Skip to content
OpenAdvisories
Medium DLA-4348-1 2 CVEs

python-pip - security update

Published Oct 26, 2025 · Updated Oct 26, 2025

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 python-pip 20.3.4-4+deb11u2

Vulnerabilities 2

  • Medium 5.9
    CVE-2025-8869

    Fallback tar extraction in pip doesn't check symbolic links point to extraction directory

    When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that …

    Python Packaging Authority pip py3-cassandra-medusa python-pip Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 5.5
    CVE-2023-5752

    Mercurial configuration injectable in repo revision when installing via pip

    When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial co…

    Pip maintainers pip python3 jwt-tool Debian Azure Linux Wolfi PyPI