CVE-2019-20916
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 3.0%
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
Produtos afetados
n/a · n/aReferências
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.htmlhttps://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2acehttps://github.com/pypa/pip/compare/19.1.1...19.2https://github.com/pypa/pip/issues/6413https://lists.debian.org/debian-lts-announce/2020/09/msg00010.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html