Denial of Service Vulnerability in Python Pip Package (CVE-2014-8991)
Summary
UBUNTU-CVE-2014-8991: pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user. Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Pip package is a widely used package manager for Python that allows users to install and manage software packages written in Python. It simplifies the process of package installation and dependency management. However, versions 1.3 through 1.5.6 of Pip are vulnerable to a local denial of service attack, which can prevent users from installing packages effectively.
Vulnerability Detail
The vulnerability identified as CVE-2014-8991 allows local users to create temporary files in the /tmp directory that can interfere with the Pip installation process for other users. This can lead to a denial of service, as it prevents the affected user from successfully installing packages. The issue arises from insufficient handling of temporary files, which can be exploited by malicious users on the same system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using Pip in environments where multiple users have access to the same system. Alternatively, users can create isolated environments using virtualenv to prevent interference from other users.
Conclusion
The CVE-2014-8991 vulnerability in the Python Pip package poses a significant risk of denial of service for users. It is crucial to update to a patched version to ensure the security and functionality of the package management process. Users are encouraged to implement the recommended fixes and workarounds to mitigate potential impacts.
See every vulnerability recorded for python-pip →
FAQ
CVE-2014-8991 is a vulnerability in the Python Pip package that allows local users to cause a denial of service by creating conflicting temporary files.
Versions 1.3 through 1.5.6 of Pip are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update Pip, consider using isolated environments with virtualenv to mitigate the risk of this vulnerability.
More information can be found in the Ubuntu security notice at https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2014/UBUNTU-CVE-2014-8991.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
