python-pip vulnerabilities (Ubuntu)
43 vulnerabilities.
-
python-pipUbuntu urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory 8.9 High -
python-pipUbuntu urllib3: Chunked Deflate streaming can enter an infinite loop 6.9 Medium -
python-pipUbuntu urllib3: HTTPS proxy TLS configuration may be ignored or overridden 7.6 High -
python-pipUbuntu pip absolute path traversal during download from malicious package indexes 5.6 Medium -
python-pipUbuntu MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error 7.5 High -
python-pipUbuntu urllib3 version 2.6.3 is vulnerable to a decompression bomb bypass in its streaming API (... 7.5 High -
python-pipUbuntu python-pip regression No score -
python-pipUbuntu pip can extract console_scripts and gui_scripts outside installation directory 4.1 Medium -
python-pipUbuntu Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix 6.9 Medium -
python-pipUbuntu urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API 8.9 High -
python-pipUbuntu urllib3: Sensitive headers forwarded across origins in proxied low-level redirects 8.2 High -
python-pipUbuntu pip self-update functionality can import newly installed modules after wheel installation 5.3 Medium -
python-pipUbuntu pip doesn't reject concatenated ZIP and tar archives 4.6 Medium -
python-pipUbuntu Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function 4.4 Medium -
python-pipUbuntu Limited path traversal when installing wheel archives 2.0 Low -
python-pipUbuntu wheel Allows Arbitrary File Permission Modification via Path Traversal 7.1 High -
python-pipUbuntu urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) 8.9 High -
python-pipUbuntu urllib3 Streaming API improperly handles highly compressed data 8.9 High -
python-pipUbuntu urllib3 allows an unbounded number of links in the decompression chain 8.9 High -
python-pipUbuntu Fallback tar extraction in pip doesn't check symbolic links point to extraction directory 5.9 Medium -
python-pipUbuntu urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation 5.3 Medium -
python-pipUbuntu Requests vulnerable to .netrc credentials leak via malicious URLs 5.3 Medium -
python-pipUbuntu setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write 7.7 High -
python-pipUbuntu Remote Code Execution in pypa/setuptools 8.8 High -
python-pipUbuntu Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 4.4 Medium -
python-pipUbuntu Requests `Session` object does not verify requests after making first request with verify=False 5.6 Medium -
python-pipUbuntu Denial of Service via Quadratic Complexity in kjd/idna 6.2 Medium -
python-pipUbuntu Request body not stripped after redirect in urllib3 4.2 Medium -
python-pipUbuntu Authorization Header forwarded on redirect 6.1 Medium -
python-pipUbuntu `Cookie` HTTP header isn't stripped on cross-origin redirects 5.9 Medium -
python-pipUbuntu Certifi's removal of e-Tugra root certificate 7.5 High -
python-pipUbuntu Unintended leak of Proxy-Authorization header in requests 6.1 Medium -
python-pipUbuntu python-pip regression No score -
python-pipUbuntu pypa/wheel vulnerable to Regular Expression denial of service (ReDoS) 7.5 High -
python-pipUbuntu pypa/setuptools vulnerable to Regular Expression Denial of Service (ReDoS) 5.9 Medium -
python-pipUbuntu Improper Input Validation in pip 5.7 Medium -
python-pipUbuntu Catastrophic backtracking in URL authority parser when passed URL containing many @ characters 7.5 High -
python-pipUbuntu python-pip vulnerability No score -
python-pipUbuntu CRLF injection in urllib3 6.5 Medium -
python-pipUbuntu Path Traversal in pip 7.5 High -
python-pipUbuntu An issue was discovered in pip (all versions) because it installs the version with the highest... 7.8 High -
python-pipUbuntu Insufficiently Protected Credentials in Requests 7.5 High -
python-pipUbuntu pip lack of randomness in build directory 2.1 Low