ECHO-072a-9ff7-3371

See a problem?
Import Source
https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json
JSON Data
https://api.osv.dev/v1/vulns/ECHO-072a-9ff7-3371
Upstream
  • CVE-2018-20225
  • GHSA-7p5p-7qq5-cc86
Withdrawn
2026-10-13T11:25:14Z
Published
2025-09-15T01:09:14Z
Modified
2026-10-13T11:45:02Z
Summary
Disputed by NVD and pip upstream. The CVE describes pip's --extra-index-url behavior where the highest version number is installed regardless of which index it comes from. The pip team considers this intended functionality, not a security flaw. Red Hat closed as WONTFIX; Ubuntu priority: Negligible. Affects all pip versions with no fix planned.
Details
References

Affected packages

Echo
python-3.11

Package

Name
python-3.11
Purl
pkg:deb/echo/python-3.11

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.11.15+e4

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json"
python-3.12

Package

Name
python-3.12
Purl
pkg:deb/echo/python-3.12

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.12.15+e3

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json"
python-3.13

Package

Name
python-3.13
Purl
pkg:deb/echo/python-3.13

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.13.16+e3

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json"
python-3.14

Package

Name
python-3.14
Purl
pkg:deb/echo/python-3.14

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.14.8+e3

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json"
python-3.15

Package

Name
python-3.15
Purl
pkg:deb/echo/python-3.15

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.15.0+e1

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json"
python-pip

Package

Name
python-pip
Purl
pkg:deb/echo/python-pip

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json"
Echo:PyPI
pip

Package

Name
pip
Purl
pkg:pypi/pip

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
25.2

Database specific

source 
"https://advisory.echohq.com/osv/ECHO-072a-9ff7-3371.json"