CVEvulnerability

CVE-2013-1888

2.1 LOW Published 2013-08-17 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2013-08-17
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 2.1 LOW — AV:L/AC:L/Au:N/C:N/I:P/A:N
Weaknesses: CWE-59

Description

pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.

Affected configurations

• pypa pip (< 1.3) • fedoraproject fedora 17 • fedoraproject fedora 18 • fedoraproject fedora 19

Related

Weakness · CWE (1)

CWE-59 Improper Link Resolution Before File Access weakness

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105952.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105989.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106311.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/03/22/10 Mailing List, Third Party Advisory
https://github.com/pypa/pip/issues/725 Third Party Advisory
https://github.com/pypa/pip/pull/734/files Patch, Third Party Advisory
https://github.com/pypa/pip/pull/780/files Patch, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105952.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105989.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106311.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/03/22/10 Mailing List, Third Party Advisory
https://github.com/pypa/pip/issues/725 Third Party Advisory
https://github.com/pypa/pip/pull/734/files Patch, Third Party Advisory
https://github.com/pypa/pip/pull/780/files Patch, Third Party Advisory