CVE-2019-20916 Path Traversal in pip
Attackers can overwrite critical files like SSH keys via directory traversal in pip, leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-20916?
CVE-2019-20916 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
Weakness: CWE-22
Which versions are affected by CVE-2019-20916?
3 open source packages ship an affected version, including pip. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
pip PyPI | All versions | 19.2 |
pip PyPI | All versions | 19.2 |
pip PyPI | All versions | 19.2 |
Linux distribution packages (37)
python-virtualenv Red Hat:enterprise_linux:7::client | All versions | 0:15.1.0-7.el7_9 |
python-virtualenv Red Hat:enterprise_linux:7::computenode | All versions | 0:15.1.0-7.el7_9 |
python-virtualenv Red Hat:enterprise_linux:7::server | All versions | 0:15.1.0-7.el7_9 |
python-virtualenv Red Hat:enterprise_linux:7::workstation | All versions | 0:15.1.0-7.el7_9 |
python3-pip Red Hat:enterprise_linux:8::appstream | All versions | 0:9.0.3-18.el8 |
platform-python-pip Red Hat:enterprise_linux:8::baseos | All versions | 0:9.0.3-18.el8 |
python-pip Red Hat:enterprise_linux:8::baseos | All versions | 0:9.0.3-18.el8 |
python3-pip-wheel Red Hat:enterprise_linux:8::baseos | All versions | 0:9.0.3-18.el8 |
python SUSE:Enterprise Storage 5 | All versions | 2.7.17-28.59.1 |
python-base SUSE:Enterprise Storage 5 | All versions | 2.7.17-28.59.1 |
python-doc SUSE:Enterprise Storage 5 | All versions | 2.7.17-28.59.1 |
python-setuptools SUSE:Enterprise Storage 5 | All versions | 40.6.2-4.18.1 |
python3 SUSE:Enterprise Storage 5 | All versions | 3.4.10-25.58.1 |
python3 SUSE:Enterprise Storage 5 | All versions | 3.4.10-25.63.1 |
python3-base SUSE:Enterprise Storage 5 | All versions | 3.4.10-25.58.1 |
python3-base SUSE:Enterprise Storage 5 | All versions | 3.4.10-25.63.2 |
python-pip SUSE:Enterprise Storage 6 | All versions | 20.0.2-150100.6.18.1 |
python-pip-wheel SUSE:Enterprise Storage 6 | All versions | 20.0.2-150100.6.18.1 |
python-pip SUSE:Enterprise Storage 7 | All versions | 20.0.2-150100.6.18.1 |
python-pip-wheel SUSE:Enterprise Storage 7 | All versions | 20.0.2-150100.6.18.1 |
python SUSE:HPE Helion OpenStack 8 | All versions | 2.7.17-28.59.1 |
python-base SUSE:HPE Helion OpenStack 8 | All versions | 2.7.17-28.59.1 |
python-doc SUSE:HPE Helion OpenStack 8 | All versions | 2.7.17-28.59.1 |
python-pip SUSE:HPE Helion OpenStack 8 | All versions | 9.0.1-3.3.1 |
python-setuptools SUSE:HPE Helion OpenStack 8 | All versions | 40.6.2-4.18.1 |
python3 SUSE:HPE Helion OpenStack 8 | All versions | 3.4.10-25.58.1 |
python3 SUSE:HPE Helion OpenStack 8 | All versions | 3.4.10-25.63.1 |
python3-base SUSE:HPE Helion OpenStack 8 | All versions | 3.4.10-25.58.1 |
python3-base SUSE:HPE Helion OpenStack 8 | All versions | 3.4.10-25.63.2 |
python-pip SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 20.0.2-150100.6.18.1 |
python-pip-wheel SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 20.0.2-150100.6.18.1 |
python-pip SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 20.0.2-150100.6.18.1 |
python-pip-wheel SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 20.0.2-150100.6.18.1 |
python SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 2.7.17-7.47.1 |
python-base SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 2.7.17-7.47.1 |
python-pip SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 10.0.1-3.3.1 |
python-pip SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 10.0.1-3.6.1 |
Products include Debian Debian Linux, Opensuse Leap, Oracle Communications Cloud Native Core Network Function Cloud Native Environment, Oracle Communications Cloud Native Core Policy, Pypa Pip.
How do I fix CVE-2019-20916?
Upgrade pip to 19.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-20916 being exploited?
There is no known exploitation of CVE-2019-20916 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLSA-2026-1772756023, DEBIAN-CVE-2019-20916, DLA-2370-1, GHSA-gpvv-69j7-gwj8, PYSEC-2020-173, RHSA-2020:4432 and 32 more.