Lucene search

GoogleOSV:GHSA-GPVV-69J7-GWJ8

HistoryJun 09, 2021 - 5:35 p.m.

Path Traversal in pip

2021-06-0917:35:04

Google

osv.dev

0.003 Low

EPSS

Percentile

65.5%

JSON

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have …/ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.

CPENameOperatorVersion
pipeq19.0.3
pipeq0.7
pipeq1.2
pipeq1.1
pipeq1.5.2
pipeq9.0.1
pipeq0.8.2
pipeq9.0.3
pipeq1.5
pipeq7.0.0

Name	Operator	Version
pip	eq	19.0.3
pip	eq	0.7
pip	eq	1.2
pip	eq	1.1
pip	eq	1.5.2
pip	eq	9.0.1
pip	eq	0.8.2
pip	eq	9.0.3
pip	eq	1.5
pip	eq	7.0.0

Rows per page:

1-10 of 761

References

lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html

lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html

github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace

github.com/pypa/pip

github.com/pypa/pip/compare/19.1.1...19.2

github.com/pypa/pip/issues/6413

lists.debian.org/debian-lts-announce/2020/09/msg00010.html

nvd.nist.gov/vuln/detail/CVE-2019-20916

www.oracle.com/security-alerts/cpuapr2022.html

www.oracle.com/security-alerts/cpujul2022.html

0.003 Low

EPSS

Percentile

65.5%

JSON

Related for OSV:GHSA-GPVV-69J7-GWJ8