The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-pyyamlUpgrade python2-psycopg2-debugUpgrade python2-chardetUpgrade python2-pytestUpgrade python-psycopg2-docUpgrade python2-docsUpgrade python2-mockUpgrade python2-rpm-macrosUpgrade python2-psycopg2-testsUpgrade python2-sqlalchemyUpgrade python2-ipaddressUpgrade python2-coverageUpgrade python2-attrsUpgrade python2-pluggyUpgrade python2-pysocksUpgrade python2-pyUpgrade python2-setuptools_scmUpgrade python2-pytzUpgrade python2-psycopg2Upgrade python2-docutilsUpgrade python-sqlalchemy-docUpgrade python2-CythonUpgrade python2-PyMySQLUpgrade python2-dnsUpgrade python2-requestsUpgrade python2-idnaUpgrade python2-funcsigsUpgrade python2-docs-infoUpgrade python2-markupsafeUpgrade python2-pytest-mock | May 4, 2022 | Sep 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python3-pipUpgrade python-pip-wheelUpgrade python2-pip | May 26, 2021 | Sep 4, 2020 |
| Centos_linux | — | Upgrade python-pymongo-debuginfoUpgrade python2-CythonUpgrade python2-numpy-debuginfoUpgrade python2-pipUpgrade python2-sixUpgrade python2-coverageUpgrade python2-lxml-debuginfoUpgrade python-lxml-debugsourceUpgrade python2-libsUpgrade python-pymongo-debugsourceUpgrade python2-pyUpgrade python2-Cython-debuginfoUpgrade python2-ipaddressUpgrade python2-jinja2Upgrade python2-pluggyUpgrade python2-setuptools-wheelUpgrade python2-coverage-debuginfoUpgrade python2-numpy-f2pyUpgrade python-virtualenvUpgrade python2-babelUpgrade platform-python-pipUpgrade python2-bson-debuginfoUpgrade python2-psycopg2Upgrade python2-pyyaml-debuginfoUpgrade python2-pyyamlUpgrade python2-backports-ssl_match_hostnameUpgrade python2-noseUpgrade python-nose-docsUpgrade python2-debugUpgrade python-psycopg2-debugsourceUpgrade python2-scipy-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade Cython-debugsourceUpgrade python2-chardetUpgrade python-psycopg2-debuginfoUpgrade python2-urllib3Upgrade python2-numpyUpgrade python2-pymongoUpgrade python2-pymongo-gridfsUpgrade python-psycopg2-docUpgrade python2Upgrade python-coverage-debugsourceUpgrade python2-docs-infoUpgrade python2-dnsUpgrade python2-pytest-mockUpgrade python2-virtualenvUpgrade python2-funcsigsUpgrade python2-scipyUpgrade python2-backportsUpgrade numpy-debugsourceUpgrade python2-setuptools_scmUpgrade python2-psycopg2-debugUpgrade python2-pygmentsUpgrade python2-idnaUpgrade python2-debugsourceUpgrade python2-pip-wheelUpgrade python2-mockUpgrade python2-docutilsUpgrade python2-docsUpgrade python2-attrsUpgrade python2-markupsafeUpgrade python2-sqlalchemyUpgrade python2-pytzUpgrade PyYAML-debugsourceUpgrade python3-pipUpgrade python2-pysocksUpgrade python2-bsonUpgrade python-sqlalchemy-docUpgrade python2-tkinterUpgrade python2-wheel-wheelUpgrade python2-testUpgrade python2-requestsUpgrade python2-psycopg2-testsUpgrade scipy-debugsourceUpgrade babelUpgrade python3-pip-wheelUpgrade python2-psycopg2-debuginfoUpgrade python2-pymongo-debuginfoUpgrade python2-toolsUpgrade python2-numpy-docUpgrade python2-PyMySQLUpgrade python2-lxmlUpgrade python2-wheelUpgrade python2-setuptoolsUpgrade python2-debuginfoUpgrade python2-develUpgrade python2-rpm-macrosUpgrade python2-pytest | Nov 5, 2020 | Sep 4, 2020 |
| Debian | — | Upgrade python-pip | Sep 14, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-pip-wheelUpgrade python2-pipUpgrade python3-pipUpgrade python-pip | Nov 3, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python-pip-wheelUpgrade python3-pipUpgrade python-pip | Dec 1, 2020 | Sep 4, 2020 |
| Oracle Solaris | — | Upgrade library/python/pip to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade legacy/library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip-27 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip-39 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-37 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade python2-backports-ssl_match_hostnameUpgrade python2-pytzUpgrade python2-jinja2Upgrade python2-pipUpgrade platform-python-pipUpgrade python2-urllib3Upgrade python2-psycopg2-debugUpgrade python-virtualenvUpgrade python2-wheel-wheelUpgrade python3-pipUpgrade python-psycopg2-docUpgrade python2-chardetUpgrade python2-babelUpgrade python2-mockUpgrade python2-numpy-f2pyUpgrade python2-sixUpgrade python2-noseUpgrade python2-setuptools-wheelUpgrade python2-rpm-macrosUpgrade python2-wheelUpgrade python-nose-docsUpgrade python2-psycopg2-testsUpgrade python2-pyyamlUpgrade python2-markupsafeUpgrade python2-backportsUpgrade babelUpgrade python2-setuptools_scmUpgrade python2-scipyUpgrade python2-CythonUpgrade python2-debugUpgrade python2-numpy-docUpgrade python2-setuptoolsUpgrade python2-pymongoUpgrade python-sqlalchemy-docUpgrade python2-pytestUpgrade python2-lxmlUpgrade python2-idnaUpgrade python2-virtualenvUpgrade python2-docs-infoUpgrade python2-attrsUpgrade python3-pip-wheelUpgrade python2-bsonUpgrade python2Upgrade python2-testUpgrade python2-docutilsUpgrade python2-coverageUpgrade python2-dnsUpgrade python2-sqlalchemyUpgrade python2-numpyUpgrade python2-pygmentsUpgrade python2-PyMySQLUpgrade python2-ipaddressUpgrade python2-pip-wheelUpgrade python2-pytest-mockUpgrade python2-pluggyUpgrade python2-pysocksUpgrade python2-develUpgrade python2-funcsigsUpgrade python2-libsUpgrade python2-tkinterUpgrade python2-docsUpgrade python2-pyUpgrade python2-toolsUpgrade python2-requestsUpgrade python2-pymongo-gridfsUpgrade python2-psycopg2 | Nov 12, 2020 | Apr 16, 2019 |
| Redhat_linux | — | Upgrade python2-tkinterUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pyUpgrade python2-virtualenvUpgrade python2-psycopg2-debugUpgrade python2-setuptools_scmUpgrade python3-pip-wheelUpgrade python3-pipUpgrade python2-markupsafeUpgrade python2-pyyaml-debuginfoNo solution existsUpgrade python2-pygmentsUpgrade python2-setuptoolsUpgrade scipy-debugsourceUpgrade python2-lxmlUpgrade python2-coverage-debuginfoUpgrade python2-pytestUpgrade python-pymongo-debugsourceUpgrade python2-numpyUpgrade PyYAML-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-jinja2Upgrade python2-chardetUpgrade python2-urllib3Upgrade python2-wheelUpgrade python2-psycopg2-debuginfoUpgrade python2-debuginfoUpgrade python2-docs-infoUpgrade python2-pytzUpgrade python2-numpy-docUpgrade python-psycopg2-docUpgrade python2-attrsUpgrade python2Upgrade python2-pip-wheelUpgrade python-coverage-debugsourceUpgrade numpy-debugsourceUpgrade python2-wheel-wheelUpgrade python2-testUpgrade python2-pysocksUpgrade python2-backportsUpgrade python2-requestsUpgrade python2-pymongoUpgrade python-sqlalchemy-docUpgrade python2-rpm-macrosUpgrade python2-noseUpgrade python2-mockUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-docsUpgrade python2-sqlalchemyUpgrade python2-debugsourceUpgrade python2-coverageUpgrade python2-babelUpgrade python2-bson-debuginfoUpgrade python-pymongo-debuginfoUpgrade python2-PyMySQLUpgrade python2-lxml-debuginfoUpgrade python2-idnaUpgrade python-psycopg2-debuginfoUpgrade python2-psycopg2-testsUpgrade python-lxml-debugsourceUpgrade babelUpgrade python2-libsUpgrade python2-pipUpgrade python2-toolsUpgrade python2-Cython-debuginfoUpgrade python2-pymongo-debuginfoUpgrade python2-bsonUpgrade python2-sixUpgrade python2-scipyUpgrade python-psycopg2-debugsourceUpgrade python2-numpy-debuginfoUpgrade python2-develUpgrade python2-ipaddressUpgrade python2-debugUpgrade python2-funcsigsUpgrade python2-psycopg2Upgrade python2-pyyamlUpgrade python2-dnsUpgrade platform-python-pipUpgrade python2-docutilsUpgrade python-nose-docsUpgrade python2-scipy-debuginfoUpgrade Cython-debugsourceUpgrade python-virtualenvUpgrade python2-pytest-mockUpgrade python2-CythonUpgrade python2-numpy-f2pyUpgrade python2-setuptools-wheelUpgrade python2-pluggy | Nov 5, 2020 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade python2-markupsafeUpgrade python-pymongo-debugsourceUpgrade python2-psycopg2-debugUpgrade python2-bsonUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-pymongo-gridfsUpgrade python2-coverage-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python-coverage-debugsourceUpgrade python2-sqlalchemyUpgrade python2-CythonUpgrade PyYAML-debugsourceUpgrade python-psycopg2-debugsourceUpgrade Cython-debugsourceUpgrade python2-pymongoUpgrade python-psycopg2-debuginfoUpgrade scipy-debugsourceUpgrade python2-bson-debuginfoUpgrade python-pymongo-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-coverageUpgrade python2-pymongo-debuginfoUpgrade python2-scipyUpgrade python2-psycopg2-testsUpgrade python2-pyyamlUpgrade python-psycopg2-docUpgrade python2-psycopg2Upgrade python2-scipy-debuginfo | Mar 12, 2024 | Sep 4, 2020 |
| Suse | — | Upgrade python-tkUpgrade python3-pip-wheelUpgrade python2-pip-wheelUpgrade libpython3_4m1_0-32bitUpgrade libpython2_7-1_0Upgrade python-doc-pdfUpgrade python-idleUpgrade pythonUpgrade python2-pipUpgrade python3-setuptools-testUpgrade python3-docUpgrade python3-baseUpgrade python3-idleUpgrade python-demoUpgrade python3-doc-devhelpUpgrade python3-pipUpgrade python3-setuptoolsUpgrade python-base-32bitUpgrade python2-setuptools-wheelUpgrade python3-develUpgrade python-baseUpgrade python3-toolsUpgrade python3Upgrade libpython2_7-1_0-32bitUpgrade python-docUpgrade python3-dbmUpgrade python3-base-32bitUpgrade python3-tkUpgrade python-xmlUpgrade libpython3_6m1_0-32bitUpgrade python3-testsuiteUpgrade python2-setuptoolsUpgrade python-cursesUpgrade libpython3_6m1_0Upgrade python-develUpgrade python39-setuptoolsUpgrade python-pipUpgrade libpython3_4m1_0Upgrade python36-baseUpgrade python3-cursesUpgrade python39-pipUpgrade python-gdbmUpgrade python2-setuptools-testUpgrade python-32bitUpgrade python3-32bitUpgrade python-setuptoolsUpgrade python36Upgrade python3-setuptools-wheel | Oct 1, 2020 | Sep 4, 2020 |
| Ubuntu | — | Upgrade python-pipUpgrade python3-pip | Oct 23, 2020 | Sep 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub