CVE-2019-20916: Path Traversal
A flaw was found in python-pip. Installing remote packages is vulnerable to directory traversal via Content-Disposition header by a malicious server.
Upstream issue:
https://github.com/pypa/pip/issues/6413
Other sources
A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an attacker who controls a malicious server to execute arbitrary code on the system.
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorizedkeys file. This occurs in downloadhttpurl in internal/download.py.
Affected Software
Remediation
Information
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20916?
CVE-2019-20916 is a vulnerability in the pip package installer for Python that allows directory traversal and arbitrary file overwrite.
How does CVE-2019-20916 affect the pip package installer?
CVE-2019-20916 affects the pip package installer by allowing a path traversal attack when downloading or installing a remote package via a specified URL.
What is the severity level of CVE-2019-20916?
CVE-2019-20916 has a severity level of high.
How do I fix CVE-2019-20916?
To fix CVE-2019-20916, upgrade to pip version 19.2 or later.
Where can I find more information about CVE-2019-20916?
You can find more information about CVE-2019-20916 in the references provided: [link1], [link2], [link3].