CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

• python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py (CVE-2019-20916)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)

• python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py (CVE-2019-20916)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

TuxCare rebuilt pip to address 1 CVE. Fixed in 9.0.post1+tuxcare.

• Merge Oracle Linux 7 changes
• CVE-2019-20916: sanitize Content-Disposition filename to prevent directory traversal

• Merge Oracle Linux 7 changes
• CVE-2019-20916: sanitize Content-Disposition filename to prevent directory traversal

It was discovered that pip did not properly sanitize the filename during pip install. A remote attacker could possible use this issue to read and write arbitrary files on the host filesystem as root, resulting in a directory traversal attack (CVE-2019-20916).

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). The python-pip package bundles a copy of python-urllib3, which was affected by this issue. The bundled copy was patched to fix the issue (CVE-2020-26137).

This update for python-pip fixes the following issues:

• CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-pip fixes the following issues:

• CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-setuptools fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for python3 fixes the following issues:

Update to 3.6.12 (bsc#1179193), including:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-pip fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-pip fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-setuptools fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for python fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python3 fixes the following issues:

Update to 3.6.12 (bsc#1179193), including:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues:

• buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126, CVE-2021-3177).
• Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python3 fixes the following issues:

• CVE-2021-3177: Fixed buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126).
• Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).

These are all security issues fixed in the python36-pip-20.2.4-1.8 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-setuptools-57.4.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python38-3.8.12-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-2.7.18-9.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-pip-24.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-setuptools-70.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Root has patched CVE-2019-20916 in the pip package for Root:PyPI. Multiple fixed versions available.

This update for python39-pip, python39-setuptools fixes the following issues:

Changes in python39-setuptools:

• Provide python39-setuptools version 44.1.1 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)

Changes in python39-pip:

• Provide python39-pip version 20.2.4 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-pip fixes the following issues:

• CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262)

This update for python-pip fixes the following issues:

• CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262)

This update for python-pip fixes the following issues:

• CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262)

This update for python-pip fixes the following issues:

• CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262)

This update for python36 fixes the following issues:

Update to 3.6.12, including the following fixes:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)
• Fixed CRLF injection via HTTP request method in httplib/http.client (bsc#1177211 CVE-2020-26116)
• Fixed possible infinite loop in specifically crafted tarball (bsc#1174091 CVE-2019-20907)
• Fixed a CRLF injection via the host part of the url passed to urlopen() (bsc#1155094 CVE-2019-18348)
• Reamed idle icons to idle3 in order to avoid conflicts with python2 (bsc#1165894)
• Handful of compatibility changes between SLE15 and SLE12 (jsc#ECO-2799, jsc#SLE-13738, bsc#1179193)

This update for python-pip fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update for python-setuptools fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update for python3 fixes the following issues:

Update to 3.6.12 (bsc#1179193), including:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update for python-setuptools fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

This update for python3 fixes the following issues:

• Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)