Unscored severity · published Aug 6, 2013
CVE-2013-1629
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to…
–
CVSS
6.2%
EPSS
No
On KEV
Description
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.2% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Pip · Pypa
before 1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1629
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1629
Vendor Advisory
http://www.pip-installer.org/en/latest/installing.html
Release Notes
http://www.pip-installer.org/en/latest/news.html#changelog
Exploit
http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=968059
Third Party Advisory
https://github.com/pypa/pip/issues/425
Patch
https://github.com/pypa/pip/pull/791/files
More from Pip
7.8
CVE-2018-20225
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a…
7.5
CVE-2019-20916
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as…
6.5
CVE-2026-13346
pip absolute path traversal during download from malicious package indexes
5.9
CVE-2013-5123
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks
5.7
CVE-2021-3572
A flaw was found in python-pip in the way it handled Unicode separators in git references