CVE-2019-20916

描述

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

如何修補 CVE-2019-20916

要修補 CVE-2019-20916,請將受影響套件升級到下列已修補版本。

• Debian/python-pip—升級至 20.0.2-1 或更新版本
• —升級至 9.0.1-2+deb9u2 或更新版本
• —升級至 19.2 或更新版本
• —升級至 a4c735b14a62f9cb864533808ac63936704f2ace 或更新版本

CVE-2019-20916 正在被利用嗎?

低 — EPSS 為 3.0%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 20.0.2-1
• from 0, < 9.0.1-2+deb9u2
• from 0, < 19.2
• from 0, < a4c735b14a62f9cb864533808ac63936704f2ace | from 0, < 19.2

CVSS 分數

參考連結(13)

• ADVISORYgithub.com/advisories/GHSA-gpvv-69j7-gwj8
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-20916
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2019-20916
• WEBlists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html