python-pip vulnerabilities (Azure Linux)
17 vulnerabilities.
-
python-pipAzure Linux virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST 7.8 High -
python-pipAzure Linux virtualenv bash activate runs commands from an environment name with a backslash before $ 7.8 High -
python-pipAzure Linux virtualenv: Bash prompt values can change meaning under older compatibility modes 7.1 High -
python-pipAzure Linux urllib3: HTTPS proxy TLS configuration may be ignored or overridden 7.6 High -
python-pipAzure Linux virtualenv: Command injection via --prompt in activate.bat (batch activator) 7.3 High -
python-pipAzure Linux pip absolute path traversal during download from malicious package indexes 5.6 Medium -
python-pipAzure Linux pip can extract console_scripts and gui_scripts outside installation directory 4.1 Medium -
python-pipAzure Linux pip self-update functionality can import newly installed modules after wheel installation 5.3 Medium -
python-pipAzure Linux pip doesn't reject concatenated ZIP and tar archives 4.6 Medium -
python-pipAzure Linux Limited path traversal when installing wheel archives 2.0 Low -
python-pipAzure Linux Fallback tar extraction in pip doesn't check symbolic links point to extraction directory 5.9 Medium -
python-pipAzure Linux urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation 5.3 Medium -
python-pipAzure Linux Remote Code Execution in pypa/setuptools 8.8 High -
python-pipAzure Linux Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 4.4 Medium -
python-pipAzure Linux Denial of Service via Quadratic Complexity in kjd/idna 6.2 Medium -
python-pipAzure Linux Request body not stripped after redirect in urllib3 4.2 Medium -
python-pipAzure Linux Setuptools vulnerable to Man-in-the-middle attacks 6.8 Medium