The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-mockUpgrade python2-psycopg2-testsUpgrade python2-pytestUpgrade python2-docsUpgrade python2-psycopg2-debugUpgrade python2-rpm-macrosUpgrade python2-pyyamlUpgrade python-psycopg2-docUpgrade python2-chardetUpgrade python2-docutilsUpgrade python2-CythonUpgrade python2-PyMySQLUpgrade python2-ipaddressUpgrade python2-pyUpgrade python2-psycopg2Upgrade python2-sqlalchemyUpgrade python2-docs-infoUpgrade python2-setuptools_scmUpgrade python2-pytzUpgrade python-sqlalchemy-docUpgrade python2-coverageUpgrade python2-requestsUpgrade python2-pluggyUpgrade python2-idnaUpgrade python2-pysocksUpgrade python2-pytest-mockUpgrade python2-attrsUpgrade python2-funcsigsUpgrade python2-markupsafeUpgrade python2-dns | May 4, 2022 | Sep 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python-pip-wheelUpgrade python2-pipUpgrade python3-pip | May 26, 2021 | Sep 4, 2020 |
| Centos_linux | — | Upgrade scipy-debugsourceUpgrade python2-psycopg2-testsUpgrade python2-mockUpgrade python2-testUpgrade python2-markupsafeUpgrade python2-backportsUpgrade python2-sqlalchemyUpgrade python2-scipyUpgrade PyYAML-debugsourceUpgrade python2-pytzUpgrade babelUpgrade python2-docsUpgrade python3-pipUpgrade python2-docutilsUpgrade python2-bsonUpgrade python2-funcsigsUpgrade python2-virtualenvUpgrade python2-pytestUpgrade python2-numpy-docUpgrade python-coverage-debugsourceUpgrade python2-pysocksUpgrade python2-pymongo-debuginfoUpgrade python2-wheelUpgrade python2-setuptoolsUpgrade python2-numpyUpgrade python2-toolsUpgrade python2-debuginfoUpgrade python2-PyMySQLUpgrade python2-develUpgrade python2-attrsUpgrade python2-debugsourceUpgrade numpy-debugsourceUpgrade python3-pip-wheelUpgrade python2-dnsUpgrade python2-pygmentsUpgrade python2-docs-infoUpgrade python-sqlalchemy-docUpgrade python2-pip-wheelUpgrade python2Upgrade python2-requestsUpgrade python2-lxmlUpgrade python2-psycopg2-debuginfoUpgrade python2-wheel-wheelUpgrade python2-pymongoUpgrade python2-pytest-mockUpgrade python2-psycopg2-debugUpgrade python2-setuptools_scmUpgrade python2-rpm-macrosUpgrade python2-tkinterUpgrade python2-pymongo-gridfsUpgrade python-nose-docsUpgrade python2-bson-debuginfoUpgrade python2-sixUpgrade python2-psycopg2-debug-debuginfoUpgrade python-pymongo-debuginfoUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pluggyUpgrade python2-jinja2Upgrade python2-coverage-debuginfoUpgrade python-virtualenvUpgrade python2-idnaUpgrade python-pymongo-debugsourceUpgrade python-psycopg2-debugsourceUpgrade python2-Cython-debuginfoUpgrade python2-urllib3Upgrade python2-pyyamlUpgrade python2-coverageUpgrade Cython-debugsourceUpgrade python2-scipy-debuginfoUpgrade python2-psycopg2Upgrade python-psycopg2-debuginfoUpgrade python2-pipUpgrade python-lxml-debugsourceUpgrade python2-lxml-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-pyUpgrade python2-chardetUpgrade python2-ipaddressUpgrade python2-numpy-debuginfoUpgrade python2-babelUpgrade python2-noseUpgrade platform-python-pipUpgrade python2-setuptools-wheelUpgrade python2-debugUpgrade python2-numpy-f2pyUpgrade python-psycopg2-docUpgrade python2-libsUpgrade python2-Cython | Nov 5, 2020 | Sep 4, 2020 |
| Debian | — | Upgrade python-pip | Sep 14, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-pipUpgrade python3-pipUpgrade python-pipUpgrade python-pip-wheel | Nov 3, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python-pip-wheelUpgrade python3-pipUpgrade python-pip | Dec 1, 2020 | Sep 4, 2020 |
| Oracle Solaris | — | Upgrade library/python/pip-39 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-27 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-37 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade legacy/library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade python2-psycopg2-debugUpgrade python2-noseUpgrade python2-mockUpgrade python2-pyyamlUpgrade python-nose-docsUpgrade python2-backports-ssl_match_hostnameUpgrade python2-numpy-f2pyUpgrade python2-wheel-wheelUpgrade python3-pipUpgrade python2-urllib3Upgrade platform-python-pipUpgrade python2-wheelUpgrade python2-setuptools-wheelUpgrade python2-chardetUpgrade python-virtualenvUpgrade python2-pipUpgrade python-psycopg2-docUpgrade python2-pytzUpgrade python2-sixUpgrade python2-jinja2Upgrade python2-babelUpgrade python2-rpm-macrosUpgrade python2-psycopg2-testsUpgrade python2-docs-infoUpgrade python2-CythonUpgrade python2-docutilsUpgrade python2-debugUpgrade python2-coverageUpgrade python2-setuptoolsUpgrade python2-ipaddressUpgrade python2-dnsUpgrade python2-pip-wheelUpgrade python2-numpyUpgrade python2-pyUpgrade python2-pymongoUpgrade python2-pluggyUpgrade python2-develUpgrade python2-pytest-mockUpgrade python2-pytestUpgrade python2-PyMySQLUpgrade python2-numpy-docUpgrade python2-pygmentsUpgrade python2-bsonUpgrade python2Upgrade python2-testUpgrade python2-scipyUpgrade python-sqlalchemy-docUpgrade python2-setuptools_scmUpgrade python2-lxmlUpgrade python2-libsUpgrade python2-idnaUpgrade python2-docsUpgrade python2-pysocksUpgrade python2-funcsigsUpgrade python2-tkinterUpgrade python2-attrsUpgrade python2-virtualenvUpgrade python2-psycopg2Upgrade python2-markupsafeUpgrade babelUpgrade python2-toolsUpgrade python2-requestsUpgrade python2-pymongo-gridfsUpgrade python2-backportsUpgrade python2-sqlalchemyUpgrade python3-pip-wheel | Nov 12, 2020 | Apr 16, 2019 |
| Redhat_linux | — | Upgrade python-psycopg2-debuginfoUpgrade python2-setuptools-wheelUpgrade python2-docutilsUpgrade python2-libsUpgrade python2-Cython-debuginfoUpgrade python2-bsonUpgrade babelUpgrade python2-pymongo-debuginfoUpgrade python2-pytest-mockUpgrade python2-psycopg2-testsUpgrade python2-babelUpgrade python2-pipUpgrade python-nose-docsUpgrade python2-sixUpgrade python2-develUpgrade python-psycopg2-debugsourceUpgrade python2-debugUpgrade python2-docsUpgrade python2-ipaddressUpgrade python2-numpy-f2pyUpgrade python2-CythonUpgrade python2-pyyamlUpgrade python2-PyMySQLUpgrade python-virtualenvUpgrade platform-python-pipUpgrade python2-debugsourceUpgrade python2-lxml-debuginfoUpgrade python2-idnaUpgrade python2-dnsUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-funcsigsUpgrade python2-numpy-debuginfoUpgrade python-pymongo-debuginfoUpgrade python2-noseUpgrade python2-bson-debuginfoUpgrade python2-scipyUpgrade python2-sqlalchemyUpgrade python2-scipy-debuginfoUpgrade python2-coverageUpgrade python2-mockUpgrade python2-psycopg2Upgrade Cython-debugsourceUpgrade python2-pluggyUpgrade python2-rpm-macrosUpgrade python-lxml-debugsourceUpgrade python2-toolsUpgrade python3-pipUpgrade python2-jinja2Upgrade numpy-debugsourceUpgrade python2-wheel-wheelUpgrade scipy-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-testUpgrade python2-markupsafeUpgrade python-pymongo-debugsourceUpgrade python2-lxmlUpgrade python2-pytestUpgrade python2-backports-ssl_match_hostnameUpgrade python2-psycopg2-debugUpgrade python2-backportsUpgrade python2-attrsUpgrade python-sqlalchemy-docUpgrade python2-pyUpgrade PyYAML-debugsourceUpgrade python2-psycopg2-debuginfoUpgrade python2-coverage-debuginfoUpgrade python2-wheelNo solution existsUpgrade python2-pygmentsUpgrade python2-pyyaml-debuginfoUpgrade python2-numpy-docUpgrade python2-pip-wheelUpgrade python-psycopg2-docUpgrade python2-setuptools_scmUpgrade python3-pip-wheelUpgrade python-coverage-debugsourceUpgrade python2-setuptoolsUpgrade python2-virtualenvUpgrade python2-chardetUpgrade python2-requestsUpgrade python2-urllib3Upgrade python2Upgrade python2-pytzUpgrade python2-pymongoUpgrade python2-pysocksUpgrade python2-numpyUpgrade python2-docs-infoUpgrade python2-debuginfoUpgrade python2-tkinter | Nov 5, 2020 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade python2-bsonUpgrade python2-psycopg2-debugUpgrade python-pymongo-debugsourceUpgrade python2-markupsafeUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-coverage-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python2-CythonUpgrade python2-pymongo-gridfsUpgrade python-coverage-debugsourceUpgrade PyYAML-debugsourceUpgrade python2-sqlalchemyUpgrade Cython-debugsourceUpgrade python2-psycopg2Upgrade python-psycopg2-docUpgrade python-pymongo-debuginfoUpgrade python2-bson-debuginfoUpgrade python2-pymongo-debuginfoUpgrade python2-coverageUpgrade python2-scipyUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2-testsUpgrade python-psycopg2-debugsourceUpgrade python2-pymongoUpgrade python2-scipy-debuginfoUpgrade scipy-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-pyyaml | Mar 12, 2024 | Sep 4, 2020 |
| Suse | — | Upgrade python3-develUpgrade python2-setuptools-wheelUpgrade python3Upgrade python-base-32bitUpgrade python3-idleUpgrade python2-pip-wheelUpgrade libpython2_7-1_0-32bitUpgrade python-docUpgrade libpython2_7-1_0Upgrade python3-pipUpgrade python3-toolsUpgrade python3-setuptoolsUpgrade python3-doc-devhelpUpgrade python3-docUpgrade python3-dbmUpgrade python2-pipUpgrade python-idleUpgrade python-doc-pdfUpgrade python-tkUpgrade libpython3_4m1_0-32bitUpgrade python3-pip-wheelUpgrade python3-baseUpgrade pythonUpgrade python3-setuptools-testUpgrade python-demoUpgrade python-baseUpgrade libpython3_4m1_0Upgrade libpython3_6m1_0-32bitUpgrade python36-baseUpgrade python-xmlUpgrade python3-32bitUpgrade python-setuptoolsUpgrade python2-setuptoolsUpgrade python36Upgrade libpython3_6m1_0Upgrade python3-tkUpgrade python-develUpgrade python39-pipUpgrade python-32bitUpgrade python2-setuptools-testUpgrade python-gdbmUpgrade python-pipUpgrade python39-setuptoolsUpgrade python3-setuptools-wheelUpgrade python3-testsuiteUpgrade python3-base-32bitUpgrade python3-cursesUpgrade python-curses | Oct 1, 2020 | Sep 4, 2020 |
| Ubuntu | — | Upgrade python-pipUpgrade python3-pip | Oct 23, 2020 | Sep 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub