CVE-2014-8991
pip lack of randomness in build directory
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
Exploit likelihood
What each source reports
NVD Score used
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
CVE-2014-8991- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
CVE-2014-8991- Updated
- 2026-11-02
EUVDEUVD-2014-0044 No score
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
EUVD-2014-0044- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-53mr-44pp-crf4
pip lack of randomness in build directory
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
GHSA-53mr-44pp-crf4- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-53mr-44pp-crf4
pip lack of randomness in build directory
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
GHSA-53mr-44pp-crf4- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV No score
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
CVE-2014-8991- Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2014-8991 No score
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
DEBIAN-CVE-2014-8991- Updated
- 2026-11-02
OSVMGASA-2015-0023 No score
Updated python-pip packages fix CVE-2014-8991
Updated python-pip packages fix security vulnerability:
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user (CVE-2014-8991).
- Record
MGASA-2015-0023- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10098-1 No score
python-pip-8.1.2-1.2 on GA media
These are all security issues fixed in the python-pip-8.1.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10098-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11251-1 No score
python36-pip-20.2.4-1.8 on GA media
These are all security issues fixed in the python36-pip-20.2.4-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11251-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11281-1 No score
python2-pip-20.0.2-2.6 on GA media
These are all security issues fixed in the python2-pip-20.0.2-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11281-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13916-1 No score
python310-pip-24.0-1.1 on GA media
These are all security issues fixed in the python310-pip-24.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13916-1- Updated
- 2026-11-02
OSVPYSEC-2014-11 No score
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
PYSEC-2014-11- Updated
- 2026-11-02
OSVSUSE-FU-2021:2130-1 No score
Feature implementation for python39-pip, python39-setuptools
This update for python39-pip, python39-setuptools fixes the following issues:
Changes in python39-setuptools:
- Provide
python39-setuptoolsversion 44.1.1 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)
Changes in python39-pip:
- Provide
python39-pipversion 20.2.4 with vendored dependencies. (jsc#SLE-17532, jsc#SLE-17957)
- Record
SUSE-FU-2021:2130-1- Updated
- 2026-11-02
OSVSUSE-RU-2019:2505-1 No score
Recommended update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner
This update for python-jmespath, python-jsonschema, python-paramiko, python-pexpect, python-pip, python-ply, python-pretend, python-process-tests, python-pycodestyle, python-pyflakes, python-pyxdg, python-tabulate, python-vcversioner fixes the following issues:
python-pip was updated to 10.0.1 (fate#324191, bsc#1065275)
Enable python3 build for:
- python-jmespath
- python-jsonschema
- python-paramiko
- python-pexpect
- python-pip
- python-ply
- python-pretend
- python-process-tests
- python-pycodestyle
- python-pyflakes
- python-pyxdg
- python-tabulate
- python-vcversioner
- Record
SUSE-RU-2019:2505-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-8991 No score
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
- Record
UBUNTU-CVE-2014-8991- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pipPyPI |
1.3 up to 6.0 | 6.0 |
python-pipDebian:12 |
before 1.5.6-4 | 1.5.6-4 |
python-pipDebian:13 |
before 1.5.6-4 | 1.5.6-4 |
python-pipDebian:14 |
before 1.5.6-4 | 1.5.6-4 |
pipPyPI |
1.3 up to 6.0, plus listed versions 1.3.11.41.4.11.51.5.1 Show 5 moreShow less1.5.21.5.31.5.41.5.51.5.6 |
6.0 |
python-pipMageia:4 |
before 1.4.1-4.2.mga4 | 1.4.1-4.2.mga4 |
python39-pipSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 4 CVEs |
before 20.2.4-7.5.1 | 20.2.4-7.5.1 |
python39-setuptoolsSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 4 CVEs |
before 44.1.1-7.3.1 | 44.1.1-7.3.1 |
python-pipSUSE:OpenStack Cloud 7 From an advisory covering 3 CVEs |
before 10.0.1-11.6.1 | 10.0.1-11.6.1 |
python-plySUSE:OpenStack Cloud 7 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-plySUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-jmespathSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 0.9.2-10.6.1 | 0.9.2-10.6.1 |
python-jsonschemaSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 2.2.0-3.3.1 | 2.2.0-3.3.1 |
python-paramikoSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 1.18.5-2.15.1 | 1.18.5-2.15.1 |
python-pipSUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 10.0.1-11.6.1 | 10.0.1-11.6.1 |
python-plySUSE:Linux Enterprise Module for Public Cloud 12 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-plySUSE:Linux Enterprise Server 12 SP4 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-plySUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 3 CVEs |
before 3.4-3.3.1 | 3.4-3.3.1 |
python-pipUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.4.1-21.5.4-11.5.4-1ubuntu11.5.4-1ubuntu31.5.4-1ubuntu4 Show 5 moreShow less1.5.4-1ubuntu4+esm11.5.4-1ubuntu4+esm21.5.4-1ubuntu4+esm31.5.4-1ubuntu4+esm41.5.4-1ubuntu4+esm5 |
None known |
python-pipopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 9.0.1-1.1 | 9.0.1-1.1 |
python2-pipopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 20.0.2-2.6 | 20.0.2-2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8991 is a low vulnerability (CVSS 2.1) in Pypa Pip, published November 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in pip 6.0.
References
openwall.com/lists/oss-security/2014/11/19/17
oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847
securityfocus.com/bid/71209
github.com/pypa/pip/pull/2122
Show 26 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-8991
security-tracker.debian.org/tracker/CVE-2014-8991
advisories.mageia.org/MGASA-2015-0023.html
bugs.mageia.org/show_bug.cgi?id=14969
lists.fedoraproject.org/pipermail/package-announce/2015-January/147567.html
suse.com/support/update/announcement/-2021-2130/suse-fu-20212130-1
bugzilla.suse.com/1176262
ubuntu.com/security/CVE-2014-8991
cve.org/CVERecord?id=CVE-2014-8991