p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de python-pip

Vulnerabilidades publicadas para python-pip en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 6

  1. USN-5821-4

    Sin evaluarCorrección disponible

    python-pip regression

    USN-5821-3 fixed a vulnerability in pip. The update introduced a minor regression in Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Sebastian Chnelik discovered that wheel incorrectly handled certain file names when validated against a regex expression. An attacker could possibly use this issue to cause a denial of service.

    python-pipSistemas operativos
    • Actualiza a 9.0.1-2.3~ubuntu1.18.04.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2022-40897

    Media · CVSS 5.9EPSS 2,63%Corrección disponible

    CVE-2022-40897

    Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

    python-pipSistemas operativos
    • Actualiza a 9.0.1-2.3~ubuntu1.18.04.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2020-26137

    Media · CVSS 6.5EPSS 2,27%Corrección disponible

    CVE-2020-26137

    urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.

    python-pipSistemas operativos
    • Actualiza a 9.0.1-2.3~ubuntu1.18.04.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2019-20916

    Alta · CVSS 7.5EPSS 3%Corrección disponible

    CVE-2019-20916

    The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

    python-pipSistemas operativos
    • Actualiza a 9.0.1-2.3~ubuntu1.18.04.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2018-18074

    Alta · CVSS 7.5EPSS 7,44%Corrección disponible

    CVE-2018-18074

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

    python-pipSistemas operativos
    • Actualiza a 9.0.1-2.3~ubuntu1.18.04.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →