vulnerability
Red Hat: CVE-2019-20916: directory traversal in _download_http_url() function in src/pip/_internal/download.py (Multiple Advisories)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | 2020-09-04 | 2020-11-05 | 2023-12-15 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
2020-09-04
Added
2020-11-05
Modified
2023-12-15
Description
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
Solution(s)
redhat-upgrade-babelredhat-upgrade-cython-debugsourceredhat-upgrade-numpy-debugsourceredhat-upgrade-platform-python-pipredhat-upgrade-python-coverage-debugsourceredhat-upgrade-python-lxml-debugsourceredhat-upgrade-python-nose-docsredhat-upgrade-python-psycopg2-debuginforedhat-upgrade-python-psycopg2-debugsourceredhat-upgrade-python-psycopg2-docredhat-upgrade-python-pymongo-debuginforedhat-upgrade-python-pymongo-debugsourceredhat-upgrade-python-sqlalchemy-docredhat-upgrade-python-virtualenvredhat-upgrade-python2redhat-upgrade-python2-attrsredhat-upgrade-python2-babelredhat-upgrade-python2-backportsredhat-upgrade-python2-backports-ssl_match_hostnameredhat-upgrade-python2-bsonredhat-upgrade-python2-bson-debuginforedhat-upgrade-python2-chardetredhat-upgrade-python2-coverageredhat-upgrade-python2-coverage-debuginforedhat-upgrade-python2-cythonredhat-upgrade-python2-cython-debuginforedhat-upgrade-python2-debugredhat-upgrade-python2-debuginforedhat-upgrade-python2-debugsourceredhat-upgrade-python2-develredhat-upgrade-python2-dnsredhat-upgrade-python2-docsredhat-upgrade-python2-docs-inforedhat-upgrade-python2-docutilsredhat-upgrade-python2-funcsigsredhat-upgrade-python2-idnaredhat-upgrade-python2-ipaddressredhat-upgrade-python2-jinja2redhat-upgrade-python2-libsredhat-upgrade-python2-lxmlredhat-upgrade-python2-lxml-debuginforedhat-upgrade-python2-markupsaferedhat-upgrade-python2-mockredhat-upgrade-python2-noseredhat-upgrade-python2-numpyredhat-upgrade-python2-numpy-debuginforedhat-upgrade-python2-numpy-docredhat-upgrade-python2-numpy-f2pyredhat-upgrade-python2-pipredhat-upgrade-python2-pip-wheelredhat-upgrade-python2-pluggyredhat-upgrade-python2-psycopg2redhat-upgrade-python2-psycopg2-debugredhat-upgrade-python2-psycopg2-debug-debuginforedhat-upgrade-python2-psycopg2-debuginforedhat-upgrade-python2-psycopg2-testsredhat-upgrade-python2-pyredhat-upgrade-python2-pygmentsredhat-upgrade-python2-pymongoredhat-upgrade-python2-pymongo-debuginforedhat-upgrade-python2-pymongo-gridfsredhat-upgrade-python2-pymysqlredhat-upgrade-python2-pysocksredhat-upgrade-python2-pytestredhat-upgrade-python2-pytest-mockredhat-upgrade-python2-pytzredhat-upgrade-python2-pyyamlredhat-upgrade-python2-pyyaml-debuginforedhat-upgrade-python2-requestsredhat-upgrade-python2-rpm-macrosredhat-upgrade-python2-scipyredhat-upgrade-python2-scipy-debuginforedhat-upgrade-python2-setuptoolsredhat-upgrade-python2-setuptools-wheelredhat-upgrade-python2-setuptools_scmredhat-upgrade-python2-sixredhat-upgrade-python2-sqlalchemyredhat-upgrade-python2-testredhat-upgrade-python2-tkinterredhat-upgrade-python2-toolsredhat-upgrade-python2-urllib3redhat-upgrade-python2-virtualenvredhat-upgrade-python2-wheelredhat-upgrade-python2-wheel-wheelredhat-upgrade-python3-pipredhat-upgrade-python3-pip-wheelredhat-upgrade-pyyaml-debugsourceredhat-upgrade-scipy-debugsource
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.