pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.

The remote NewStart CGSL host, running version MAIN 6.06, has python-pip packages installed that are affected by a vulnerability:

  - pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the     /tmp/pip-build temporary directory. (CVE-2013-1888)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the
    /tmp/pip-build temporary directory. (CVE-2013-1888)

The remote host is affected by the vulnerability described in GLSA-201309-05 (pip: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in pip. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could conduct a Man-in-the-Middle attack to cause pip       to execute arbitrary code. A local attacker could perform symlink attacks       to overwrite arbitrary files with the privileges of the user running the       application.
  Workaround :

    There is no known workaround at this time.

- Fixes two security issues with the bundled copy of pip :

    - Insecure tempdir usage CVE-2013-1888

    - Uses http:// to download packages instead of https://       See changelog at:
      http://pypi.python.org/pypi/virtualenv#id2 Multiple       bugfixes. See       http://pypi.python.org/pypi/virtualenv/1.7.1.2 for       information. Multiple bugfixes. See       http://pypi.python.org/pypi/virtualenv/1.7.1.2 for       information. See changelog at:
      http://pypi.python.org/pypi/virtualenv#id2 Multiple       bugfixes. See       http://pypi.python.org/pypi/virtualenv/1.7.1.2 for       information. Multiple bugfixes. See       http://pypi.python.org/pypi/virtualenv/1.7.1.2 for       information. See changelog at:
      http://pypi.python.org/pypi/virtualenv#id2 Multiple       bugfixes. See       http://pypi.python.org/pypi/virtualenv/1.7.1.2 for       information. Multiple bugfixes. See       http://pypi.python.org/pypi/virtualenv/1.7.1.2 for       information.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
266260	NewStart CGSL MAIN 6.06 : python-pip Vulnerability (NS-SA-2025-0209)	Nessus	NewStart CGSL Local Security Checks	medium
410190	SCA: security update for pip (GHSA-4gv5-qhvr-36vv)	Tenable Cloud Security	SCA Checks	medium
410190	SCA: security update for pip (GHSA-4gv5-qhvr-36vv)	Tenable Self-Hosted Container Security	SCA Checks	medium
69861	GLSA-201309-05 : pip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
66599	Fedora 19 : python-virtualenv-1.9.1-1.fc19 (2013-8166)	Nessus	Fedora Local Security Checks	medium
66580	Fedora 17 : python-virtualenv-1.9.1-1.fc17 (2013-8221)	Nessus	Fedora Local Security Checks	medium
66578	Fedora 18 : python-virtualenv-1.9.1-1.fc18 (2013-8193)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-1888

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium