The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-psycopg2Upgrade python2-coverageUpgrade python2-docs-infoUpgrade python2-CythonUpgrade python-sqlalchemy-docUpgrade python2-pysocksUpgrade python2-ipaddressUpgrade python2-PyMySQLUpgrade python2-dnsUpgrade python2-pyUpgrade python2-docutilsUpgrade python2-requestsUpgrade python2-markupsafeUpgrade python2-attrsUpgrade python2-setuptools_scmUpgrade python2-funcsigsUpgrade python2-pluggyUpgrade python2-sqlalchemyUpgrade python2-idnaUpgrade python2-pytest-mockUpgrade python2-pytzUpgrade python2-docsUpgrade python2-chardetUpgrade python2-mockUpgrade python2-psycopg2-testsUpgrade python-psycopg2-docUpgrade python2-psycopg2-debugUpgrade python2-pytestUpgrade python2-rpm-macrosUpgrade python2-pyyaml | May 4, 2022 | Sep 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python-pip-wheelUpgrade python2-pipUpgrade python3-pip | May 26, 2021 | Sep 4, 2020 |
| Centos_linux | — | Upgrade python2-pymongo-gridfsUpgrade python2-funcsigsUpgrade python2-pymongoUpgrade python2-docutilsUpgrade python2-setuptools_scmUpgrade PyYAML-debugsourceUpgrade python2-docsUpgrade python2-tkinterUpgrade python3-pipUpgrade python2-psycopg2-debugUpgrade python2-pytestUpgrade numpy-debugsourceUpgrade python2-dnsUpgrade python2-pysocksUpgrade python2-docs-infoUpgrade python2-virtualenvUpgrade python2-rpm-macrosUpgrade python2-sqlalchemyUpgrade python2-mockUpgrade python2-pygmentsUpgrade python2-toolsUpgrade python-sqlalchemy-docUpgrade python2-PyMySQLUpgrade python2-setuptoolsUpgrade python2-wheelUpgrade python2-scipyUpgrade python2-pytzUpgrade python2-develUpgrade python2-pymongo-debuginfoUpgrade python2-lxmlUpgrade python2-pytest-mockUpgrade python2-attrsUpgrade python2-markupsafeUpgrade scipy-debugsourceUpgrade python2-psycopg2-testsUpgrade python2-bsonUpgrade babelUpgrade python2-numpy-docUpgrade python3-pip-wheelUpgrade python2-debugsourceUpgrade python2-requestsUpgrade python2Upgrade python-coverage-debugsourceUpgrade python2-numpyUpgrade python2-pip-wheelUpgrade python2-testUpgrade python2-debuginfoUpgrade python2-psycopg2-debuginfoUpgrade python2-backportsUpgrade python2-wheel-wheelUpgrade python2-pluggyUpgrade python-psycopg2-docUpgrade python2-backports-ssl_match_hostnameUpgrade python2-chardetUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-numpy-f2pyUpgrade platform-python-pipUpgrade python2-numpy-debuginfoUpgrade python2-lxml-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-babelUpgrade python-pymongo-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-ipaddressUpgrade python2-setuptools-wheelUpgrade python-nose-docsUpgrade python2-noseUpgrade python-psycopg2-debugsourceUpgrade python2-pyyamlUpgrade python2-CythonUpgrade python2-libsUpgrade python2-sixUpgrade Cython-debugsourceUpgrade python2-coverageUpgrade python2-psycopg2Upgrade python2-scipy-debuginfoUpgrade python2-debugUpgrade python2-bson-debuginfoUpgrade python-virtualenvUpgrade python2-coverage-debuginfoUpgrade python2-idnaUpgrade python2-jinja2Upgrade python-lxml-debugsourceUpgrade python2-urllib3Upgrade python2-pipUpgrade python2-py | Nov 5, 2020 | Sep 4, 2020 |
| Debian | — | Upgrade python-pip | Sep 14, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-pipUpgrade python2-pipUpgrade python3-pipUpgrade python-pip-wheel | Nov 3, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python-pip-wheelUpgrade python3-pipUpgrade python-pip | Dec 1, 2020 | Sep 4, 2020 |
| Oracle Solaris | — | Upgrade library/python/pip-27 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip-37 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-39 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade legacy/library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade python-nose-docsUpgrade python2-jinja2Upgrade python-psycopg2-docUpgrade python2-psycopg2-debugUpgrade python2-noseUpgrade python2-pipUpgrade python2-backports-ssl_match_hostnameUpgrade python2-psycopg2-testsUpgrade python2-mockUpgrade python2-numpy-f2pyUpgrade python2-babelUpgrade python2-rpm-macrosUpgrade python2-urllib3Upgrade python-virtualenvUpgrade platform-python-pipUpgrade python2-pytzUpgrade python2-sixUpgrade python3-pipUpgrade python2-chardetUpgrade python2-setuptools-wheelUpgrade python2-pyyamlUpgrade python2-wheelUpgrade python2-wheel-wheelUpgrade python2-markupsafeUpgrade python2-backportsUpgrade python2-coverageUpgrade python2-bsonUpgrade python2-setuptoolsUpgrade python2-pymongo-gridfsUpgrade python2-toolsUpgrade python2-psycopg2Upgrade python2-dnsUpgrade python2-setuptools_scmUpgrade python2-develUpgrade python2-pytest-mockUpgrade python2-PyMySQLUpgrade python2-pygmentsUpgrade python2-pluggyUpgrade python2-pytestUpgrade python2-numpy-docUpgrade python2-pyUpgrade python2-lxmlUpgrade python2-libsUpgrade python2-idnaUpgrade python2-funcsigsUpgrade python2-docsUpgrade python2-CythonUpgrade python2-tkinterUpgrade python2-attrsUpgrade python2-virtualenvUpgrade python2-numpyUpgrade python2-pip-wheelUpgrade python3-pip-wheelUpgrade python2-ipaddressUpgrade python2-sqlalchemyUpgrade python2-pysocksUpgrade python2-docs-infoUpgrade python2-debugUpgrade python-sqlalchemy-docUpgrade python2Upgrade python2-testUpgrade python2-docutilsUpgrade python2-pymongoUpgrade python2-scipyUpgrade babelUpgrade python2-requests | Nov 12, 2020 | Apr 16, 2019 |
| Redhat_linux | — | Upgrade python2-wheel-wheelUpgrade python2-numpyUpgrade python2-psycopg2-debuginfoUpgrade python-sqlalchemy-docUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pip-wheelUpgrade python2-pymongoUpgrade python2-psycopg2-debugUpgrade python-coverage-debugsourceUpgrade numpy-debugsourceUpgrade python2-debuginfoUpgrade python2-urllib3Upgrade python2-pysocksUpgrade python2Upgrade PyYAML-debugsourceUpgrade python2-wheelUpgrade python2-coverage-debuginfoUpgrade python2-attrsUpgrade python2-pytzUpgrade python2-requestsUpgrade python2-testUpgrade python2-numpy-docUpgrade python2-virtualenvUpgrade python2-chardetUpgrade python2-pytestUpgrade python2-backportsUpgrade python2-docs-infoUpgrade scipy-debugsourceUpgrade python2-pyyaml-debuginfoUpgrade python2-lxmlUpgrade python-pymongo-debugsourceUpgrade python2-jinja2Upgrade python2-setuptoolsUpgrade python3-pip-wheelUpgrade python-psycopg2-docUpgrade python2-pyUpgrade python2-pymongo-gridfsUpgrade python2-pygmentsUpgrade python2-markupsafeNo solution existsUpgrade python2-setuptools_scmUpgrade python3-pipUpgrade python2-tkinterUpgrade python-psycopg2-debugsourceUpgrade Cython-debugsourceUpgrade python2-noseUpgrade python-pymongo-debuginfoUpgrade python-nose-docsUpgrade python2-psycopg2-testsUpgrade python2-bsonUpgrade python-psycopg2-debuginfoUpgrade python2-ipaddressUpgrade python2-sixUpgrade python2-debugUpgrade python-virtualenvUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-coverageUpgrade python2-pyyamlUpgrade python2-numpy-debuginfoUpgrade python2-lxml-debuginfoUpgrade python2-PyMySQLUpgrade python2-scipy-debuginfoUpgrade python2-babelUpgrade python2-pluggyUpgrade python2-psycopg2Upgrade python2-docutilsUpgrade python2-dnsUpgrade python2-idnaUpgrade python2-funcsigsUpgrade python2-bson-debuginfoUpgrade python2-sqlalchemyUpgrade python2-scipyUpgrade python2-pytest-mockUpgrade python2-setuptools-wheelUpgrade python2-numpy-f2pyUpgrade python2-CythonUpgrade platform-python-pipUpgrade python2-rpm-macrosUpgrade python2-mockUpgrade python2-debugsourceUpgrade python2-docsUpgrade python2-develUpgrade python2-Cython-debuginfoUpgrade python-lxml-debugsourceUpgrade python2-libsUpgrade python2-toolsUpgrade babelUpgrade python2-pipUpgrade python2-pymongo-debuginfo | Nov 5, 2020 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade python2-CythonUpgrade python2-sqlalchemyUpgrade python2-psycopg2-debugUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-coverage-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-markupsafeUpgrade python-coverage-debugsourceUpgrade python2-bsonUpgrade python2-psycopg2-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-pymongo-gridfsUpgrade PyYAML-debugsourceUpgrade python-psycopg2-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2-testsUpgrade python-psycopg2-debugsourceUpgrade python2-pymongoUpgrade python2-scipy-debuginfoUpgrade python-psycopg2-docUpgrade python2-psycopg2Upgrade python2-coverageUpgrade python2-pyyamlUpgrade Cython-debugsourceUpgrade python2-pymongo-debuginfoUpgrade python2-scipyUpgrade python-pymongo-debuginfoUpgrade python2-bson-debuginfoUpgrade scipy-debugsource | Mar 12, 2024 | Sep 4, 2020 |
| Suse | — | Upgrade libpython2_7-1_0Upgrade python3-develUpgrade python-demoUpgrade libpython3_4m1_0-32bitUpgrade python3-baseUpgrade python-baseUpgrade python3-doc-devhelpUpgrade python-docUpgrade python3-setuptoolsUpgrade python3-idleUpgrade python3-pipUpgrade python3-toolsUpgrade python3-dbmUpgrade python2-pipUpgrade python3-docUpgrade libpython2_7-1_0-32bitUpgrade python-idleUpgrade python3-setuptools-testUpgrade pythonUpgrade python-tkUpgrade python3-pip-wheelUpgrade python-base-32bitUpgrade python3Upgrade python-doc-pdfUpgrade python2-setuptools-wheelUpgrade python2-pip-wheelUpgrade python39-setuptoolsUpgrade python3-32bitUpgrade python-setuptoolsUpgrade python39-pipUpgrade python3-tkUpgrade python-pipUpgrade python36Upgrade python36-baseUpgrade python-xmlUpgrade python3-cursesUpgrade libpython3_6m1_0-32bitUpgrade python3-base-32bitUpgrade python-cursesUpgrade python3-testsuiteUpgrade python2-setuptoolsUpgrade python3-setuptools-wheelUpgrade libpython3_6m1_0Upgrade python2-setuptools-testUpgrade python-gdbmUpgrade python-32bitUpgrade python-develUpgrade libpython3_4m1_0 | Oct 1, 2020 | Sep 4, 2020 |
| Ubuntu | — | Upgrade python-pipUpgrade python3-pip | Oct 23, 2020 | Sep 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub