Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:2698-1

Опубликовано: 21 сент. 2020
Источник: suse-cvrf

Описание

Security update for python-pip

This update for python-pip fixes the following issues:

  • CVE-2019-20916: Fixed a directory traversal in _download_http_url (bsc#1176262)

Список пакетов

SUSE Linux Enterprise Module for Public Cloud 12
python-pip-10.0.1-11.9.1
python3-pip-10.0.1-11.9.1
SUSE OpenStack Cloud 6-LTSS
python-pip-10.0.1-11.9.1
SUSE OpenStack Cloud 7
python-pip-10.0.1-11.9.1

Ссылки

Описание

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 12:python-pip-10.0.1-11.9.1
SUSE Linux Enterprise Module for Public Cloud 12:python3-pip-10.0.1-11.9.1
SUSE OpenStack Cloud 6-LTSS:python-pip-10.0.1-11.9.1
SUSE OpenStack Cloud 7:python-pip-10.0.1-11.9.1
Ссылки