p PatchFirst

CVE-2019-20916

CVE-2019-20916

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

CVSS 7.5 · High · EPSS 3.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • python-pip Debian:12

    Affected ranges
    • ECOSYSTEM: < 20.0.2-1

    Update to 20.0.2-1

  • python-pip Debian:13

    Affected ranges
    • ECOSYSTEM: < 20.0.2-1

    Update to 20.0.2-1

  • python-pip Debian:14

    Affected ranges
    • ECOSYSTEM: < 20.0.2-1

    Update to 20.0.2-1

  • pip PyPI

    Versions
    • 0.2
    • 0.2.1
    • 0.3
    • 0.3.1
    • 0.4
    • 0.5
    • 0.5.1
    • 0.6
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.7
    • 0.7.1
    • 0.7.2
    • 0.8
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.2
    • 1.2.1
    • 1.3
    • 1.3.1
    • 1.4
    • 1.4.1
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.5.5
    • 1.5.6
    • 10.0.0
    • 10.0.0b1
    • 10.0.0b2
    • 10.0.1
    • 18.0
    • 18.1
    • 19.0
    • 19.0.1
    • 19.0.2
    • 19.0.3
    • 19.1
    • 19.1.1
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 6.0.7
    • 6.0.8
    • 6.1.0
    • 6.1.1
    • 7.0.0
    • 7.0.1
    • 7.0.2
    • 7.0.3
    • 7.1.0
    • 7.1.1
    • 7.1.2
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.1.0
    • 8.1.1
    • 8.1.2
    • 9.0.0
    • 9.0.1
    • 9.0.2
    • 9.0.3
    Affected ranges
    • ECOSYSTEM: < 19.2

    Update to 19.2

  • pip PyPI

    Versions
    • 0.2
    • 0.2.1
    • 0.3
    • 0.3.1
    • 0.4
    • 0.5
    • 0.5.1
    • 0.6
    • 0.6.1
    • 0.6.2
    • 0.6.3
    • 0.7
    • 0.7.1
    • 0.7.2
    • 0.8
    • 0.8.1
    • 0.8.2
    • 0.8.3
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.2
    • 1.2.1
    • 1.3
    • 1.3.1
    • 1.4
    • 1.4.1
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.5.5
    • 1.5.6
    • 6.0
    • 6.0.1
    • 6.0.2
    • 6.0.3
    • 6.0.4
    • 6.0.5
    • 6.0.6
    • 6.0.7
    • 6.0.8
    • 6.1.0
    • 6.1.1
    • 7.0.0
    • 7.0.1
    • 7.0.2
    • 7.0.3
    • 7.1.0
    • 7.1.1
    • 7.1.2
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.1.0
    • 8.1.1
    • 8.1.2
    • 9.0.0
    • 9.0.1
    • 9.0.2
    • 9.0.3
    • 10.0.0b1
    • 10.0.0b2
    • 10.0.0
    • 10.0.1
    • 18.0
    • 18.1
    • 19.0
    • 19.0.1
    • 19.0.2
    • 19.0.3
    • 19.1
    • 19.1.1
    Affected ranges
    • GIT: < a4c735b14a62f9cb864533808ac63936704f2ace
    • ECOSYSTEM: < 19.2

    Update to 19.2

  • python-pip Ubuntu:Pro:14.04:LTS

    Versions
    • 1.4.1-2
    • 1.5.4-1
    • 1.5.4-1ubuntu1
    • 1.5.4-1ubuntu3
    • 1.5.4-1ubuntu4
    • 1.5.4-1ubuntu4+esm1
    • 1.5.4-1ubuntu4+esm2
    • 1.5.4-1ubuntu4+esm3
    • 1.5.4-1ubuntu4+esm4
    • 1.5.4-1ubuntu4+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.6-7ubuntu1
    • 1.5.6-7ubuntu2
    • 8.0.2-7
    • 8.0.3-1
    • 8.0.3-2
    • 8.1.0-1
    • 8.1.0-2
    • 8.1.1-1
    • 8.1.1-2
    • 8.1.1-2ubuntu0.1
    • 8.1.1-2ubuntu0.2
    • 8.1.1-2ubuntu0.4
    • 8.1.1-2ubuntu0.6
    • 8.1.1-2ubuntu0.6+esm2
    • 8.1.1-2ubuntu0.6+esm3
    • 8.1.1-2ubuntu0.6+esm4
    • 8.1.1-2ubuntu0.6+esm5
    • 8.1.1-2ubuntu0.6+esm6
    • 8.1.1-2ubuntu0.6+esm8
    • 8.1.1-2ubuntu0.6+esm10
    • 8.1.1-2ubuntu0.6+esm11
    • 8.1.1-2ubuntu0.6+esm12
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:18.04:LTS

    Versions
    • 9.0.1-2
    • 9.0.1-2.3~ubuntu1
    • 9.0.1-2.3~ubuntu1.18.04.1
    • 9.0.1-2.3~ubuntu1.18.04.2
    • 9.0.1-2.3~ubuntu1.18.04.3
    Affected ranges
    • ECOSYSTEM: < 9.0.1-2.3~ubuntu1.18.04.4

    Update to 9.0.1-2.3~ubuntu1.18.04.4

Original sources

Check your server →