SUSE-SU-2020:2784-1 Security update for python-pip

This update for python-pip fixes the following issues: - CVE-2019-20916: Fixed a directory traversal in downloadhttpurl bsc1176262...

SUSE-SU-2020:2726-1 Security update for python-pip

This update for python-pip fixes the following issues: - CVE-2019-20916: Fixed a directory traversal in downloadhttpurl bsc1176262...

SUSE-SU-2020:2698-1 Security update for python-pip

This update for python-pip fixes the following issues: - CVE-2019-20916: Fixed a directory traversal in downloadhttpurl bsc1176262...

Exploit for CVE-2020-1472

CVE-2020-1472 - Zero-Logon POC !alt texthttps://github.com...

Debian DLA-2370-1 : python-pip security update

It was discovered that there was a directory traversal attack in pip, the Python package installer. When an URL was given in an install command, as a Content-Disposition header was permitted to have '../' components in their filename, arbitrary local files eg. /root/.ssh/authorizedkeys could be...

[SECURITY] [DLA 2370-1] python-pip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2370-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 11, 2020 https://wiki.debian.org/LTS -...

DLA-2370-1 python-pip - security update

Bulletin has no description...

CVE-2019-20916

A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an...

Python pip directory traversal vulnerability

Python is an open source, object-oriented programming language from the Python Software Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A directory traversal vulnerability exists in Python pip versions prior to 19.2. The vulnerability stems...

CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

DEBIAN-CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

Directory traversal

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

PYSEC-2020-173

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

auto-dl (0.1.1), chalice (>=1.0.1, <=1.2.2) +14 more potentially affected by CVE-2019-20916 via pip (9.0.3)

pip PYPI version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - auto-dl 0.1.1 - chalice =1.0.1, =1.5.119, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =1.5.6, =0.2.0, =2.1.6.16123016, =2.1.1.16070814,...

khan-mongo (0.1.6), uranium (>=0.2.35, <=0.2.37) potentially affected by CVE-2019-20916 via pip (8.1.2)

pip PYPI version 8.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - khan-mongo 0.1.6 - uranium =0.2.35, =0.2.37 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

PYSEC-2020-173

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

backlogprocessing (>=0.0.0, <=0.0.2), commit-helper (>=3.4.15, <=3.4.16) +17 more potentially affected by CVE-2019-20916 via pip (>=19.0.2, <=19.1.1)

pip PYPI version =19.0.2, =0.0.0, =3.4.15, =2.3.0.18070322, =2.3.0.18072813, =2.3.0.18073020, =0.0.37, =2.3.7.19022609, =2.3.4.19022609, =2.3.2.19022615, =2.3.0.18070322, =0.1.7, =1.4.0, =1.4.4, =2019.2.25, =2019.7.21 and more Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

nexus-uploader (1.0.14), uranium (>=0.2.38, <=1.1.0) potentially affected by CVE-2019-20916 via pip (8.1.1)

pip PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - nexus-uploader 1.0.14 - uranium =0.2.38, =1.1.0 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...