CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in _internal/download.py.

References

Affected packages

Git / github.com/gzpan123/pip

Affected ranges

Type: GIT
Repo: https://github.com/gzpan123/pip
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

a4c735b14a62f9cb864533808ac63936704f2ace

Type

GIT

Repo

https://github.com/pypa/pip

Events

Introduced

Fixed

0e642958ada570358c3e095b28d78b6196c56a35

Introduced

Last affected

1ee0501791ac56f5476d4c104592eb1a17ab1b2e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "19.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0"
        }
    ]
}

Affected versions

0.*

0.3

0.4

0.5

0.6

0.7

0.7.1

0.8

0.8.1

0.8.2

0.8.3

1.*

1.0

1.0.1

1.0.2

1.1

1.2

1.2.1

1.3

1.3.1

1.3rc1

1.3rc2

1.4

1.4.1

1.4rc1

1.4rc2

1.4rc3

1.4rc4

1.4rc5

1.5

1.5.1

1.5.1rc1

1.5.2

1.5.3

1.5.4

1.5.5

1.5.6

1.5rc1

1.5rc2

1.5rc3

1.5rc4

10.*

10.0.0

10.0.0b1

10.0.0b2

10.0.1

18.*

18.0

18.1

19.*

19.0

19.0.1

19.0.2

19.0.3

19.1

19.1.1

6.*

6.0

6.0.1

6.0.2

6.0.3

6.0.4

6.0.5

6.0.6

6.0.7

6.0.8

6.1.0

6.1.1

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.1.0

7.1.1

7.1.2

8.*

8.0.0

8.0.1

8.0.2

8.0.3

8.1.0

8.1.1

8.1.2

9.*

9.0.0

9.0.1

9.0.2

9.0.3

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "15.2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "22.1.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.15.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-20916.json"