MGASA-2021-0054: python-pip Mageia

Published

Published 25-01-2021Last modified 16-04-2026

Vulnerability summary

MGASA-2021-0054 is a vulnerability in python-pip Mageia with no CVSS score yet.

Priority

Insufficient evidence

No CVSS vector published; no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 2 · Downstream 0

CVE-2019-20916 CVE-2020-26137

Timeline

25-01-2021
PublishedVulnerability first disclosed.
16-04-2026
Last modifiedVulnerability information updated.

Description

Updated python-pip packages fix security vulnerabilities It was discovered that pip did not properly sanitize the filename during pip install. A remote attacker could possible use this issue to read and write arbitrary files on the host filesystem as root, resulting in a directory traversal attack (CVE-2019-20916). urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). The python-pip package bundles a copy of python-urllib3, which was affected by this issue. The bundled copy was patched to fix the issue (CVE-2020-26137).