uranium (>=0.2.23, <=0.2.34) potentially affected by CVE-2019-20916 via pip (7.1.2)

pip PYPI version 7.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - uranium =0.2.23, =0.2.34 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2019-20916 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

magellan (1.0.0b0), sprinter (1.4.1) potentially affected by CVE-2019-20916 via pip (6.1.1)

pip PYPI version 6.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - magellan 1.0.0b0 - sprinter 1.4.1 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

oriole-test (0.2.2) potentially affected by CVE-2019-20916 via pip (9.0.2)

pip PYPI version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - oriole-test 0.2.2 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

chalice (>=1.6.2, <=1.8.0), commit-helper (3.4.13) +6 more potentially affected by CVE-2019-20916 via pip (18.1.0)

pip PYPI version 18.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.6.2, =0.1.6, =0.0.3, =3.2.0, =4.0.0 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

lisa-api (0.5.0), lisa-plugins-shopping (>=0.1.9, <=0.2.0) +2 more potentially affected by CVE-2019-20916 via pip (1.5.6)

pip PYPI version 1.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - lisa-api 0.5.0 - lisa-plugins-shopping =0.1.9, =1.0.0rc1, =1.0.0, =1.1.2 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

chalice (>=1.2.3, <=1.6.0), httptesting (>=1.0.1, <=1.0.2) +4 more potentially affected by CVE-2019-20916 via pip (10.0.1)

pip PYPI version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.2.3, =1.0.1, =4.0.0, =4.0.0, =4.0.1 - zerv 0.1.0 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

cli-pipeline (1.5.114), medikit (0.5.20) potentially affected by CVE-2019-20916 via pip (10.0.0b2)

pip PYPI version 10.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cli-pipeline 1.5.114 - medikit 0.5.20 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

sprinter (1.4.2), uranium (>=0.2.8, <=0.2.22) +1 more potentially affected by CVE-2019-20916 via pip (7.1.0)

pip PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - sprinter 1.4.2 - uranium =0.2.8, =0.2.22 - yt-formula-node 0.0.4 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

bentodev (>=0.1.17, <=2018.11.2), clacks (0.1.1.dev845) +6 more potentially affected by CVE-2019-20916 via pip (9.0.1)

pip PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - bentodev =0.1.17, =2.4.0, =0.2.0, =0.1.4, =1.2.0, =1.11.0 Source cves: CVE-2019-20916 Source advisory: OSV:PYSEC-2020-173...

PYSEC-2020-192

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

CVE-2019-20916

The CVE-2019-20916 issue affects the Python pip package prior to 19.2. It enables Directory Traversal when a URL is provided in an install command due to a Content-Disposition header containing ../ in a filename, demonstrated by overwriting /root/.ssh/authorized_keys. The vulnerability is in _int...

CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

auto-dl (0.1.1), aws-lambda-sls (0.1.0) +53 more potentially affected by CVE-2019-20916 via pip (>=1.5.6, <=19.1.1)

pip PYPI version =1.5.6, =0.0.0, =0.1.17, =1.0.1, =1.5.114, =3.4.13, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =2.4.0, =1.5.6, =1.5.8 and more Source cves: CVE-2019-20916 Source advisory: MEND:CVE-2019-20916...

CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

PT-2020-22669

Name of the Vulnerable Software and Affected Versions pip versions prior to 19.2 Description The issue allows Directory Traversal when a URL is given in an install command. This is because a Content-Disposition header can contain ../ in a filename. For example, it can be used to overwrite the...

CVE-2019-20916: Improper Limitation of a Pathname to a Restricted Directory

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py...

AWS Report - A Tool For Analyzing Amazon Resources

AWS Report is a tool for analyzing amazon resources. Install using PIP pip install awsreport Features Search IAM users based on creation date Search buckets public Search security based in rules, default is 0.0.0.0/0 Search elastic ip dissociated Search volumes available Search AMIs with permissi...

Yelp: RCE on build server via misconfigured pip install

The following Python library has been installed on at least one Yelp owned build server directly from the public PyPI registry. https://pypi.org/project/yelp-cgeom/ This package should normally be downloaded from the internal Yelp registry, but a misconfiguration appears to have caused it to be...