CVE-2013-1629

2013-08-0602:52:10

Debian Security Bug Tracker

security-tracker.debian.org

cve-2013-1629

pypi repository

http

integrity checks

man-in-the-middle

arbitrary code

pip install

unix

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.004

Percentile

73.0%

JSON

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a “pip install” operation.

OSVersionArchitecturePackageVersionFilename
Debian12allpython-pip< 1.3.1-1python-pip_1.3.1-1_all.deb
Debian11allpython-pip< 1.3.1-1python-pip_1.3.1-1_all.deb
Debian999allpython-pip< 1.3.1-1python-pip_1.3.1-1_all.deb
Debian13allpython-pip< 1.3.1-1python-pip_1.3.1-1_all.deb
Debian12allpython-virtualenv< 1.9.1-1python-virtualenv_1.9.1-1_all.deb
Debian11allpython-virtualenv< 1.9.1-1python-virtualenv_1.9.1-1_all.deb
Debian999allpython-virtualenv< 1.9.1-1python-virtualenv_1.9.1-1_all.deb
Debian13allpython-virtualenv< 1.9.1-1python-virtualenv_1.9.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	python-pip	< 1.3.1-1	python-pip_1.3.1-1_all.deb
Debian	11	all	python-pip	< 1.3.1-1	python-pip_1.3.1-1_all.deb
Debian	999	all	python-pip	< 1.3.1-1	python-pip_1.3.1-1_all.deb
Debian	13	all	python-pip	< 1.3.1-1	python-pip_1.3.1-1_all.deb
Debian	12	all	python-virtualenv	< 1.9.1-1	python-virtualenv_1.9.1-1_all.deb
Debian	11	all	python-virtualenv	< 1.9.1-1	python-virtualenv_1.9.1-1_all.deb
Debian	999	all	python-virtualenv	< 1.9.1-1	python-virtualenv_1.9.1-1_all.deb
Debian	13	all	python-virtualenv	< 1.9.1-1	python-virtualenv_1.9.1-1_all.deb