CVE-2019-20916 (High) detected in pip19.0.3

[mend-bolt-for-github]

CVE-2019-20916 - High Severity Vulnerability

Vulnerable Library - pip19.0.3

The Python package installer

Library home page: https://github.com/pypa/pip.git

Found in HEAD commit: 989085aee421ad91c5e038a0c5b86552fc4dcb71

Vulnerable Source Files (1)

/vendor/lib/python2.7/site-packages/pip/_internal/download.py

Vulnerability Details

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Publish Date: 2020-09-04

URL: CVE-2019-20916

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20916

Release Date: 2020-09-04

Fix Resolution: 19.2

---

Step up your Open Source Security Game with Mend here