CVE-2019-20916: Path Traversal in pip

CVE-2019-20916 · Severity: low · CVSS 3.1 · Published 2020-09-04

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Technologies: pip (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2019-20916 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-20916 being exploited in the wild.
How severe is CVE-2019-20916?
Low severity, with a CVSS score of 3.1, published 4 September 2020.
Which products and versions are affected?
pip (PyPI) ECOSYSTEM:introduced=0,fixed=19.2, GIT:introduced=0,fixed=a4c735b14a62f9cb864533808ac63936704f2ace|ECOSYSTEM:introduced=0,fixed=19.2.
Is there a fix for CVE-2019-20916?
Yes. pip (PyPI): upgrade to 19.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2019-20916?
Check whether you run pip (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pip (PyPI): upgrade to 19.2 or later
    pip install "pip>=19.2"

Affected products

  • pip (PyPI) ECOSYSTEM:introduced=0,fixed=19.2, GIT:introduced=0,fixed=a4c735b14a62f9cb864533808ac63936704f2ace|ECOSYSTEM:introduced=0,fixed=19.2

Identifiers

  • CVE-2019-20916
  • GHSA-gpvv-69j7-gwj8
  • PYSEC-2020-173

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.