python-virtualenv-15.1.0-7.el7

エラータID: AXSA:2022-3284:03

Release date: 
Tuesday, June 28, 2022 - 13:46
Subject: 
python-virtualenv-15.1.0-7.el7
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
Moderate
Description: 

The virtualenv tool creates isolated Python environments. The virtualenv tool is a successor to workingenv, and an extension of virtual-python.

Security Fix(es):

* python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py (CVE-2019-20916)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2019-20916
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. python-virtualenv-15.1.0-7.el7.src.rpm
    MD5: fcc9109d891eca08506f603acb598883
    SHA-256: 3e6ee392eec81768b0e6edd3987d030a680fe19ce760e6df6b88418dda7b3b33
    Size: 1.80 MB

Asianux Server 7 for x86_64
  1. python-virtualenv-15.1.0-7.el7.noarch.rpm
    MD5: f6beee7fa24760bb4123743e52e2f653
    SHA-256: 3a3a180e35e06d8ec224b1fdeaa3072e49b9b6fa6a9ae16d5773ef3fc59bfa37
    Size: 1.53 MB