---
id: CVE-2021-3572
title: >-
  A flaw was found in python-pip in the way it handled Unicode separators in git
  references
summary: >-
  A flaw was found in python-pip in the way it handled Unicode separators in git
  references. A remote attacker could possibly use this issue to install a
  different revision on a repository. The highest threat from this vulnerability
  is to …
severity: medium
cvss: 5.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-20
vendor: pypa
product: pip
affected:
  - pip < 21.1
  - agile_product_lifecycle_management = 9.3.6
  - >-
    communications_cloud_native_core_network_function_cloud_native_environment =
    1.10.0
  - >-
    communications_cloud_native_core_network_function_cloud_native_environment =
    22.1.0
  - communications_cloud_native_core_policy = 1.15.0
  - communications_cloud_native_core_policy = 22.1.3
patched:
  - pip 21.1
published: '2021-11-10'
updated: '2026-08-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-3572'
references:
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1962856'
    label: secalert@redhat.com
  - url: 'https://security.netapp.com/advisory/ntap-20240621-0006/'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: secalert@redhat.com
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: secalert@redhat.com
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1962856'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240621-0006/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - exploit-available
epss: 0.01829
epssPercentile: 0.77937
ingestedAt: '2026-08-25T17:29:31.781Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/frenzymadness/CVE-2021-3572'
  checkedAt: '2026-09-24T07:52:48.139Z'
exploitAvailable: true
---

## Overview

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.

## Affected

- `pip < 21.1`
- `agile_product_lifecycle_management = 9.3.6`
- `communications_cloud_native_core_network_function_cloud_native_environment = 1.10.0`
- `communications_cloud_native_core_network_function_cloud_native_environment = 22.1.0`
- `communications_cloud_native_core_policy = 1.15.0`
- `communications_cloud_native_core_policy = 22.1.3`

## Remediation

Upgrade past the affected range:

- `pip 21.1`