backlogprocessing (>=0.0.0, <=0.0.2), commit-helper (>=3.4.15, <=3.4.16) +17 more potentially affected by CVE-2019-20916 via pip (>=19.0.2, <=19.1.1)

pip PYPI version =19.0.2, =0.0.0, =3.4.15, =2.3.0.18070322, =2.3.0.18072813, =2.3.0.18073020, =0.0.37, =2.3.7.19022609, =2.3.4.19022609, =2.3.2.19022615, =2.3.0.18070322, =0.1.7, =1.4.0, =1.4.4, =2019.2.25, =2019.7.21 and more Source cves: CVE-2019-20916 Source advisory: GHSA-GPVV-69J7-GWJ8...

nexus-uploader (1.0.14), uranium (>=0.2.38, <=1.1.0) potentially affected by CVE-2019-20916 via pip (8.1.1)

pip PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - nexus-uploader 1.0.14 - uranium =0.2.38, =1.1.0 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

uranium (>=0.2.23, <=0.2.34) potentially affected by CVE-2019-20916 via pip (7.1.2)

pip PYPI version 7.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - uranium =0.2.23, =0.2.34 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

auto-dl (0.1.1), chalice (>=1.0.1, <=1.2.2) +14 more potentially affected by CVE-2019-20916 via pip (9.0.3)

pip PYPI version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - auto-dl 0.1.1 - chalice =1.0.1, =1.5.119, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =1.5.6, =0.2.0, =2.1.6.16123016, =2.1.1.16070814,...

cli-pipeline (1.5.114), medikit (0.5.20) potentially affected by CVE-2019-20916 via pip (10.0.0b2)

pip PYPI version 10.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cli-pipeline 1.5.114 - medikit 0.5.20 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2019-20916 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

GHSA-GPVV-69J7-GWJ8 Path Traversal in pip

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py. ...

lisa-api (0.5.0), lisa-plugins-shopping (>=0.1.9, <=0.2.0) +2 more potentially affected by CVE-2019-20916 via pip (1.5.6)

pip PYPI version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - lisa-api 0.5.0 - lisa-plugins-shopping =0.1.9, =1.0.0rc1, =1.0.0, =1.1.2 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

chalice (>=1.2.3, <=1.6.0), httptesting (>=1.0.1, <=1.0.2) +4 more potentially affected by CVE-2019-20916 via pip (10.0.1)

pip PYPI version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.2.3, =1.0.1, =4.0.0, =4.0.0, =4.0.1 - zerv 0.1.0 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

khan-mongo (0.1.6), uranium (>=0.2.35, <=0.2.37) potentially affected by CVE-2019-20916 via pip (8.1.2)

pip PYPI version 8.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - khan-mongo 0.1.6 - uranium =0.2.35, =0.2.37 Source cves: CVE-2019-20916 Source advisory: OSV:GHSA-GPVV-69J7-GWJ8...

SUSE: Security Advisory (SUSE-SU-2020:3599-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:3737-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2020:2698-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Exploit for Improper Input Validation in Pypa Pip

CVE-2021-3572 This repository is designed for testing CVE-202...

Exploit for Improper Input Validation in Pypa Pip

CVE-2021-3572 This repository is designed for testing CVE-202...

Fedora: Security Advisory for python-pip (FEDORA-2021-1b6848f31c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-3572

A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity...

SUSE-SU-2021:1779-1 Security update for python-httplib2

This update for python-httplib2 contains the following fixes: Security fixes included in this update: - CVE-2021-21240: Fixed a regular expression denial of service via malicious header bsc1182053. - CVE-2020-11078: Fixed an issue where an attacker could change request headers and body bsc1171998...

Fedora: Security Advisory for python-pip (FEDORA-2021-3f378dda90)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Amazon Linux 2 : python-pip (ALAS-2021-1639)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1639 advisory. The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting...