01 Record

CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 3.00% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 86.8% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2020-09-04 19:20Z6 YR AGO

Last updated

2024-08-05 03:00Z2 YR AGO

Reserved

2020-09-04

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base

Data version

5.1

Document digest

6ca96815c43c0bf7d15adbb75117d0e72682699f61037e7f2455fbbcb3a91b6a

05 Affected products

VendorProductVersionsPlatforms

debiandebian_linuxNot specified—

opensuseleapNot specified—

oraclecommunications_cloud_native_core_network_function_cloud_native_environmentNot specified—

oraclecommunications_cloud_native_core_policyNot specified—

pypapipNot specified—

redhatenterprise_linuxNot specified—

redhatrhel_software_collectionsNot specified—

06 References

github.comhttps://github.com/pypa/pip/issues/6413x_refsource_MISC
github.comhttps://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2acex_refsource_MISC
github.comhttps://github.com/pypa/pip/compare/19.1.1...19.2x_refsource_MISC
lists.debian.org[debian-lts-announce] 20200911 [SECURITY] [DLA 2370-1] python-pip security updatehttps://lists.debian.org/debian-lts-announce/2020/09/msg00010.htmlmailing-listx_refsource_MLIST
lists.opensuse.orgopenSUSE-SU-2020:1598http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgopenSUSE-SU-2020:1613http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.htmlvendor-advisoryx_refsource_SUSE
www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC
www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.htmlx_refsource_MISC

07 Fixed in

AlmaLinux 8

python-psycopg2-doc
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python-sqlalchemy-doc
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.2-2.module_el8.5.0+2569+5c5719bc
- Affected before 1.3.2-2.module_el8.6.0+2781+fed64c13
python2-Cython
Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
python2-PyMySQL
Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
python2-attrs
Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
python2-chardet
Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
python2-coverage
Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
python2-dns
Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
python2-docs
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docs-info
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docutils
Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
python2-funcsigs
Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
python2-idna
Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
python2-ipaddress
Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
python2-markupsafe
Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
python2-mock
Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
python2-pluggy
Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
python2-psycopg2
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-debug
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-tests
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-py
Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
python2-pysocks
Fixed in 1.6.8-6.module_el8.6.0+2781+fed64c13
python2-pytest
Fixed in 3.4.2-13.module_el8.6.0+2781+fed64c13
python2-pytest-mock
Fixed in 1.9.0-4.module_el8.6.0+2781+fed64c13
python2-pytz
Fixed in 2017.2-12.module_el8.6.0+2781+fed64c13
python2-pyyaml
Fixed in 3.12-16.module_el8.6.0+2781+fed64c13
python2-requests
Fixed in 2.20.0-3.module_el8.6.0+2781+fed64c13
python2-rpm-macros
Fixed in 3-38.module_el8.6.0+2781+fed64c13
python2-setuptools_scm
Fixed in 1.15.7-6.module_el8.6.0+2781+fed64c13
python2-sqlalchemy
Fixed in 1.3.2-2.module_el8.6.0+2781+fed64c13

CloudLinux 8

python-psycopg2-doc
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python-sqlalchemy-doc
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.2-2.module_el8.5.0+2569+5c5719bc
- Affected before 1.3.2-2.module_el8.6.0+2781+fed64c13
python2-Cython
Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
python2-PyMySQL
Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
python2-attrs
Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
python2-chardet
Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
python2-coverage
Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
python2-dns
Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
python2-docs
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docs-info
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docutils
Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
python2-funcsigs
Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
python2-idna
Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
python2-ipaddress
Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
python2-markupsafe
Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
python2-mock
Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
python2-pluggy
Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
python2-psycopg2
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-debug
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-tests
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-py
Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
python2-pysocks
Fixed in 1.6.8-6.module_el8.6.0+2781+fed64c13
python2-pytest
Fixed in 3.4.2-13.module_el8.6.0+2781+fed64c13
python2-pytest-mock
Fixed in 1.9.0-4.module_el8.6.0+2781+fed64c13
python2-pytz
Fixed in 2017.2-12.module_el8.6.0+2781+fed64c13
python2-pyyaml
Fixed in 3.12-16.module_el8.6.0+2781+fed64c13
python2-requests
Fixed in 2.20.0-3.module_el8.6.0+2781+fed64c13
python2-rpm-macros
Fixed in 3-38.module_el8.6.0+2781+fed64c13
python2-setuptools_scm
Fixed in 1.15.7-6.module_el8.6.0+2781+fed64c13
python2-sqlalchemy
Fixed in 1.3.2-2.module_el8.6.0+2781+fed64c13

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

python-pip
Fixed in 20.0.2-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

python-pip
Fixed in 20.0.2-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

python-pip
Fixed in 20.0.2-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

python-pip
Fixed in 9.0.1-2.3~ubuntu1.18.04.4

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

python-pip
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

python-pip
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.