| ID | CVE-2019-20916 | ||||||
| Sažetak | The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. | ||||||
| Reference |
|
||||||
| CVSS |
|
||||||
| Pristup |
|
||||||
| Impact |
|
||||||
| CVSS vektor | AV:N/AC:L/Au:N/C:N/I:P/A:N | ||||||
| Zadnje važnije ažuriranje | 08-02-2024 - 02:04 | ||||||
| Objavljeno | 04-09-2020 - 20:15 |
