CVE-2023-5752 (MEDIUM): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2023-5752](https://avd.aquasec.com/nvd/cve-2023-5752) | `MEDIUM` | `pip` | `23.0.1` | `23.3` | `2023-10-25T18:17:44.867Z` | `2025-07-02T10:18:37.185324308Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/python:3.10` | `public.ecr.aws/lambda/python@sha256:bdd42e632d7f0ff456a7a9d72818ab9f6c7e7b82230dc95477c3f6361da2bc34` |
| `public.ecr.aws/lambda/python:3.9` | `public.ecr.aws/lambda/python@sha256:a7cce2f593062bf9cf249459077f728d0f5d7f7f1565bc7a89b4f2227e233789` |

---

## Description

> When installing a package from a Mercurial VCS URL (ie "pip install
hg+...") with pip prior to v23.3, the specified Mercurial revision could
be used to inject arbitrary configuration options to the "hg clone"
call (ie "--config"). Controlling the Mercurial configuration can modify
how and which repository is installed. This vulnerability does not
affect users who aren't installing from Mercurial.

---

### Remediation Steps
- Update the affected package `pip` from version `23.0.1` to `23.3`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.