CVE-2013-1629
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2013-1629
Vendor advisory: cve@mitre.org — https://github.com/pypa/pip/pull/791/files
Vendor advisory: cve@mitre.org — http://www.pip-installer.org/en/latest/news.html#changelog
Vendor advisory: cve@mitre.org — http://www.pip-installer.org/en/latest/installing.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 1.3.1-1 |
| debian | bullseye | fixed | 1.3.1-1 |
| debian | forky | fixed | 1.3.1-1 |
| debian | sid | fixed | 1.3.1-1 |
| debian | trixie | fixed | 1.3.1-1 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | pip | <1.3 | 1.3 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| pypa | pip | {"endExcluding":"1.3"} | 1.3 |
References
- http://www.pip-installer.org/en/latest/installing.html
- http://www.pip-installer.org/en/latest/news.html#changelog
- http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
- https://bugzilla.redhat.com/show_bug.cgi?id=968059
- https://github.com/pypa/pip/issues/425
- https://github.com/pypa/pip/pull/791/files
- https://nvd.nist.gov/vuln/detail/CVE-2013-1629
- https://github.com/advisories/GHSA-g3p5-fjj9-h8gj
- https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2013-8.yaml
- https://github.com/pypa/pip
- http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a
- https://security-tracker.debian.org/tracker/CVE-2013-1629
CWEs
CWE-20
Verify integrity in audit chain (admin only). AS-IS.