CVE-2019-20916: Path Traversal
Published Apr 16, 2019
·Updated
A flaw was found in python-pip. Installing remote packages is vulnerable to directory traversal via Content-Disposition header by a malicious server. Upstream issue: https://github.com/pypa/pip/issues/6413
Affected Software
21 affected componentsFixes available
redhat/python-virtualenv<0:15.1.0-7.el7_9
0:15.1.0-7.el7_9
redhat/python-pip<0:9.0.3-18.el8
0:9.0.3-18.el8
redhat/rh-python36-python<0:3.6.12-1.el6
0:3.6.12-1.el6
redhat/rh-python36-python-pip<0:9.0.1-5.el6
0:9.0.1-5.el6
redhat/rh-python36-python-virtualenv<0:15.1.0-3.el6
0:15.1.0-3.el6
redhat/python27-python<0:2.7.18-2.el7
0:2.7.18-2.el7
redhat/python27-python-pip<0:8.1.2-6.el7
0:8.1.2-6.el7
redhat/python27-python-virtualenv<0:13.1.0-4.el7
0:13.1.0-4.el7
redhat/rh-python36-python<0:3.6.12-1.el7
0:3.6.12-1.el7
redhat/rh-python36-python-pip<0:9.0.1-5.el7
0:9.0.1-5.el7
redhat/rh-python36-python-virtualenv<0:15.1.0-3.el7
0:15.1.0-3.el7
redhat/python-pip<19.2
19.2
pip/pip<19.2
19.2
pypa pip<19.2
openSUSE Leap=15.1
openSUSE Leap=15.2
Debian Debian Linux=9.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment=1.10.0
Oracle Communications Cloud Native Core Network Function Cloud Native Environment=22.1.0
Oracle Communications Cloud Native Core Policy=1.15.0
IBM Edge Application Manager<=4.5
Remediation
Information
Avoid downloading or installing packages from potentially malicious servers via the command-line "pip download" or "pip install".
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Apr 16, 2019
CVE Published
12:00 AM
Sep 4, 2020
CVE Published
via MITRE·07:20 PM
Data Sourced
via MITRE·07:20 PM
Description
Jun 9, 2021
Advisory Published
via GitHub·05:35 PM
Aug 20, 2025
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is CVE-2019-20916?
CVE-2019-20916 is a vulnerability in the pip package installer for Python that allows directory traversal and arbitrary file overwrite.
2
How does CVE-2019-20916 affect the pip package installer?
CVE-2019-20916 affects the pip package installer by allowing a path traversal attack when downloading or installing a remote package via a specified URL.
3
What is the severity level of CVE-2019-20916?
CVE-2019-20916 has a severity level of high.
4
How do I fix CVE-2019-20916?
To fix CVE-2019-20916, upgrade to pip version 19.2 or later.
5
Where can I find more information about CVE-2019-20916?
You can find more information about CVE-2019-20916 in the references provided: [link1], [link2], [link3].