CVE-2018-20225: 
CBL Mariner vulnerability analysis and mitigation

A vulnerability was discovered in pip (all versions) where it installs the version with the highest version number when using the --extra-index-url option, even if the user intended to obtain a private package from a private index. The vulnerability (CVE-2018-20225) affects cases where the package does not already exist in the public index, allowing an attacker to put the package there with an arbitrary version number (NIST NVD, Cowlicks Blog).

The vulnerability occurs specifically when --extra-index-url is used to point to a private PyPI server that has packages with names that are not claimed on the public PyPI. When this happens, pip needs to choose which PyPI to take the package from and simply selects the one with the higher version number. This becomes exploitable when someone is using a private PyPI with the --extra-index-url option and they are using a package on the private PyPI with a name they have not claimed on the public PyPI (Cowlicks Blog).

An attacker could potentially execute arbitrary code by taking control of an unclaimed package name on the public PyPI and replacing it with a malicious payload. The attacker could gain control of the public package name if it wasn't taken, or even if it was taken but unused (according to PEP 541). This particularly affects organizations using private Python packages that haven't claimed their package names on the public PyPI (Cowlicks Blog).

Red Hat recommends using --index-url and not using --extra-index-url, OR explicitly setting --index-url when using --extra-index-url. The Python security team recommends using version-pinning and hash-pinning for deployments to avoid this issue. Another mitigation strategy is to claim and maintain ownership of private package names on the public PyPI (Red Hat Bugzilla, Cowlicks Blog).

Red Hat Product Security does not consider this to be a security vulnerability because per the pip documentation, this is intended behavior of pip when using the --extra-index-url flag. The issue was marked as WONTFIX. The Python security team acknowledged the issue but stated there was no path to fix it at the time. The vulnerability gained renewed attention in 2021 when it was rediscovered and received significant press coverage (Red Hat Bugzilla).