CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Affected products

Almalinux, Astra Linux, Centos, Red Hat, Red Os, Rocky Linux, Suse, Ubuntu

Pypa Pip

< 19.2

Fix

Available

CVSS 3.1

7.5 HIGH

EPSS

3.0% (86th percentile)

Weakness

CWE-22

NVD status

Modified

Published

2020-09-04

No exploit for CVE-2019-20916 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.