pip absolute path traversal during download from malicious package indexes

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks

A flaw was found in python-pip in the way it handled Unicode separators in git references

pip can extract console_scripts and gui_scripts outside installation directory