Security fix for CVE-2023-5752

Resolves: rhbz#2263291

python-pip.spec

@@ -14,7 +14,7 @@
 
 Name:           python-%{srcname}
 Version:        %{base_version}%{?prerel:~%{prerel}}
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A tool for installing and managing Python packages
 
 # We bundle a lot of libraries with pip, which itself is under MIT license.
@@ -83,6 +83,13 @@ Patch:          nowarn-pip._internal.main.patch
 # Upstream issue: https://github.com/pypa/packaging/issues/368
 Patch:          no-version-warning.patch
 
+# Security fix for CVE-2023-5752:
+# Mercurial configuration injectable in repo revision when installing via pip
+# Resolved upstream:
+# https://github.com/pypa/pip/commit/1082eb12622b20d101d2864111dd9a591dd6c2f5
+# https://github.com/pypa/pip/commit/6dbd9c68f085c5bf304247bf7c7933842092efb2
+Patch:          CVE-2023-5752.patch
+
 %description
 pip is a package management system used to install and manage software packages
 written in Python. Many packages can be found in the Python Package Index
@@ -361,6 +368,10 @@ pytest_k='not completion'
 %{python_wheel_dir}/%{python_wheel_name}
 
 %changelog
+* Wed Apr 17 2024 Charalampos Stratakis <cstratak@redhat.com> - 23.2.1-2
+- Security fix for CVE-2023-5752
+Resolves: rhbz#2263291
+
 * Fri Aug 04 2023 Miro Hrončok <mhroncok@redhat.com> - 23.2.1-1
 - Update to 23.2.1
 Resolves: rhbz#2223082