New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Several path traversal bugs related to the use of the zipfile module #730

Closed

d1b opened this issue Nov 23, 2012 · 1 comment

Labels

auto-locked type: bug

Contributor

d1b commented Nov 23, 2012

There are several instances of path traversal bugs in pip.

pip/commands/zip.py the unzip_package method does no checking of the filename provided by the zip (line 137 - for name in zip.namelist():)
pip/util.py the unzip_file is vulnerable to path traversal if the flattern argument is false or if there are two filesnames with different leading paths zipfile (has_leding_dir returns false)

xavfernandez added the type: bug label

Member

dstufft commented Mar 30, 2017

Duplicate of #3907.

dstufft closed this as completed

lock bot added the auto-locked label

lock bot locked as resolved and limited conversation to collaborators

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.