You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVE-2019-20916 - High Severity Vulnerability
The Python package installer
Library home page: https://github.com/pypa/pip.git
Found in HEAD commit: 989085aee421ad91c5e038a0c5b86552fc4dcb71
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
Publish Date: 2020-09-04
URL: CVE-2019-20916
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20916
Release Date: 2020-09-04
Fix Resolution: 19.2
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: