Skip to content
OpenAdvisories
High USN-4601-1 1 CVE

python-pip vulnerability

Published Oct 22, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that pip did not properly sanitize the filename during
pip install. A remote attacker could possible use this issue to read and
write arbitrary files on the host filesystem as root, resulting in a
directory traversal attack. (CVE-2019-20916)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS python-pip 9.0.1-2.3~ubuntu1.18.04.4

Vulnerabilities 1

  • High 7.5
    CVE-2019-20916

    Path Traversal in pip

    The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _d…

    python-pip pip python-pip Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2019-20916