Debian Package Tracker
Register | Log in
Subscribe

python-pip

Choose email to subscribe with

general
  • source: python-pip (main)
  • version: 25.2+dfsg-1
  • maintainer: Debian Python Team (DMD)
  • uploaders: Stefano Rivera [DMD] – Carl Chenet [DMD]
  • arch: all
  • std-ver: 4.7.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 20.3.4-4+deb11u1
  • oldstable: 23.0.1+dfsg-1
  • stable: 25.1.1+dfsg-1
  • testing: 25.2+dfsg-1
  • unstable: 25.2+dfsg-1
versioned links
  • 20.3.4-4+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 23.0.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 25.1.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 25.2+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • python3-pip (4 bugs: 0, 4, 0, 0)
  • python3-pip-whl (1 bugs: 0, 0, 1, 0)
action needed
1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:
  • CVE-2025-8869: When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
Created: 2025-09-24 Last update: 2025-09-25 22:00
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2025-8869: When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
Created: 2025-09-24 Last update: 2025-09-25 22:00
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2025-8869: When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
Created: 2025-09-24 Last update: 2025-09-25 22:00
2 security issues in bullseye high

There are 2 open security issues in bullseye.

1 important issue:
  • CVE-2025-8869: When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
1 issue postponed or untriaged:
  • CVE-2023-5752: (needs triaging) When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
Created: 2025-09-24 Last update: 2025-09-25 22:00
2 security issues in bookworm high

There are 2 open security issues in bookworm.

1 important issue:
  • CVE-2025-8869: When extracting a tar archive pip may not check symbolic links point into the extraction directory if the tarfile module doesn't implement PEP 706. Note that upgrading pip to a "fixed" version for this vulnerability doesn't fix all known vulnerabilities that are remediated by using a Python version that implements PEP 706. Note that this is a vulnerability in pip's fallback implementation of tar extraction for Python versions that don't implement PEP 706 and therefore are not secure to all vulnerabilities in the Python 'tarfile' module. If you're using a Python version that implements PEP 706 then pip doesn't use the "vulnerable" fallback code. Mitigations include upgrading to a version of pip that includes the fix, upgrading to a Python version that implements PEP 706 (Python >=3.9.17, >=3.10.12, >=3.11.4, or >=3.12), applying the linked patch, or inspecting source distributions (sdists) before installation as is already a best-practice.
1 issue left for the package maintainer to handle:
  • CVE-2023-5752: (needs triaging) When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-10-25 Last update: 2025-09-25 22:00
debian/patches: 1 patch with invalid metadata, 1 patch to forward upstream high

Among the 7 debian patches available in version 25.2+dfsg-1 of the package, we noticed the following issues:

  • 1 patch with invalid metadata that ought to be fixed.
  • 1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-08-10 23:30
lintian reports 40 warnings normal
Lintian reports 40 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2025-08-10 Last update: 2025-08-10 21:33
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.7.0).
Created: 2025-02-21 Last update: 2025-08-11 19:44
news
[rss feed]
  • [2025-08-15] python-pip 25.2+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2025-08-10] Accepted python-pip 25.2+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2025-05-11] python-pip 25.1.1+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2025-05-02] Accepted python-pip 25.1.1+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2025-04-26] Accepted python-pip 25.1+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2025-03-28] python-pip 25.0.1+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-25] Accepted python-pip 25.0.1+dfsg-1 (source) into unstable (Colin Watson)
  • [2025-01-30] python-pip 25.0+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2025-01-26] Accepted python-pip 25.0+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2024-11-04] python-pip 24.3.1+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2024-11-01] Accepted python-pip 24.3.1+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2024-08-11] python-pip 24.2+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2024-08-08] Accepted python-pip 24.2+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2024-07-02] python-pip 24.1.1+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2024-06-29] Accepted python-pip 24.1.1+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2024-06-27] python-pip 24.1+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2024-06-25] Accepted python-pip 24.1+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2024-03-16] python-pip 24.0+dfsg-2 MIGRATED to testing (Debian testing watch)
  • [2024-03-06] Accepted python-pip 24.0+dfsg-2 (source) into unstable (Stefano Rivera)
  • [2024-02-08] python-pip 24.0+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2024-02-05] Accepted python-pip 24.0+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2023-10-21] python-pip 23.3+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2023-10-19] Accepted python-pip 23.3+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2023-09-25] python-pip 23.2.1+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2023-09-22] Accepted python-pip 23.2.1+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2023-07-22] python-pip 23.2+dfsg-1 MIGRATED to testing (Debian testing watch)
  • [2023-07-20] Accepted python-pip 23.2+dfsg-1 (source) into unstable (Stefano Rivera)
  • [2023-06-19] python-pip 23.1.2+dfsg-2 MIGRATED to testing (Debian testing watch)
  • [2023-06-11] Accepted python-pip 23.1.2+dfsg-2 (source) into unstable (Stefano Rivera)
  • [2023-05-04] Accepted python-pip 23.1.2+dfsg-1 (source) into experimental (Stefano Rivera)
  • 1
  • 2
bugs [bug history graph]
  • all: 6
  • RC: 0
  • I&N: 5
  • M&W: 1
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (0, 40)
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 25.1.1+dfsg-1ubuntu2
  • 19 bugs
  • patches for 25.1.1+dfsg-1ubuntu2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing