Skip to content
OpenAdvisories
High ELSA-2022-9204 1 CVE

Important: python-pip security update (Oracle Linux 7)

Published Mar 10, 2022 · Updated Mar 10, 2022

Ecosystem: Oracle Linux

Summary

[9.0.3-8.0.1]
- CVE-2019-20916 [Orabug: 33861505]

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 python3-pip 0:9.0.3-8.0.1.el7

Vulnerabilities 1

  • High 7.5
    CVE-2019-20916

    Path Traversal in pip

    The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _d…

    python-pip pip python-pip Debian Ubuntu PyPI