20.0.2-5ubuntu1.5) focal-security; urgency=medium

  * Security: Don't split git references on unicode separators. (LP: #1926957)

 -- Stefano Rivera <email address hidden> Wed, 12 May 2021 21:04:29 -0400