Directory Traversal Vulnerability in Python Pip Package: CVE-2019-20916
Summary
UBUNTU-CVE-2019-20916: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/... Affects python-pip versions 1.4.1-2 – 1.5.4-1ubuntu4+esm5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python Pip package is a widely used package management system for Python, enabling users to install and manage software packages written in Python. It is essential for developers to easily access and utilize libraries and frameworks. However, certain versions of Pip are vulnerable to a directory traversal issue, which could lead to unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2019-20916, arises from the handling of the Content-Disposition header in HTTP responses during the installation of packages. Specifically, if a URL is provided in the install command, the header can contain '../' in the filename, allowing attackers to overwrite sensitive files, such as the /root/.ssh/authorized_keys file. This flaw can lead to severe security breaches, including unauthorized access to systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using URLs in the install command that could be manipulated to include directory traversal sequences. Instead, use trusted package sources or local files for installations.
Conclusion
CVE-2019-20916 is a significant vulnerability in the Python Pip package that can lead to directory traversal attacks. Users are advised to update their Pip installations to the latest versions to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for python-pip →
FAQ
CVE-2019-20916 is a directory traversal vulnerability in the Python Pip package that allows attackers to overwrite sensitive files.
Affected versions include those prior to 19.2, specifically versions 1.5.4, 8.1.1, and 9.0.1 for various Ubuntu distributions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, potentially compromising system security.
Ensure that you update to the latest patched version of Python Pip and avoid using untrusted URLs in installation commands.
Related vulnerabilities
Recent vulnerabilities recorded for python-pip.
