GitHub Advisoryadvisory · PyPI
GHSA-53mr-44pp-crf4 pip lack of randomness in build directory
MEDIUM
Official page ↗
- Aliases
- CVE-2014-8991
- Ecosystem
- PyPI
- Packages
- pip
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Reviewed
- 2023-10-19
Affected packages
• PyPI pip: >= 1.3, < 6.0 → fixed in 6.0
Description
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a `/tmp/pip-build-*` file for another user.
Related
Alias · CVE (1)
- CVE-2014-8991 pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-*… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-8991 advisory
- https://github.com/pypa/pip/pull/2122 web
- https://github.com/pypa/pip/commit/043fe9f5700315d97f83609c1f59deece8f1b901 web
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725847 web
- https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2014-11.yaml web
- https://github.com/pypa/pip package
- http://www.openwall.com/lists/oss-security/2014/11/19/17 web
- http://www.openwall.com/lists/oss-security/2014/11/20/6 web
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html web