Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:3565-1

Опубликовано: 30 нояб. 2020
Источник: suse-cvrf

Описание

Security update for python-pip

This update for python-pip fixes the following issues:

  • Fixed a directory traversal in _download_http_url() (bsc#1176262 CVE-2019-20916)

Список пакетов

Image SLES15-Azure-BYOS
python3-pip-10.0.1-3.6.1
Image SLES15-SAP-Azure
python3-pip-10.0.1-3.6.1
Image SLES15-SAP-Azure-BYOS
python3-pip-10.0.1-3.6.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS
python2-pip-10.0.1-3.6.1
python3-pip-10.0.1-3.6.1
SUSE Linux Enterprise High Performance Computing 15-LTSS
python2-pip-10.0.1-3.6.1
python3-pip-10.0.1-3.6.1
SUSE Linux Enterprise Module for Basesystem 15 SP1
python3-pip-10.0.1-3.6.1
SUSE Linux Enterprise Module for Basesystem 15 SP2
python3-pip-10.0.1-3.6.1
SUSE Linux Enterprise Module for Python 2 15 SP1
python2-pip-10.0.1-3.6.1
SUSE Linux Enterprise Module for Python 2 15 SP2
python2-pip-10.0.1-3.6.1
SUSE Linux Enterprise Server 15-LTSS
python2-pip-10.0.1-3.6.1
python3-pip-10.0.1-3.6.1
SUSE Linux Enterprise Server for SAP Applications 15
python2-pip-10.0.1-3.6.1
python3-pip-10.0.1-3.6.1

Ссылки

Описание

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Затронутые продукты
Image SLES15-Azure-BYOS:python3-pip-10.0.1-3.6.1
Image SLES15-SAP-Azure-BYOS:python3-pip-10.0.1-3.6.1
Image SLES15-SAP-Azure:python3-pip-10.0.1-3.6.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS:python2-pip-10.0.1-3.6.1
Ссылки