The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-pyUpgrade python2-dnsUpgrade python2-pluggyUpgrade python2-ipaddressUpgrade python2-sqlalchemyUpgrade python2-coverageUpgrade python2-docutilsUpgrade python2-funcsigsUpgrade python2-setuptools_scmUpgrade python2-markupsafeUpgrade python2-pytzUpgrade python-sqlalchemy-docUpgrade python2-requestsUpgrade python2-CythonUpgrade python2-pysocksUpgrade python2-psycopg2Upgrade python2-attrsUpgrade python2-pytest-mockUpgrade python2-idnaUpgrade python2-docs-infoUpgrade python2-PyMySQLUpgrade python2-psycopg2-testsUpgrade python2-rpm-macrosUpgrade python2-chardetUpgrade python2-pytestUpgrade python2-mockUpgrade python2-docsUpgrade python-psycopg2-docUpgrade python2-psycopg2-debugUpgrade python2-pyyaml | May 4, 2022 | Sep 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python-pip-wheelUpgrade python2-pipUpgrade python3-pip | May 26, 2021 | Sep 4, 2020 |
| Centos_linux | — | Upgrade python2-markupsafeUpgrade python2-pytest-mockUpgrade python2-setuptools_scmUpgrade python2-backportsUpgrade python2-pymongo-gridfsUpgrade python2-psycopg2-debuginfoUpgrade python2-requestsUpgrade python2-lxmlUpgrade python2-pymongo-debuginfoUpgrade python2-PyMySQLUpgrade python2-debuginfoUpgrade python2-wheelUpgrade python3-pip-wheelUpgrade python2-setuptoolsUpgrade python2-testUpgrade python2-develUpgrade python2-toolsUpgrade python2-rpm-macrosUpgrade python2-wheel-wheelUpgrade numpy-debugsourceUpgrade python2-pip-wheelUpgrade python3-pipUpgrade python2Upgrade python2-debugsourceUpgrade python2-pygmentsUpgrade python-coverage-debugsourceUpgrade python2-sqlalchemyUpgrade python2-attrsUpgrade babelUpgrade scipy-debugsourceUpgrade python2-numpy-docUpgrade python2-funcsigsUpgrade python2-dnsUpgrade python2-pysocksUpgrade python2-docs-infoUpgrade python2-numpyUpgrade python2-pymongoUpgrade python2-psycopg2-debugUpgrade python2-pytestUpgrade python-sqlalchemy-docUpgrade python2-mockUpgrade python2-bsonUpgrade python2-psycopg2-testsUpgrade python2-docsUpgrade PyYAML-debugsourceUpgrade python2-scipyUpgrade python2-docutilsUpgrade python2-tkinterUpgrade python2-virtualenvUpgrade python2-pytzUpgrade python-psycopg2-debugsourceUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-numpy-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-backports-ssl_match_hostnameUpgrade python2-scipy-debuginfoUpgrade python2-coverageUpgrade Cython-debugsourceUpgrade python2-ipaddressUpgrade python2-psycopg2Upgrade python2-pyyamlUpgrade python-pymongo-debuginfoUpgrade python-psycopg2-docUpgrade python2-babelUpgrade python2-numpy-f2pyUpgrade platform-python-pipUpgrade python-lxml-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-idnaUpgrade python2-jinja2Upgrade python2-debugUpgrade python-virtualenvUpgrade python2-bson-debuginfoUpgrade python2-lxml-debuginfoUpgrade python2-pyUpgrade python2-pyyaml-debuginfoUpgrade python2-chardetUpgrade python2-sixUpgrade python2-pluggyUpgrade python2-setuptools-wheelUpgrade python-pymongo-debugsourceUpgrade python2-libsUpgrade python2-CythonUpgrade python2-urllib3Upgrade python2-noseUpgrade python2-Cython-debuginfoUpgrade python-nose-docsUpgrade python2-pip | Nov 5, 2020 | Sep 4, 2020 |
| Debian | — | Upgrade python-pip | Sep 14, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-pipUpgrade python3-pipUpgrade python2-pipUpgrade python-pip-wheel | Nov 3, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python-pipUpgrade python-pip-wheelUpgrade python3-pip | Dec 1, 2020 | Sep 4, 2020 |
| Oracle Solaris | — | Upgrade library/python/pip to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade legacy/library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip-39 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-27 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip-37 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade python2-numpy-f2pyUpgrade python2-setuptools-wheelUpgrade python2-urllib3Upgrade platform-python-pipUpgrade python2-pipUpgrade python2-sixUpgrade python2-rpm-macrosUpgrade python2-noseUpgrade python2-psycopg2-debugUpgrade python2-wheelUpgrade python-psycopg2-docUpgrade python-virtualenvUpgrade python2-pytzUpgrade python2-babelUpgrade python-nose-docsUpgrade python2-backports-ssl_match_hostnameUpgrade python2-psycopg2-testsUpgrade python2-pyyamlUpgrade python2-jinja2Upgrade python2-mockUpgrade python2-chardetUpgrade python2-wheel-wheelUpgrade python3-pipUpgrade python2-setuptools_scmUpgrade python2-CythonUpgrade python2-markupsafeUpgrade python3-pip-wheelUpgrade python2-sqlalchemyUpgrade python2-pyUpgrade python2-pip-wheelUpgrade python2-numpyUpgrade python2-ipaddressUpgrade python2-dnsUpgrade python2-pymongoUpgrade python2-virtualenvUpgrade python2-attrsUpgrade python2-docs-infoUpgrade python2-testUpgrade python2-scipyUpgrade python2-docutilsUpgrade python2-debugUpgrade python2-coverageUpgrade python2-bsonUpgrade python2Upgrade python2-backportsUpgrade python2-psycopg2Upgrade python2-setuptoolsUpgrade babelUpgrade python2-requestsUpgrade python2-lxmlUpgrade python2-idnaUpgrade python-sqlalchemy-docUpgrade python2-tkinterUpgrade python2-funcsigsUpgrade python2-libsUpgrade python2-docsUpgrade python2-pymongo-gridfsUpgrade python2-toolsUpgrade python2-numpy-docUpgrade python2-PyMySQLUpgrade python2-develUpgrade python2-pytest-mockUpgrade python2-pytestUpgrade python2-pygmentsUpgrade python2-pluggyUpgrade python2-pysocks | Nov 12, 2020 | Apr 16, 2019 |
| Redhat_linux | — | Upgrade python2-debugUpgrade python2-scipy-debuginfoUpgrade python2-bsonUpgrade python-psycopg2-debuginfoUpgrade python2-numpy-f2pyUpgrade python2-bson-debuginfoUpgrade python2-pluggyUpgrade python-pymongo-debuginfoUpgrade python2-sqlalchemyUpgrade python2-psycopg2-debug-debuginfoUpgrade babelUpgrade python2-rpm-macrosUpgrade python2-lxml-debuginfoUpgrade python2-pytest-mockUpgrade python2-CythonUpgrade python-lxml-debugsourceUpgrade python-nose-docsUpgrade python-psycopg2-debugsourceUpgrade python2-sixUpgrade python2-develUpgrade python2-docsUpgrade python2-ipaddressUpgrade python2-numpy-debuginfoUpgrade Cython-debugsourceUpgrade python2-babelUpgrade python2-toolsUpgrade python2-mockUpgrade python2-psycopg2-testsUpgrade python2-pymongo-debuginfoUpgrade python-virtualenvUpgrade python2-debugsourceUpgrade python2-dnsUpgrade python2-libsUpgrade python2-coverageUpgrade python2-docutilsUpgrade python2-pipUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2Upgrade python2-funcsigsUpgrade python2-noseUpgrade python2-scipyUpgrade python2-pyyamlUpgrade python2-PyMySQLUpgrade python2-idnaUpgrade python2-setuptools-wheelUpgrade platform-python-pipUpgrade numpy-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-debuginfoUpgrade python2-urllib3Upgrade python2-chardetUpgrade python2-docs-infoUpgrade python2-markupsafeUpgrade python2-numpy-docUpgrade python2-jinja2Upgrade python2-pymongoUpgrade python2-pytestUpgrade python2-pygmentsUpgrade python2-wheel-wheelUpgrade python3-pip-wheelUpgrade python2Upgrade python2-numpyUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pyyaml-debuginfoUpgrade python2-requestsUpgrade python2-tkinterUpgrade python2-pytzUpgrade python3-pipUpgrade python2-lxmlUpgrade scipy-debugsourceNo solution existsUpgrade python2-setuptools_scmUpgrade python2-setuptoolsUpgrade python2-backportsUpgrade python-sqlalchemy-docUpgrade python2-psycopg2-debuginfoUpgrade python2-pip-wheelUpgrade python-pymongo-debugsourceUpgrade python2-testUpgrade python-psycopg2-docUpgrade PyYAML-debugsourceUpgrade python2-pyUpgrade python2-virtualenvUpgrade python2-attrsUpgrade python2-psycopg2-debugUpgrade python2-pysocksUpgrade python-coverage-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-wheel | Nov 5, 2020 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade python-pymongo-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-psycopg2-debugUpgrade python-coverage-debugsourceUpgrade python2-CythonUpgrade python2-markupsafeUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-coverage-debuginfoUpgrade python2-sqlalchemyUpgrade PyYAML-debugsourceUpgrade python2-psycopg2-debuginfoUpgrade python2-bsonUpgrade python-psycopg2-debugsourceUpgrade python-pymongo-debuginfoUpgrade python2-coverageUpgrade python2-pymongo-debuginfoUpgrade python2-psycopg2Upgrade python2-scipyUpgrade python2-pyyaml-debuginfoUpgrade scipy-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-pyyamlUpgrade Cython-debugsourceUpgrade python2-pymongoUpgrade python2-scipy-debuginfoUpgrade python-psycopg2-docUpgrade python2-bson-debuginfo | Mar 12, 2024 | Sep 4, 2020 |
| Suse | — | Upgrade python36-baseUpgrade libpython3_4m1_0Upgrade python-develUpgrade python3-setuptools-wheelUpgrade python3-cursesUpgrade python3-base-32bitUpgrade python-pipUpgrade python36Upgrade python-setuptoolsUpgrade python2-setuptoolsUpgrade python3-32bitUpgrade python-cursesUpgrade python3-testsuiteUpgrade libpython3_6m1_0Upgrade python3-tkUpgrade python-32bitUpgrade python39-setuptoolsUpgrade python39-pipUpgrade python-xmlUpgrade python2-setuptools-testUpgrade python-gdbmUpgrade libpython3_6m1_0-32bitUpgrade python3-pip-wheelUpgrade python-base-32bitUpgrade python3-develUpgrade python3-docUpgrade python2-pipUpgrade python3-baseUpgrade python3Upgrade python2-setuptools-wheelUpgrade python-baseUpgrade python-docUpgrade python3-doc-devhelpUpgrade python3-dbmUpgrade python3-setuptoolsUpgrade python-demoUpgrade pythonUpgrade python3-idleUpgrade python3-setuptools-testUpgrade python-tkUpgrade python-doc-pdfUpgrade libpython2_7-1_0-32bitUpgrade python3-toolsUpgrade libpython3_4m1_0-32bitUpgrade python3-pipUpgrade python2-pip-wheelUpgrade libpython2_7-1_0Upgrade python-idle | Oct 1, 2020 | Sep 4, 2020 |
| Ubuntu | — | Upgrade python-pipUpgrade python3-pip | Oct 23, 2020 | Sep 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub