pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
References
Link | Resource |
---|---|
http://www.pip-installer.org/en/latest/installing.html | Vendor Advisory |
http://www.pip-installer.org/en/latest/news.html#changelog | Release Notes Vendor Advisory |
http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/ | Exploit Third Party Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=968059 | Issue Tracking Third Party Advisory |
https://github.com/pypa/pip/issues/425 | Third Party Advisory |
https://github.com/pypa/pip/pull/791/files | Patch Third Party Advisory |
Configurations
History
15 Mar 2021, 16:22
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/ - Exploit, Third Party Advisory | |
References | (CONFIRM) https://github.com/pypa/pip/issues/425 - Third Party Advisory | |
References | (CONFIRM) http://www.pip-installer.org/en/latest/installing.html - Vendor Advisory | |
References | (CONFIRM) https://github.com/pypa/pip/pull/791/files - Patch, Third Party Advisory | |
References | (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=968059 - Issue Tracking, Third Party Advisory | |
References | (CONFIRM) http://www.pip-installer.org/en/latest/news.html#changelog - Release Notes, Vendor Advisory | |
CPE | cpe:2.3:a:pip-installer:pip:1.2:*:*:*:*:*:*:* cpe:2.3:a:pip-installer:pip:*:*:*:*:*:*:*:* cpe:2.3:a:pip-installer:pip:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:pip-installer:pip:1.0.1:*:*:*:*:*:*:* cpe:2.3:a:pip-installer:pip:1.1:*:*:*:*:*:*:* |
cpe:2.3:a:pypa:pip:*:*:*:*:*:*:*:* |
Information
Published : 2013-08-06 02:52
Updated : 2023-12-10 11:16
NVD link : CVE-2013-1629
Mitre link : CVE-2013-1629
CVE.ORG link : CVE-2013-1629
JSON object : View
Products Affected
pypa
- pip
CWE
CWE-20
Improper Input Validation