Skip to content
OpenAdvisories

Package · Debian

python-pip

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2019-20916

    Path Traversal in pip

    The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _d…

    python-pip pip python-pip Debian Ubuntu PyPI
  • High 8.4
    CVE-2013-1629

    Improper Input Validation in pip

    pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.

    python-virtualenv pip python-pip Debian PyPI