The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python2-chardetUpgrade python2-docsUpgrade python2-pyyamlUpgrade python-psycopg2-docUpgrade python2-psycopg2-debugUpgrade python2-pytestUpgrade python2-rpm-macrosUpgrade python2-mockUpgrade python2-psycopg2-testsUpgrade python2-pytzUpgrade python2-ipaddressUpgrade python2-coverageUpgrade python2-sqlalchemyUpgrade python2-attrsUpgrade python2-pyUpgrade python-sqlalchemy-docUpgrade python2-pluggyUpgrade python2-PyMySQLUpgrade python2-idnaUpgrade python2-dnsUpgrade python2-psycopg2Upgrade python2-docutilsUpgrade python2-CythonUpgrade python2-pytest-mockUpgrade python2-pysocksUpgrade python2-setuptools_scmUpgrade python2-funcsigsUpgrade python2-docs-infoUpgrade python2-markupsafeUpgrade python2-requests | May 4, 2022 | Sep 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python-pip-wheelUpgrade python2-pipUpgrade python3-pip | May 26, 2021 | Sep 4, 2020 |
| Centos_linux | — | Upgrade python2-numpy-docUpgrade python2-psycopg2-debuginfoUpgrade python2-sqlalchemyUpgrade python2-wheelUpgrade python2-lxmlUpgrade python2-setuptoolsUpgrade python2-markupsafeUpgrade python-coverage-debugsourceUpgrade python2Upgrade python2-pip-wheelUpgrade python2-pymongoUpgrade python2-dnsUpgrade python2-wheel-wheelUpgrade python2-tkinterUpgrade python2-virtualenvUpgrade python2-numpyUpgrade python2-pygmentsUpgrade python2-mockUpgrade python2-attrsUpgrade python3-pipUpgrade python2-debugsourceUpgrade python2-psycopg2-debugUpgrade python2-pytest-mockUpgrade python2-setuptools_scmUpgrade numpy-debugsourceUpgrade python2-toolsUpgrade python2-pytzUpgrade python2-pymongo-gridfsUpgrade python2-funcsigsUpgrade PyYAML-debugsourceUpgrade scipy-debugsourceUpgrade python3-pip-wheelUpgrade python-sqlalchemy-docUpgrade python2-docs-infoUpgrade python2-pysocksUpgrade python2-scipyUpgrade python2-debuginfoUpgrade python2-PyMySQLUpgrade python2-pymongo-debuginfoUpgrade python2-docutilsUpgrade python2-develUpgrade python2-backportsUpgrade python2-rpm-macrosUpgrade python2-requestsUpgrade python2-psycopg2-testsUpgrade python2-bsonUpgrade python2-testUpgrade python2-pytestUpgrade python2-docsUpgrade babelUpgrade python2-coverageUpgrade python-virtualenvUpgrade python2-noseUpgrade python-nose-docsUpgrade python2-pyyamlUpgrade python-psycopg2-debugsourceUpgrade python2-pyUpgrade python2-lxml-debuginfoUpgrade python2-pipUpgrade python2-chardetUpgrade python-lxml-debugsourceUpgrade python2-ipaddressUpgrade python2-numpy-f2pyUpgrade python2-psycopg2Upgrade python2-scipy-debuginfoUpgrade Cython-debugsourceUpgrade python2-urllib3Upgrade python2-idnaUpgrade python-psycopg2-debuginfoUpgrade python2-jinja2Upgrade python2-pluggyUpgrade python2-setuptools-wheelUpgrade python2-coverage-debuginfoUpgrade python2-backports-ssl_match_hostnameUpgrade python2-pyyaml-debuginfoUpgrade python2-numpy-debuginfoUpgrade python2-sixUpgrade python2-bson-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python-pymongo-debugsourceUpgrade python2-Cython-debuginfoUpgrade python-pymongo-debuginfoUpgrade platform-python-pipUpgrade python-psycopg2-docUpgrade python2-babelUpgrade python2-debugUpgrade python2-CythonUpgrade python2-libs | Nov 5, 2020 | Sep 4, 2020 |
| Debian | — | Upgrade python-pip | Sep 14, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python-pip-wheelUpgrade python3-pipUpgrade python-pipUpgrade python2-pip | Nov 3, 2020 | Sep 4, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python-pip-wheelUpgrade python3-pipUpgrade python-pip | Dec 1, 2020 | Sep 4, 2020 |
| Oracle Solaris | — | Upgrade library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip-39 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-37 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade library/python/pip-27 to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4Upgrade legacy/library/python/pip-35 to version 19.1.1-11.4.30.0.0.88.0 on Solaris 11.4Upgrade library/python/pip to version 20.2.4-11.4.30.0.1.88.0 on Solaris 11.4 | Feb 17, 2021 | Sep 4, 2020 |
| Oracle_linux | — | Upgrade python2-docutilsUpgrade python2-scipyUpgrade python2-debugUpgrade python2-testUpgrade python2-pymongoUpgrade python2-setuptoolsUpgrade python2Upgrade python2-dnsUpgrade python2-sqlalchemyUpgrade python2-pyUpgrade python2-virtualenvUpgrade python2-bsonUpgrade python2-coverageUpgrade python2-develUpgrade python2-setuptools_scmUpgrade babelUpgrade python2-pip-wheelUpgrade python2-markupsafeUpgrade python2-psycopg2Upgrade python2-requestsUpgrade python2-ipaddressUpgrade python2-pytestUpgrade python2-pytest-mockUpgrade python2-pygmentsUpgrade python2-pysocksUpgrade python2-numpy-docUpgrade python2-pluggyUpgrade python2-backportsUpgrade python2-numpyUpgrade python2-tkinterUpgrade python2-PyMySQLUpgrade python2-attrsUpgrade python2-toolsUpgrade python2-docsUpgrade python2-idnaUpgrade python2-docs-infoUpgrade python2-pymongo-gridfsUpgrade python-sqlalchemy-docUpgrade python2-funcsigsUpgrade python2-libsUpgrade python2-CythonUpgrade python2-lxmlUpgrade python3-pip-wheelUpgrade python2-sixUpgrade python2-wheelUpgrade python2-setuptools-wheelUpgrade python2-wheel-wheelUpgrade python2-urllib3Upgrade python2-chardetUpgrade platform-python-pipUpgrade python3-pipUpgrade python-psycopg2-docUpgrade python2-psycopg2-debugUpgrade python2-jinja2Upgrade python-virtualenvUpgrade python2-backports-ssl_match_hostnameUpgrade python-nose-docsUpgrade python2-pyyamlUpgrade python2-psycopg2-testsUpgrade python2-numpy-f2pyUpgrade python2-mockUpgrade python2-noseUpgrade python2-pytzUpgrade python2-pipUpgrade python2-rpm-macrosUpgrade python2-babel | Nov 12, 2020 | Apr 16, 2019 |
| Redhat_linux | — | Upgrade python2-psycopg2-debugUpgrade python2-psycopg2-debuginfoUpgrade python2-chardetUpgrade python-psycopg2-docUpgrade python2Upgrade python2-pysocksUpgrade python2-pytzUpgrade python2-requestsUpgrade python2-virtualenvUpgrade PyYAML-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-pyyaml-debuginfoUpgrade python2-setuptoolsUpgrade python2-lxmlUpgrade python2-pygmentsUpgrade python3-pip-wheelUpgrade python2-markupsafeUpgrade scipy-debugsourceUpgrade python2-setuptools_scmNo solution existsUpgrade python3-pipUpgrade python2-wheelUpgrade python2-testUpgrade python2-attrsUpgrade python-pymongo-debugsourceUpgrade python2-numpy-docUpgrade python-coverage-debugsourceUpgrade python2-pymongo-gridfsUpgrade python2-pip-wheelUpgrade python2-backports-ssl_match_hostnameUpgrade python2-jinja2Upgrade python2-backportsUpgrade python2-wheel-wheelUpgrade python-sqlalchemy-docUpgrade python2-pytestUpgrade python2-urllib3Upgrade python2-tkinterUpgrade python2-numpyUpgrade python2-pymongoUpgrade numpy-debugsourceUpgrade python2-docs-infoUpgrade python2-pyUpgrade python2-debuginfoUpgrade python2-ipaddressUpgrade python-nose-docsUpgrade python-virtualenvUpgrade python2-coverageUpgrade Cython-debugsourceUpgrade python2-noseUpgrade python2-psycopg2Upgrade python2-docutilsUpgrade python2-pluggyUpgrade python2-bson-debuginfoUpgrade python-pymongo-debuginfoUpgrade python2-rpm-macrosUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-docsUpgrade python2-scipyUpgrade python2-develUpgrade python2-CythonUpgrade python2-pytest-mockUpgrade python2-debugUpgrade python2-mockUpgrade python2-debugsourceUpgrade python2-setuptools-wheelUpgrade python2-numpy-f2pyUpgrade python-psycopg2-debugsourceUpgrade python2-Cython-debuginfoUpgrade python2-pyyamlUpgrade python2-toolsUpgrade python2-sixUpgrade python2-bsonUpgrade python2-scipy-debuginfoUpgrade python2-dnsUpgrade platform-python-pipUpgrade python2-idnaUpgrade python2-pipUpgrade python2-funcsigsUpgrade python-lxml-debugsourceUpgrade python2-libsUpgrade python-psycopg2-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-sqlalchemyUpgrade python2-babelUpgrade python2-lxml-debuginfoUpgrade python2-numpy-debuginfoUpgrade python2-PyMySQLUpgrade python2-pymongo-debuginfoUpgrade babel | Nov 5, 2020 | Sep 4, 2020 |
| Rocky_linux | — | Upgrade python2-pymongo-gridfsUpgrade python2-markupsafeUpgrade python2-psycopg2-debuginfoUpgrade python-coverage-debugsourceUpgrade python2-coverage-debuginfoUpgrade python2-Cython-debuginfoUpgrade python2-psycopg2-debug-debuginfoUpgrade python2-CythonUpgrade PyYAML-debugsourceUpgrade python2-psycopg2-debugUpgrade python2-bsonUpgrade python2-sqlalchemyUpgrade python-pymongo-debugsourceUpgrade python2-psycopg2Upgrade python-pymongo-debuginfoUpgrade python-psycopg2-docUpgrade python2-bson-debuginfoUpgrade python-psycopg2-debuginfoUpgrade python2-pyyamlUpgrade Cython-debugsourceUpgrade python2-pymongoUpgrade scipy-debugsourceUpgrade python-psycopg2-debugsourceUpgrade python2-scipyUpgrade python2-pyyaml-debuginfoUpgrade python2-psycopg2-testsUpgrade python2-scipy-debuginfoUpgrade python2-coverageUpgrade python2-pymongo-debuginfo | Mar 12, 2024 | Sep 4, 2020 |
| Suse | — | Upgrade python-pipUpgrade libpython3_4m1_0Upgrade python39-setuptoolsUpgrade python3-tkUpgrade libpython3_6m1_0Upgrade python-develUpgrade python3-setuptools-wheelUpgrade python3-testsuiteUpgrade python-setuptoolsUpgrade python3-cursesUpgrade python3-32bitUpgrade python36Upgrade python36-baseUpgrade libpython3_6m1_0-32bitUpgrade python-cursesUpgrade python3-base-32bitUpgrade python39-pipUpgrade python2-setuptoolsUpgrade python-xmlUpgrade python-gdbmUpgrade python2-setuptools-testUpgrade python-32bitUpgrade pythonUpgrade python-tkUpgrade python3-setuptools-testUpgrade python3Upgrade python-base-32bitUpgrade python2-setuptools-wheelUpgrade python-baseUpgrade python-demoUpgrade python-idleUpgrade libpython2_7-1_0Upgrade libpython3_4m1_0-32bitUpgrade python3-toolsUpgrade python2-pip-wheelUpgrade python3-idleUpgrade python2-pipUpgrade python3-docUpgrade python3-develUpgrade python3-setuptoolsUpgrade libpython2_7-1_0-32bitUpgrade python3-pipUpgrade python3-baseUpgrade python3-doc-devhelpUpgrade python-docUpgrade python3-dbmUpgrade python3-pip-wheelUpgrade python-doc-pdf | Oct 1, 2020 | Sep 4, 2020 |
| Ubuntu | — | Upgrade python3-pipUpgrade python-pip | Oct 23, 2020 | Sep 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub