CVE-2019-20916
EUVD-2020-013804.09.2020, 20:15
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| pypa | pip | 𝑥 < 19.2 |
| opensuse | leap | 15.1 |
| opensuse | leap | 15.2 |
| debian | debian_linux | 9.0 |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 22.1.0 |
| oracle | communications_cloud_native_core_policy | 1.15.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References