CVE-2014-8991 in pip
Summary
by MITRE
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* file for another user.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 03/19/2026
The vulnerability identified as CVE-2014-8991 affects the python package installer pip version 1.3 through 1.5.6, representing a significant local privilege escalation and denial of service weakness. This flaw resides in the package installation process where pip creates temporary build directories in the /tmp filesystem, specifically using patterns like /tmp/pip-build-*. The issue occurs when a malicious local user can pre-create these temporary directories with specific permissions or ownership, thereby interfering with legitimate package installation processes. The vulnerability stems from inadequate temporary file handling and insufficient access control mechanisms during pip's build operations.
The technical implementation of this vulnerability exploits the predictable naming convention and insecure temporary file creation patterns within pip's installation workflow. When pip attempts to create a temporary build directory in /tmp, it does not properly validate or handle cases where such directories already exist with conflicting permissions or ownership. This creates a race condition scenario where a local attacker can establish a malicious temporary directory that prevents the legitimate installation process from proceeding correctly. The flaw is particularly dangerous because it allows attackers to completely block package installations without requiring elevated privileges, effectively creating a denial of service condition that impacts system functionality and user operations.
The operational impact of this vulnerability extends beyond simple denial of service, as it represents a fundamental security weakness in package management systems that could be exploited to disrupt system administration tasks. System administrators and regular users who rely on pip for package management would experience complete installation failures, potentially leading to service disruptions and security maintenance issues. The vulnerability affects any system where pip is used for package installation, making it particularly concerning in multi-user environments where different users share the same system resources. Organizations using pip for automated deployment or containerized environments may face significant operational challenges due to this persistent denial of service condition.
Mitigation strategies for CVE-2014-8991 should focus on immediate version upgrades to pip 1.6 or later, where the vulnerability has been addressed through improved temporary file handling mechanisms. System administrators should also implement proper file system permissions and monitoring for /tmp directory contents, particularly looking for unexpected pip-build directories. The fix implemented in newer pip versions addresses the core issue by ensuring proper directory creation with appropriate permissions and by implementing better error handling when temporary directories cannot be created. This vulnerability aligns with CWE-362, which describes concurrent execution using shared resource with improper synchronization, and relates to ATT&CK technique T1499.004 for denial of service through resource exhaustion or manipulation. Organizations should also consider implementing automated patch management processes to prevent similar vulnerabilities from affecting their systems.