CVE DATABASE / CVE-2019-20916
CVE-2019-20916
CVSS 7.5 · HIGH
Summary
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVSS 3.1 breakdown
| Base score | 7.5 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity | HIGH |
| Availability | NONE |
Weakness type (CWE)
Affected products
Pypa pipOpensuse leapDebian debian linuxOracle communications cloud native core network function cloud native environmentOracle communications cloud native core policy
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html
- https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace
- https://github.com/pypa/pip/compare/19.1.1...19.2
- https://github.com/pypa/pip/issues/6413
- https://lists.debian.org/debian-lts-announce/2020/09/msg00010.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Data: NIST NVD. NVD last modified 2024-11-21. Always verify against the vendor advisory before acting.