PT-2013-3287 · Python · Pip

Glyph · Publicado 2013-08-06 · Atualizado 2022-05-13 · CVE-2013-1629

Positive Technologies (AI Summary)

CVSS v4.0

7.3

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions pip versions prior to 1.3

Description The issue allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation, as pip retrieves packages from the PyPI repository using HTTP and does not perform integrity checks on package contents.

Recommendations For pip versions prior to 1.3, consider updating to version 1.3 or later to resolve the issue. As a temporary workaround, restrict the use of pip to trusted networks to minimize the risk of man-in-the-middle attacks.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-1629

GHSA-G3P5-FJJ9-H8GJ

PYSEC-2013-8

Produtos afetados

Pip

Referências · 18

• 🔥 http://reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a · Exploit
• https://github.com/pypa/pip · Nota
• https://github.com/pypa/pip/pull/791/files · Correção
• https://github.com/pypa/pip/issues/425 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2013-8.yaml · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=968059 · Nota
• http://pip-installer.org/en/latest/installing.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-1629 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-1629 · Nota de Segurança
• http://pip-installer.org/en/latest/news.html#changelog · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-1629 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2013-8 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1629 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-g3p5-fjj9-h8gj · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1629 · Aviso do Fabricante