Read the docs
TI-2019-15130 Aliases CVE-2019-20916GHSA-gpvv-69j7-gwj8

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in…

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 12 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Why it matters now

EPSS 0.03003 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial pip (PyPI): 19.2Red Hat: 5 advisoriesRed Hat: 12 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pip (PyPI)before 19.219.2Patch availableGHSA-gpvv-69j7-gwj8
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pip (PyPI) Vendor— Affected before 19.2 Fixed in 19.2 Patch available GHSA-gpvv-69j7-gwj8

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:*before 19.2Vulnerablepypa
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:*22.1.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
  • cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:* Versions before 19.2 Vulnerable ·pypa
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* Versions 22.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-gpvv-69j7-gwj8 pip (PyPI) Fixed in 19.2 Advisory →

Red Hat 5 advisories

  • RHSA-2022:5234 Released 2022-06-28 · Red Hat rating Moderate
    python-virtualenv security update
    • Red Hat Enterprise Linux Client Optional (v. 7) python-virtualenv-15.1.0-7.el7_9
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-virtualenv-15.1.0-7.el7_9
    • Red Hat Enterprise Linux Server (v. 7) python-virtualenv-15.1.0-7.el7_9
    • Red Hat Enterprise Linux Workstation (v. 7) python-virtualenv-15.1.0-7.el7_9
  • RHSA-2020:4654 Released 2020-11-04 · Red Hat rating Moderate
    python27:2.7 security update
    • Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-9.module+el8.1.0+3111+de3f2d8e.noarch::python27:2.7 +47
  • RHSA-2020:4432 Released 2020-11-04 · Red Hat rating Moderate
    python-pip security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3-pip-9.0.3-18.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-pip-9.0.3-18.el8, python-pip-9.0.3-18.el8, python3-pip-wheel-9.0.3-18.el8
Show 2 more Red Hat advisories
  • RHSA-2020:4273 Released 2020-10-20 · Red Hat rating Moderate
    python27 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
  • RHSA-2020:4285 Released 2020-10-19 · Red Hat rating Moderate
    rh-python36 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-python36-python-3.6.12-1.el6, rh-python36-python-debug-3.6.12-1.el6, rh-python36-python-devel-3.6.12-1.el6 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-python36-python-3.6.12-1.el6, rh-python36-python-debug-3.6.12-1.el6, rh-python36-python-devel-3.6.12-1.el6 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4432, RHSA-2020:4654
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:4432
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2022:5234
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2022:5234
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2022:5234
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2022:5234
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:4273, RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:4273, RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:4273, RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:4273, RHSA-2020:4285
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-20916
  2. 2026-10-03 Alias added: GHSA-gpvv-69j7-gwj8

References

Exploit 1

Patch 4

Advisory 5

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences