https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:56:24 +0000 https://cve.radiocsirt.org/vuln/alsa-2020:4654 <p><strong>Affected:</strong> AlmaLinux:8: python-psycopg2-doc, AlmaLinux:8: python-sqlalchemy-doc, AlmaLinux:8: python2-Cython, AlmaLinux:8: python2-PyMySQL, AlmaLinux:8: python2-attrs, AlmaLinux:8: python2-chardet, AlmaLinux:8: python2-coverage, AlmaLinux:8: python2-dns, AlmaLinux:8: python2-docs, AlmaLinux:8: python2-docs-info and 20 more</p> <p>Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.</p> <p>Security Fix(es):</p> <p>* python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)</p> <p>* python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py (CVE-2019-20916)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: python-psycopg2-doc, AlmaLinux:8: python-sqlalchemy-doc, AlmaLinux:8: python2-Cython, AlmaLinux:8: python2-PyMySQL, AlmaLinux:8: python2-attrs, AlmaLinux:8: python2-chardet, AlmaLinux:8: python2-coverage, AlmaLinux:8: python2-dns, AlmaLinux:8: python2-docs, AlmaLinux:8: python2-docs-info and 20 more</p> <p>Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.</p> <p>Security Fix(es):</p> <p>* python: infinite loop in the tarfile module via crafted TAR archive (CVE-2019-20907)</p> <p>* python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py (CVE-2019-20916)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2020:4654 https://cve.radiocsirt.org/vuln/bdu:2021-03750 bdu:2021-03750 https://cve.radiocsirt.org/vuln/bdu:2021-03750 https://cve.radiocsirt.org/vuln/brew-pypy-cve-2019-20916 <p><strong>Affected:</strong> Homebrew: pypy</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.</p> <p><strong>Affected:</strong> Homebrew: pypy</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.</p> https://cve.radiocsirt.org/vuln/brew-pypy-cve-2019-20916 https://cve.radiocsirt.org/vuln/certfr-2021-avi-912 certfr-2021-avi-912 https://cve.radiocsirt.org/vuln/certfr-2021-avi-912 https://cve.radiocsirt.org/vuln/cnvd-2020-51511 cnvd-2020-51511 https://cve.radiocsirt.org/vuln/cnvd-2020-51511 https://cve.radiocsirt.org/vuln/euvd-2026-60352 EUVD-2026-60352 https://cve.radiocsirt.org/vuln/euvd-2026-60352 https://cve.radiocsirt.org/vuln/fkie_cve-2019-20916 <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-20916 https://cve.radiocsirt.org/vuln/ghsa-gpvv-69j7-gwj8 <p><strong>Affected:</strong> PyPI: pip</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.</p> <p><strong>Affected:</strong> PyPI: pip</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.</p> https://cve.radiocsirt.org/vuln/ghsa-gpvv-69j7-gwj8 https://cve.radiocsirt.org/vuln/gsd-2019-20916 gsd-2019-20916 https://cve.radiocsirt.org/vuln/gsd-2019-20916 https://cve.radiocsirt.org/vuln/msrc_cve-2019-20916 msrc_CVE-2019-20916 https://cve.radiocsirt.org/vuln/msrc_cve-2019-20916 https://cve.radiocsirt.org/vuln/opensuse-su-2020:1598-1 <p>Security update for python-pip</p> <p>Security update for python-pip</p> https://cve.radiocsirt.org/vuln/opensuse-su-2020:1598-1 https://cve.radiocsirt.org/vuln/pysec-2020-173 <p><strong>Affected:</strong> PyPI: pip</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.</p> <p><strong>Affected:</strong> PyPI: pip</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.</p> https://cve.radiocsirt.org/vuln/pysec-2020-173 https://cve.radiocsirt.org/vuln/rhsa-2020:4273 <p>python: CRLF injection via the host part of the url passed to urlopen() python: infinite loop in the tarfile module via crafted TAR archive python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py python: CRLF injection via HTTP request method in httplib/http.client</p> <p>python: CRLF injection via the host part of the url passed to urlopen() python: infinite loop in the tarfile module via crafted TAR archive python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py python: CRLF injection via HTTP request method in httplib/http.client</p> https://cve.radiocsirt.org/vuln/rhsa-2020:4273 https://cve.radiocsirt.org/vuln/suse-fu-2021:2130-1 <p>Feature implementation for python39-pip, python39-setuptools</p> <p>Feature implementation for python39-pip, python39-setuptools</p> https://cve.radiocsirt.org/vuln/suse-fu-2021:2130-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-20916 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:18.04:LTS: python-pip</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:18.04:LTS: python-pip</p> <p>The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2019-20916 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0193 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um die Verfügbarkeit, Integrität und Vertraulichkeit zu gefährden.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um die Verfügbarkeit, Integrität und Vertraulichkeit zu gefährden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0193