7.5

CVE-2019-20916: debian debian_linux

Modified
AliasesSUSE-SU-2020:2698-1SUSE-SU-2020:2726-1SUSE-SU-2020:2784-1
Published 04-09-2020Last modified 05-08-2024

Vulnerability summary

CVE-2019-20916 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 3.00% chance of exploitation in the next 30 days, higher than 87.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
3.00%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 16 · Related 12
MGASA-2021-0054OPENSUSE-SU-2021:0270-1OPENSUSE-SU-2021:0331-1OPENSUSE-SU-2024:11284-1OPENSUSE-SU-2024:11285-1OPENSUSE-SU-2024:11551-1

Timeline

  1. 04-09-2020
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

3.00%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Pip

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse163 products
  • python-base&distro=HPE Helion OpenStack 8< 2.7.17-28.59.1
  • python-base&distro=SUSE Enterprise Storage 5< 2.7.17-28.59.1
  • python-base&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 2.7.17-7.47.1
  • python-base&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 2.7.17-7.47.1
  • python-base&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.7.17-7.47.1
Opensuse25 products
  • leapEOL15.1 | 15.2
  • python-base&distro=openSUSE Leap 15.1< 2.7.17-lp151.10.29.1
  • python-base&distro=openSUSE Leap 15.2< 2.7.17-lp152.3.9.2
  • python-doc&distro=openSUSE Leap 15.1< 2.7.17-lp151.10.29.1
  • python-doc&distro=openSUSE Leap 15.2< 2.7.17-lp152.3.9.1
Redhat5 products
  • platform-python-pip< 0:9.0.3-18.el8
  • python-pip< 0:9.0.3-18.el8
  • python-virtualenv< 0:15.1.0-7.el7_9
  • python3-pip< 0:9.0.3-18.el8
  • python3-pip-wheel< 0:9.0.3-18.el8
Debian2 products
Oracle2 products
Pypa1 product
PyPI1 product
  • pip< a4c735b14a62f9cb864533808ac63936704f2ace | < 19.2
Ubuntu1 product
  • python-pipAll versions (No fix recorded) | < 9.0.1-2.3~ubuntu1.18.04.4

8 vendors · 200 products · Showing 200 of 218

References

57 links
Show all 57 references