Directory Traversal Vulnerability in Python PIP Package

CVE-2019-20916

What is CVE-2019-20916?

The PIP package for Python prior to version 19.2 is susceptible to a directory traversal vulnerability. This issue arises when a URL is specified in an install command, allowing an attacker to exploit a Content-Disposition header that contains a filename with a '../' string. As a result, malicious users can overwrite critical files on the system, such as the /root/.ssh/authorized_keys file, thereby compromising the integrity of the system. This vulnerability is particularly concerning as it opens a pathway for unauthorized access and configuration tampering.

References