Description
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pip | < 1.3 | 1.3 | GHSA-4gv5-qhvr-36vv |
References
- [oss-security] 20130322 Re: CVE Request: python-pip insecure temporary directory handling mailing-list
- FEDORA-2013-8221 vendor-advisory
- https://github.com/pypa/pip/pull/734/files
- https://github.com/pypa/pip/pull/780/files
- FEDORA-2013-8193 vendor-advisory
- https://github.com/pypa/pip/issues/725
- FEDORA-2013-8166 vendor-advisory