The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-requestsUpgrade python2-pluggyUpgrade python2-coverageUpgrade python2-docs-infoUpgrade python2-docutilsUpgrade python2-pytzUpgrade python2-markupsafeUpgrade python2-ipaddressUpgrade python2-pysocksUpgrade python2-attrsUpgrade python2-PyMySQLUpgrade python2-dnsUpgrade python2-sqlalchemyUpgrade python2-pyUpgrade python2-setuptools_scmUpgrade python2-CythonUpgrade python2-psycopg2Upgrade python-sqlalchemy-docUpgrade python2-funcsigsUpgrade python2-idnaUpgrade python2-pytest-mockUpgrade python2-chardetUpgrade python2-psycopg2-testsUpgrade python2-rpm-macrosUpgrade python-psycopg2-docUpgrade python2-pytestUpgrade python2-psycopg2-debugUpgrade python2-mockUpgrade python2-pyyamlUpgrade python2-docs | May 4, 2022 | Sep 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python-pip-wheelUpgrade python2-pipUpgrade python3-pip | May 26, 2021 | Sep 4, 2020 |
| Centos_linux | — | Upgrade python2-wheelUpgrade python2-requestsUpgrade python2-PyMySQLUpgrade python2-pysocksUpgrade python2-rpm-macrosUpgrade python2-lxmlUpgrade python2-tkinterUpgrade python3-pipUpgrade python2-pymongo-debuginfoUpgrade python2-docsUpgrade python2-numpyUpgrade python2-pytzUpgrade python-coverage-debugsourceUpgrade python2-debuginfoUpgrade python2Upgrade python2-setuptoolsUpgrade python2-psycopg2-testsUpgrade python2-bsonUpgrade python2-docutilsUpgrade python2-toolsUpgrade python2-pip-wheelUpgrade python2-markupsafeUpgrade python2-backportsUpgrade python-sqlalchemy-docUpgrade python2-mockUpgrade python2-develUpgrade python2-dnsUpgrade python3-pip-wheelUpgrade python2-scipyUpgrade python2-pygmentsUpgrade python2-wheel-wheelUpgrade babelUpgrade python2-pytest-mockUpgrade python2-setuptools_scmUpgrade python2-pymongoUpgrade python2-pymongo-gridfsUpgrade python2-virtualenvUpgrade numpy-debugsourceUpgrade python2-psycopg2-debugUpgrade scipy-debugsourceUpgrade python2-numpy-docUpgrade python2-debugsourceUpgrade python2-pytestUpgrade python2-sqlalchemyUpgrade python2-psycopg2-debuginfoUpgrade python2-attrsUpgrade PyYAML-debugsourceUpgrade python2-testUpgrade python2-docs-infoUpgrade python2-funcsigsUpgrade python-psycopg2-docUpgrade python2-chardetUpgrade python2-Cython-debuginfoUpgrade python2-setuptools-wheelUpgrade python2-urllib3Upgrade python2-ipaddressUpgrade python-nose-docsUpgrade python2-pyyamlUpgrade python2-noseUpgrade python2-sixUpgrade python-pymongo-debugsourceUpgrade python2-libsUpgrade python-psycopg2-debuginfoUpgrade python-psycopg2-debugsourceUpgrade python2-backports-ssl_match_hostnameUpgrade platform-python-pipUpgrade python2-numpy-f2pyUpgrade python2-babelUpgrade python2-coverageUpgrade python2-psycopg2Upgrade Cython-debugsourceUpgrade python2-idnaUpgrade python2-scipy-debuginfoUpgrade python2-debugUpgrade python2-coverage-debuginfoUpgrade python2-bson-debuginfoUpgrade python-virtualenvUpgrade python2-lxml-debuginfoUpgrade python2-pluggyUpgrade python2-jinja2Upgrade python2-pyUpgrade python2-numpy-debuginfoUpgrade python2-pipUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python-lxml-debugsourceUpgrade python-pymongo-debuginfoUpgrade python2-Cython | Nov 5, 2020 | Sep 4, 2020 |
| Debian | — | Upgrade python-pip | Sep 14, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-pip-wheelUpgrade python3-pipUpgrade python2-pipUpgrade python-pip | Nov 3, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python-pip-wheelUpgrade python3-pipUpgrade python-pip | Dec 1, 2020 | Sep 4, 2020 |
| Oracle Solaris | — | Upgrade library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip-39 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-37 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-27 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade legacy/library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade python2-pytestUpgrade python2-numpy-docUpgrade python2-pygmentsUpgrade python2-numpyUpgrade python2-pip-wheelUpgrade python3-pip-wheelUpgrade python2-pytest-mockUpgrade python2-testUpgrade python2-docutilsUpgrade python2-scipyUpgrade python2-setuptools_scmUpgrade python2Upgrade python2-PyMySQLUpgrade python2-pysocksUpgrade python2-bsonUpgrade python2-dnsUpgrade python2-develUpgrade python2-CythonUpgrade python2-coverageUpgrade python2-libsUpgrade python2-tkinterUpgrade python2-docsUpgrade python-sqlalchemy-docUpgrade python2-virtualenvUpgrade python2-lxmlUpgrade python2-debugUpgrade python2-pluggyUpgrade python2-pyUpgrade python2-funcsigsUpgrade python2-setuptoolsUpgrade python2-psycopg2Upgrade python2-attrsUpgrade python2-markupsafeUpgrade python2-docs-infoUpgrade python2-requestsUpgrade python2-toolsUpgrade babelUpgrade python2-pymongoUpgrade python2-sqlalchemyUpgrade python2-backportsUpgrade python2-pymongo-gridfsUpgrade python2-idnaUpgrade python2-ipaddressUpgrade python2-psycopg2-debugUpgrade python2-noseUpgrade python2-mockUpgrade python2-jinja2Upgrade python2-sixUpgrade python-virtualenvUpgrade python2-pyyamlUpgrade python2-psycopg2-testsUpgrade python2-backports-ssl_match_hostnameUpgrade python-nose-docsUpgrade python-psycopg2-docUpgrade python2-numpy-f2pyUpgrade python2-rpm-macrosUpgrade python2-babelUpgrade python2-wheelUpgrade python2-setuptools-wheelUpgrade python3-pipUpgrade python2-urllib3Upgrade platform-python-pipUpgrade python2-wheel-wheelUpgrade python2-chardetUpgrade python2-pipUpgrade python2-pytz | Nov 12, 2020 | Apr 16, 2019 |
| Redhat_linux | — | Upgrade python-sqlalchemy-docUpgrade python2-numpyNo solution existsUpgrade python2Upgrade python2-attrsUpgrade python-psycopg2-docUpgrade python2-psycopg2-debuginfoUpgrade python2-backportsUpgrade python2-docs-infoUpgrade PyYAML-debugsourceUpgrade python2-wheelUpgrade python2-coverage-debuginfoUpgrade python2-virtualenvUpgrade python2-setuptoolsUpgrade python2-debuginfoUpgrade python2-markupsafeUpgrade python2-pytzUpgrade python3-pipUpgrade python2-setuptools_scmUpgrade python2-tkinterUpgrade python2-pymongoUpgrade python2-pysocksUpgrade python2-lxmlUpgrade python2-wheel-wheelUpgrade numpy-debugsourceUpgrade python2-pyUpgrade python3-pip-wheelUpgrade python2-pytestUpgrade python2-urllib3Upgrade python2-psycopg2-debugUpgrade python2-pyyaml-debuginfoUpgrade python2-requestsUpgrade python-pymongo-debugsourceUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pygmentsUpgrade scipy-debugsourceUpgrade python2-testUpgrade python2-jinja2Upgrade python-coverage-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-pip-wheelUpgrade python2-numpy-docUpgrade python2-chardetUpgrade python-nose-docsUpgrade python2-rpm-macrosUpgrade python2-coverageUpgrade python2-pyyamlUpgrade Cython-debugsourceUpgrade python2-pytest-mockUpgrade python2-debugsourceUpgrade python2-mockUpgrade python2-PyMySQLUpgrade python2-numpy-debuginfoUpgrade python2-docutilsUpgrade python2-scipy-debuginfoUpgrade python2-scipyUpgrade python2-numpy-f2pyUpgrade python2-funcsigsUpgrade platform-python-pipUpgrade python2-setuptools-wheelUpgrade python2-libsUpgrade python2-pipUpgrade python2-idnaUpgrade python-lxml-debugsourceUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-debugUpgrade python2-psycopg2Upgrade python2-ipaddressUpgrade python2-docsUpgrade python2-CythonUpgrade python-pymongo-debuginfoUpgrade python2-develUpgrade python-psycopg2-debugsourceUpgrade python2-sixUpgrade python2-noseUpgrade python2-bson-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-bsonUpgrade python2-pymongo-debuginfoUpgrade python2-sqlalchemyUpgrade python2-psycopg2-testsUpgrade python2-pluggyUpgrade python-virtualenvUpgrade python2-babelUpgrade python2-dnsUpgrade python2-lxml-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-toolsUpgrade babel | Nov 5, 2020 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade python2-psycopg2-debuginfoUpgrade PyYAML-debugsourceUpgrade python-pymongo-debugsourceUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-coverage-debuginfoUpgrade python2-markupsafeUpgrade python2-pymongo-gridfsUpgrade python-coverage-debugsourceUpgrade python2-CythonUpgrade python2-bsonUpgrade python2-sqlalchemyUpgrade python2-psycopg2-debugUpgrade python2-Cython-debuginfoUpgrade Cython-debugsourceUpgrade python2-bson-debuginfoUpgrade python2-pyyamlUpgrade python2-pymongo-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-coverageUpgrade python-psycopg2-debugsourceUpgrade python2-scipyUpgrade python-psycopg2-debuginfoUpgrade scipy-debugsourceUpgrade python2-pymongoUpgrade python-pymongo-debuginfoUpgrade python2-scipy-debuginfoUpgrade python2-psycopg2Upgrade python-psycopg2-docUpgrade python2-psycopg2-tests | Mar 12, 2024 | Sep 4, 2020 |
| Suse | — | Upgrade python-baseUpgrade python-idleUpgrade python3-doc-devhelpUpgrade python3-docUpgrade libpython3_4m1_0-32bitUpgrade python-demoUpgrade python2-pipUpgrade pythonUpgrade python3-toolsUpgrade python3-dbmUpgrade python-docUpgrade python-base-32bitUpgrade python3-pip-wheelUpgrade libpython2_7-1_0Upgrade python3-baseUpgrade python-tkUpgrade python2-setuptools-wheelUpgrade python3-develUpgrade python3-setuptoolsUpgrade python3-setuptools-testUpgrade python-doc-pdfUpgrade python2-pip-wheelUpgrade python3-idleUpgrade libpython2_7-1_0-32bitUpgrade python3-pipUpgrade python3Upgrade python-gdbmUpgrade libpython3_6m1_0Upgrade python-xmlUpgrade python-develUpgrade python3-32bitUpgrade python3-setuptools-wheelUpgrade python39-setuptoolsUpgrade python-pipUpgrade python-cursesUpgrade python3-base-32bitUpgrade libpython3_6m1_0-32bitUpgrade python3-testsuiteUpgrade python2-setuptools-testUpgrade python2-setuptoolsUpgrade python-setuptoolsUpgrade python-32bitUpgrade python39-pipUpgrade python36-baseUpgrade python3-cursesUpgrade python36Upgrade libpython3_4m1_0Upgrade python3-tk | Oct 1, 2020 | Sep 4, 2020 |
| Ubuntu | — | Upgrade python3-pipUpgrade python-pip | Oct 23, 2020 | Sep 4, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub