{"action":"Upgrade pip to 1.3 or later.","affected":[{"fixed":"1.3","introduced":"0"}],"component":"pip","cve_ids":["CVE-2013-1888"],"ecosystem":"PyPI","epss":0.00364,"exploited":false,"fixed_versions":["1.3"],"ghsa_id":"GHSA-4gv5-qhvr-36vv","id":"tcs_01M5KG5Y8M8PM2513JBEBTYPGB","modified_at":"2023-11-08T03:57:16.010568Z","published_at":"2013-08-17T06:54:00Z","references":["https://osv.dev/vulnerability/PYSEC-2013-9","http://www.openwall.com/lists/oss-security/2013/03/22/10","https://github.com/pypa/pip/pull/734/files","https://github.com/pypa/pip/issues/725","https://github.com/pypa/pip/pull/780/files","http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105952.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105989.html","http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106311.html","https://github.com/advisories/GHSA-4gv5-qhvr-36vv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2013-9","url":"https://osv.dev/vulnerability/PYSEC-2013-9"}],"summary":"pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory."}