PT-2013-3287 · Python · Pip

Glyph · Published 2013-08-06 · Updated 2022-05-13 · CVE-2013-1629

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions pip versions prior to 1.3

Description The issue allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation, as pip retrieves packages from the PyPI repository using HTTP and does not perform integrity checks on package contents.

Recommendations For pip versions prior to 1.3, consider updating to version 1.3 or later to resolve the issue. As a temporary workaround, restrict the use of pip to trusted networks to minimize the risk of man-in-the-middle attacks.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1629

GHSA-G3P5-FJJ9-H8GJ

PYSEC-2013-8

Affected Products

Pip

References · 18

• 🔥 http://reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a · Exploit
• https://github.com/pypa/pip/pull/791/files · Patch
• http://pip-installer.org/en/latest/installing.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-1629 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1629 · Security Note
• http://pip-installer.org/en/latest/news.html#changelog · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1629 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-8 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1629 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g3p5-fjj9-h8gj · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1629 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1629 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-1629 · Security Note
• https://github.com/pypa/pip · Note
• https://github.com/pypa/pip/issues/425 · Note