106 matches found
GHSA-MQ26-G339-26XF Command Injection in pip when used with Mercurial
When installing a package from a Mercurial VCS URL, e.g. pip install hg+..., with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the hg clone call e.g. --config. Controlling the Mercurial configuration can modify how and which...
DEBIAN-CVE-2023-5752
When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call ie "--config". Controlling the Mercurial configuration can modify how and which...
PT-2023-36240 · Unknown · Python-Pip
Name of the Vulnerable Software and Affected Versions: python-pip affected versions not specified Description: The issue with python-pip is related to the presence of .exe files in the RPM package, which could cause problems with security scanners. Recommendations: At the moment, there is no...
PT-2023-36241 · Unknown · Python-Pip
Name of the Vulnerable Software and Affected Versions: python-pip affected versions not specified Description: The issue with python-pip is related to the presence of .exe files in the RPM package, which could cause problems with security scanners. Recommendations: At the moment, there is no...
SUSE: Security Advisory (SUSE-SU-2023:0516-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE CVE-2013-1629
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation...
SUSE CVE-2013-1888
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory...
SUSE CVE-2014-8991
pip 1.3 through 1.5.6 allows local users to cause a denial of service prevention of package installation by creating a /tmp/pip-build- file for another user...
SUSE CVE-2018-20225
An issue was discovered in pip all versions because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not...
SUSE CVE-2019-20916
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...
K000130545: Python-pip vulnerability CVE-2018-20225
Security Advisory Description DISPUTED An issue was discovered in pip all versions because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitati...
AlmaLinux 8 : python-pip (ALSA-2021:4455)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:4455 advisory. - A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different...
SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2021:4002-1)
The remote SUSE Linux SLED15 / SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:4002-1 advisory. - CVE-2021-3572: Fixed incorrect handling of unicode separators in git references bsc1186819. Tenable has extracted the preceding description...
MGASA-2021-0371 Updated python-pip packages fix security vulnerabilities
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository CVE-2021-3572. The bundled python-urllib3 was also vulnerable to: The urllib3 library 1.26.x before 1.26.4 for...
Exploit for Improper Input Validation in Pypa Pip
CVE-2021-3572 This repository is designed for testing CVE-202...
Ubuntu 20.04 LTS : pip vulnerability (USN-4961-1)
The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4961-1 advisory. It was discovered that pip incorrectly handled unicode separators in git references. A remote attacker could possibly use this issue to install a different revisi...
Ubuntu 18.04 LTS : pip vulnerability (USN-4601-1)
The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4601-1 advisory. It was discovered that pip did not properly sanitize the filename during pip install. A remote attacker could possible use this issue to read and write arbitrary...
Python pip directory traversal vulnerability
Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A directory traversal vulnerability exists in Python pip versions prior to 19.2. The vulnerability stems...
DEBIAN-CVE-2019-20916
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...
CVE-2018-20225
An issue was discovered in pip all versions because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not...