CVE-2019-20916
Public on 2020-09-04
Modified on 2021-05-24
Description
A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an attacker who controls a malicious server to execute arbitrary code on the system.
CVSS v3 Base Score
See breakdown
