CVE-2019-20916: Path Traversal
A flaw was found in python-pip. Installing remote packages is vulnerable to directory traversal via Content-Disposition header by a malicious server.
Upstream issue:
https://github.com/pypa/pip/issues/6413
Other sources
A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an attacker who controls a malicious server to execute arbitrary code on the system.
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-virtualenvto a version that resolves this vulnerability.Fixed in 0:15.1.0-7.el7_9 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.3-18.el8 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.12-1.el6 - Upgrade
Upgrade
redhat/rh-python36-python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.1-5.el6 - Upgrade
Upgrade
redhat/rh-python36-python-virtualenvto a version that resolves this vulnerability.Fixed in 0:15.1.0-3.el6 - Upgrade
Upgrade
redhat/python27-pythonto a version that resolves this vulnerability.Fixed in 0:2.7.18-2.el7 - Upgrade
Upgrade
redhat/python27-python-pipto a version that resolves this vulnerability.Fixed in 0:8.1.2-6.el7 - Upgrade
Upgrade
redhat/python27-python-virtualenvto a version that resolves this vulnerability.Fixed in 0:13.1.0-4.el7 - Upgrade
Upgrade
redhat/rh-python36-pythonto a version that resolves this vulnerability.Fixed in 0:3.6.12-1.el7 - Upgrade
Upgrade
redhat/rh-python36-python-pipto a version that resolves this vulnerability.Fixed in 0:9.0.1-5.el7 - Upgrade
Upgrade
redhat/rh-python36-python-virtualenvto a version that resolves this vulnerability.Fixed in 0:15.1.0-3.el7 - Upgrade
Upgrade
redhat/python-pipto a version that resolves this vulnerability.Fixed in 19.2 - Upgrade
Upgrade
pip/pipto a version that resolves this vulnerability.Fixed in 19.2 - Upgrade
Upgrade
python-pipto a version that resolves this vulnerability.Fixed in 19.2 - Compensating control
Avoid downloading or installing packages from potentially malicious servers via the command-line "pip download" or "pip install".
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20916?
CVE-2019-20916 is a vulnerability in the pip package installer for Python that allows directory traversal and arbitrary file overwrite.
How does CVE-2019-20916 affect the pip package installer?
CVE-2019-20916 affects the pip package installer by allowing a path traversal attack when downloading or installing a remote package via a specified URL.
What is the severity level of CVE-2019-20916?
CVE-2019-20916 has a severity level of high.
How do I fix CVE-2019-20916?
To fix CVE-2019-20916, upgrade to pip version 19.2 or later.
Where can I find more information about CVE-2019-20916?
You can find more information about CVE-2019-20916 in the references provided: [link1], [link2], [link3].