The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4432 advisory.

    pip is a package management system used to install and manage software packages written in Python. Many     packages can be found in the Python Package Index (PyPI). pip is a recursive acronym that can stand for     either Pip Installs Packages or Pip Installs Python.

    Security Fix(es):

    * python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py     (CVE-2019-20916)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python fixes the following issues :

  - buffer overflow in PyCArg_repr in _ctypes/callproc.c,     which may lead to remote code execution (bsc#1181126,     CVE-2021-3177).

  - Provide the newest setuptools wheel (bsc#1176262,     CVE-2019-20916) in their correct form (bsc#1180686).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues :

  - Fixed a directory traversal in _download_http_url()     (bsc#1176262 CVE-2019-20916)

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version MAIN 6.02, has python-pip packages installed that are affected by a vulnerability:

  - The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install     command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting     the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
    (CVE-2019-20916)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python36 fixes the following issues :

buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126, CVE-2021-3177).

Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python fixes the following issues :

buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution (bsc#1181126, CVE-2021-3177).

Provide the newest setuptools wheel (bsc#1176262, CVE-2019-20916) in their correct form (bsc#1180686).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install     command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting     the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
    (CVE-2019-20916)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
142392	RHEL 8 : python-pip (RHSA-2020:4432)	Nessus	Red Hat Local Security Checks	11/4/2020	11/7/2024	high
146518	openSUSE Security Update : python (openSUSE-2021-270)	Nessus	SuSE Local Security Checks	2/16/2021	1/22/2024	critical
143539	openSUSE Security Update : python (openSUSE-2020-2189)	Nessus	SuSE Local Security Checks	12/8/2020	2/6/2024	high
147285	NewStart CGSL MAIN 6.02 : python-pip Vulnerability (NS-SA-2021-0081)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	1/16/2024	high
146395	SUSE SLES12 Security Update : python36 (SUSE-SU-2021:0428-1)	Nessus	SuSE Local Security Checks	2/11/2021	1/22/2024	critical
146463	SUSE SLES12 Security Update : python (SUSE-SU-2021:0432-1)	Nessus	SuSE Local Security Checks	2/12/2021	1/22/2024	critical
222872	Linux Distros Unpatched Vulnerability : CVE-2019-20916	Nessus	Misc.	3/4/2025	9/10/2025	high

Detections

Analytics

Plugins Search

high

critical

high

high

critical

critical

high